Abstract
The biggest challenge of Web application is the inestimable losses arising from security flaws. Two approaches were advanced by a number of scholars to provide security to Web space. One of such approach is vulnerability assessment, which is a conscious effort to isolate, identify and recognize potentials vulnerabilities exploited by attackers. The second being the estimation and determination of level of risks/threats posed to Web applications by vulnerabilities obvious to the developer (or tester); this is generally referred to as penetration testing. Recently, there is Vulnerability Assessment and Penetration Testing (VAPT) that combined these two schemes to improve safety and effectively combat the menace of attackers on Web applications. This paper proposed Fuzzy Classifier-based Vulnerability and Assessment Testing (FCVAPT) model to provide security for sensitive data/information in Web applications. Cross Site Scripting (XSS) and Structured Query Language (SQL) injections were selected for evaluation of proposed FCVAPT model. FCVAPT model’s classification performance for MSE, MAPE and RMSE were 33.33, 14.81% and 5.77% respectively. FCVAPT is considerably effective for detecting vulnerability and ascertaining the nature of threats/risks available to Web applications.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Doshi, J., Trivedi, B.: Comparison of vulnerability assessment and penetration testing. Int. J. Appl. Inf. Syst. 8(6), 51–54 (2015)
Ruse, M.E.: Modelling checking techniques for vulnerability analysis of web applications. Unpublished Ph.D. thesis, Department of Computer Science, Iowa State University, Ames, USA, pp. 1–90 (2013)
Aghariya, T.: Security testing on web application. Unpublished M.Eng. thesis, Department of Software Engineering, Charles Darwin University, Darwin, Australia, pp. 1–93 (2015)
Samant, N.: Automated penetration testing. Unpublished M.Sc. thesis, Department of Computer Science, San Jose State University, California, USA, pp. 1–69 (2011)
Jovanovic, N., Kruegel, K., Kirda, E.: Precise alias analysis for static detection of web application vulnerabilities. In: Proceedings of Programming Languages and Analysis for Security, New York, pp. 27–36. ACM press (2006)
Petukhov, A., Kozlov, D.: Detecting security vulnerabilities in web applications using dynamic analysis with penetration testing. Computing Systems Lab, Department of Computer Science, Moscow State University, pp. 1–120 (2008)
Chen, J.M., Wu, C.L.: An automated vulnerability scanner for injection attack based on injection point. In: Proceedings of International Computer Symposium, pp. 113–118 (2010)
Li, X., Xue, Y.: BLOCK: a black-box approach for detection of state violation attacks towards web applications. In: Proceedings of the 27th Annual Computer Security Applications Conference, pp. 247–256 (2011)
Salas, M.I.P., Martins, E.: Security testing methodology for vulnerabilities detection of XSS in Web Services and WS-Security. Electron. Notes Theor. Comput. Sci. 302, 133–154 (2014)
McAllister, S., Kirda, E., Kruegel, C.: Leveraging user interactions for in-depth testing of web applications. In: Proceedings of Recent Advances in Intrusion Detection, pp. 191–210. Springer, Berlin, Heidelberg (2008)
Doupe, A.L.: Advanced automated web application vulnerability analysis. Unpublished Ph.D. thesis, Department of Computer Science, University of California, Santa Barbara, USA, pp. 1–227 (2014)
Shelly, D.A.: Using a web server test bed to analyse the limitations of web application vulnerability scanners. Unpublished M.Sc. thesis, Department of Computer Engineering, Virginia Polytechnic Institute and State University, Blacksburg, USA, pp. 1–98 (2010)
Acknowledgements
We acknowledge the support and sponsorship provided by Covenant University through the Centre for Research, Innovation and Discovery (CUCRID).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer International Publishing AG
About this paper
Cite this paper
Alhassan, J.K., Misra, S., Umar, A., Maskeliūnas, R., Damaševičius, R., Adewumi, A. (2018). A Fuzzy Classifier-Based Penetration Testing for Web Applications. In: Rocha, Á., Guarda, T. (eds) Proceedings of the International Conference on Information Technology & Systems (ICITS 2018). ICITS 2018. Advances in Intelligent Systems and Computing, vol 721. Springer, Cham. https://doi.org/10.1007/978-3-319-73450-7_10
Download citation
DOI: https://doi.org/10.1007/978-3-319-73450-7_10
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-73449-1
Online ISBN: 978-3-319-73450-7
eBook Packages: EngineeringEngineering (R0)