Web Application Analysis - Revision history

NKirnbauer: expired link changed with link from wayback machine

2024-10-04T06:22:14Z

expired link changed with link from wayback machine

← Older revision		Revision as of 06:22, 4 October 2024
Line 123:		Line 123:
	<References>		<References>
	<ref name="top10"> https://owasp.org/www-project-top-ten/ </ref>		<ref name="top10"> https://owasp.org/www-project-top-ten/ </ref>
	<ref name="def"> https://~~blog~~.stackpath.com/~~web-application~~/ </ref>		<ref name="def"> http://web.archive.org/web/20240615054417/https://www.stackpath.com/blog/ </ref>
	<ref name="def2"> https://www.w4rri0r.com/hacking-tools-windows-os-x-linux-android-solaris-unixware/web-application-analysis.html </ref>		<ref name="def2"> https://www.w4rri0r.com/hacking-tools-windows-os-x-linux-android-solaris-unixware/web-application-analysis.html </ref>
	<ref name="testing"> https://www.imperva.com/learn/application-security/application-security-testing/ </ref>		<ref name="testing"> https://www.imperva.com/learn/application-security/application-security-testing/ </ref>

NKirnbauer: fixed link

2024-10-04T06:13:09Z

fixed link

← Older revision		Revision as of 06:13, 4 October 2024
Line 74:		Line 74:
	=== WPScan===		=== WPScan===

	[https://wpscan.com/wordpress-security-~~scanner~~ WPScan] stands for WordPress Scanner. WordPress is a popular tool for creating websites. It is often used for blogs and private websites that are hosted by a single private person. It is estimated that over 43% of all websites on the Internet are powered by WordPress. This makes it a popular target for attackers, so popular that it even got its own tool. It scans web applications using a database with 24500+ registered WordPress vulnerabilities.		[https://wpscan.com/blog/wordpress-security-scan WPScan] stands for WordPress Scanner. WordPress is a popular tool for creating websites. It is often used for blogs and private websites that are hosted by a single private person. It is estimated that over 43% of all websites on the Internet are powered by WordPress. This makes it a popular target for attackers, so popular that it even got its own tool. It scans web applications using a database with 24500+ registered WordPress vulnerabilities.

	To install it you need to clone the git repository:		To install it you need to clone the git repository:

APecl at 16:06, 4 January 2022

2022-01-04T16:06:27Z

← Older revision		Revision as of 16:06, 4 January 2022
Line 10:		Line 10:
	There is a magnitude of security threats that can occur in a website or web application. The Open Web Application Security Projekt (OWASP) publishes every four years the OWASP Top 10 report, including the ten most occurring security threats <ref name="owasp"/>. Here is a comparison between the year 2017 and the year 2021:		There is a magnitude of security threats that can occur in a website or web application. The Open Web Application Security Projekt (OWASP) publishes every four years the OWASP Top 10 report, including the ten most occurring security threats <ref name="owasp"/>. Here is a comparison between the year 2017 and the year 2021:

	[[File:OwaspTop10.png]~~\|350px~~]<ref name="top10"/>		[[File:OwaspTop10.png]]<ref name="top10"/>

	These vulnerabilities are easily avoidable but end up over and over on the Top 10 list. One common reason for them being this high listed is the lack of knowledge of the developer. Because knowledge and understanding of the possible threats are so important, there are many test and learning platforms specially made to train and improve best practice security policies.		These vulnerabilities are easily avoidable but end up over and over on the Top 10 list. One common reason for them being this high listed is the lack of knowledge of the developer. Because knowledge and understanding of the possible threats are so important, there are many test and learning platforms specially made to train and improve best practice security policies.

APecl: /* Web Application Security */

2022-01-04T16:06:13Z

Web Application Security

← Older revision		Revision as of 16:06, 4 January 2022
Line 5:		Line 5:
	== Web Application Security ==		== Web Application Security ==

	Web application analysis is a branch in the IT security field that deals with web vulnerabilities and how to find them.		Web application analysis is a branch in the IT security field that deals with web vulnerabilities and how to find them. Using it vulnerabilities that were overlooked in the development can be found and eliminated before they can be exploited.

	=== Security Threats ===		=== Security Threats ===

APecl: /* Web Application Security */

2022-01-04T16:05:09Z

Web Application Security

← Older revision		Revision as of 16:05, 4 January 2022
Line 8:		Line 8:

	=== Security Threats ===		=== Security Threats ===
	There is a magnitude of security threats that can occur in a website or web application. The Open Web Application Security Projekt (OWASP) publishes every four years the OWASP Top 10 report, including the ten most occurring security threats <ref=~~name~~"owasp"/>. Here is a comparison between the year 2017 and the year 2021:		There is a magnitude of security threats that can occur in a website or web application. The Open Web Application Security Projekt (OWASP) publishes every four years the OWASP Top 10 report, including the ten most occurring security threats <ref name="owasp"/>. Here is a comparison between the year 2017 and the year 2021:

	[[File:OwaspTop10.png]\|350px]<ref name="top10"/>		[[File:OwaspTop10.png]\|350px]<ref name="top10"/>

APecl: /* Web Application Scanning Tool */

2022-01-04T16:04:56Z

Web Application Scanning Tool

← Older revision		Revision as of 16:04, 4 January 2022
Line 25:		Line 25:
	* ...		* ...

	Many tools come pre-installed with Kali Linux. They are used for information gathering, exploitation and testing throughout the development of web applications. These tools run a set of tests to see how the application reacts and analyses those reactions. Depending on the kind of reaction the tools recieve they evaluate if an attack could be accomplished or not. The positive/false ratio is usually pretty low, which is an indication of how accurate they are.<ref=~~name~~"testing"/>		Many tools come pre-installed with Kali Linux. They are used for information gathering, exploitation and testing throughout the development of web applications. These tools run a set of tests to see how the application reacts and analyses those reactions. Depending on the kind of reaction the tools recieve they evaluate if an attack could be accomplished or not. The positive/false ratio is usually pretty low, which is an indication of how accurate they are.
			<ref name="testing"/>

	There are 3 ways to test web applications: static, dynamic or interactive.		There are 3 ways to test web applications: static, dynamic or interactive.

APecl at 16:04, 4 January 2022

2022-01-04T16:04:15Z

APecl: /* Skipfish */

2022-01-04T16:02:43Z

Skipfish

← Older revision		Revision as of 16:02, 4 January 2022
Line 60:		Line 60:
	=== Skipfish ===		=== Skipfish ===

	[https://gitlab.com/kalilinux/packages/skipfish Skipfish] is a tool that allows quick scanning of websites and web applications for vulnerabilities and threats. After finishing the scan it presents its results in an interactable sitemap and lists the findings according to their importance. <ref name="~~skipfish~~"/>		[https://gitlab.com/kalilinux/packages/skipfish Skipfish] is a tool that allows quick scanning of websites and web applications for vulnerabilities and threats. After finishing the scan it presents its results in an interactable sitemap and lists the findings according to their importance. <ref name="skipfi"/>

	It can only be used for information gathering and cannot be used to exploit vulnerabilities. Because it is written in C it runs very performant and handles many requests and responses without loading the CPU.		It can only be used for information gathering and cannot be used to exploit vulnerabilities. Because it is written in C it runs very performant and handles many requests and responses without loading the CPU.

APecl at 16:02, 4 January 2022

2022-01-04T16:02:36Z

← Older revision		Revision as of 16:02, 4 January 2022
Line 1:		Line 1:
	== Summary ==		== Summary ==

	Web Application Analysis is engaged in finding and vulnerabilities and if necessary to harden current security measures. The analysing process should be contemplated for every web application. It might reveal exploits that would cause devastating consequences. Unprotected websites and web applications are targeted by hackers and often lead to database leaks, theft of banking information and infringement of privacy. Many companies are not technically adept and therefore cannot evaluate the possible damage, hoping to save costs in the development phase by skipping the web application analysis. <ref name="def" /><ref name="~~def1~~" />		Web Application Analysis is engaged in finding and vulnerabilities and if necessary to harden current security measures. The analysing process should be contemplated for every web application. It might reveal exploits that would cause devastating consequences. Unprotected websites and web applications are targeted by hackers and often lead to database leaks, theft of banking information and infringement of privacy. Many companies are not technically adept and therefore cannot evaluate the possible damage, hoping to save costs in the development phase by skipping the web application analysis. <ref name="def" /><ref name="def2" />

	== Web Application Security ==		== Web Application Security ==

APecl: /* Skipfish */

2022-01-04T16:01:44Z

Skipfish

← Older revision		Revision as of 16:01, 4 January 2022
Line 60:		Line 60:
	=== Skipfish ===		=== Skipfish ===

	[https://gitlab.com/kalilinux/packages/skipfish Skipfish] is a tool that allows quick scanning of websites and web applications for vulnerabilities and threats. After finishing the scan it presents its results in an interactable sitemap and lists the findings according to their importance. <ref name="skipfish">		[https://gitlab.com/kalilinux/packages/skipfish Skipfish] is a tool that allows quick scanning of websites and web applications for vulnerabilities and threats. After finishing the scan it presents its results in an interactable sitemap and lists the findings according to their importance. <ref name="skipfish"/>

	It can only be used for information gathering and cannot be used to exploit vulnerabilities. Because it is written in C it runs very performant and handles many requests and responses without loading the CPU.		It can only be used for information gathering and cannot be used to exploit vulnerabilities. Because it is written in C it runs very performant and handles many requests and responses without loading the CPU.