|
|
Web Application Penetration Testing
Hric, Michal ; Čermák, Igor (advisor) ; Hlaváč, Jindřich (referee)
The aim of the present thesis was to analyze the level of security of select open-source web applications based on penetration testing at various stages of testing, defined by the PTES methodology. This included application of new PETA methodology to perform web application penetration testing and the creation of new knowledge objects concerning penetration testing in the MBI portal. The open-source web applications Juice Shop, NodeGoat, XVWA and bWAPP were tested. The security of the web applications was evaluated as insufficient as at least one vulnerability with a high risk of exploitation was identified for each of the tested applications. For each vulnerability found in the application, recommended corrective measures to eliminate the associated risk is stated. When using the PETA methodology for penetration testing, the benefit was mainly in integrating of penetration testing in the context of IS/IT management in an organization based on application of the narrowed framework for IS/IT management. Finally, new knowledge objects in the MBI portal are listed and described. Objects created include a task concerning the process of penetration testing, a set of metrics for evaluating the success of penetration testing and roles linked to the task.
|
|
|
Security of social networks
Hric, Michal ; Veber, Jaromír (advisor) ; Luc, Ladislav (referee)
Social networks represent an integral part of the personal, and in some cases, professional life of many people. The security of social networks is one of the key factors that determines its quality and credibility. The thesis analyzes security of six of most widely used social networks, with emphasis on the security of their web applications, optional security features of user accounts and privacy policies. Web application security was different for all investigated social networks. The most common deficiency was the use of SHA-1 signature algorithm, RC4 cipher support and unsupported option HSTS. Optional security features of user accounts were managed best by the first two evaluated networks (Facebook and YouTube), while other social networks provided less optional security features. Privacy policies didn't differ significantly, major differences were determinated by social network functionality. Although there are known risks related to insufficient security of social networks, even the most widely used social networks have deficiencies in this area.
|
guest ::
RSS feed.