|
|
MCUXpresso Web application security
Mittaš, Tomáš ; Heriban, Pavel (referee) ; Roupec, Jan (advisor)
This thesis deals with testing of the security of web application MCUXpresso Web SDK Builder using ethical hacking techniques and tools. At the beginning, the history of ethical hacking and structure of web applications are briefly mentioned. The thesis then analyses the application itself from the user’s point of view, its parts before logging in and after logging in and the operation of this application. The following is a list of the most common vulnerabilities and weaknesses found in web applications to understand any vulnerabilities found. Furthemore, the thesis deals with the techniques and tools of web application security and compares them. The penultimate chapter deals with the use of Analysis and vulnerability scanning technique on the application MCUXpresso Web SDK Builder. Finally, an application security test plan is designed, while part of this plan is automated.
|
|
|
Security Of Web Applications In Php
Slunsky, Tomas
This article deals with the security of web applications, focussing on vulnerabilities inweb applications written in PHP language. This work reveals existing security issues, demonstratesthe impact of them and propose solution with more approaches. The solution focuses mainly onthe level of network filtering with Intrusion Detection System (IDS) or Intrusion Prevention Systems(IPS). There are more issue solution approaches and it will therefore be possible to propose the bestone and describe it more.
|
|
|
Advanced Penetration Testing Of Obfuscated Android Applications
Michalec, Pavol
Android applications are susceptible to security vulnerabilities just like any other application. To minimize the risk and detect any potential vulnerabilities, penetration tests are conducted. However, many clients are not willing or are not capable to provide unobfuscated version of the application with security defenses disabled. It is up to the testers to bypass all these restrictions and properly test the application. Bypassing all the restrictions takes considerable ammount of time, thus making the test more expensive. This paper describes methodology for dealing with obfuscation as quickly as possible without creating unnecessary code or introducing additional tools.
|
|
|
Development of a calculator for assessing vulnerabilities in Javascript
Škrhák, Pavel ; Fujdiak, Radek (referee) ; Holasová, Eva (advisor)
The aim of this work is to describe the known methods of vulnerability assessment, and to implement them in a web application using the Vue.js framework. The thesis describes two vulnerability assessment systems, namely CVSS (Common Vulnerability Scoring System) and OWASP (Open Web Application Security Project) Risk Rating Methodology. Their parts, metrics and methods of calculation of the evaluation are described. Subsequently, these systems are compared and their strengths and weaknesses are determined. The work then evaluates some known vulnerabilities using these two assessment methods. The work then describes the design of the frontend and backend of the web application. The frontend uses the Vue.js framework, which allows the creation of dynamic one-page web applications. The components and layout of the application are designed. Furthermore, the appearance of the front application and its components is designed. The backend was designed to suit with the Djnago framework, which together with the django REST framework can be used to quickly create an API (Application Programming Interface) communicating with the database. A model for storing data from a frontend application was designed. The work then describes the implementation of this application divided into frontend and backend. The backend describes the implementation of the API and the database. The implementation of the model itself, serializer and methods for communication with the frontend application are described. In the frontend, a vue router is created, which is used to dynamically change the content of the page, then the components themselves are created, which serve as building blocks of the application. These components contain three parts, namely structure, JavaScript code and CSS (Cascading Sytle Sheets). Components can pass data and call functions of other components. The last part of the work is testing of the application itself. Its functionality is tested by calculating the score of already assessed vulnerabilities and some items of the OWASP ASVS (Application Security Verification Standard). Furthermore, security is tested by testing several known vulnerabilities, along with testing with OWASP ASVS.
|
|
|
Specific modules for manual security testing support
Osmani, Jakub ; Safonov, Yehor (referee) ; Paučo, Daniel (advisor)
This bachelor thesis deals with the concept of penetration testing and the standards that coincide with it. The main aim of the theoretical part of this thesis is to describe the world of penetration testing, and the widely known OWASP documentation. Vulnerabilities from the top 10 vulnerabilities list as well as recommendations about secure web application development, from the Application Security Verification Standard (ASVS), are provided. The practical part of this thesis is focused on the development of three tools, that are to be used to help automate certain aspects of penetration testing.
|
|
|
Web application for testing web server vulnerabilities
Šnajdr, Václav ; Burda, Karel (referee) ; Smékal, David (advisor)
The Master’s Thesis deals with the design and implementation of a web application for testing the security of SSL/TLS protocols on a remote server. The web application is developed in the Nette framework. The theoretical part describes SSL/TLS protocols, vulnerabilities, recommendations and technologies used in the practical part. The practical part is devoted to the creation of a web application with the process of using automatic scripts to test and display the results on the website with a rating of A+~to~C. The web application also displays a list of detected vulnerabilities and their recommendations.
|
|
|
Application that supports penetration tests of web applications
Holovová, Simona ; Švikruha, Patrik (referee) ; Martinásek, Zdeněk (advisor)
This master´s thesis is about the security of web applications and penetration testing. The main goal is to gain knowledge about testing methodologies OWASP Testing Guide and ASVS and to implement this knowledge into a web application to assist during manual penetration testing. The theoretical part of the thesis describes both methodologies and web technologies used during the development of the application. The practical part of the thesis is about the design of the application based on the specification, its implementation, and security hardening.
|
|
|
Design of methodology for vulnerability assesment
Pecl, David ; Martinásek, Zdeněk (referee) ; Gerlich, Tomáš (advisor)
The thesis deals with the assessment of security vulnerabilities. The aim of this work is to create a new method of vulnerability assessment, which will better prioritize critical vulnerabilities and reflect parameters that are not used in currently used methods. Firstly, it describes the common methods used to assess vulnerabilities and the parameters used in each method. The first described method is the Common Vulnerability Scoring System for which are described all three types of scores. The second analysed method is OWASP Risk Rating Methodology. The second part is devoted to the design of the own method, which aims to assess vulnerabilities that it is easier to identify those with high priority. The method is based on three groups of parameters. The first group describes the technical assessment of the vulnerability, the second is based on the requirements to ensure the confidentiality, integrity and availability of the asset and the third group of parameters evaluates the implemented security measures. All three groups of parameters are important for prioritization. Parameters describing the vulnerability are divided into permanent and up-to-date, where the most important up-to-date parameter are Threat Intelligence and easy of exploitation. The parameters of the impact on confidentiality, integrity and availability are linked to the priority of the asset, and to the evaluation of security measures, which increase the protection of confidentiality, integrity and availability. The priority of the asset and the quality of the countermeasures are assessed based on questionnaires, which are submitted to the owners of the examined assets as part of the vulnerability assessment. In the third part of the thesis, the method is compared with the currently widely used the Common Vulnerability Scoring System. The strengths of the proposed method are shown in several examples. The effectiveness of prioritization is based primarily on the priority of the asset and the security measures in place. The method was practically tested in a laboratory environment, where vulnerabilities were made on several different assets. These vulnerabilities were assessed using the proposed method, the priority of the asset and the quality of the measures were considered, and everything was included in the priority of vulnerability. This testing confirmed that the method more effectively prioritizes vulnerabilities that are easily exploitable, recently exploited by an attacker, and found on assets with minimal protection and higher priority.
|
|
|
Security Testing of Obfuscated Android Applications
Michalec, Pavol ; Dzurenda, Petr (referee) ; Malina, Lukáš (advisor)
Diplomová práca je o bezpečnostnom testovaní obfuskovaných Android aplikácií. Teoretická časť práce opisuje základy obfuskácie a spomína niektoré vybrané obfuskátory. Dopad obfuskácie na penetračné testovanie je taktiež zmienený. Práca navrhuje dynamickú analýzu ako hlavný nástroj pri obchádzaní obfuskácie. Praktická časť práce popisuje ochrany aplikácie v reálnom čase a spôsoby, ako tieto ochrany obísť pomocou dynamickej analýzy. Druhá polovica praktickej časti je venovaná pokročilým technikám obfuskácie a spôsobom ich obídenia.
|
|
|
GetSimple content management system security testing
Kadoch, Lukáš ; Veber, Jaromír (advisor) ; Čermák, Radim (referee)
The main aim of this work is to test the security of content management system GetSimple by means of OWASP methodic. The first part is devoted to the theory and clarification of specific terms which are used in the field of web application security. Further on, it introduces a chosen GetSimple system including its parameters and requirements for a host server. The second part contains the penetration testing itself. Each test includes the aim, instructions and in case of discovery of vulnerability a suggestion for improvement. The testing is subject to OWASP methodic standards and it is managed according to the OWASP Top Ten documentation. The added value of this work is finding the security risks of the chosen system.
|
guest ::
