|
|
Web Application Penetration Testing
Hric, Michal ; Čermák, Igor (advisor) ; Hlaváč, Jindřich (referee)
The aim of the present thesis was to analyze the level of security of select open-source web applications based on penetration testing at various stages of testing, defined by the PTES methodology. This included application of new PETA methodology to perform web application penetration testing and the creation of new knowledge objects concerning penetration testing in the MBI portal. The open-source web applications Juice Shop, NodeGoat, XVWA and bWAPP were tested. The security of the web applications was evaluated as insufficient as at least one vulnerability with a high risk of exploitation was identified for each of the tested applications. For each vulnerability found in the application, recommended corrective measures to eliminate the associated risk is stated. When using the PETA methodology for penetration testing, the benefit was mainly in integrating of penetration testing in the context of IS/IT management in an organization based on application of the narrowed framework for IS/IT management. Finally, new knowledge objects in the MBI portal are listed and described. Objects created include a task concerning the process of penetration testing, a set of metrics for evaluating the success of penetration testing and roles linked to the task.
|
guest ::
