Thesis Details
Web Application Penetration Testing Automation
This work has two goals - to propose a generally applicable approach to web application penetration testing that is non-destructive to a target application, and to implement a tool that will follow it. The proposed approach has three phases. In the first phase, a tester gathers and adheres to the testing requirements (including the non-destructiveness), prepares a tool set and starts the reconnaissance. In the second phase, additional testing tools are used to process collected information and to verify vulnerabilities and provide conclusions. During the third phase, a final report is generated. The implemented tool is built as a collection of modules that are capable of the detection of reflected XSS, hidden query string parameters, resource enumeration and server misconfigurations detection. In comparison to Acunetix vulnerability scanner, the implemented tool performs just as well in the reflected XSS detection and outperforms the Acunetix in hidden resources enumeration. This work also brings a proof of concept implementation of a tool for Pastebin.com side-channel monitoring.
Penetration testing, web applications, automation, information security, security, open source inteligence, automated security scanning.
Češka Milan, prof. RNDr., CSc. (DITS FIT BUT), člen
Matoušek Petr, doc. Ing., Ph.D., M.A. (DIFS FIT BUT), člen
Pavlík Jan, Mgr., Ph.D. (DADM FME BUT), člen
Rychlý Marek, RNDr., Ph.D. (DIFS FIT BUT), člen
Smrčka Aleš, Ing., Ph.D. (DITS FIT BUT), člen
@mastersthesis{FITMT21678, author = "Daniel Du\v{s}ek", type = "Master's thesis", title = "Web Application Penetration Testing Automation", school = "Brno University of Technology, Faculty of Information Technology", year = 2019, location = "Brno, CZ", language = "english", url = "https://www.fit.vut.cz/study/thesis/21678/" }