Tato práce má dva cíle - navrhnout obecně aplikovatelný přístup k penetračnímu testování webových aplikací, který bude využívat pouze nedestruktivních interakcí, a dále pak implementovat nástroj, který se tímto postupem bude řídit. Navrhovaný přístup má tři fáze - v první fázi tester posbírá požadavky pro testovací sezení (včetně požadavků na nedestruktivnost) a připraví si nástroje a postupy, kterých při testování využije, následně začne s průzkumem. V druhé fázi využije dodatečných nástrojů pro zpracování informací z předchozí fáze a pro ověření a odhalení zranitelností. Ve třetí fázi jsou všechny informace překovány ve zprávu o penetračním testování. Implementovaný nástroj je postavený na modulech, které jsou schopny odhalení reflektovaného XSS, serverových miskonfigurací, skrytých adresních parametrů a skrytých zajímavých souborů. V porovnání s komerčním nástrojem Acunetix je implementovaný nástroj srovnatelný v detekci reflektovaného XSS a lepší v detekci skrytých zajímavých souborů. Práce také originálně představuje nástroj pro sledování postranního kanálu Pastebin.com s cílem detekce utíkajících informací.

Both for its simplicity and efficiency to search for the most critical security vulnerabilities that could exist within a web application, a web vulnerability scanner is a popular tool among any company that develops a web application. With the existence of many different scanners that are available to use, one is unlikely the same as the other and the results attained when evaluating these scanners in relation to each other are often not the same. In this thesis, three different open source web vulnerability scanners are evaluated and analysed based on their ability to find SQL injection and cross-site scripting vulnerabilities. The scanners were used on several open source deliberately broken web applications that acted as benchmarks. The benchmarks that caused much diversity in the results from the scanners were further investigated. When analysing the scanners based on the results, both the actual results were analysed on what caused the diversity but most of all the source code of the scanners were explored and investigated. It could be found that the techniques used by the scanners were essentially similar but contained several minor differences that caused the diversity in the results. Most differences were dependant on the variation of the predefined payloads injected by the scanners, but it could also be found that the approaches used to determine if a vulnerability was detected or not could vary as well. The finalised result concluded in a report that reveals and demonstrates the different approaches that any web vulnerability scanner could use and the limitations of them.

This master's thesis deals with open source PBX security against security attacks. In the theoretical part is detailed description of problematic about attacks that could be used on VoIP systems with high focus on the Denial of Service attack. Furthermore are in theoretical part described methods of security of initialization protocol SIP. Individual chapter is devoted to intrusion detection and prevention of IDS and IPS systems, focusing on Snort and OSSEC. In the practical part of the work was created generator of attacks against various PBX systems, which was subsequently used for detailed testing. Special tests of PBX system are then used against DoS attacks, for which was created protection in form of active elements consisting of IDS Snort & OSSEC. These are capable to provide protection in real-time. The protection was tested on particular PBX systems and in matter of comparison were measured possibilities before and after of security implementation. The output of this work is attacks generator VoIPtester and creation of configuration rules for Snort and OSSEC.

This master project focuses on the possibilities of protecting the most common free software PBX Asterisk, FreeSWITCH and YATE. In practice, it was verified the behavior of PBX in the attacks and suggested protection against them on one of the most popular distributions of Linux server on CentOS. Tool was created to simulate several types of attacks targeting denial of service. Both protective options PBX themselves and operating system capabilities are used in this work. Comparison was also the possibility of protection of individual PBX with each other. It also includes a brief description of the protocol, topology attacks and recommendation for the operation of softswitches.

This master’s thesis deals with the modern methods and technologies used in electronic business with the focus on expanding company’s portfolio by providing e-commerce solutions. It also demonstrates the implementation of open-source software based e-shop as a cost-effective solution for the new start-up companies.

The aim of this master thesis is to make research of Open Source software, which are used for simulation autonomous robots. At the begining is performed research of selected robotic simulators. In the first part of this work is to get familiar with robotic simulator Gazebo and robotic framework ROS. The second part of this work deals with simulating and subsequent implementation of choosen robotic tasks through the simulator Gazebo and the ROS framework.

Temporary zone is open-source design studio. This diploma thesis is concerned with origin of the project and its theoretic background. Theoretic part of the thesis defines the term „open-source design“ and tries to explain motivations behind creation of Temporary zone.

Nous modélisons une chaîne de traitement de documents comme un processus de décision markovien, et nous utilisons l’apprentissage par renforcement afin de permettre à l’agent d’apprendre à construire des chaînes adaptées à la volée, et de les améliorer en continu. Nous construisons une plateforme qui nous permet de mesurer l’impact sur l’apprentissage de divers modèles, services web, algorithmes, paramètres, etc. Nous l’appliquons dans un contexte industriel, spécifiquement à une chaîne visant à extraire des événements dans des volumes massifs de documents provenant de pages web et d’autres sources ouvertes. Nous visons à réduire la charge des analystes humains, l’agent apprenant à améliorer la chaîne, guidé par leurs retours (feedback) sur les événements extraits. Pour ceci, nous explorons des types de retours différents, d’un feedback numérique requérant un important calibrage, à un feedback qualitatif, beaucoup plus intuitif et demandant peu, voire pas du tout, de calibrage. Nous menons des expériences, d’abord avec un feedback numérique, puis nous montrons qu’un feedback qualitatif permet toujours à l’agent d’apprendre efficacement. / Information extraction (IE) is defined as the identification and extraction of elements of interest, such as named entities, their relationships, and their roles in events. For example, a web-crawler might collect open-source documents, which are then processed by an IE treatment chain to produce a summary of the information contained in them.We model such an IE document treatment chain} as a Markov Decision Process, and use reinforcement learning to allow the agent to learn to construct custom-made chains ``on the fly'', and to continuously improve them.We build a platform, BIMBO (Benefiting from Intelligent and Measurable Behaviour Optimisation) which enables us to measure the impact on the learning of various models, algorithms, parameters, etc.We apply this in an industrial setting, specifically to a document treatment chain which extracts events from massive volumes of web pages and other open-source documents.Our emphasis is on minimising the burden of the human analysts, from whom the agent learns to improve guided by their feedback on the events extracted. For this, we investigate different types of feedback, from numerical rewards, which requires a lot of user effort and tuning, to partially and even fully qualitative feedback, which is much more intuitive, and demands little to no user intervention. We carry out experiments, first with numerical rewards, then demonstrate that intuitive feedback still allows the agent to learn effectively.Motivated by the need to rapidly propagate the rewards learnt at the final states back to the initial ones, even on exploration, we propose Dora: an improved version Q-Learning.

Gemeinsamer Workshop von Universitaetsrechenzentrum und Professur Rechnernetze und verteilte Systeme (Fakultaet fuer Informatik) der TU Chemnitz. Workshop-Thema: Infrastruktur der ¨Digitalen Universitaet¨ Der Vortrag befaßt sich mit der Kosten- und Preissituation bei Informationsprodukten. Die Effekte von Preisdifferenzierungen und Produktbindungen werden betrachtet. Den Abschluß bilden Geschäftsmodelle und Lizenztypen zu den Konzepten ¨freie¨ Software und ¨Open Source¨.

Die Folien skizzieren einen Projektantrag, der (2008 und überarbeitet 2009) bei der Deutschen Forschungsgemeinschaft DFG eingereicht wurde. Absicht der beiden Antragssteller, des Instituts der Gesellschaft zur Förderung der Angewandten Informationsforschung (IAI, http://www.iai.uni-sb.de/iaide/index.htm) und der Saarländischen Universitäts- und Landesbibliothek (SULB, http://www.sulb.uni-saarland.de), war es, die am IAI entwickelte Software AUTINDEX zur halbautomatischen Verschlagwortung in Open-Access-Repositories einzubinden. Da Autoren große Mühe mit der Verschlagwortung ihrer Dokumente nach der Schlagwortnormdatei (SWD) haben, sollten sie, ganz im Sinne des "Easy Submission"-Postulats, beim Enspielen der Dokumente unterstützt werden. Mit Hilfe einer linguistisch intelligenten Software sollten automatisch Schlagwörter aus der SWD zu einem eingereichten Dokument erzeugt und dem Autoren angeboten werden. Dieser hätte anschließend entschieden, welche der angebotenen Schlagwörter er dem Dokument zuweisen möchte. Der typische Workflow beim Einspielen von Dokumenten verlangt vom Autor das Ausfüllen eines Metadatenformulars, idealerweise inklusive der Beschreibung mit SWD-Schlagworten. Da die SWD den Autoren nicht vertraut ist, vergeben diese meist unexakte, zu grobe oder falsche Schlagworte - oder solche, die in der SWD nicht existieren. Daher wird ein aufwändiges Nachbearbeiten seitens des Serverbetreibers nötig, der zwar über Expertise in der SWD-Nutzung verfügt, allerdings das Dokument nicht so exakt beschreiben kann wie es dem Autoren möglich wäre. Für ein exaktes Retrieval wäre es sinnvoll, wenn die Wissenschaftler selbst eine exakte Verschlagwortung vornähmen. Die im mittlerweile leider abgelehnten Antrag geplante prototypische, offene und nachnutzbare Einbindung einer Software zur automatischen Vergabe von SWD-Schlagworten hätte eine erhebliche Erleichterung des Veröffentlichungs- und Bearbeitungsprozesses einerseits und eine Verbesserung der Metadatenqualität andererseits gesichert.