This project explores how a Meta Attack Language based Domain Specific Language for web applications can be used to threat model web applications in order to evaluate and improve web application security. Organizations and individuals are targeted by cyberattacks every day where malicious actors could gain access to sensitive information. These malicious actors are also developing new and innovative ways to exploit the many different components of web applications. Web applications are becoming more and more complex and the increasingly complex architecture gives malicious actors more components to target with exploits. In order to develop a secure web application, developers have to know the ins and outs of web application components and web application security. The Meta Attack Language, a framework for developing domain specific languages, was recently developed and has been used to create languages for domains such as Amazon Web Services and smart cars but no language previously existed for web applications. This project presents a prototype web application language delimited to the first vulnerability in the top ten list provided by Open Worldwide Application Security Project (OWASP), which is broken access control, and tests it against the OWASP juice shop, which is an insecure web application developed by OWASP to test new tools. Based on the results it is concluded that the prototype can be used to model web application vulnerabilities but more work needs to be done in order for the language to work on any given web application and vulnerability. / Detta projekt utforskar hur ett Meta Attack Language baserat Domän Specifikt Språk för webbapplikationer kan användas för att hotmodellera samt undersöka och förbättra webbapplikationssäkerhet. Organisationer och individer utsätts dagligen för cyberattacker där en hackare kan få tillgång till känslig information. Dessa hackare utverklar nya och innovativa sätt att utnyttja dem många olika komponenterna som finns i webbapplikationer. Webbapplikationer blir mer och mer komplexa och denna ökande komplexa arkitekturen leder till att det finns mer mål för en hackare att utnyttja. För att utveckla en säker webbapplikation måste utvecklare veta allt som finns om webbapplikations komponenter och webbapplikations säkerhet. Meta Attack Language är ett ramverk för att utveckla nya språk för domäner som till exempel Amazon Web Services och smarta fordon men innan detta existerade inget språk för webbapplikationer. Detta projekt presenterar en webbapplikations språk prototyp som är avgränsad till den första sårbarheten i top tio listan av Open Worldwide Application Security Project (OWASP) vilket är broken access control, och testar den mot OWASP juice shop, vilket är en sårbar webapplikation som utveckalts av OWASP för att testa nya verktyg. Baserat på resultaten dras slutsatsen att prototypen kan användas för att modellera webbapplikations sårbarheter men att det behövs mer arbete för att språket ska fungera på vilken webbapplikation och sårbarhet som helst.

The widespread usage of smartphones and mobile applications in Sweden exposes the users to potential risks if not adequate security standards are implemented. An insecure application that is exploited by an adversary could potentially compromise the users private data and integrity. As such, this report aims to examine and evaluate the security of ten commonly used mobile applications in Sweden. Using the OWASP Mobile Security Testing Guide (MSTG) and conducting penetration testing, the applications were assessed in regards of strengths and weaknesses. The results presents nine potential vulnerabilities of which three were successfully exploited with the use of brute-force and session hijack attacks. Even though all examined applications adopt industry security standards of various degrees, our findings shows that a few applications are susceptible to vulnerabilities. / Det breda användadet av smarta telefoner och mobila applikationer i Sverige utsätter användare för potentiella risker om inte tillräckliga nivåer av säkerhetsstandarder implementeras. En osäker applikation som utnyttjas av en person med onda avsikter skulle kunna leda till dataintrång hos en användare. Därav siktar denna rapport på att utvärdera säkerheten hos tio vanligt förekommande mobila applikationer i Sverige. Med hjälp av OWASP Mobile Security Testing Guide (MSTG) och utförandet av penetrationstester så har applikationernas styrkor och svagheter utvärderats. Resultatet som presenteras visar på nio potentiella sårbarheter varav tre kunde verifieras genom lyckade brute-force och session hijack attacker. Även om de utvärderade applikationerna implementerar en viss nivå av säkerhetsstandarder, så visar vårt resultat att vissa av applikationerna är utsatta för sårbarheter.

This work deals with a issue of a DoS vulnerability in web applications. At first, there are described principles of a computer security, general principles of the DoS and a penetration testing. Further text describes a OWASP Testing Guide v3 for the DoS in web applications. There is a design of own application on basis own experiences. This application is implemented and tested by the web applications.

How secure is your application? How can you evaluate if it is secure? The threats are many and may be hard to find. In a world where things are more and more automated; how does manual labour contribute to security auditing applications? This study aims to assess two proof of concept Android client-server applications, developed by students to suit the needs of a fictitious Police Department and Fire Department, respectively. The approach is unconventional yet supported by well-established theory. The gist of a vulnerability assessment methodology initially developed to assess the security of middleware is followed and applied to the entire architecture of these client-server applications. How the manual labour contributed to the end results, in comparison to the use of automated tools and a list of known threats, is then evaluated.   It is concluded that the applications encompass multiple of the Open Web Application Security Project (OWASP) Top 10 Mobile Risks and that automated tools find most of those vulnerabilities. However, relying on automation may lead to a false sense of security, which in effect may cause developers to lose understanding of why vulnerabilities occur and how they should be mitigated. Understanding how the design and architecture of the application influence its security is key.   As of Android 9.0+, default is that applications use SSL encrypted communication. Only 40% of Android users are in 2020 affected by this change according to Android studio developer information, leaving a majority of users unaware of if or how their data is being protected, also observed in analysis results from this thesis work. One should consider if or how to inform users of how their data is being handled, not only in newer Android versions or regarding SSL communication.    This work also shows that developers' decisions may be greatly affected by time pressed situations, which is reflected upon in the last chapter. Another important finding was that the third-party software Sinch, which enabled the use of voice and video communication in one of the applications, sent IP addresses and usernames of the users in clear text during the binding request, when the Session Traversal Utilities for NAT (STUN) protocol was used.

Web Application Firewall (WAF) is used to protect the Web application (web app). One of the advantages of having WAF is, it can detect possible attacks even if there is no validation implemented on the web app. But how can WAF protect the web app if WAF itself is vulnerable? In general, four testing methods are used to test WAF such as fuzzing, payload execution, bypassing, and footprinting. There are several open-source WAF testing tools but it appears that it only offers one or two testing methods. That means a tester is required to have multiple tools and learn how each tool works to be able to test WAF using all testing methods. This project aims to solve this difficulty by developing a WAF testing tool called ProjectX that offers all testing methods. ProjectX has been tested on a testing environment and the results show that it fulfilled its requirements. Moreover, ProjectX is available on Github for any developer who want to improve or add more functionality to it.

The thesis deals with the assessment of security vulnerabilities. The aim of this work is to create a new method of vulnerability assessment, which will better prioritize critical vulnerabilities and reflect parameters that are not used in currently used methods. Firstly, it describes the common methods used to assess vulnerabilities and the parameters used in each method. The first described method is the Common Vulnerability Scoring System for which are described all three types of scores. The second analysed method is OWASP Risk Rating Methodology. The second part is devoted to the design of the own method, which aims to assess vulnerabilities that it is easier to identify those with high priority. The method is based on three groups of parameters. The first group describes the technical assessment of the vulnerability, the second is based on the requirements to ensure the confidentiality, integrity and availability of the asset and the third group of parameters evaluates the implemented security measures. All three groups of parameters are important for prioritization. Parameters describing the vulnerability are divided into permanent and up-to-date, where the most important up-to-date parameter are Threat Intelligence and easy of exploitation. The parameters of the impact on confidentiality, integrity and availability are linked to the priority of the asset, and to the evaluation of security measures, which increase the protection of confidentiality, integrity and availability. The priority of the asset and the quality of the countermeasures are assessed based on questionnaires, which are submitted to the owners of the examined assets as part of the vulnerability assessment. In the third part of the thesis, the method is compared with the currently widely used the Common Vulnerability Scoring System. The strengths of the proposed method are shown in several examples. The effectiveness of prioritization is based primarily on the priority of the asset and the security measures in place. The method was practically tested in a laboratory environment, where vulnerabilities were made on several different assets. These vulnerabilities were assessed using the proposed method, the priority of the asset and the quality of the measures were considered, and everything was included in the priority of vulnerability. This testing confirmed that the method more effectively prioritizes vulnerabilities that are easily exploitable, recently exploited by an attacker, and found on assets with minimal protection and higher priority.

Both for its simplicity and efficiency to search for the most critical security vulnerabilities that could exist within a web application, a web vulnerability scanner is a popular tool among any company that develops a web application. With the existence of many different scanners that are available to use, one is unlikely the same as the other and the results attained when evaluating these scanners in relation to each other are often not the same. In this thesis, three different open source web vulnerability scanners are evaluated and analysed based on their ability to find SQL injection and cross-site scripting vulnerabilities. The scanners were used on several open source deliberately broken web applications that acted as benchmarks. The benchmarks that caused much diversity in the results from the scanners were further investigated. When analysing the scanners based on the results, both the actual results were analysed on what caused the diversity but most of all the source code of the scanners were explored and investigated. It could be found that the techniques used by the scanners were essentially similar but contained several minor differences that caused the diversity in the results. Most differences were dependant on the variation of the predefined payloads injected by the scanners, but it could also be found that the approaches used to determine if a vulnerability was detected or not could vary as well. The finalised result concluded in a report that reveals and demonstrates the different approaches that any web vulnerability scanner could use and the limitations of them.

The goal of this research is to improve the security of smart home hubs by developing a standard against which hubs can be evaluated. This was done by first reviewing existing standards, guides, and collections of best practices. I determined that adapting or extending an existing standard was the best way to proceed. Potential candidates were selected, and after thorough comparison, I chose to extend the OWASP Application Security Verification Standard (ASVS). Extensions were composed of additional security requirements to address smart home hub functionality not covered by the existing requirements of the ASVS. These additional requirements were developed based upon existing best practices and are referred to as the Smart Home Extensions. Where a best practice or guidance did not yet exist for a particular hub functionality, guidance from related fields was adapted. The entire set of Smart Home Extensions were reviewed by industry experts, updated based on feedback, and then sent on for further peer review. Four smart home hubs – VeraLite, Wink, Connect, and SmartThings – were evaluated using the ASVS with the Smart Home Extensions. The evaluation uncovered security vulnerabilities in all four hubs, some previously disclosed by other researchers, and others new. Analysis of the evaluation data suggests that authentication is a common problem area, among others. Based on the performance of the hubs and the data collected, I suggest that the ASVS and Smart Home Extensions can be an effective tool to provide insight into the security posture of smart home hubs.

The popularity of the internet has made the use of web applications ubiquitous and essential to the daily lives of people, businesses and governments. Web servers and web applications are commonly used to handle tasks and data that can be critical and highly valuable, making them a very attractive target for attackers and a vector for successful attacks that are aimed at the application layer. Existing misuse and anomaly-based detection and prevention techniques fail to cope with the volume and sophistication of new attacks that are continuously appearing, which suggests that there is a need to provide new additional layers of protection. This work aims to design a new layer of defense based on deception that is employed in the context of web application-layer traffic with the purpose of detecting and preventing attacks. The proposed design is composed of five deception strategies: Deceptive Comments, Deceptive Request Parameters, Deceptive Session Cookies, Deceptive Status Codes and Deceptive JavaScript. The strategies were implemented as a software artifact and their performance evaluated in a testing environment using a custom test script, the OWASP ZAP penetration testing tool and two vulnerable web applications. Deceptive Parameter strategy obtained the best security performance results, followed by Deceptive Comments and Deceptive Status Codes. Deceptive Cookies and Deceptive JavaScript got the poorest security performance results since OWASP ZAP was unable to detect and use deceptive elements generated by these strategies. Operational performance results showed that the deception artifact could successfully be implemented and integrated with existing web applications without changing their source code and adding a low operational overhead.

The Master’s Thesis deals with the design and implementation of a web application for testing the security of SSL/TLS protocols on a remote server. The web application is developed in the Nette framework. The theoretical part describes SSL/TLS protocols, vulnerabilities, recommendations and technologies used in the practical part. The practical part is devoted to the creation of a web application with the process of using automatic scripts to test and display the results on the website with a rating of A+~to~C. The web application also displays a list of detected vulnerabilities and their recommendations.