Black-box web application vulnerability scanners are automated tools that are used to crawl a web application to look for vulnerabilities. These tools are often used in one of two ways. In the first approach, scanners are used as Point-and-Shoot tools where a scanner is only given the root URL of an application and asked to scan the site. Whereas, in the second approach, scanners are first configured to maximize the crawling coverage and vulnerability detection accuracy. Although the performance of leading commercial scanners has been thoroughly studied, very little research has been done to evaluate open-source scanners. This paper presents a feature and performance evaluation of five open-source scanners. We analyze the crawling coverage, vulnerability detection accuracy, scanning speed, report- ing and usability features. The scanners are tested against two well known benchmarks: WIVET and WAVSEP. Additionally, the scanners are tested against a realistic web application called WackoPicko. The chosen benchmarks are composed of a wide range of vulnerabilities and crawling challenges. Each scanner is tested in two modes: default and configured. Lastly, the scanners are compared with the state of the art commercial scanner Burp Suite Professional. Our results show that being able to properly crawl a web application is a critical task in detecting vulnerabilities. Unfortunately, the majority of the scanners evaluated had difficulty crawling through common web technologies such as dynamically generated JavaScript content and Flash applications. We also identified several classes of vulnerabilities that are not being detected by the scanners. Furthermore, our results show that scanners displayed considerable improvement when run in configured mode.

No description available.

Dissertação (mestrado)—Universidade de Brasília, Instituto de Ciências Exatas, Departamento de Ciência da Computação, Programa de Pós-Graducação em Informática, 2016. / Submitted by Fernanda Percia França (fernandafranca@bce.unb.br) on 2016-08-15T19:28:04Z No. of bitstreams: 1 2016_LaécioLimadosSantos.pdf: 8101789 bytes, checksum: cfa3494dd6c9cb6bcef19bad2ae8150d (MD5) / Approved for entry into archive by Raquel Viana(raquelviana@bce.unb.br) on 2016-10-11T21:17:42Z (GMT) No. of bitstreams: 1 2016_LaécioLimadosSantos.pdf: 8101789 bytes, checksum: cfa3494dd6c9cb6bcef19bad2ae8150d (MD5) / Made available in DSpace on 2016-10-11T21:17:42Z (GMT). No. of bitstreams: 1 2016_LaécioLimadosSantos.pdf: 8101789 bytes, checksum: cfa3494dd6c9cb6bcef19bad2ae8150d (MD5) / A Web Semântica (WS) adiciona informações semânticas a Web tradicional, permitindo que os computadores entendam conteúdos antes acessíveis apenas aos humanos. A Ontology Web Language (OWL), linguagem padrão para criação de ontologias na WS, se baseia em lógica descritiva para permitir uma modelagem formal de um domínio de conhecimento. A OWL, no entanto, não possui suporte para tratamento de incerteza, presente em diversas situações, o que motivou o estudo de várias alternativas para tratar este problema. O Probabilistic OWL (PR-OWL) adiciona suporte à incerteza ao OWL utilizando Multi-Entity Bayesian Networks (MEBN), uma linguagem probabilística de primeira ordem. A inferência no MEBN ocorre através da geração de uma rede bayesiana específica de situação (SSBN). O PR-OWL 2 estende a linguagem original oferecendo uma maior integração com o OWL e permitindo a construção de ontologias que mesclam conhecimento determinístico e probabilístico. PR-OWL não permite lidar com domínios que contenham bases assertivas muito grandes. Isto se deve a alta complexidade computacional da lógica descritiva na qual a OWL é baseada e ao fato de que as máquinas de inferência utilizadas nas implementações das versões do PR-OWL requerem que a base assertiva esteja carregada em memória. O presente trabalho propõe o PR-OWL 2 RL, uma versão escalável do PR-OWL baseada no profile OWL 2 RL e em triplestores. O OWL 2 RL permite raciocínio em tempo polinomial para as principais tarefas de inferência. Triplestores permitem armazenar triplas RDF (Resource Description Framework) em bancos de dados otimizados para trabalhar com grafos. Para permitir a geração de SSBN para bases contendo muitas evidências, este trabalho propõe um novo algoritmo, escalável ao instanciar nós de evidência apenas caso eles influenciem o nó objetivo. O plug-in PR-OWL 2 RL para o framework UnBBayes foi desenvolvido para permitir uma avaliação experimental dos algoritmos propostos. O estudo de caso abordado foi o de fraudes em licitações públicas. _______________________________________________________________________________________________ ABSTRACT / Semantic Web (SW) adds semantic information to the traditional Web, allowing computers to understand content before accessible only by human beings. The Web Ontology Language (OWL), main language for building ontologies in SW, allows a formal modeling of a knowledge domain based on description logics. OWL, however, does not support uncertainty. This restriction motivated the creation of several extensions of this language. Probabilistic OWL (PROWL) improves OWL with the ability to treat uncertainty using Multi-Entity Bayesian Networks (MEBN). MEBN is a first-order probabilistic logic. Its inference consists of generating a Situation Specific Bayesian Network (SSBN). PR-OWL 2 extends the PR-OWL offering a better integration with OWL and its underlying logic, allowing the creation of ontologies with deterministic and probabilistic parts. PR-OWL, however, does not deal with very large assertive bases. This is due to the high computational complexity of the description logic of OWL. Another fact is that reasoners used in PR-OWL implementation require that the data be fully load into memory at the time of inference. To address this issue, this work proposes PR-OWL 2 RL, a scalable version of PR-OWL based on OWL 2 RL profile and on triplestores. OWL 2 RL allows reasoning in polynomial time for the main reasoning tasks. Triplestores can store RDF (Resource Description Framework) triples in databases optimized to work with graphs. To allow the generation of SSBNs for databases with large evidence base, this work proposes a new algorithm that is scalable because it instantiates an evidence node only if it influence a target node. A plug-in for the UnBBayes framework was developed to allow an empirical evaluation of the new algorithms proposed. A case study over frauds into procurements was carried on.

Master of Science / Department of Computer Science / Daniel Andresen / This project involves in developing a responsive web application for Beach Museum at Manhattan, Kansas. Application is built on development boxes using Amazon web services. Project is built on MVC architecture that helps user to search images, create their own collection from the images and include an admin module. Migrating the current existing SQL database to couchDB for better performance of the available data. Integrated Apache Lucene to support text search in the couch database writing different indexes to retrieve the results. Implementing core functionalities like basic search, advanced search, filter objects with respective to artist, decade, object type and relevance using different indexes and Mango queries in the couchDB. Search Results are further chunked and displayed to the user. Web storage API’s were used to provide the functionality for a user to create their own collection (set of Images). Built an Admin module to perform CRUD operations the database. Admin module involves in creating exhibitions, adding/editing works and artists in the couch DB.

Orientador: José Eduardo Santarem Segundo / Banca: Plácida Leopoldina Ventura Amorim da Costa Santos / Banca: Elvis Fusco / Resumo: O aumento dos fluxos de informação na Web, devido a difusão e utilização cada vez maior das Tecnologias de Informação e Comunicação (TIC), tornam substancial a criação de tecnologias capazes de otimizar o acesso aos recursos informacionais e à informação. O recurso audiovisual que cresce desordenadamente requer soluções concernentes à estruturação, representação, interoperabilidade e à sua recuperação, gerando discussões muito necessárias na área da Ciência da Informação. A Web Semântica se propõe a possibilitar estruturação e a significação dos conteúdos na Web, para que computadores possam processar e interpretar o conteúdo para uma recuperação de informações mais eficiente, apresenta-se como o universo adequado para muitos estudos e pesquisas. Nesse contexto, o projeto Linked Data prevê melhores práticas para disponibilizar dados facilitando a interoperabilidade e a recuperação de informações. O objetivo deste trabalho consiste em identificar e analisar os conjuntos de dados sobre recursos audiovisuais no contexto do Linked Data, buscando verificar como a estrutura dos padrões de descrição pode contribuir para o ambiente informacional digital na representação de recursos e na interoperabilidade. O método utilizado foi o descritivo e exploratório, que consistiu no levantamento e documentação bibliográfica sobre os temas centrais da pesquisa e no estudo de ontologias e de padrões de metadados para descrição de recursos audiovisuais. A etapa exploratória consistiu na análise ... (Resumo completo, clicar acesso eletrônico abaixo) / Abstract: The increase in Web information flows due to diffusion and increasing use Technologies of Information and Communication (TIC) make substantial creating technologies that optimize access to information resources and information. The audiovisual resource that grows inordinately requires solutions concerning the structure, representation, interoperability and recovery, generating much needed discussions in the area of Information Science. The Semantic Web aims to enable the structuring and the significance of the content on the Web, so that computers can process and interpret the content for more efficient information retrieval, is presented as the appropriate universe for many studies and research. In this context, the project Linked Data provides best practices to provide data to facilitate interoperability and information retrieval. The objective of this work is to identify and analyze the data sets of audiovisual resources in the context of Linked Data, in order to verify the structure of the description of patterns may contribute to the digital information environment in the representation of resources and interoperability. The method used was descriptive and exploratory, which consisted of the survey and scientific literature on the central themes of research and study of ontologies and metadata standards for describing audio-visual resources. The exploratory phase consisted in the analysis of data sets audiovisual feature available in Linked Data. It is concluded that the... (Complete abstract click electronic access below) / Mestre

Thesis (DTech (Information Technology))Cape Peninsula University of Technology, 2011 / It was concluded in the literature review that small- to medium-sized enterprises (SMME) should prioritise utilising the websites on the Internet, as it provides a low cost infrastructure, unlocking opportunities and allowing small- to medium-sized enterprises to market to the international customer, promoting business activities in a low-risk environment. However, visitors do not know that they do not know, meaning a need for facilitation exists between the Internet user in terms of the information required and the information available on the Internet. Search engines (governed by their organic ranking algorithms) were created for this very purpose, to facilitate users in finding relevant information on the Internet in the shortest time possible. Search engines interpret and evaluate any given indexed web page from a targeted keywords perspective, indicating that web pages must be optimised from a search engine perspective. However, the elements search engines perceive to be important may not always be aligned with what website visitors perceive to be important. Anything on the web page that may remotely impede the visitors’ experience could be detrimental as alternative website options are but a click away. An example would be the excessive use of content on a given web page. The search engine may find the excessive content useful as it may provide contextual interpretation of the web page. However, the excessive content may impede a visitor’s website interaction as it is estimated that the average visitors will often view a web page for 45-60 seconds and read a maximum of 200 words only. During the process of identifying the contradictory search engine optimisation (SEO) elements and website usability (WU) attributes, three journal articles were written, with two journal articles following their own research methodologies and the third journal article utilising all the research results in order to create the fused SEO and WU model. Journal Article 1: Two websites were used as part of the experiment: • Control Website (CW): http://www.copywriters.co.za • Experimental Website (EW): http://www.copywriters.co.za/ppc/. The CW is an existing website with no special emphasis applied to SEO and/or WU. The EW was developed by implementing the WU attributes and ignoring all contradictory SEO elements. In order to ensure integrity of the experiment, search engines were denied access to the EW. The traffic sources for the CW were search engines (organic) traffic, as well as direct and referrer traffic.

Visibilidade Web é a área de estudo das medidas de visibilidade de organizações, termos ou documentos na web, sendo um dos campos de pesquisa da ciência de Webmetria. Neste trabalho, uma fórmula para o cálculo de visibilidade na web é proposta, baseando-se na visão proporcionada por diferentes motores de busca. O resultado final é um indicador de Visibilidade Web para universidades. São apresentados e analisados rankings de universidades do mundo todo encontrados na web, tais como o ARWU, o WR e o THE. Tais rankings trabalham com indicadores compostos, mas abordam a questão da visibilidade na rede de maneiras diferentes. Também são discutidos alguns trabalhos recentes no campo de Visibilidade Web. O indicador elaborado baseia-se na classificação do site oficial da universidade nos buscadores como meio de pontuar a visibilidade, valendo-se de metabusca. Um método de fusão de rankings é utilizado para a pontuação. Siglas de universidades brasileiras foram submetidas ao cálculo de visibilidade e classificadas, mostrando uma aplicação da fórmula no mundo real. Dois rankings foram construídos, um deles apontando falhas no método proposto e o segundo contornando o problema encontrado, apresentando uma classificação justa, coerente com a realidade e com outros rankings de universidades brasileiras. A principal contribuição do trabalho é a definição de um indicador de visibilidade na web que mostra como são classificadas as instituições através dos principais pontos de entrada da rede: os motores de busca. / Web Visibility is the area of study of visibility measures of organizations, terms or documents on the web, one of the fields of the Webmetrics science. In this work, a formula for the calculation of visibility on the web is proposed, based on the vision provided by different search engines. The result is an indicator of Web Visibility for universities. In related works section are presented and analyzed rankings of universities around the world from the web, such as ARWU, WR and THE. Such rankings work with composite indicators, but address the issue of visibility on the network in different ways. Also are covered some resent works in the field of Web Visibility. The indicator developed is based on the classification of the universities’ official website in search engines as a means of scoring the visibility, using a metasearch engine. A method of rankings fusion is used for the scoring process. Acronyms of Brazilian universities were subjected to the calculation of visibility and classified, showing an application of the formula in the real world. Two rankings were built, one of them pointing out flaws in the proposed method and another solving the problem encountered with a fair rating, consistent with reality and with other rankings of universities. The main contribution of this work is a Web Visibility indicator that shows how the institutions are classified by the main entry points of the network: the search engines.

Este trabalho de pesquisa apresenta um protótipo de servidor Web distribuído com diferenciação de serviços baseado em QoS relativa e absoluta. São implementados e comparados diferentes algoritmos de escalonamento. Um dos algoritmos avaliados é o EBS. O objetivo é transpor a teoria da política para o mundo real, e comparar o seu comportamento com os resultados das simulações, utilizando o tempo de resposta como medida de desempenho. Além do EBS, outros algoritmos são avaliados, tais como, Round-Roubin e Weighted Round Robin / This work presents a prototype of a distributed Web server with service differentiation based on relative and absolute QoS. Are compared different schedule algorithms. One of the policies to be evaluated is the EBS. The goal is to implement the policy theory to the real world, comparing their behavior with the simulation results, using the response time as a performance measure. In addition to the EBS, others policies are evaluated, such as Round-Roubin and Weight Round Robin

Este trabalho descreve um projeto simples de gerenciamento de clusters que apresenta uma interface de usuário para as tarefas mais comuns de uso e gerenciamento de um cluster utilizado como máquina paralela. A partir do estudo de vários softwares existentes hoje, o sistema projetado foi adequado às necessidades do cluster do Laboratório de Processamento Paralelo Aplicado do Instituto de Física de São Carlos. O sistema é baseado em páginas HTML e scripts CGI. O uso de HTML e CGI se demonstrou apropriado para o desenvolvimento desse tipo de sistemas. / This work describes a simple cluster management system that operates as a user interface for some common user and manager tasks performed on a cluster used as parallel machine. We studied some cluster management systems from the literature and then designed a system with the needs of our research laboratory in mind. The system was implemented using HTML pages and CGI scripts. The use of HTML and CGI was found adequate for this type of systems.

Este trabalho apresenta um estudo, implementação e validação em ambiente simulado de uma política de escalonamento de tempo real para provisão de QoS absoluto em serviço Web. Sintetizando características de escalonamento de tempo real, com baixa latência e de modelo re-alimentado, a política proposta permite um ajuste ponderado pela quantificação da exigência à qual o sistema está submetido por meio de suas classes. A meta é oferecer ações imediatas às requisições mais urgentes, sem, entretanto, degradar a qualidade do sistema como um todo. Verificou-se que a estratégia de escalonamento baseada em exigência (EBS - Exigency-Based Scheduling) é benéfica para o controle da qualidade de serviço oferecida. Escalonar de forma a evitar demasiado peso imposto ao sistema permite que o servidor tenha mais condições de cumprir os requisitos contratuais. Também foi alvo do estudo a criação de uma métrica de avaliação da satisfação de atendimento por parte dos usuários dos serviços. Os resultados alcançados com o emprego da política EBS sinalizam uma melhoria em termos de qualidade de serviço e melhor satisfação dos clientes de forma balanceada / The present work presents a study, implementation and validation in a simulated environment of a real time scheduling policy to provide absolute QoS for web services. Synthesizing characteristic from real time scheduling, low latency and feedback scheduling, the proposed policy allows an adjustment weighed by the quantification of the exigency which the system is exposed through its classes. The goal is to offer immediate actions to most urgent requests, without decreasing the system quality as a whole. It was verified that the scheduling strategy based on exigency (EBS - Exigency-Based Scheduling) helps to control the quality of service offered. Scheduling in order to avoid imposing a heavy load to the system gives more condition to the server to fulfill the requirements agreed. Another goal of this work is the creation of a metrics to evaluate the client satisfaction. The results achieved with the EBS policy indicate a higher quality of service and better client satisfaction