Nástroj pro penetrační testování aplikací

Abstract

This thesis deals with the automation process of web applications penetration testing. The main goal is to gather intelligence about the current level of automation in this area and to check the quality of the web application vulnerability scanners. The thesis presents several experiments focusing on a detection of the Cross Site Scripting vulnerabilities of the three testing web applications using selected vulnerability scanners. The Nikto and Wapiti scanners detect only a very small amount of vulnerabilities. The analysis of the network traffic and logs shows that the Nikto does not perform website crawling, and the Wapiti fails to detect if the tested web application stops responding during the testing process. The best results in the terms of Cross Site Scripting vulnerabilities detection are achieved with the ZAP scanner. However this scanner does not detect DOM XSS vulnerabilities of features that rely on a JavaScript code. The main output of the thesis is a custom fuzzer that is able to detect this type of vulnerabilities.