期刊名称：International Journal of Advanced Computer Science and Applications(IJACSA)
印刷版ISSN：2158-107X
电子版ISSN：2156-5570
出版年度：2017
卷号：8
期号：12
DOI：10.14569/IJACSA.2017.081254
出版社：Science and Information Society (SAI)
摘要：The internet has provided a vast range of benefits to society, and empowering people in a variety of ways. Due to incredible growth of Internet usage in past 2 decades, everyday a number of new Web applications are also becoming a part of World Wide Web. The distributed and open nature of internet attracts hackers to interrupt the smooth services of web applications. Some of the famous web application vulnerabilities are SQL Injection, Cross Site Scripting (XSS) and Cross Site request Forgery (CSRF). We believe that in order to encounter these vulnerabilities; the web application vulnerabilities scanner should have strong detection and prevention rules to ease the problem. At present, a number of web application vulnerabilities scanners have been proposed by research community, such as ZED Attack Proxy (ZAP) by AWASP, Wapiti by sourceforge.net and w3af by w3af.org. However, these scanners cannot challenge all web vulnerabilities. This research proposed and develop a vulnerability scanning tool WUM (web unique method) to detection and prevention of all the major instance vulnerabilities and demonstrates how to detect unauthorized access by finding vulnerabilities. With the efficient use of this tool, the developers are able to find potentially vulnerable web application. WUM generated a high level of accuracy and compatibility, which is elaborated underneath. The result of the experiment shows proposed vulnerability scanner tool WUM which gives less false positive and detect more vulnerabilities in comparison of well-known black box scanners.
关键词：Automated vulnerability detection; black-box scanners; web vulnerabilities crawling; security scanner
