Web application security using top 10 OWASP

Web Application Penetration Testing And Vulnerability Mitigation Using OWASP Top 10

Web applications are ubiquitous and serve various business and technical functions. As the number of web applications continues to increase, they are also becoming one of the most common targets for cyber-attacks. This paper proposes a web application penetration testing framework that helps identify, classify, and mitigate security vulnerabilities in web applications. The proposed framework is based on the OWASP Top 10 and leverages several security tools to detect vulnerabilities with higher accuracy and a minimized number of false-positive outcomes. The proposed framework classifies detected vulnerabilities based on their categories and assigns a priority level to the detected vulnerabilities based on their risk assessment. Mitigation recommendations are also provided along with a complete security report that helps developers in strengthening the application security. The effectiveness of the proposed framework is evaluated using a number of web applications including DVWA and OWASP Juice Shop.

Penetration Testing in System Security

This review's results show that penetration testing is an important part of improving cybersecurity because it helps identify weaknesses before they become problems and reduces risk.

TOP 10

Automated Fuzzing Tool for Testing Web Application Security

The importance of Web Application Security grows daily as more organizations are threatened and attacked by cyber criminals. With the growing threat from cyber criminals, performing security testing to identify vulnerabilities in web systems is critical. Of all security testing techniques, fuzz testing is perhaps the best technique available today. Fuzz testing involves injecting input into a target application, including malformed, unexpected, or random data to see how it reacts when it receives bad data. In the case of web applications, fuzz testing is done by sending numerous HTTP requests (each request contains different forms of crafted or invalid data) to a web server to measure the response generated by the server. This study will create an Automated Web Application Fuzzer which will be integrated with Jenkins so that continuous security testing of Web Applications can occur. Test cases were created using known security vulnerabilities within web applications. Testing revealed that the automation tool found vulnerabilities in thirteen (13) out of fifteen (15) test cases. Therefore, testing reveals that the majority of web vulnerabilities can be easily identified simply by reviewing the content of HTTP responses, thereby validating the effectiveness of the proposed automated web application fuzzing methodology

Comparative Effectiveness of OWASP WSTG and Top Ten in Web Security Audits

This study evaluates the comparative effectiveness of two widely adopted cybersecurity frameworks, the OWASP Top Ten (2021) and the OWASP Web Security Testing Guide (WSTG), in the context of web application security auditing. While the OWASP Top Ten is a standard for risk awareness, it lacks the technical granularity required for comprehensive testing, creating a gap between high-level risk identification and practical verification. To bridge this gap, this study proposes a structured integration through comparative mapping and empirical validation using real-world mitigation data. A procedural analysis combined with granularity evaluation was employed to map the ten OWASP risk categories to 102 technical verification units in the WSTG. The results reveal a 920% increase in testing granularity compared to the baseline Top Ten framework. Empirical validation conducted on a government subdomain (Instansi X) demonstrated that this integrated approach identified critical vulnerabilities, including Broken Access Control and Cryptographic Failures, which are often overlooked in high-level assessments. By implementing specific WSTG-based mitigation procedures, such as middleware authorization and secure communication protocols, identified risks were successfully remediated without disrupting production stability. This study contributes a validated framework that bridges the gap between conceptual risk and actionable technical verification. The findings indicate that while the OWASP Top Ten serves as a strategic reference, the WSTG is superior as a primary technical auditing framework. This integration enhances audit consistency, precision, and efficiency in evaluating modern web environments.

Cloud in the crosshairs: exposing vulnerabilities in web-based management interfaces of open-source IaaS platforms

The security of open-source cloud platforms is paramount, given their widespread adoption in modern business operations. This study conducts a large-scale empirical security analysis of the web-based management interfaces of ten widely used open-source Infrastructure-as-a-Service (IaaS) platforms. Using a black-box penetration testing methodology that combines automated scanning with Burp Suite and its security extensions with systematic manual analysis, we identified a total of 16 vulnerabilities spanning nine classes, including high-severity flaws that enable account takeover. Our findings, which culminated in the assignment of six new Common Vulnerabilities and Exposures (CVE) IDs, provide concrete, empirically validated examples of how server misconfigurations and flawed authentication logic manifest in the exposed management interfaces of mainstream open-source IaaS platforms, including mis-issued API tokens, time-based user enumeration, and host-header–driven misrouting. Specifically, the identified vulnerabilities stem from improper authentication, insufficient input validation, and server misconfigurations. In addition to a responsible vulnerability disclosure process, this work provides practical hardening recommendations to mitigate the identified weaknesses.