Análise black-box de ferramentas de segurança na Web

Abstract

Vulnerabilities in Web applications still are a common and frequent problem. Recent statistics indicate that even old vulnerabilities, such as SQL injection, still represent a security risk in most of Web applications. As a way to contribute to the process of detecting and diagnosing security flaws, this work presents an analysis of scanning tools free scanners in a controlled scenario containing the ten most frequent vulnerabilities in Web systems. Complementarily, the impact of Software Development Frameworks and Web Application Firewalls (WAFs) on the security of Web systems are evaluated and discussed. The results allow the identification of the main differences between existing scanners and the impact of each development framework and WAF on the security of Web applications. As an example, the development framework Laravel automatically mitigates 60 % of the vulnerabilities evaluated, while the Codeigniter framework mitigates only 30 %. This means that the choice of the development framework may have a significant impact on the system’s security.