Uniscan: um scanner de vulnerabilidades para sistemas web

Abstract

With the increasing number of intrusions and data theft, the security of computing systems is becoming an important concern inside organizations. Every time more it is essential to use automated tools for detecting vulnerabilities in Web systems. Considering this current context, the objective of this work is to design and implement a vulnerability scanner for Web systems. Unlike most existing tools, the solution is free, open source and has a modular architecture. Its main functionality is to automate, in a flexible and extensible way, the process of vulnerabilities detection in Web environments, providing diagnosis and reports to improve the process of solving the existing problems. Thus, the resulting solution of the work is an important and useful tool for security and development teams. The developed tool, called Uniscan, transformed into a free software project, can be found at www.uniscan.com.br. The main innovation of the solution is the fact that it implements some features, to detect specific vulnerabilities, not present in most similar tools, such as local file inclusion, remote file inclusion and remote commands execution. This work presents the design, development, evaluation and achieved results of the vulnerability scanner. The resulting experience and achievements show that tools like Uniscan are important to be included in security and development processes inside corporations. Information Technology and Communications teams, responsible for these processes, can take advantage of the resources provided by this kind of tools.