Script para a automatização de testes de vulnerabilidades em aplicações web

Abstract

In the current software development market, there is an increasing need for constant and fast deliveries in order to stay ahead in the competitive scenario. As a consequence, the practice of security testing in the development process ends up becoming a secondary task, necessary only after deliveries and performed by specialized companies which, consequently, can cause the late detection of vulnerabilities. Thus, aiming at the need to detect security vulnerabilities still in the development process without delaying the whole operation, the demand for an automated flow arises. The main objective of the project was to develop a script that provides professionals in the industry a way to parallelize the security testing of web applications with their main activities performed on a daily basis, as well as a simpler way to visualize the results obtained through reports. An analysis of the vulnerabilities presented by OWASP Top Ten was performed, in which three categories were chosen: Injection, Vulnerable and Outdated Components, and Broken Access Control. The developed script automates the execution of several tools that help in security tests, these tests were divided into stages in which they had an auxiliary tool, these stages are respectively: enumeration or information gathering, network analysis, vulnerability tests, and report generation. The final results obtained had varying effectiveness, the information gathering and report generation steps were successful and provided the expected results, the network and vulnerability analysis steps performed poorly due to time and script scope limitations, as well as false positives appearing in the network analysis. In the future, it is expected to deliver an improvement in execution time along with an increase in the scope of vulnerability analysis as well as an elimination of false positives, plus the entire report design will be redone.