Vulnerability Analysis of E-voting Application using Open Web Application Security Project (OWASP) Framework

Abstract

This paper reports on security concerns in the Evoting used for the election of village heads. Analysis of the system and server uses two different tools to determine the accuracy of scanning vulnerabilities based on the OWASP Framework. We reported that the results of the scanning using the ZAP tool got vulnerability information with the following risk level, one high level, three medium levels, and eleven low levels. The Arachni tool got vulnerability information with the following risk level, one high level, three medium levels, and two low levels. ZAP has a more complex vulnerability view than Arachni. Fatal findings on E-voting in this E-voting system is XSS, which impacts clients, which can be exploited by attackers to bypass security. Directory Traversal allows attackers to access directories and can execute commands outside of the web server's base directory. Cyber Hiscox Readiness report in 2018 in several European countries such as The United States, Britain, Germany, Spain, and the Netherlands, that the Attackers target through the most vulnerable security holes such as injection, Broken Authentication, Sensitive Data Exposure, XXE, Merged, Security Misconfiguration, XSS, Insecure Deserialization, Using Components with Known Vulnerabilities, Insufficient Logging, and Monitoring. The purpose of cyberattacks alone can threaten the stability of the country and disturb other factors. E-voting, as part of an electronic government system, needs to be audited in terms of security, which can cause the system to disrupt.

Web Application Vulnerability Analysis Using the OWASP Method (Case Study: OJS CSFD UIN Sunan Kalijaga Yogyakarta)

“…Acunetix and NetSparker showed lower false positive rates than OWASP-ZAP, while tests utilizing the OWASP-ZAP tools had stronger vulnerability detection and were ranked in the open source category [7]. Based on the amount of risk, vulnerability information can be obtained from scan results using a vulnerability scanner [8]. Then, in order to enhance accuracy, testing utilizing the OWASP technique, which makes use of a vulnerability scanning tool, also needs to be configured [9].…”

Review of the security challenges in web-based systems

“…Despite majority of organizations attempting to protect their systems using Secure Sockets Layer (SSL) and firewalls, they do not provide adequate protection against web system intrusion. This is because website access is public [30], [31], [32], [33], [34]. Web-based systems' backend data can always be directly accessed and since majority of them are customized, their degrees of testing are lower compared to off-shelf applications [35].…”