Vulnerability Assessment and Penetration Testing On The Xyz Website Using Nist 800-115 Standard

Abstract

Currently the website has become an effective communication tool. However, it is essential to have vulnerabilities assessment and penetration testing using specific standards on released websites to the public for securing information. The problems raised in this research are conducting vulnerability testing on the XYZ website to analyze security gaps in the XYZ website, as well as conducting penetration testing on high vulnerabilities found. Testing was conducted using the NIST 800 – 115 Standard through 4 main stages: planning, discovery, attack, and report. Several tools were used: Nmap, OWASP ZAP, Burp Suite, and Foxy Proxy. This research results are presented and analyzed. There were seven vulnerabilities found, one high-level vulnerability, two medium-level vulnerabilities, and four low-level vulnerabilities. At the high level, SQL Injection types are found, at the medium level, Cross-Domains Misconfiguration and vulnerabilities are found, at the low level, Absence of Anti-CSRF Tokens, Incomplete or No Cache-control and Pragma HTTP Header Set, Server Leaks Information via “X-Powered-By” HTTP Response Header Field and X-Content-Type-Options Header Missing are found.

Adaptive Hybrid Learning for Websites Vulnerability prediction

“…Following the adjustment of the training subset, the Random Forest and Gradient Boosting classifier efficacy were appraised on the testing subset through well-recognized evaluation metrics. These metrics are detailed in Table (2), providing insights into the predictive capabilities of the model in the context of vulnerability detection.…”

“…The rapid advancement of information technology has significantly enhanced the convenience of human life, with the proliferation of websites serving as a prime example [1]. With rapid progress in technology, agencies and organizations are increasingly investing in the development of websites to represent and enhance their operations [2]. The landscape of the Internet is vast, with 201,898,446 active websites and an additional 200,756,193 websites at various stages of the activity.…”

Campus Website Security Vulnerability Analysis Using Nessus

“…With advances in technology for now agencies or organizations are competing to create websites for their agencies. [1] In recent years, human work has become easier with the existence of a website. According to Nick Huss on his website [2] in the world of existing websites (05/04/2022) there are 1,179,448,021 active websites and 200,756,193 websites.…”