Web Application Security Education Platform Based on OWASP API Security Project

Abstract

The trend of API-based systems in web applications in the last few years keeps steadily growing. API allows web applications to interact with external systems to enable business-to-business or system-to-system integration which leads to multiple application innovations. However, this trend also comes with a different surface of security problems that can harm not only web applications, but also mobile and IoT applications. This research proposed a web application security education platform which is focused on the OWASP API security project. This platform provides different security risks such as excessive data exposure, lack of resources and rate-limiting, mass assignment, and improper asset management which cannot be found in monolithic security learning application like DVWA, WebGoat, and Multillidae II. The development also applies several methodologies such as Capture-The-Flag (CTF) learning model, vulnerability assessment, and container virtualization. Based on our experiment, we are successfully providing 10 API vulnerability challenges to the platform with 3 different levels of severity risk rating which can be exploited using tools like Burp Suite, SQLMap, and JWTCat. In the end, based on our performance experiment, all of the containers on the platform can be deployed in approximately 16 seconds with minimum storage resource and able to serve up to 1000 concurrent users with the average throughput of 50.58 requests per second, 96.35% successful requests, and 15.94s response time.

Development of Cineverse Film Website Utilizing Themoviedb's Api for Dynamic Content Management

“…APIs facilitate swift and inventive app development by enabling applications to engage with external systems. They are pivotal in crafting diverse application platforms like IoT, mobile apps, and web applications (Idris et al, 2022). An API is an interface that connects various application systems, allowing simultaneous access to some or all of the functions of these systems (Paramitha et al, 2022).…”

Formulate an Adaptive Technique to Validate Near Field Communication Technology using Attributed Graph Grammar-AGG tool

“…NFC, as a smart equipment can assist to perform purchases through smartphones. [1,13,15,16,17,18] NFC is rooted in radio-frequency identification technology such RFID which allows compatible hardware to both supply power to and communicate with an otherwise unpowered and passive electronic tag using radio waves. This is used for identification, authentication and tracking.…”

“…Due to the novelty of NFC technology, academic data is scarce at the moment, despite the fact that the sum of academic research studies conducted in the last two years has previously exceeded the total number of prior works combined. [8,9,12,13,14,17,21] Also, NFC technology is short-range wireless RFID that makes use of electromagnetic radio fields to establish cooperative connections rather than the conventional direct radio transmissions, which are now managed by technologies e.g., Bluetooth. On the other hand, mobile payment techniques began in a few countries, including Japan and Canada, before spreading to the rest of the world, including the United Kingdom, the United States, the United Arab Emirates, and lately, in most great countries such, KSA and Qatar.…”

Segurança da informação na pesquisa científica

“…A evolução tecnológica tem incorporado cada vez mais as APIs na arquitetura de softwares modernos e em diversas soluções computacionais. Entretanto, o aumento do uso dessa tecnologia também resulta no crescimento dos vetores de ataque [5,6], destacando a importância da adoção de padrões de segurança rigorosos no desenvolvimento e manutenção dessas interfaces [4,6].…”

“…A evolução tecnológica tem incorporado cada vez mais as APIs na arquitetura de softwares modernos e em variadas soluções computacionais. Contudo, o crescimento do uso dessa tecnologia também resulta no aumento de vetores de ataque[5,6], evidenciando a necessidade premente de adotar padrões de segurança rigorosos no desenvolvimento e na manutenção desse componente[4;6].O OWASP API Security TOP 10 destaca diversas vulnerabilidades que devem ser consideradas como potenciais riscos. Essas vulnerabilidades abrangem desde falhas em mecanismos de autenticação e autorização até a exposição indevida de dados sensíveis.…”