Unsecure Webservices: bWAPP vs. JuiceShop

Introduction

The number of users of online services has increased significantly the last years. Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet are growing and make so-called penetration tests necessary. A penetration test comprises a series of activities with which security gaps are recorded and identified. In the following seminar paper two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. Attackers take advantage of specific weaknesses in order to gain access to get familiar information. A variation of the SQL injection attack is described.

Author

Melanie Kaimer

Web Security Test-Application

Penetrating Testing

Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML external entities (XEE) and cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

SQL Injection Vulnerability

With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.

SQL injection vulnerability is one of the most dangerous issue for confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list as one of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.

The practical part of this thesis deals with the SQL injection attack. Attackers are able to perform a series of actions when an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

bWAPP

The term bWAPP stands for buggy Web Applications. bWAPP belongs to the ITSEC-Games-Project and describes a deliberately extremely faulty web application. It was designed with the goal of ensuring IT security. Furthermore, it has a gaming character and should serve as a fun factor in addition to training.

OWASP Juice Shop

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a very short time.

Conclusion

Tools like bWAPP and OWASP Juice Shop are very instructive and interesting to playfully try out hacking tasks in different levels of difficulty. With the unstoppable development of technology and today's abundance of information it becomes more important to be well informed about the dangers from the World Wide Web. As various studies have shown, the choice of a password proven positive effects on the data security of users have.

For further information and the practical part see the link to my seminar paper.