Proceedings of the Third International Conference on Trends in Electronics and Informatics (ICOEI 2019)

IEEE Xplore Part Number: CFP19J32-ART; ISBN: 978-1-5386-9439-8

A Survey on Vulnerability Assessment & Penetration

Testing for Secure
Keyur Patel
Communication
Computer Engineering Dept., Marwadi University, Rajkot, Gujarat 360003
Email: [email protected]
Abstract – As the technology is growing rapidly, the Increased so it is very difficult to identify the weakness in the
development of systems and software are becoming more complex system. To stay secure the organizations have to
complex. For this reason, the security of software and web identify the maximum vulnerabilities and minimize the threats.
applications become more vulnerable. In the last two To do so they have to do Vulnerability Assessment and
decades, the use of internet application and security hacking Penetration Testing on a regular basis.
activities are on top of the glance. The organizations are VAPT is made up of two things Vulnerability Assessment
having the biggest challenge that how to secure their web (VA) and Penetration Testing (PT), both these techniques have
applications from the rapidly increasing cyber threats their own features and uniqueness. Vulnerability Assessment
because the organization can’t compromise the security of means to scan the system and identify the loopholes of the
their sensitive information. Vulnerability Assessment and system and generates a report of them. Penetration Testing
Penetration Testing techniques may help organizations to means it is a white box testing conducted by the organization to
find security loopholes. The weakness can be the asset for exploit the vulnerabilities identified in the vulnerability
the attacker if the organizations are not aware of this. assessment report.
Vulnerability Assessment and Penetration Testing helps an There are many vulnerability scanners available in the market
organization to cover the security loopholes and determine which can calculate the damage and threats which can be
their security arrangements are working as per defined occurred due to those vulnerabilities. It can also be identified
policies or not. To cover the tracks and mitigate the threats that what is the impact score of that vulnerability and what are
it is necessary to install security patches. This paper the possible solution available for the vulnerability. VAPT
includes the survey on the current vulnerabilities, techniques tests identify the flaws so that organizations can
determination of those vulnerabilities, the methodology decide the priority for the mitigation process. So we can say that
used for determination, tools used to determine the the combined packet of Vulnerability Assessment and
vulnerabilities to secure the organizations from cyber Penetration Testing gives the cleared path of existing
threat. weaknesses along with the risk associated with it.

In this paper, a survey has been presented over VAPT

Index Terms – Cross-site Scripting (XSS), SQL Injection, technique. Section 2, Types of vulnerabilities as per OWASP
Broken Authentication, Security Misconfiguration, Top 10 2017. Section 3. An overview of VAPT. Section 4,
Vulnerability Assessment and Penetration Testing (VAPT). Tools used for VAPT. Section 5, Conclusion.
.
2. TYPES OF VULNERABILITIES
1. INTRODUCTION

A s the significant use of internet and web application in the

Vulnerabilities are the security flaws and weaknesses that can
last two decades, there is a huge risk associated with be a threat to security risks which can cause damage to the
unauthorized access to the confidential data and the risk of system. There are a huge amount of vulnerabilities found on a
maintaining the integrity of the information. Day by day new daily basis. A survey found that minimum 30-40 vulnerabilities
exploitation and hacking activities are discovered. Therefore it found on a daily basis. The survey conducted by CVE details
is really necessary to identify the vulnerabilities and install the says that 14,600 vulnerabilities were reported in 2017,
security patches for those vulnerabilities. This activity becomes compared to 6447 in 2016[13]. Once the attacker has found a
the highest priority of organizations nowadays. potential threat or flow and determines the access of it, then he
To help organization for identifying their loopholes into the can be able to get unauthorized access to the system. Attackers
system the Vulnerability Assessment & Penetration Testing use specific tools and technologies to identify and analyse
(VAPT) techniques are used. It helps to determine the reliability
security weaknesses. Open Web Application Security Project
of the security arrangements, that they are effective against the
(OWASP), is the organization which gives the latest and
latest cyber threats or not. This technique helps to develop a
trending vulnerabilities related to web application [7]. Table1
secured mechanism which is able to identify the vulnerabilities
shows the Top 10 vulnerabilities declared by the OWASP in
[1].
2017 [3], with their common weakness enumeration (CWE)
The identification of the vulnerabilities into the system has
associated [2].
become a prime issue for an organization. With the growing
technology, the complexity of the systems is also being

978-1-5386-9439-8/19/$31.00 ©2019 IEEE 320

 Proceedings of the Third International Conference on Trends in Electronics and Informatics (ICOEI 2019)
IEEE Xplore Part Number: CFP19J32-ART; ISBN: 978-1-5386-9439-8

1) Persistent/Stored XSS: In this type of XSS attack the

TABLE 1 malicious string is already inserted into the application
OWASP TOP 10 VULNERABILITIES 2017
database. The string is previously accepted as the input
Vulnerability CWE Rank string like feedback text where the data is expected in
Injection CWE-1027 A1 text format.
Broken Authentication & 2) Reflected XSS: In this type of XSS attack the
CWE-1028 A2 malicious code is injected in the client request. So it is
Session Management
reflected when the webpage is loaded [8].
Sensitive Data Exposure CWE-1029 A3
XML External Entities CWE-1030 A4 3) DOM-based XSS: DOM-based refers to document
object model, generally it is a client-side attack where
Broken Access Control CWE-1031 A5
malicious string is inserted at client-side and response
Security Misconfiguration CWE-1032 A6
also arrives from the client-side code rather than
Cross-Site Scripting (XSS) CWE-1033 A7
server-side code [8].
Insecure Deserialization CWE-1034 A8
Using Components with B. SQL Injection:
CWE-1035 A9
known vulnerabilities
Insufficient Logging & SQL-Injection is an attack technique which tries to exploit the
CWE-1036 A10 database layer vulnerability of an application. To obtain
Monitoring
unauthorized access to the database of a system and understand
the schema of the database and included data within that,
As described in OWASP Top 10-2017 we will try to give a hackers are using this type of injection techniques. With the
brief introduction about current trending vulnerabilities like help of SQL-injection attacker can attach the malicious code to
Broken Authentication, SQL Injection, Sensitive Data an application and passed that code to the back-end database
Exposure, and Cross-Site Scripting [3]. and get access to it. This type of malicious code then executes
such types of queries which gives sensitive information to the
attacker which should not be disclosed.
Vulnerabilities To bypass the web application’s security mechanisms like
authentication and authorization and retrieve the contents of the
database, the attacker uses the SQL-Injection vulnerability.
Security SQL-Injection can also be used to modify the data with the help
Misconfiguration of INSERT, DELETE, ALTER queries to add, delete and
Sensitive Data modify the records of the database which affects the data
9% Exposure integrity. So, in general, we can say an SQL vulnerability can
6% 29% provide sensitive information with the help of unauthorized
XSS
12% access to an attacker. SQL Injection can be classified into three
major categories [11].
SQL

24% 20% 1) In-band SQL Injection: This is the most common and
Broken easiest way to exploit the SQL Injection vulnerability.
Authentication
In-band SQL Injection can be done when an attacker
Other Attacks uses the same channel to inject the malicious code and
get output within that only. There are two types of In-
band SQL Injections [8].
Fig.1 Survey On Current Vulnerability Scenario
Error-based SQL injection: This type of injection
A. Cross-Site Scripting:
relies on error messages thrown by the database server
Cross-Site Scripting (XSS) attacks are one type of injection
while obtaining information about the database
attack in which the malicious scripts are injected into the
website code. XSS attacks happen when an attacker makes use structure.
of web application to send the malicious code generally, it is in
the form of browser-side script. Generally, this type of attack Union-based SQL injection: This type of injection
can be done due to improper input validations. So an attacker relies on the UNION SQL operator to combine more
can insert malicious script into the application and can get than two SELECT statements into one result which is
access to the web application [4]. There are three types of then resultant part of the HTTP response.
Cross-Site Scripting attack:

978-1-5386-9439-8/19/$31.00 ©2019 IEEE 321

 Proceedings of the Third International Conference on Trends in Electronics and Informatics (ICOEI 2019)
IEEE Xplore Part Number: CFP19J32-ART; ISBN: 978-1-5386-9439-8

2) Inferential SQL Injection (Blind SQL Injection): In this Risks which are associated with it is cause privacy violation,
type of attack the attacker will not be able to see the identity theft and undermine authorization and accountability
result of an attack and no data is actually transferred via controls [12].
web application but the attacker is able to reconstruct
the database with the help of payloads from the D. Sensitive Data Exposure:
observation of the response came from the web As the name suggests, sensitive data exposure occurs when
the web application does not protect the information such as
application and the resulting behavior of the database.
passwords, payment information or health data and many more.
There are two types of Inferential SQL Injection [8].
As of now, attackers are very smart they can use this
information for further use or can sell the important information
Boolean-based Blind SQL Injection: In this type of of the organization to the dark web. They can access this
attack the database will be questioned with the TRUE information for their personal use and can violate the security
or FALSE statements and determines the answer based of the organization. Recent news in early 2019 that Bleeding of
on the application response. This attack is often used 773 Million User Credentials from the various attacks which
when the web application is configured to show the are really a big security breach is an example of sensitive data
generic messages, but the security of code from SQL exposure.
vulnerability is not being configured.
E. Security Misconfiguration:
Security Misconfiguration comes into the picture when the
Time-based Blind SQL Injection: This type of injection security of the application is used as default from where the
relies on the time means when the SQL query is sent to development of the application is done. If any kind of weakness
the database it forces the database to wait some amount is left at the time of the development then it can be exploited by
of time before responding to the request. The response the attacker and he might get unauthorized access to the system.
time will indicate the attacker that the query gives a Perfect security requires a secure configuration defined and
successful result or not. deployed for the application, web servers and other related
platforms. For security purpose, every organization should have
its own defined policies and according to that security, rules
Blind SQL injection is similar to normal SQL injection
should be created. Regular testing of the security should be
the only difference with this technique is how the data done and install updated security patches for preventing this
is retrieved. When the database is not giving proper type of attack.
output via web application we will try to obtain an
output with the help of TRUE or FALSE statements 3. OVERVIEW OF VAPT
which gives a more difficult and complex level of this
vulnerability but it isn’t impossible.
A. Vulnerability Assessment:
3) Out-of-band SQL Injections: This is an unusual type of A vulnerability assessment is a process of identifying the
injection because it depends on the features being security loopholes or vulnerabilities in the computer system,
allowed on the database server which is being used by network or web applications of organization with the necessary
the web application. It can be done when an attacker is knowledge, understanding of infrastructure and understanding
of the potential threats of the environment. After the whole
unable to use the same channel to trigger the attack and
assessment process is done a detailed report is generated which
get results.
can be further used for the penetration testing process [1].
C. Broken Authentication & Session Management:
Authentication & session management is a critical section of Advantage: Vulnerability Assessment is useful for providing
web application security. Flaws in this area can cause failure to the layer-one remediation process for the security of
protect the user credentials and session token used within one organizations. Also, it is helpful to do thousands of security
lifecycle. This flaws can lead to serious damage to the system checks in less time with the help of automation tools.
like overtaking of user or administrative accounts, privacy
violation and unexpected modification of credentials, Disadvantage: Vulnerability Assessment is unable to identify
undermine authorization and accountability controls. the logical attack vectors. Automated tools only generate the
Application functions related to authentication and session analysis according to policies defined by the tester, if anything
management are often not implemented correctly this can allow is left out then it might not be considered in the analysis. It can
the attacker to compromise user credentials, the key for generate some unnecessary data with some false positive
encryption-decryption or session tokens or the sensitive including in it
information which can reveal the user identity.

978-1-5386-9439-8/19/$31.00 ©2019 IEEE 322

 Proceedings of the Third International Conference on Trends in Electronics and Informatics (ICOEI 2019)
IEEE Xplore Part Number: CFP19J32-ART; ISBN: 978-1-5386-9439-8

1) A detailed view of potential threats and risks faced by

an application can be provided.
2) Identify the security errors which is left while the
creation of the application which leads to cyber-
attacks.
3) Provides risk management and also a perfect security
model for the organization.
4) Provides security to business against the loss of money
and reputation.
5) Secure application from internal and external attacks
and protects the organization from the various
malicious attacks.

4. VAPT TOOLS
There are bunch of tools available for the VAPT technique.
Each tool has its own different functionality. Let us list out
some the tools and its functionality [5].

A. NMAP: Network Mapper, an open source and freely

available tool to determine hosts and services running on it. It
can work with any operating system, so we can say it is a cross-
platform tool.

B. Nessus: Nessus is a commercial tool and widely used by the

organization. It is a vulnerability assessment tool which is used
for scanning network systems and web applications. Nessus
gives a full detailed report according to user-defined policies.
Fig.2 VAPT Process Diagram Nessus is the product of Tenable Community which updates
their security plugins regularly.
B. Penetration Testing:
Penetration Testing is a technique in which tester tries to C. Burp Suite: Burp Suite is a tool used for web application
exploit the vulnerabilities of computer systems, network or web testing. Burp Suite is available as both freeware and
applications which are being found in the vulnerability commercial version. It is used for intercept ongoing requests
assessment phase. It is also known as Ethical Hacking. By and manipulates the requests and responses. Attacks like brute
performing Penetration Testing the tester came to know which force can be done with the help of Burp Suite.
vulnerabilities actually are there in the system and which are the
false positives [1]. D. Accuentix: Accuentix is a commercial tool like Nessus. It is
used for identifying the vulnerabilities in web applications. It is
Advantages: It helps to remove false positives from all the layer available for both operating system, windows and Linux as
of the security model. It helps in analysing the vulnerabilities in well. The key feature of this tool can support a single page
detail and according to that generates the impact score of the application as well [10].
vulnerabilities. Mitigating the unnecessary controls taken into
the account and helps in designing the perfect security model. E. Metasploit: Metasploit is the most popular and advanced tool
made for penetration testing. It contains lots of payloads and
Disadvantages: Requires more time to execute the whole exploits for the testing purpose. It is a CLI based tool and also
process. The guaranteed output of vulnerability is not available. available in GUI based tool named as ‘Armitage’. It works on
Requires a high cost because the dedicated team and specialized web applications, mobile phones, computers, servers etc. It is
person should require to do the process. also available as a commercial tool.
C. Benefits of VAPT: F. The Harvester: The Harvester is used for information
The combined process of VAPT is very effective for identifying gathering in the vulnerability assessment phase. It can help to
the security loopholes into the system. VAPT offers many gather information like email-ids, usernames, hostnames,
benefits for the organizations which are listed below: subdomains etc. It is a very effective tool while testing email
security. It tool can be used for spear phishing.

978-1-5386-9439-8/19/$31.00 ©2019 IEEE 323

 Proceedings of the Third International Conference on Trends in Electronics and Informatics (ICOEI 2019)
IEEE Xplore Part Number: CFP19J32-ART; ISBN: 978-1-5386-9439-8

6. CONCLUSION
G. Wireshark: Wireshark is used when it comes to network
Potential Threats to integrity and confidentiality of the
security. It is used to analyse all the network layer traffic and
sensitive data and the organization’s resources are increased too
packet so it is known as a packet sniffer. It is a freeware and
much. To safeguards from cyber-attacks, organizations perform
inbuilt tool in operating systems like kali, Backtrack, and Parrot
VAPT to check the security of the system architecture as per
OS. It is a Cross-Platform network protocol analyser. Its
the designed security model. As we have listed some of the
original name was Ethereal [9].
VAPT tools which are used to identify the vulnerabilities into
the system. The smart attackers are finding new ways to bypass
H. Zed Attack Proxy (ZAP): ZAP is developed by the
the security of the applications so day by day new
organization called Open Web Application Security Project
vulnerabilities are added into the list which should be addressed
(OWASP). It is freeware and inbuilt in operating systems like
into the organization’s security model so we can mitigate the
Kali and Parrot. It is only designed to scan web applications. It
risk of attack from those vulnerabilities. Regularly updating
includes features like proxy intercepting, scanning and spider
security policies and mechanism of the security model may
to crawl all the pages of web applications.
decrease the chances of being exploited from the evolved
vulnerabilities. To make VAPT results meaningful it must be
I. Beef: Beef stands for “The Browser Exploitation
prioritized and explain with CVE numbers which can be
Framework”. It used for penetration testing based on browsers
utilized from the industry standard references like national
vulnerabilities. It is a freeware tool. It helps to identify the
vulnerability database(NVD), common vulnerability scoring
zombie browsers in real time with their vulnerabilities. Provides
system(CVSS), open source vulnerability database(OSVDB),
a command and control interface which helps us to control an
CVE details etc. [1]
individual as well as a group of victims.

J. SQLMAP: SQLMAP is again an open-source tool used for

the purpose of penetration testing. SQLMAP identifies and REFERENCES
detects the vulnerabilities available in SQL databases. This tool [1] Shinde, P. and Ardhapurkar, S. (2016). Cyber security
is so powerful that it can give all the information which is stored analysis using vulnerability assessment and
in the SQL database. It is a CLI-based tool available for all the penetration testing. 2016 World Conference on
operating systems. Futuristic Trends in Research and Innovation for
Social Welfare (Startup Conclave).
5. PREVENTIVE MEASURES AGAINST OWASP TOP 10
[2] Cwe.mitre.org. (2019). CWE -Common Weakness
1) For Injection, It is easy to identify the injection flaws while Enumeration. [online] Available at:
doing application security testing. Developers can use input https://cwe.mitre.org/ [Accessed 15 Mar. 2019].
validations and parameterized queries to safeguards from this [3] Owasp.org. (2019). Top 10-2017 Top 10 - OWASP.
vulnerability. [online] Available at:
2) For Broken Authentication & Session management, the best https://www.owasp.org/index.php/Top_10-
way is to use multifactor authentication which can provide more
2017_Top_10 [Accessed 15 Mar. 2019].
security to identify the authorized user.
[4] Pranathi, K., Kranthi, S., Srisaila, A. and
3) For Sensitive Date Exposure, Encryption of data at rest and
transit can decrease the risk of exploitation. Madhavilatha, P. (2018). Attacks on Web Application
4) For XML External Entity, Similar to injection technique the Caused by Cross Site Scripting. 2018 Second
developer can identify it while application security tests. Proper International Conference on Electronics,
security test cases and input validations can do work. Communication and Aerospace Technology (ICECA).
5) For Broken Access Control, Try more and more penetration [5] Shebli, H. and Beheshti, B. (2018). A study on
technique to achieve all the loopholes. penetration testing process and tools. 2018 IEEE Long
6) For Security Misconfiguration, Dynamic Application Island Systems, Applications and Technology
security testing can detect the misconfigured APIs, code etc. Conference (LISAT).
7) For Cross-Site Scripting, Best coding techniques like [6] Taha, T. and Karabatak, M. (2018). A proposed
encoding, input validation, inbound/outbound input handling, approach for preventing cross-site scripting. 2018 6th
and content filtering can do the job [6]. International Symposium on Digital Forensic and
8) For Insecure Deserialization, Regular penetration testing and
Security (ISDFS).
application testing is needed to validate the problem.
9) For Using Components with Known Vulnerabilities, [7] Hasan, A., Meva, D., Roy, A. and Doshi, J. (2017).
Analysis of software infrastructure with static analysis Perusal of web application security approach. 2017
technique can detect insecure versions of the component. International Conference on Intelligent
10) For Insufficient Logging & Monitoring, Examine all the Communication and Computational Techniques
logs and try to be as an attacker while doing pen testing to do (ICCT).
sufficient monitoring.

978-1-5386-9439-8/19/$31.00 ©2019 IEEE 324

 Proceedings of the Third International Conference on Trends in Electronics and Informatics (ICOEI 2019)
IEEE Xplore Part Number: CFP19J32-ART; ISBN: 978-1-5386-9439-8

[8] Nagpure, S. and Kurkure, S. (2017). Vulnerability

Assessment and Penetration Testing of Web
Application. 2017 International Conference on
Computing, Communication, Control and Automation
(ICCUBEA).
[9] Sandhya, S., Purkayastha, S., Joshua, E. and Deep, A.
(2017). Assessment of website security by penetration
testing using Wireshark. 2017 4th International
Conference on Advanced Computing and
Communication Systems (ICACCS).
[10] Kadam, S., Mahajan, B., Patanwala, M., Sanas, P. and
Vidyarthi, S. (2016). Automated Wi-Fi penetration
testing. 2016 International Conference on Electrical,
Electronics, and Optimization Techniques (ICEEOT).
[11] Abirami, J., Devakunchari, R. and Valliyammai, C.
(2015). A top web security vulnerability SQL injection
attack — Survey. 2015 Seventh International
Conference on Advanced Computing (ICoAC).
[12] Al-Khurafi, O. and Al-Ahmad, M. (2015). Survey of
Web Application Vulnerability Attacks. 2015 4th
International Conference on Advanced Computer
Science Applications and Technologies (ACSAT).
[13] Cvedetails.com. (2019). CVE security vulnerability
database. Security vulnerabilities, exploits, references
and more. [online] Available at:
https://www.cvedetails.com/ [Accessed 17 Mar.
2019].

978-1-5386-9439-8/19/$31.00 ©2019 IEEE 325