GIS SCIENCE JOURNAL ISSN NO : 1869-9391

A Review on Security & Threats of Web

Application
Akhil Goplani
Department of Computer Engineering, Bharati Vidyapeeth’s College of Engineering, Lavale
Pune, Maharashtra, India
Email: [email protected]

Shubit Mattoo
Department of Computer Engineering, Bharati Vidyapeeth’s College of Engineering, Lavale
Pune, Maharashtra, India
Email: [email protected]

Shashank Kumar Gupta

Department of Computer Engineering, Bharati Vidyapeeth’s College of Engineering, Lavale
Pune, Maharashtra, India
Email: [email protected]

Darshan Amrutkar
Department of Computer Engineering, Bharati Vidyapeeth’s College of Engineering, Lavale
Pune, Maharashtra, India
Email: [email protected]

Prof. Yogesh Kadam

Department of Computer Engineering, Bharati Vidyapeeth’s College of Engineering, Lavale
Pune, Maharashtra, India
Email: [email protected]

Abstract— Web security is a critical aspect of online security, as more and more users rely on web applications to conduct business,
share information, and communicate with others. The increasing complexity and sophistication of web attacks, such as injection attacks and
cross-site scripting, have made it essential for organizations to take proactive measures to protect their web applications and users from potential
security breaches.
Keywords- Web Security, Threats, Attacks, Injection Attacks, SQL Injection, Brute Force Attack, Access Control Issues, IP Spoofing, Cross
Site Scripting, Insufficient Input Validation..
Web security is an ongoing process, and it requires continuous
I. INTRODUCTION monitoring and updating to keep pace with evolving threats and
attacks. By implementing strong web security measures,
Web security refers to the measures taken to protect websites organizations can help protect their web applications and users
and web applications from security threats and attacks. As more from potential security breaches and data loss.
and more information is shared and transactions are conducted
online, web security has become increasingly important.
II. THREATS & ATTACKS – ACCESS CONTROL
Some common web security threats include cross-site scripting THREAT
(XSS), injection attacks such as SQL injection, brute force,
access control issues. Access control is a security measure that is implemented to
restrict access to resources such as files, directories, databases,
Web security can be enhanced through a variety of techniques, or systems, to authorized individuals or entities. Access control
including secure coding practices, implementing access control, is an important aspect of information security as it helps prevent
and using encryption technologies such as SSL/TLS to protect unauthorized access to sensitive information and resources.
data in transit. Additionally, regular security testing and audits
can help identify and address vulnerabilities in web
applications.

VOLUME 10, ISSUE 5, 2023 PAGE NO: 1494

GIS SCIENCE JOURNAL ISSN NO : 1869-9391

Access control can be implemented using various techniques, To prevent insufficient input validation, web applications
such as: should implement strong input validation measures. This
includes validating the format, type, and length of user input, as
1. Role-based access control (RBAC): In RBAC, access well as implementing input sanitization techniques to remove
to resources is granted based on the role or any potentially malicious content. Input validation should also
responsibility of the user. Users are assigned roles be performed on both the client-side and server-side of the
based on their job function, and access is granted based application, as client-side validation can be bypassed by
on the permissions associated with their roles. attackers.

2. Mandatory access control (MAC): In MAC, access to Regular security testing and auditing can also help identify and
resources is granted based on a set of rules that are address insufficient input validation vulnerabilities in web
predefined by the system administrator. These rules applications. By implementing these measures, organizations
are usually based on the security classification of the can help prevent malicious attacks that exploit this common
resource and the user's clearance level. security vulnerability.

3. Discretionary access control (DAC): In DAC, access Prevention of Input Validation

to resources is granted based on the discretion of the Insufficient input validation is a common vulnerability that can
owner of the resource. The owner of the resource allow attackers to inject malicious input into a web application,
decides who is granted access and what level of access potentially leading to data breaches, unauthorized access, and
is granted. other security risks. Here are some steps you can take to prevent
insufficient input validations:
4. Attribute-based access control (ABAC): In ABAC,
access to resources is granted based on the attributes 1. Implement Server-Side Validation: Server-side
of the user, resource, and environment. These validation involves validating user input on the server
attributes are evaluated by a policy engine to side, rather than relying solely on client-side
determine if access should be granted. validation. Server-side validation can help prevent
attackers from bypassing client-side validation and
Access control is a critical security measure that should be injecting malicious input directly into the server.
implemented in all information systems. It helps prevent
unauthorized access to sensitive information and resources, and 2. Validate Input Format and Type: It is important to
ensures that only authorized users can access and modify data. validate the format and type of user input to ensure that
it matches the expected format and type. For example,
you can validate email addresses to ensure that they
III. THREATS & ATTACKS – INSUFFICIENT INPUT include an "@" symbol and a domain name, or validate
VALIDATION THREAT numeric input to ensure that it only contains numbers.

Insufficient input validation is a common security vulnerability 3. Implement Input Sanitization: Input sanitization
in web applications. It occurs when an application fails to involves filtering user input to remove any potentially
properly validate user input, which can allow attackers to inject malicious content, such as HTML tags or SQL
malicious data into the application. This can result in a variety statements. This can help prevent attackers from
of attacks, including SQL injection, cross-site scripting (XSS), injecting malicious code into your web application.
and command injection.
4. Set Limits on Input Length: Setting limits on input
For example, if a web application fails to validate user input on length can help prevent buffer overflow attacks and
a form field, an attacker could enter malicious code, such as other types of input-based attacks. By limiting the
SQL statements or JavaScript, which could then be executed by amount of input that can be accepted, you can reduce
the application. This could lead to unauthorized access to the the risk of attackers injecting large amounts of
application's database or the theft of sensitive user data. malicious code into your web application.

VOLUME 10, ISSUE 5, 2023 PAGE NO: 1495

GIS SCIENCE JOURNAL ISSN NO : 1869-9391

5. Use Libraries and Frameworks: Using libraries and The attacker typically uses automated software or scripts to
frameworks can help ensure that your web application generate and test thousands or millions of possible passwords
is built with security in mind. Many libraries and in a short amount of time. The success of a brute force attack
frameworks include built-in input validation and depends on the strength of the password or encryption key
sanitization functionality, which can help prevent being targeted, as well as the computational resources available
insufficient input validations. to the attacker.

There are several techniques that can be used to defend against

By implementing these steps, you can help prevent insufficient brute force attacks, including:
input validations and ensure that your web application is secure
against this common type of vulnerability. It is also important 1. Strong passwords: Strong passwords that are long,
to regularly test and audit your web application for security complex, and include a combination of uppercase and
vulnerabilities, and to promptly address any vulnerabilities that lowercase letters, numbers, and special characters can
are identified. make it more difficult for attackers to crack them.

IV. THREATS & ATTACKS – BRUTE FORCE 2. Password policies: Enforcing password policies that
ATTACK require users to change their passwords periodically,
use unique passwords for different accounts, and
Brute force attacks are a type of cyber-attack in which an prohibit the use of common or easily guessable
attacker uses automated software or scripts to try every possible passwords can also help.
combination of characters until the correct password or
encryption key is found. These attacks are a popular method for 3. Account lockout: Implementing account lockout
hackers to gain unauthorized access to web applications, policies that temporarily lock out users after a certain
databases, and other sensitive systems. number of failed login attempts can prevent brute
force attacks.
To carry out a brute force attack, attackers use software that
generates and tests a large number of passwords or encryption 4. Rate limiting: Limiting the number of login attempts
keys in a short amount of time. The success of the attack that can be made within a certain time frame can also
depends on the strength of the password or encryption key help to prevent brute force attacks.
being targeted and the computing power available to the
attacker. 5. Two-factor authentication: Using two-factor
authentication, such as a one-time code sent to a user's
There are several techniques that can be used to defend against phone, can add an additional layer of security to
brute force attacks. These include enforcing strong password prevent brute force attacks.
policies, implementing account lockout policies, limiting the
number of login attempts, and using two-factor authentication. Overall, protecting against brute force attacks requires a
By combining these measures, web applications can reduce the combination of technical and human measures to ensure that
risk of successful brute force attacks and protect user data from passwords and encryption keys are strong and secure, and that
unauthorized access. users are aware of best practices for creating and managing
passwords.
In addition to technical measures, user education is also
important in preventing brute force attacks. Users should be V. THREATS & ATTACKS – IP SPOOFING
encouraged to use strong passwords and to avoid using the same ATTACK
password for multiple accounts. They should also be educated
about the risks of brute force attacks and how to identify and IP spoofing is a technique used by attackers to deceive network
report suspicious login attempts. By working together, web systems by changing the source IP address of a packet to hide
developers and users can help protect against brute force attacks their true identity or to impersonate another system. It is a
and maintain the security of web applications. common method used in DDoS attacks and other network-
based attacks.
Prevention

VOLUME 10, ISSUE 5, 2023 PAGE NO: 1496

GIS SCIENCE JOURNAL ISSN NO : 1869-9391

In IP spoofing, the attacker modifies the source IP address of 4. Deploying anti-spoofing technology: Several anti-
the packet header to make it appear as if the packet originated spoofing technologies are available, such as reverse
from a different system or location. This can be done using path forwarding (RPF) and unicast reverse path
various tools and techniques, such as packet generators or forwarding (uRPF). These technologies verify the
custom software. source IP address of incoming packets and filter out
packets with invalid source addresses.
The main goal of IP spoofing is to bypass security measures that
rely on the source IP address for authentication or access 5. Educating users: Finally, it's important to educate
control. For example, an attacker could use IP spoofing to users about the risks of IP spoofing and how to identify
bypass firewalls, intrusion detection systems, and other security and report suspicious network activity. This can help
measures that rely on IP address verification. prevent insider threats and social engineering attacks
that may be used to circumvent network security
To prevent IP spoofing, various techniques can be employed, measures.
such as filtering packets that originate from outside the
network, implementing ingress filtering at the network edge, By implementing these techniques, organizations can
and using cryptographic authentication mechanisms such as significantly reduce the risk of IP spoofing and ensure the
IPsec. Network administrators can also monitor network traffic integrity and security of their networks.
and analyze patterns to detect potential spoofing attacks and
take appropriate action. VI. THREATS & ATTACKS – CROSS-SITE
SCRIPTING
Overall, IP spoofing is a serious threat to network security, and
it is essential for organizations to implement effective security Cross-site scripting (XSS) is a type of web security
measures to prevent and detect such attacks. vulnerability that allows attackers to inject malicious code into
web pages viewed by other users. The attack occurs when an
Prevention attacker injects malicious code, typically in the form of a script,
There are several techniques that can be used to prevent IP into a web page viewed by a victim. The injected code is then
spoofing, including: executed by the victim's web browser, which can lead to a range
of malicious actions, such as stealing sensitive information,
1. Filtering packets: One of the most effective ways to hijacking user sessions, and redirecting users to phishing sites.
prevent IP spoofing is to filter packets that originate
from outside the network. This can be done by XSS attacks can be classified into two main types: stored and
implementing ingress filtering at the network edge, reflected. In stored XSS, the malicious code is injected into a
which examines incoming packets and filters out those web application and stored on the server, where it can be viewed
with source IP addresses that do not belong to the by multiple users. In reflected XSS, the malicious code is
network. reflected back to the user in the response from the web server,
typically as part of a search query or other user input.
2. Using cryptographic authentication: Another approach
to preventing IP spoofing is to use cryptographic To prevent XSS attacks, web developers can implement several
authentication mechanisms such as IPsec. IPsec security measures, such as:
provides data integrity, confidentiality, and
authenticity by encrypting network traffic and 1. Input validation: Validating user input and filtering out
verifying the identity of the sender. malicious code can prevent most XSS attacks. This
can be done using input validation techniques such as
3. Implementing network segmentation: Network input sanitization and input encoding.
segmentation can help prevent IP spoofing by dividing
the network into smaller, isolated subnets and 2. Output encoding: Encoding output before sending it to
enforcing strict access control policies. This limits the the user's browser can help prevent reflected XSS
scope of potential attacks and makes it harder for attacks. This involves converting characters that have
attackers to spoof IP addresses. special meaning in HTML or JavaScript into their
equivalent safe representation.

VOLUME 10, ISSUE 5, 2023 PAGE NO: 1497

GIS SCIENCE JOURNAL ISSN NO : 1869-9391

3. Content Security Policy (CSP): Implementing a CSP

can help prevent both stored and reflected XSS attacks
by specifying which content sources are allowed to be
loaded on a web page.
4. Cookie security: Implementing secure cookie policies,
such as HttpOnly and Secure flags, can help prevent
session hijacking attacks that rely on stealing cookies.

5. By implementing these security measures, web

developers can significantly reduce the risk of XSS
attacks and ensure the security and integrity of their
web applications.

VIII. REFERENCES

1. OWASP (Open Web Application Security Project) -

https://owasp.org/
2. NIST (National Institute of Standards and
Technology) -
https://www.nist.gov/topics/cybersecurity
3. CERT (Computer Emergency Response Team) -
https://www.cert.org/
4. SANS (SysAdmin, Audit, Network, Security) Institute
- https://www.sans.org/
5. WASC (Web Application Security Consortium) -
http://www.webappsec.org/
6. CSIS (Center for Strategic and International Studies) -
https://www.csis.org/
7. WhiteHat Security - https://www.whitehatsec.com/

VOLUME 10, ISSUE 5, 2023 PAGE NO: 1498