See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/363891246

Vulnerability Management System

Article · September 2022

CITATIONS READS

2 2,103

2 authors:

Prachita Kharat Pramila M. Chawan

University of Mumbai Veermata Jijabai Technological Institute
9 PUBLICATIONS 75 CITATIONS 194 PUBLICATIONS 879 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Pramila M. Chawan on 28 September 2022.

The user has requested enhancement of the downloaded file.

 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 09 Issue: 09 | Sep 2022 www.irjet.net p-ISSN: 2395-0072

Vulnerability Management System

Pravin P. Kharat1, Prof. Pramila M. Chawan2
1M. Tech Student, Dept of Computer Engineering and IT, VJTI College, Mumbai, Maharashtra, India
2Associate Professor, Dept of Computer Engineering and IT, VJTI College, Mumbai, Maharashtra, India

---------------------------------------------------------------------***---------------------------------------------------------------------
Abstract - In simple terms, a vulnerability in cyber security To avoid such situations manual testing, security audits, or
refers to any fault or flaw, or weakness in an information code inspections are to be performed by highly skilled cyber
system, internal controls, or system processes of an security engineers or experts. But as it is labour intensive
organization. It can also be defined as a flaw or a fault in the and expensive and prone to errors; automating the above
source code design which determines the application steps to discover respective vulnerabilities for the software
malfunctions. Therefore, a good Vulnerability Management applications is required.
plan should be implemented to avoid attacks on the system or
to minimize the damages produced by a cyberattack. To avoid 1.1 Software Vulnerabilities
such damages manual source code inspections or security
audits are performed, which requires highly trained cyber An error or a flaw or a weakness of the application's
security engineers, and it requires more time, which is prone to source code that an attacker or a hacker can take advantage
errors. For this reason, there is a need to automate such of is known as software vulnerability. These errors tend to
processes to discover vulnerabilities. This results in the make the system function abnormally and undesirable
implementation of the Vulnerability Management System, actions. These flaws or errors in code may arise due to the
which will automate security testing for the identification of lack of knowledge of the developer or programmer who is
vulnerabilities caused in the software products. developing the software application. These flaws may lead to
system crashes, loss of data, reputational damage, major
damage to the targeted system, loss of customers, personal
Key Words: Vulnerability, Vulnerability Management data being exposed, etc.
System, Algorithm, Software testing, Web based
application.
1.2 Types of Vulnerabilities
1.INTRODUCTION The common security goals i.e., confidentiality, availability,
integrity, non-repudiation, and usability, can be affected by
Many organizations have embraced the technologies such as the software vulnerabilities.
software applications, web applications, software products,
and many more to explore their new business opportunities Following listed below are cyberattacks associated with
and few organizations are being forced to adopt e-commerce software vulnerabilities:
due to advancements in software technologies, customers, or
competitors. Software applications and web applications Phishing: Phishing is a cyberattack that attempts to steal
have been gaining popularity day by day, and these sensitive information. This sensitive information can be login
applications come up with different components which are credentials and credit card details. This attack can also be a
highly complex and written by different software developers form of social engineering where an attacker tries to mislead
in different smaller chunks. Most of these applications fail to the user into clicking a malicious link created by the attacker,
give proper output due to untreated cases or flaws. downloading some malicious attachments, or revealing
Therefore, the software application or Operating system sensitive data.
which contains untreated cases, flaws, or weaknesses are
known as software vulnerabilities. Later, the flaws in the DDoS Attacks: Distributed denial of service attack is an
source code of the application can be exemplified as an entry attempt to spoil an online service or a website or a server or
point for the hacker and can be treated as a software network by making it unavailable by sending many access
vulnerability. requests that it cannot manage.
Despite all the security measures, the number of Computer Viruses: Computer code or a program that
vulnerabilities discovered continues to grow as the number modifies the way a computer behaves is known as Viruses.
of users using the internet has increased. Any device which They are meant to spread through contaminated data, files,
contains software functions can tend to have source code and insecure networks. And once it enters the system, it can
errors, logical errors, and flaws. Thus, the existence of replicate and spread from one program to another and infect
detection techniques is mandatory for software vulnerability other computer systems also.
remediation as well as prevention.
© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page 1
 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 09 Issue: 09 | Sep 2022 www.irjet.net p-ISSN: 2395-0072

Attack Vectors: Attack vector is a malicious term used to Jan-Min Chen.[6] In this paper, the author has implemented
discover system vulnerability points, launch cyberattacks or an automated vulnerability scanner that identifies the
install malicious software. Following are the four important injection attack vulnerabilities. This system automatically
attack vectors: Drive-by, Zero-day attack, MITM (man in the examines the website to find the XSS and SQL injection
middle), SQL Injection. vulnerabilities. The proposed system also uses NVD i.e.,
National Vulnerability Database.
Vulnerability Management System is not only intended to Andrey Fedorchenko.[7] In this research paper, the author
identify and evaluate vulnerability, but it will also generate a has proposed the process of integrating a vulnerability
detail report which will report of the vulnerability point database system. This integrated database can be used for the
found in the software application which will be tested. further application of security systems. In this paper, the
structure of the vulnerabilities database is suggested, and the
2. LITERATURE REVIEW process of vulnerabilities database generation is suggested.

In this section summarization of the existing research work is 3. PROPOSED SYSTEM

done. A new vulnerable management system will be created
based on the existing work with additional functionality. 3.1 Problem Statement
Mădălina Aldea.[1] The author in this paper has introduced a
new vulnerability management system i.e., SV – IMS – To develop a Vulnerability Management System (VMS) which
Software Vulnerability Integrated Management System. This will detect vulnerability using source code and Binary code
system can perform security tests to detect software analysis of the software product and also analyze the
vulnerabilities and the result of this test can be viewed upon intensity of the vulnerability found.
a dedicated platform. It also gives defines the CVSS i.e.,
Common Vulnerability Scoring System, which is an 3.2 Proposed Methodology
international scoring system that describes how severe a
vulnerability is. A hybrid algorithm is developed which automates the
Robert A. Martin.[2] The author in this research paper process of scanning software applications. The major goal of
describes Common Vulnerability Exposure (CVE) and Open the proposed algorithm is to automate and increase the
Vulnerability Assessment Language (OVAL) which are a pair accuracy of vulnerability detection. Although the accuracy is
of international, community-based efforts amongst industry, not achieved at 100% but an effort is made to put up the
government, and academia. Where CVE is aimed to create a proposed system above the existing systems. The proposed
means for making vulnerability alerts more applicable to hybrid algorithm is similar to the existing algorithms. The
individual enterprises and OVAL is aimed to provide the OWASP results are considered with the output for better
means for standardized vulnerability assessment and result reasoning and understanding. OWASP results are updated on
in uniform and standardized information assurance the regular basis to avoid any inconvenience.
parameters for systems.
GeonLyang Kim.[3] The author of this research paper has The proposed system’s hybrid algorithm is mainly based on
introduced a new method for constructing and managing the concept of combining different features which are of
Vulnerabilities by creating a vulnerability database. In this different components. This will result in the new algorithm
research work, a new National Vulnerability Database (NDV) which will give more impactful results on the respective
system is created which can be used by various enterprises. scans. Therefore, the combination of such features from
While referring a new vulnerability found can also be different components has been done based on optimization
registered in the NVD system. and sophistication among other components with the goal of
increasing the accuracy or efficiency of the hybrid algorithm.
Manoj Kumar.[4] In this author proposed a framework that
uses a knowledge base and inference engine. Using this the
The Hybrid algorithm mainly consists of five phases i.e.,
vulnerability management automatically takes required
actions, classifies, prioritizes, and mitigates the vulnerability. Inspection, Scanning, Attack Detection, Analysis, and
The proposed system reduces the threats, security risks, and Reporting. The inspection which can also be called crawling,
reputational and Monterey loss. mainly focuses on fetching information about the
application. The more information gathered in this phase the
Chee-Wooi Ten.[5] This Author has proposed a Vulnerability more successful the entire executed scan will be. After phase
assessment framework that evaluates the vulnerability of the 1, phase 2 consists of scanning. Scanning is the process in
SCADA system. This is done at three levels – System, which the algorithm will identify the weakness of the system
Scenarios, and access points. This framework is based on the on which the scan is been initiated. Once the scanning
system which has firewall and password models. This
process is completed, the next step will be to identify the
proposed framework also evaluates the impact of the attack
attacks or vulnerabilities and perform an analysis to identify
launched and countermeasures are identified for
improvement of cyber security. the vulnerability definition and remediation methods. Later

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page 2
 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 09 Issue: 09 | Sep 2022 www.irjet.net p-ISSN: 2395-0072

Reporting phase is initiated to generate a well informative The initial stage according to the phase diagram is inspection
report for the scan which was performed. which can be called as requirement or information gathering
stage. After phase 1, the next process involves mainly
crawling and parsing, and identifying new vulnerabilities.
Phase 2 is repeated until all the vulnerabilities of the
applications are not discovered. A further step includes
analysis of the vulnerabilities found to identify proper
definitions according to the OWASP and getting proper
remediation for the same. Further, this analysis is
summarized, and the final report is generated as an end
result.

Input: Input is mainly provided by the user who is going to

initiate the scanning. This input can be an IP address or the
URL for the application which needs to be scanned by the
VMS.
Processing: This step mainly involves fuzzing, crawling the
pages, and identifying the weakness, and later vulnerabilities
are identified based on the weaknesses identified.
Output: Output will be generated after the proper analysis
process is done.
Fig -1: Component of VMS

A detailed description of the flow for the developed Hybrid

algorithm:

Fig -3: Flowchart for XSS

Many different scanning methods are used in VMS algorithm,

considering one following method is used for Cross Site
Fig -2: Flowchart for VMS
Scripting:

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page 3
 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 09 Issue: 09 | Sep 2022 www.irjet.net p-ISSN: 2395-0072

1. For each URL in the list of the visited URLs 6. Nikto:

a) Identify all parameters Nikto is a free command-line vulnerability scanner that looks
b) Push the parameters in the list. for unsafe files/CGIs, out-of-date server software, and other
c) For each of the parameter in the list issues on web servers. Checks are run on both generic and
i) give input as a XSS test case or script to the server-specific levels. Any cookies that are received are also
parameter and pass the request. recorded and printed. The data files used by Nikto to run the
ii) verify the respective response program are not free software, but the Nikto code itself is.
2. Report the Vulnerability Nikto can identify more than 6700 potentially harmful files
and CGIs, as well as version-specific issues on more than 270
3.3 Tools servers and obsolete versions on more than 1250 servers.
Nikto can also identify installed web servers and software
These experiments or practical were performed by running and checks for server configuration elements.
different methods/tool with its respective scripts. These
methods were installed and executed on Virtual machine and 7. Dnsmap:
have the similar configurations and resources. Dnsmap uses an internal or external wordlist to search a
domain for common subdomains (if specified using -w
1. Nmap: option). There are about 1000 words in both English and
For probing computer networks, Nmap offers several Spanish on the internal wordlist, including ns1, firewall
functions, including host discovery, service detection, and services, and smtp. Therefore, an automatic search for
operating system detection. Scripts that offer more smtp.example.com within example.com will be available. For
sophisticated service discovery, vulnerability detection, and additional processing, results can be saved in CSV and
other features can extend these features. During a scan, human-readable formats. Dnsmap should not be executed
Nmap can adjust to changing network conditions, such as with root privileges for security reasons because it does not
latency and congestion. need them to function.

2. Dirbuster: 9. Uniscan:
DirBuster is an application with a GUI interface developed in An open-source program called Uniscan can check web
Java. It is used to find concealed files and directories by applications for serious flaws including cross-site scripting,
brute-forcing files & directories with the aim of gaining some blind SQL injection, remote file inclusion, web shell
significant information that could help in cyber-attacks. A vulnerabilities, and hidden backdoors, among others. In
wordlist could influence how effective such a tool is; the addition to assessing vulnerabilities, Uniscan has the ability
more effective the wordlist, the more effective the to search Google and Bing for domains using shared IP
instrument. addresses.

3. Xsser: 3.4 Resources required for the VMS tool

Cross-Site "Scripter" (also known as XSSer) is an automatic
framework for finding, using and reporting XSS flaws in web- Operating System: Kali Linux or Ubuntu OS or System
based applications. There are numerous ways to attempt to configured with Virtual Machine with same OS. The system
get around particular filters, as well as numerous unique and virtual machines specifications are as - processor, 2.6
code injection strategies. GHZ Core i5, 2 GB RAM, 100 GB HDD and OS as above
mentioned.
4. Dnswalk:
A DNS (Domain Name System) debugger is called Dnswalk. 4. RESULTS AND DISCUSSION
Dnswalk carries out zone transfers for specified domains
and executes precise database integrity checks in a variety of
ways.

5. whois:
A query and response protocol i.e., WHOIS, which is
pronounced "who is," is frequently used for accessing
databases that list the registered users or assignees of
Internet resources like domain names, blocks of IP Fig -4: Screenshot for web app of VMS tool
addresses, and autonomous systems. On most UNIX
systems, the command-line utility used to do WHOIS
protocol searches is called whois. Additionally, Referral
Whois is a sibling protocol of WHOIS (RWhois).

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page 4
 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 09 Issue: 09 | Sep 2022 www.irjet.net p-ISSN: 2395-0072

ii) Improve Analysis and Reporting:

VMS algorithms need to improve the accuracy so that the
identified vulnerability can be stated with the severity level.
To obtain high-end accuracy more sophisticated methods
must be used during the scanning process which will require
more research and practical implementation of the
algorithm. VMS system can be upgraded for analysis and
reporting in such a way that the vulnerabilities can be
visualized and can be shown in a representable manner with
the severity levels.
Fig -5: Screenshot of VMS URL input
iii) Reducing scanning time:
There need to be proper results which is generated in short
time frame with better accuracy and reporting. It needs to
improve overall scanning method using more scripts and
identification of more vulnerabilities.
Fig -6: Screenshot of VMS tool output
REFERENCES
Vulnerability Management System generated better and
faster results overall. It can automate the VA and PT process
[1] Mădălina Aldea, Daniel Gheorghică, Victor Croitoru,
till particular instance. Also, it is able to identify the present “Software Vulnerabilities Integrated Management
vulnerabilities and specific remediation based on the System”, 2020 13th International Conference on
vulnerability found and generate report with severity levels Communications (COMM), IEEE, 2020: pp. 97 - 102, doi:
accordingly. The sole disadvantage is that, according to 10.1109/COMM48946.2020.9141970
reports, it takes more time to scan than the majority of the [2] Robert A. Martin, “Integrating Your Information Security
web scanners utilized in this study. Although its Vulnerability Management Capabilities Through
performance is not perfect, compared to other tools, it has a Industry Standards (CVE & OVAL)”, 2003 IEEE
larger capacity to detect more flaws. International Conference on Systems, Man and
Cybernetics. Conference Theme - System Security and
Assurance, pp. 1528 – 1533), doi:
5. CONCLUSION & RECOMMENDATIONS 10.1109/ICSMC.2003.1244628
[3] GeonLyang Kim, JinTae Oh, DongI Seo, JeongNyeo Kim,
5.1 Conclusion “The Design of Vulnerability Management System”,
IJCSNS International Journal of Computer Science and
The proposed Vulnerability Management System based on Network Security, VOL.13 No.4, April 2013: pp. 19 – 24
the hybrid algorithm extensively work to identify [4] Manoj Kumar, Arun Sharma, “An integrated framework
vulnerabilities based on software-based applications. Testing for software vulnerability detection, analysis and
of such applications is done for safeguarding it. The suggested mitigation: an autonomic system”, Indian Academy of
Sciences Sadhana Vol. 42, No. 9, September 2017, pp.
hybrid method presents additional vulnerabilities and does 1481–1493, doi: 10.1007/s12046-017-0696-7
so in a professional manner when reporting those that have
been found. However, because not all of the current [5] Chee-Wooi Ten, Chen-Ching Liu, Govindarasu
Manimaran, “Vulnerability Assessment of Cybersecurity
vulnerabilities were completely scanned by the suggested for SCADA Systems”, IEEE Transactions on Power
hybrid approach. To make sure that "deep" crawling was Systems, Vol. 23, no. 4, November 2008, pp. 1836-1846,
carried out, the algorithm's crawling component needed to be doi: 10.1109/TPWRS.2008.2002298
increased. The results also indicate that the proposed method [6] Jan-Min Chen, Chia-Lun Wu, “An automated
needs to be improved in order to complete the scanning vulnerability scanner for injection attack based on
quickly. To create an algorithm with the ability to identify injection point”, 2010 International Computer
more vulnerabilities, more study and research is required. Symposium (ICS2010), 16-18 Dec. 2010, pp. 113 – 118,
doi: 10.1109/COMPSYM.2010.5685537
5.2 Recommendations [7] Andrey Fedorchenko, Igor Kotenko, Andrey Chechulin,
“Design of Integrated Vulnerabilities Database for
Computer Networks Security Analysis”, 2015 23rd
i) Improve crawling capabilities: Euromicro International Conference on Parallel,
The proposed hybrid algorithm requires more methods and Distributed, and Network-Based Processing, 4-6 March
functions for crawling mechanisms so that VMS will be able 2015, pp. 559-566, doi: 10.1109/PDP.2015.38
to scan all the contents of any URL or a web application, [8] Armold; Hyla, Rowe, “Automatically Building an
without skipping any content of the webpage. Information-Security Vulnerability Database”, 2006
IEEE Information Assurance Workshop”, 21-23 June
2006, pp. 376-377, doi: 10.1109/IAW.2006.1652119

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page 5
 International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 09 Issue: 09 | Sep 2022 www.irjet.net p-ISSN: 2395-0072

[9] Ching-Huang Lin, Chih-Hao Chen, Chi-Sung Laih, “A University Ranking 2022) – 2nd Rank- Best Scientist,
Study and Implementation of Vulnerability Assessment VJTI Computer Science domain 1138th Rank- Best
and Misconfiguration Detection”, 2008 IEEE Asia-Pacific Scientist, Computer Science, India.
Services Computing Conference, 9-12 Dec. 2008, pp.
1252-1257, doi: 10.1109/APSCC.2008.212
[10] Yu, Y., Yang, Y., Gu, J., & Shen, L. (2011). Analysis and
suggestions for the security of web applications. In
Computer Science and Network Technology (ICCSNT),
2011 International Conference on, Vol. 1, pp. 236-240
[11] Pravin Kharat, Pramila Chawan, “Vulnerability
Management System”, 2021 International Research
Journal of Engineering and Technology (IRJET), 25-28
Nov 2021

BIOGRAPHIES

Pravin P. Kharat
1’st M Tech. Dept. of Computer
Author Engineering – NIMS, VJTI,
Photo Mumbai

Prof. Pramila M. Chawan, is

working as an Associate Professor
in the Computer Engineering
Department of VJTI, Mumbai. She
has done her B.E. (Computer
Engineering) and M.E. (Computer
Engineering) from VJTI College of
Engineering, Mumbai University. She has 28 years of
teaching experience and has guided 85+ M. Tech.
projects and 130+ B. Tech. projects. She has published
143 papers in the International Journals, 20 papers in
the National/International Conferences/ Symposiums.
She has worked as an Organizing Committee member
for 25 International Conferences and 5 ICTE/MHRD
sponsored Workshops/STTPs/FDPs. She has
participated in 16 National/International Conferences.
Worked as Consulting Editor on – JEECER, JETR, JETMS,
Technology Today, JAM&AER Engg. Today, The Tech.
World Editor – Journals of ADR Reviewer -IJEF, Inters
cience She has worked as NBA Coordinator of the
Computer Engineering Department of VJTI for 5 years.
She had written a proposal under TEQIP-I in June 2004
for ‘Creating Central Computing Facility at VJTI’. Rs.
Eight Crore were sanctioned by the World Bank under
TEQIP-I on this proposal. Central Computing Facility
was set up at VJTI through this fund which has played a
key role in improving the teaching
learning process at VJTI. warded by SIESRP with
Innovative & Dedicated Educationalist Award
Specialization: Computer Engineering & I.T. in 2020
AD Scientific Index Ranking (World Scientist and

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page 6

View publication stats