TY - JOUR T1 - VinJect: Toolkit for Penetration Testing and Vulnerability Scanning TT - VinJect: Sızma Testi ve Güvenlik Açığı Taraması Aracı AU - Akbulut, Akhan PY - 2018 DA - August DO - 10.29130/dubited.425414 JF - Duzce University Journal of Science and Technology JO - DÜBİTED PB - Düzce Üniversitesi WT - DergiPark SN - 2148-2446 SP - 779 EP - 790 VL - 6 IS - 4 LA - en AB - Penetrationtesting plays an important role in the development of secure software productsand electronic systems. Sustainability of commercial systems is ensured throughthe regular scans of vulnerability. In this era where quality assurance andtesting organizations become increasingly widespread, the effectiveness of theused tools and methods are critical. This article describes the architecture ofthe software named VinJect, which isdeveloped for efficient penetration testing and vulnerability scanning. The primarygoal of this application is to detect vulnerable locations in a shorter timewith running in a multi-threaded structure. Our proposed application uses Wapitiand SQLmap applications’ services in the background. With user-friendlyinterfaces, it is also aimed to remove the bad UX that these applicationsrunning on the command line have. In the tests we performed, WinJect was found to be more efficient incompleting the vulnerability scans in a much shorter time. KW - Penetration testing tool KW - Vulnerability detection KW - Security N2 - Güveniliryazılım ürünleri ve elektronik sistemlerin geliştirilmesinde sızma testi önemlirol oynamaktadır. Zaafiyet taramalarının düzenli olarak yapılması sayesinde, ticarisistemlerin sürdürülebilirliği sağlanmaktadır. Kalite güvence ve test firmalarınıngünümüzde yaygınlıklarını arttırdıkları bu dönemde, kullanılan araç ve yöntemlerin etkinlikleriçok kritiktir. Bu makalede etkin bir sızma testi ve güvenlik açığı taramasıiçin geliştirilmiş VinJect ismindeki yazılımın mimarisi anlatılmaktadır. Amaç, çokişparçacıklı yapıda çalışan bu uygulama ile zaafiyet barındıran yerlerintespitinin daha kısa sürede yapılmasıdır. Önerdiğimiz uygulama, arka planındaWapiti ve SQLmap uygulamalarına ait servisleri kullanmaktadır. Kullanıcı dostuarayüzler ile çoğunlukla komut satırında çalışşan uygulamaların verdiği olumsuzkullanıcı tecrübesinin ortadan kaldırılması hedeflenmiştir. Yaptığımıztestlerde, WinJect'in daha etkin bir kullanım sunduğu ve zaafiyet taramalarıçok daha kısa sürede tamamladığı görüldü. CR - [1] Allen, L., Heriyanto, T. and Ali, S., Kali Linux–Assuring security by penetration testing. Packt Publishing Ltd, 2014. CR - [2] Stallings, W., Brown, L., Bauer, M.D. and Bhattacharjee, A.K., Computer security: principles and practice. Pearson Education, 2012. CR - [3] Patil, S., Marathe, N., & Padiya, P., "Design of efficient web vulnerability scanner.", Inventive Computation Technologies (ICICT), International Conference on. Vol. 2. IEEE, 2016. CR - [4] Aliero, M. S., & Ghani, I., "A component based SQL injection vulnerability detection tool.", Software Engineering Conference (MySEC), 2015 9th Malaysian. IEEE, 2015. CR - [5] Parvez, M., Zavarsky, P., & Khoury, N., "Analysis of effectiveness of black-box web application scanners in detection of stored SQL injection and stored XSS vulnerabilities.", Internet Technology and Secured Transactions (ICITST), 2015 10th International Conference for. IEEE, 2015. CR - [6] Khoury, N., Zavarsky, P., Lindskog, D., & Ruhl, R., "An analysis of black-box web application security scanners against stored SQL injection.", Privacy, Security, Risk and Trust (PASSAT) and 2011 IEEE Third Inernational Conference on Social Computing (SocialCom), 2011 IEEE Third International Conference on. IEEE, 2011. CR - [7] Delamore, B., & Ko, R. K., "Escrow: A large-scale web vulnerability assessment tool.", Trust, Security and Privacy in Computing and Communications (TrustCom), 2014 IEEE 13th International Conference on. IEEE, 2014. CR - [8] Liban, A., & Hilles, S. M., "Enhancing Mysql Injector vulnerability checker tool (Mysql Injector) using inference binary search algorithm for blind timing-based attack.", Control and System Graduate Research Colloquium (ICSGRC), 2014 IEEE 5th. IEEE, 2014. CR - [9] Singh, A. K., & Roy, S., "A network based vulnerability scanner for detecting sqli attacks in web applications.", Recent Advances in Information Technology (RAIT), 2012 1st International Conference on. IEEE, 2012. CR - [10] Lounis, O., Guermeche, S. E. B., Saoudi, L., & Benaicha, S. E., "A new algorithm for detecting SQL injection attack in Web application." Science and Information Conference (SAI), 2014. IEEE, 2014. CR - [11] Dessiatnikoff, A., Akrout, R., Alata, E., Kaâniche, M., & Nicomette, V., "A clustering approach for web vulnerabilities detection.", Dependable Computing (PRDC), 2011 IEEE 17th Pacific Rim International Symposium on. IEEE, 2011. CR - [12] Salas, M. I. P., & Martins, E., "A black-box approach to detect vulnerabilities in web services using penetration testing.", IEEE Latin America Transactions 13.3 (2015): 707-712. CR - [13] Fortify WebInspect, “URL:http://www8.hp.com/us/en/software-solutions/webinspect-dynamic-analysis-dast/”, [Accessed: 20-May-2018]. CR - [14] Gamja : Web vulnerability scanner, “URL: https://sourceforge.net/projects/gamja/”, [Accessed: 20-May-2018]. CR - [15] N-Stalker The Web Security Specialists, “URL:http://www.nstalker.com/”, [Accessed: 20-May-2018]. CR - [16] IBM Security AppScan, “URL: https://www.ibm.com/developerworks/downloads/r/appscan/index.html”, [Accessed: 20-May-2018]. CR - [17] Burp Suite Scanner | PortSwigger, “URL:http://portswigger.net/suite/”, [Accessed: 20-May-2018]. CR - [18] Acunetix, “URL: https://www.acunetix.com/web-vulnerability-scanner/”, [Accessed: 20-May-2018]. CR - [19] ImmuniWeb Application Security Testing Platform, “URL: https://www.htbridge.com/immuniweb/” , [Accessed: 20-May-2018]. CR - [20] Wapiti : a Free and Open-Source web-application vulnerability scanner in Python for Windows, Linux, BSD, OSX, “URL:http://wapiti.sourceforge.net/” [Accessed: 20-May-2018]. CR - [21] sqlmap : automatic SQL injection and database takeover tool, “URL: http://sqlmap.org/” [Accessed: 20-May-2018]. CR - [22] Pankratius, V., Adl-Tabatabai, A.R. and Tichy, W., eds. Fundamentals of multicore software development. CRC Press, 2011. CR - [23] Ammann, P. and Offutt, J., Introduction to software testing. Cambridge University Press, 2016. CR - [24] Wright, H.K., Kim, M. and Perry, D.E., "Validity concerns in software engineering research." Proceedings of the FSE/SDP workshop on Future of software engineering research. ACM, 2010. UR - https://doi.org/10.29130/dubited.425414 L1 - https://dergipark.org.tr/tr/download/article-file/517129 ER -