Penetration tests for computer security to the web server using owasp methodology for the detection of vulnerabilities in the cybersecurity laboratory at the Universidad Politécnica Estatal del Carchi

Abstract

This research called “Penetration tests for computer security to the web server of the cybersecurity laboratory at the Carchi State Polytechnic University” delved into the study of the vulnerabilities present in web servers and their relationship with security processes, the objective The main part of the project was to diagnose existing vulnerabilities in web servers such as SQL injections, XXS Cross Site Script, brute force attacks, among others. Through pentest tools, the risks and threats present were made known, to fulfill this goal a qualitative approach was proposed in conjunction with field and documentary research that allowed data to be collected through the technique of an interview with the laboratory coordinator cybersecurity, resulting in detailed information on security processes and the most common problems that occur on web servers.
From the results obtained, several tests were established using a methodology to develop the processes, the Owasp and Owasp Zap methodology were the main tools to find threat alerts, as well as the execution of processes such as: information collection, use of engines search to verify analysis, enumeration of the server applications, review of comments towards the website to verify the presence of vulnerable information, identification of entry points, alerts and analysis of the application architecture, configuration management test and development, configuration and infrastructure test, file extension test, http method test, strict Hsts security test, input validation test, among others. As well as the use of Kali Linux as an operating system that allowed the use of pentest techniques and security corrections to the server. On the other hand, a comparison of the web servers was established with a value reached of 80% for Apache and 30% for Microsoft IIS, as well as a final comparison of the vulnerabilities of 5.33% for management, configuration and development, 8% handling of identity and http method, 7% brute force and Cross Site Scripting, 5% SQL injection and DoS and finally 4.67% Owasp Zap / directories. The use of these techniques combined with the management of the phases of the Owasp methodology allowed to organize, guide quickly and reliably basic techniques to protect against common and important threats, obtaining as a reference the generated documentation that can be reusable for future projects or in implementation work.