Penetracijsko testiranje web aplikacija korištenjem neizrazitih tehnika

professional thesis

• Title (english): Penetration testing of web applications using fuzzing techniques
• Author: Konrad Višković
• Mentor: Marin Vuković (mentor)
• Committee member: Miljenko Mikuc (predsjednik povjerenstva)
• Committee member: Marin Vuković (član povjerenstva)
• Committee member: Krešimir Grgić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2021, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Područje specijalističkog rada obuhvaća pregled najčešćih ranjivosti web aplikacija te opis postupka ispitivanja ranjivosti web aplikacija slijedeći metodu zajednice OWASP. Opisan je općeniti algoritam za neizrazito ispitivanje koji se može koristiti za ispitivanje navedenih ranjivosti. Opisana je podjela alata za neizrazito ispitivanje i dan je primjer arhitekture takvog alata. Opisan je posrednički poslužitelj Mitmproxy. U okviru rada ostvareno je programsko rješenje za neizrazito ispitivanje korištenjem napada grubom silom, prikazan je primjer njegove upotrebe i dane su smjernice za daljnji razvoj.

Abstract (english)

The area of specialization includes a description of the most common web application vulnerabilities. It describes the web application testing process following the OWASP method. It provides description of a general fuzzing algorithm able to detect said vulnerabilities. The paper describes classification of fuzzing tools and provides an architecture overview. The paper contains an overview of the Mitmproxy proxy tool. It provides a description and implementation of a simple fuzzing tool used for brute force testing and provides guidelines for further development.

• Keywords: neizrazito ispitivanje; fuzzing; napad grubom silom; Mitmproxy; ranjivosti web aplikacija
• Keywords (english): fuzz testing; fuzzing; brute force attack; Mitmproxy; web application vulnerabilities
• Language: croatian
• URN:NBN: urn:nbn:hr:168:529438
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2022-07-01 07:07:16