Web Application Security Education Platform Based on OWASP API Security Project
The trend of API-based systems in web applications in the last few years keeps steadily growing. API allows web applications to interact with external systems to enable business-to-business or system-to-system integration which leads to multiple application innovations. However, this trend also co...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Politeknik Elektronika Negeri Surabaya
2022-12-01
|
| Series: | Emitter: International Journal of Engineering Technology |
| Subjects: | |
| Online Access: | https://emitter.pens.ac.id/index.php/emitter/article/view/705 |
| _version_ | 1811198704154050560 |
|---|---|
| author | Muhammad Idris Iwan Syarif Idris Winarno |
| author_facet | Muhammad Idris Iwan Syarif Idris Winarno |
| author_sort | Muhammad Idris |
| collection | DOAJ |
| description |
The trend of API-based systems in web applications in the last few years keeps steadily growing. API allows web applications to interact with external systems to enable business-to-business or system-to-system integration which leads to multiple application innovations. However, this trend also comes with a different surface of security problems that can harm not only web applications, but also mobile and IoT applications. This research proposed a web application security education platform which is focused on the OWASP API security project. This platform provides different security risks such as excessive data exposure, lack of resources and rate-limiting, mass assignment, and improper asset management which cannot be found in monolithic security learning application like DVWA, WebGoat, and Multillidae II. The development also applies several methodologies such as Capture-The-Flag (CTF) learning model, vulnerability assessment, and container virtualization. Based on our experiment, we are successfully providing 10 API vulnerability challenges to the platform with 3 different levels of severity risk rating which can be exploited using tools like Burp Suite, SQLMap, and JWTCat. In the end, based on our performance experiment, all of the containers on the platform can be deployed in approximately 16 seconds with minimum storage resource and able to serve up to 1000 concurrent users with the average throughput of 50.58 requests per second, 96.35% successful requests, and 15.94s response time.
|
| first_indexed | 2024-04-12T01:35:46Z |
| format | Article |
| id | doaj.art-f7be7c5bb55a440aa9ce4e712eb3b9b9 |
| institution | Directory Open Access Journal |
| issn | 2355-391X 2443-1168 |
| language | English |
| last_indexed | 2024-04-12T01:35:46Z |
| publishDate | 2022-12-01 |
| publisher | Politeknik Elektronika Negeri Surabaya |
| record_format | Article |
| series | Emitter: International Journal of Engineering Technology |
| spelling | doaj.art-f7be7c5bb55a440aa9ce4e712eb3b9b92022-12-22T03:53:20ZengPoliteknik Elektronika Negeri SurabayaEmitter: International Journal of Engineering Technology2355-391X2443-11682022-12-0110210.24003/emitter.v10i2.705Web Application Security Education Platform Based on OWASP API Security ProjectMuhammad Idris0Iwan Syarif1Idris Winarno2Politeknik Elektronik Negeri SurabayaPoliteknik Elektronika Negeri SurabayaPoliteknik Elektronika Negeri Surabaya The trend of API-based systems in web applications in the last few years keeps steadily growing. API allows web applications to interact with external systems to enable business-to-business or system-to-system integration which leads to multiple application innovations. However, this trend also comes with a different surface of security problems that can harm not only web applications, but also mobile and IoT applications. This research proposed a web application security education platform which is focused on the OWASP API security project. This platform provides different security risks such as excessive data exposure, lack of resources and rate-limiting, mass assignment, and improper asset management which cannot be found in monolithic security learning application like DVWA, WebGoat, and Multillidae II. The development also applies several methodologies such as Capture-The-Flag (CTF) learning model, vulnerability assessment, and container virtualization. Based on our experiment, we are successfully providing 10 API vulnerability challenges to the platform with 3 different levels of severity risk rating which can be exploited using tools like Burp Suite, SQLMap, and JWTCat. In the end, based on our performance experiment, all of the containers on the platform can be deployed in approximately 16 seconds with minimum storage resource and able to serve up to 1000 concurrent users with the average throughput of 50.58 requests per second, 96.35% successful requests, and 15.94s response time. https://emitter.pens.ac.id/index.php/emitter/article/view/705API SecurityOWASPCTFRisk RatingContainer |
| spellingShingle | Muhammad Idris Iwan Syarif Idris Winarno Web Application Security Education Platform Based on OWASP API Security Project Emitter: International Journal of Engineering Technology API Security OWASP CTF Risk Rating Container |
| title | Web Application Security Education Platform Based on OWASP API Security Project |
| title_full | Web Application Security Education Platform Based on OWASP API Security Project |
| title_fullStr | Web Application Security Education Platform Based on OWASP API Security Project |
| title_full_unstemmed | Web Application Security Education Platform Based on OWASP API Security Project |
| title_short | Web Application Security Education Platform Based on OWASP API Security Project |
| title_sort | web application security education platform based on owasp api security project |
| topic | API Security OWASP CTF Risk Rating Container |
| url | https://emitter.pens.ac.id/index.php/emitter/article/view/705 |
| work_keys_str_mv | AT muhammadidris webapplicationsecurityeducationplatformbasedonowaspapisecurityproject AT iwansyarif webapplicationsecurityeducationplatformbasedonowaspapisecurityproject AT idriswinarno webapplicationsecurityeducationplatformbasedonowaspapisecurityproject |