A vulnerability scanning tool for session management vulnerabilities
Raymond Lukanta, Yudistira Dwi Wardhana Asnar, Achmad Imam Kistijantoro · 2014
Session management vulnerabilities can be categorized as a group of vulnerability that is still often discovered. Session management vulnerabilities consist of session fixation, CSRF, and insufficient cookies attributes. Based on OWASP Top 10 2013, issues on session management are ranked on 2ndplace, while CSRF on 8th. To detect session management vulnerabilities, we developed a vulnerability scanning tool extending an existing open source tool, namely Nikto. To validate our tool, we have performed two types of testing, which are a functional and a field testing. In functional testing, we created some synthetic test cases to prove all the functionalities can function well. In the field testing, we used some existing projects and we can conclude that Nikto failed to execute some test cases and also found some false negative. The false negative is caused by the error in detecting random token performed by CSRF detector.