SASMEDU: Security Assessment Method of Software in Engineering Education
Güncel Sarıman, Ecir Uğur Küçüksille · International Journal of Information Technology and Computer Science · 2018
Security and usability of web and mobile applications where users share their personal information have become to be a factor about which users should be careful.Rapid increase of developers, programming at early ages, desire for earning money by working freelance have caused widespread use of web and mobile applications and an increase of codes which contain vulnerabilities.Safe and good software development is also based on software lessons given to the students in high school or college years.This paper presents a developed testing and evaluation software in order to find out the leakages in the web applications which was developed by using asp.net,php and java languages.It is aimed that the developed analysis tool was designed to be used by engineering students as a training tool, in security courses by trainees and by programmers for testing.Within the scope of the study, security tests of web projects were carried out with static code analysis method in input control, metric analysis and style control phases.For testing the developed software tool, student web projects were used which were downloaded from "www.freestudentprojects.com" website.10 test projects were tested in the stages of input control, metric analysis and style control.According to the results of the analysis, the errors were concentrated on Structural Query Language Injection and Cross Site Scripting attacks, which were developed by the students due to the lack of security audit in the projects.