VIET NAM – KOREA UNIVERSITY OF INFORMATION AND COMMUNICATION TECHNOLOGY FACULTY OF COMPUTER AND ELECTRONIC ENGINEERING REPORT OF 4th IT BASE PROJECT Topic: BUILDING A WEBSITE WITH TOP 10 OWASP VULNERABILITIES Student : NGUYEN VIET KHANG – 22NS028 Instructor: PhD. NGUYEN HUU NHAT MINH Class : 4th IT Base Project Da Nang, November 2024 VIET NAM – KOREA UNIVERSITY OF INFORMATION AND COMMUNICATION TECHNOLOGY FACULTY OF COMPUTER AND ELECTRONIC ENGINEERING REPORT OF 4th IT BASE PROJECT Topic: BUILDING A WEBSITE WITH TOP 10 OWASP VULNERABILITIES Student : NGUYEN VIET KHANG – 22NS028 Instructor: PhD. NGUYEN HUU NHAT MINH Class : 4th IT Base Project Da Nang, November 2024 PREFACE In the process of studying and learning for the 4th IT Base Project , i realized that network security and web security are indispensable factors when developing and operating online systems. Open source software has been and is contributing significantly to the development of modern technology, with advantages of transparency, flexibility and a large support community.
However, security vulnerabilities can also appear if not detected and fixed promptly, especially in the context of website development. This report is designed to understand how to build a website that contains security vulnerabilities listed in the OWASP Top 10, and to further research how these vulnerabilities can be exploited and how they affect the system. Through this research, I hope to have a more comprehensive view of security in an open source environment, as well as grasp effective system protection methods. ACKNOWLEDGEMENTS During the process of implementing and completing this project, i have received very enthusiastic and useful help and guidance from the teacher of the Faculty of Computer and Electronics Engineering, Vietnam - Korea University of Information Technology and Communications.
I would like to express my sincere thanks to the teacher who have provided me with valuable knowledge, information, documents and guidance during the project. In particular, i would like to thank Mr. Nguyen Huu Nhat Minh - who directly guided me during the implementation of this project. However, due to limitations in time, knowledge and practical experience, the topic is inevitably flawed.
I look forward to receiving sympathy from teachers and welcome comments, assessments and feedback from teachers and students so that i can continue to improve and develop in future research and implementation projects. Once again, i would like to express my sincere thanks to Mr. Nguyen Huu Nhat Minh , who have supported and helped me throughout the process of implementing this project. …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… … …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… …………………………………………………………………………………… Instructor INDEX CHAPTER I.
OVERVIEW OF THE TOPIC. Information about the topic.1 Introduce the topic and reasons for choosing the topic 2 1.2 Objectives, meaning and subjects of the topic 2 1.3 Meaning of the topic: 3 1. Technologies used in the topic.1 Oracle VM Virtual Box 3 1.11 Vmware player 11 CHAPTER II. PROJECT SYSTEM STRUCTURE AND ANALYSIS.2 Database 17 CHAPTER III.
IMAGES AND PROJECT ACHIEVEMENTS.1 Normal user side 22 3.2 Vulnerabilities have been added to the site.1 Broken Access Control and Misconfiguration 27 3.6 Cryptographic Failures 32 CHAPTER IV. CONCLUSION AND DEVELOPMENT DIRECTION.3 Advantages and disadvantages of the topic:.4 Development direction of the topic:.34 PHOTO LIST Figure 1.1 VM Virtual Box.1 Use-case diagram.5 Type of food.6 general_info_order.3 Home page interface.7 Food description interface.8 Shopping cart and payment interface for multiple dishes.5 Access with admin rights.6 No attack payload yet.7 With attack payload.8 Malicious string insertion.12 Encoding cookies with base64.13 Do not encrypt user passwords.32 LIST OF ABBREVIATIONS STT Symbol Full text 1 HTML Hypertext Markup Language 2 CSS Cascading Style Sheets 3 JS JavaScript 4 EJS Embedded JavaScript 5 SCSS Sassy Cascading Style Sheets 6 API Application programming interface 10 CHAPTER I. OVERVIEW OF THE TOPIC 1. Information about the topic 1.1 Introduce the topic and reasons for choosing the topic Topic introduction: This topic focuses on detecting and describing common security vulnerabilities in the OWASP list, including SQL Injection, XSS (Cross-Site Scripting), Path traversal, Broken Access Control, Misconfiguration, Cryptographic Failures, and Authentication Failures.
These are all vulnerabilities that are frequently exploited by hackers to gain control or steal sensitive information from web systems, causing serious consequences for user security and privacy. Reason for choosing the topic: I chose to study these vulnerabilities because they are very common and have a profound impact on all web systems. Whether large or small businesses, organizations are still at risk of being attacked if they do not implement appropriate security measures. Moreover, understanding the operating mechanism and how to prevent these vulnerabilities helps us have a solid foundation of knowledge about web application security and create safer products in the future.2 Objectives, meaning and subjects of the topic Objective of the topic: - Raise awareness of three common security vulnerabilities and their exploitation mechanisms.
- Deep analysis of how these vulnerabilities are implemented in real environments. - Provides prevention methods for each vulnerability, helping to develop more secure systems. - Build a website that simulates vulnerabilities to provide a realistic environment for developers and security researchers to learn and practice.3 Meaning of the topic: This topic not only helps protect the system from external threats but also contributes to raising public awareness of information security. When developers are clearly aware of vulnerabilities and how to prevent them, they will contribute to minimizing attacks, better protecting user information and minimizing security risks for businesses.
Technologies used in the topic 1.1 Oracle VM Virtual Box Figure 1.1 VM Virtual Box Concept: Oracle VM VirtualBox is an open source virtualization software that allows the creation and management of virtual machines on personal computers. It provides an environment to run multiple operating systems on the same physical machine without the need for direct installation. In this project, VirtualBox helps create an isolated test environment for website deployment, making it easy to test OWASP security vulnerabilities and analyze application performance without affecting the actual production environment. Uses: VirtualBox helps create a separate virtual environment on the computer, allowing for safe deployment and testing of websites without affecting the main system.
You can set up and test many different configurations, easily re-initialize the environment when necessary, and quickly detect vulnerabilities without risking the actual system. Burp Suite Figure 1. BurpSuite Concept: Burp Suite is a powerful tool for security testing of web applications. It is especially useful for assessing OWASP vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and authentication vulnerabilities.
Burp Suite offers a variety of features, including proxies, automated and manual scanning, and tools to test, exploit, and remediate security vulnerabilities on your website. Uses: Burp Suite is an important tool for detecting and testing website security vulnerabilities. It acts as a proxy, helping you monitor and modify HTTP requests and responses between the browser and the server. Burp Suite also has an automatic vulnerability detection feature, allowing you to find and exploit security vulnerabilities such as XSS, SQL Injection, helping you improve the security level of your web application.3 JS 13 Concept: A client-side programming language used to interact with and change content on a web page.
JS allows for dynamic actions such as validating data, dynamically changing content, handling events, and interacting with users. Uses: JavaScript is used to make web pages interactive and dynamic. It allows adding effects, changing content based on user behavior, validating input, and interacting with APIs to get and send data from the server.4 Bootsrap5 Concept: It is a popular and powerful CSS framework, used to build responsive and mobile-friendly web interfaces. Uses: Provides a set of tools and CSS classes for building web interfaces quickly and easily.
It provides interface components such as buttons, forms, tables, navigation bars, etc. that are pre-designed and compatible across various devices and browsers. Bootstrap 5 uses a flexible grid system (flexbox) to layout and arrange elements on the page. It also provides CSS classes and JavaScript components to implement effects, interactions, and custom features.
With Bootstrap 5, we can quickly build professional web interfaces, compatible on many devices and save time in the development process.5 Nodejs Concept: A server-side JavaScript runtime environment that allows JavaScript code to be executed not only on the browser but also on the server.js uses JavaScript to build web applications and server-side applications. Uses: The main use of Node.js is to build server-side web applications.js, you can build dynamic web applications, real-time applications, APIs, and other network applications.js provides asynchronous multithreading capabilities, allowing you to handle multiple requests at the same time without slowing down the application's performance.js also allows the use of libraries and modules created by the JavaScript community through npm (Node Package Manager). This helps reuse open source code and speeds up the application development process.6 EJS 15 Concept: A template language for Node. It allows dynamic HTML templates to be created by embedding JavaScript code into HTML.
EJS helps separate logic and interface in web applications, allowing for easy reuse and management of web page interface components. Uses: The main use of EJS is to separate logic and interface in web applications. Using EJS, it is possible to create reusable and easily manageable HTML templates. EJS allows JavaScript code to be inserted into HTML templates to create dynamic, repeating, conditional content and data charts.
With EJS, you can pass data from the server into your HTML template and use JavaScript expressions to manipulate that data during rendering. This allows you to create dynamic web pages that interact with data from the server.7 Express Concept: A powerful and flexible Node.js web application framework. It provides tools and features for building server-side web applications quickly and easily. Express allows for handling HTTP requests, managing routing, handling middleware, creating APIs, and much more.
Uses: Handles HTTP requests, manages routing, handles middleware, and creates APIs. With Express, you can build dynamic web applications, real-time applications, and RESTful APIs. Express helps create routes to determine how to handle requests from the client side and create middleware to perform intermediate processing functions like authentication, logging, data compression, etc. It also supports objects and methods to handle requests and send responses from the server.8 MySQL MySQL is an open source relational database management system that uses the SQL language to manage and query data.
It was developed by Oracle and is commonly used in web applications, especially on open source platforms such as Linux. Uses of MySQL: - Data Management: Store, query, and manage information efficiently. - Web application support: Commonly used in developing dynamic websites and content management systems. - Big Data Processing: Manage and process large amounts of data with high performance.
- Security: Provides strong security mechanisms for the database. - High compatibility: Works on multiple operating systems and programming languages 17 1.9 Github GitHub is a source code hosting and project management platform for software development. It provides tools and features for developing, managing, and sharing project source code. GitHub's key features include: - Source code hosting : GitHub allows you to create repositories to store your project's source code.
You can upload, branch, and manage versions of the source code. - Project Management : GitHub provides tools to manage and track project progress. You can create and assign issues, track and label issues, and track changes through a version control system. - Collaboration : GitHub allows multiple people to work on the same project.
You can invite members to your project, manage access, and view and review proposed changes via pull requests. - Share and discover : GitHub is a large community of software developers. You can share public source code, search and discover other projects, and participate in open source projects.10 Swagger Swagger is essentially an ecosystem of tools and standards, with the most popular standard data format being the OpenAPI Specification (OAS). OpenAPI is a RESTful API description standard that allows defining API endpoints, HTTP methods, parameters, and responses.