Click to open the HelpDesk interface
AECE - Front page banner

Menu:


FACTS & FIGURES

JCR Impact Factor: 0.595
JCR 5-Year IF: 0.661
Issues per year: 4
Current issue: May 2017
Next issue: Aug 2017
Avg review time: 78 days


PUBLISHER

Stefan cel Mare
University of Suceava
Faculty of Electrical Engineering and
Computer Science
13, Universitatii Street
Suceava - 720229
ROMANIA

Print ISSN: 1582-7445
Online ISSN: 1844-7600
WorldCat: 643243560
doi: 10.4316/AECE


TRAFFIC STATS

1,639,993 unique visits
496,235 downloads
Since November 1, 2009



Robots online now
Googlebot
YandexBot


SJR SCImago RANK

SCImago Journal & Country Rank


SEARCH ENGINES

aece.ro - Google Pagerank




TEXT LINKS

Anycast DNS Hosting
MOST RECENT ISSUES

 Volume 17 (2017)
 
     »   Issue 2 / 2017
 
     »   Issue 1 / 2017
 
 
 Volume 16 (2016)
 
     »   Issue 4 / 2016
 
     »   Issue 3 / 2016
 
     »   Issue 2 / 2016
 
     »   Issue 1 / 2016
 
 
 Volume 15 (2015)
 
     »   Issue 4 / 2015
 
     »   Issue 3 / 2015
 
     »   Issue 2 / 2015
 
     »   Issue 1 / 2015
 
 
 Volume 14 (2014)
 
     »   Issue 4 / 2014
 
     »   Issue 3 / 2014
 
     »   Issue 2 / 2014
 
     »   Issue 1 / 2014
 
 
  View all issues  


FEATURED ARTICLE

ABC Algorithm based Fuzzy Modeling of Optical Glucose Detection, SARACOGLU, O. G., BAGIS, A., KONAR, M., TABARU, T. E.
Issue 3/2016

AbstractPlus






LATEST NEWS

2017-Jun-14
Thomson Reuters published the Journal Citations Report for 2016. The JCR Impact Factor of Advances in Electrical and Computer Engineering is 0.595, and the JCR 5-Year Impact Factor is 0.661.

2017-Apr-04
We have the confirmation Advances in Electrical and Computer Engineering will be included in the EBSCO database.

2017-Feb-16
With new technologies, such as mobile communications, internet of things, and wide applications of social media, organizations generate a huge volume of data, much faster than several years ago. Big data, characterized by high volume, diversity and velocity, increasingly drives decision making and is changing the landscape of business intelligence, from governments to private organizations, from communities to individuals. Big data analytics that discover insights from evidences has a high demand for computing efficiency, knowledge discovery, problem solving, and event prediction. We dedicate a special section of Issue 4/2017 to Big Data. Prospective authors are asked to make the submissions for this section no later than the 31st of May 2017, placing "BigData - " before the paper title in OpenConf.

2017-Jan-30
We have the confirmation Advances in Electrical and Computer Engineering will be included in the Gale database.

2016-Dec-17
IoT is a new emerging technology domain which will be used to connect all objects through the Internet for remote sensing and control. IoT uses a combination of WSN (Wireless Sensor Network), M2M (Machine to Machine), robotics, wireless networking, Internet technologies, and Smart Devices. We dedicate a special section of Issue 2/2017 to IoT. Prospective authors are asked to make the submissions for this section no later than the 31st of March 2017, placing "IoT - " before the paper title in OpenConf.

Read More »


    
 

  1/2014 - 15

WAPTT - Web Application Penetration Testing Tool

DURIC, Z. See more information about DURIC, Z. on SCOPUS See more information about DURIC, Z. on IEEExplore See more information about DURIC, Z. on Web of Science
 
Click to see author's profile on See more information about the author on SCOPUS SCOPUS, See more information about the author on IEEE Xplore IEEE Xplore, See more information about the author on Web of Science Web of Science

Download PDF pdficon (614 KB) | Citation | Downloads: 775 | Views: 3,170

Author keywords
databases, security, vulnerabilities, web sites, web applications

References keywords
application(11), security(10), link(10), applications(9), injection(8), detection(6), analysis(6), vulnerabilities(5), testing(5), static(5)
Blue keywords are present in both the references section and the paper title.

About this article
Date of Publication: 2014-02-28
Volume 14, Issue 1, Year 2014, On page(s): 93 - 102
ISSN: 1582-7445, e-ISSN: 1844-7600
Digital Object Identifier: 10.4316/AECE.2014.01015
Web of Science Accession Number: 000332062300015
SCOPUS ID: 84894630963

Abstract
Quick view
Full text preview
Web applications vulnerabilities allow attackers to perform malicious actions that range from gaining unauthorized account access to obtaining sensitive data. The number of reported web application vulnerabilities in last decade is increasing dramatically. The most of vulnerabilities result from improper input validation and sanitization. The most important of these vulnerabilities based on improper input validation and sanitization are: SQL injection (SQLI), Cross-Site Scripting (XSS) and Buffer Overflow (BOF). In order to address these vulnerabilities we designed and developed the WAPTT (Web Application Penetration Testing Tool) tool - web application penetration testing tool. Unlike other web application penetration testing tools, this tool is modular, and can be easily extended by end-user. In order to improve efficiency of SQLI vulnerability detection, WAPTT uses an efficient algorithm for page similarity detection. The proposed tool showed promising results as compared to six well-known web application scanners in detecting various web application vulnerabilities.


References | Cited By  «-- Click to see who has cited this paper

[1] H. Shahriar, M. Zulkernine. Automatic Testing of Program Security Vulnerabilities, 33rd Annual IEEE International Computer Software and Applications Conference, pp. 550 - 555, 2009.
[CrossRef] [SCOPUS Times Cited 15]


[2] A. Kiezun, P. J. Guo, K. Jayaraman, and M. D. Ernst, "Automatic creation of SQL injection and cross-site scripting attacks", in ICSE’09, Proceedings of the 30th International Conference on Software Engineering, Vancouver, BC, Canada, May 20-22, 2009.
[CrossRef] [Web of Science Times Cited 26] [SCOPUS Times Cited 159]


[3] T. Scholtea, D. Balzarottib, E.Kirda, "Have things changed now? An empirical study on input validation vulnerabilities in web applications", Computers & Security, vol. 31, pp. 344-356, 2012.
[CrossRef] [Web of Science Times Cited 12] [SCOPUS Times Cited 25]


[4] J. Bau, E. Bursztein, D. Gupta, J. Mitchell, "State of the Art: Automated Black-Box Web Application Vulnerability Testing", Proceedings of the 2010 IEEE Symposium on Security and Privacy, pp. 332-345, 2010.
[CrossRef] [Web of Science Times Cited 37] [SCOPUS Times Cited 81]


[5] N. Antunes, N. Laranjeiro, M. Vieira, H. Madeira, "Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services", IEEE SCC 2009, pp. 260-267, 2009.
[CrossRef] [Web of Science Times Cited 18] [SCOPUS Times Cited 34]


[6] X. Li and Y. Xue, "A Survey on Web Application Security", Technical report, Vanderbilt University, 2011.

[7] W. G. Halfond and A. Orso, "AMNESIA: Analysis and Monitoring for NEutralizing SQL-Injection attacks", Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, pp. 174-183, 2005.

[8] Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo, "Securing Web application code by static analysis and runtime protection", Proceedings of the 13th international conference on World Wide Web, pp. 40 - 52, 2004.
[CrossRef]


[9] M. Lam, M. Martin, B. Livshits, and J. Whaley, "Securing Web applications with static and dynamic information flow tracking", Proceedings of the ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, pp. 3-12, 2008.
[CrossRef] [Web of Science Times Cited 26] [SCOPUS Times Cited 52]


[10] M. Martin and M. Lam, "Automatic generation of XSS and SQL injection attacks with goal-directed model checking", Proceedings of the 17th conference on Security symposium, pp. 31-43, 2008.

[11] OWASP Top 10 2013, [Online] Available: Temporary on-line reference link removed - see the PDF document

[12] Information Technology Industry Council NCITS. SQL-92 standard. [Online] Available: Temporary on-line reference link removed - see the PDF document

[13] C. Anley, Advanced SQL Injection in SQL Server Applications, [Online] Available: Temporary on-line reference link removed - see the PDF document

[14] C. Anley,(more) Advanced SQL Injection, [Online] Available: Temporary on-line reference link removed - see the PDF document

[15] G. Wassermann and Z. Su, "Sound and precise analysis of web applications for injection vulnerabilities," SIGPLAN Not., vol. 42, no. 6, pp. 32-41, 2007.
[CrossRef] [Web of Science Times Cited 33]


[16] M. S. Lam, M. Martin, B. Livshits, and J. Whaley, "Securing web applications with static and dynamic information flow tracking," in PEPM ’08: Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics based program manipulation. New York, NY, USA: ACM, pp. 3-12, 2008.
[CrossRef] [Web of Science Times Cited 26] [SCOPUS Times Cited 52]


[17] N. Jovanovic, C. Kruegel, and E. Kirda, "Pixy: A static analysis tool for detecting web application vulnerabilities (short paper)," IEEE Symposium on Security and Privacy, pp. 258-263, 2006.
[CrossRef] [Web of Science Times Cited 84] [SCOPUS Times Cited 269]


[18] Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo, "Securing web application code by static analysis and runtime protection," Proceedings of the 13th international conference on World Wide Web. New York, NY, USA: ACM, pp. 40-52, 2004.
[CrossRef]


[19] S. Kals, E. Kirda, C. Kruegel, and N. Jovanovic, "Secubat: a web vulnerability scanner", Proceedings of the 15th international conference on World Wide Web, pp. 247-256, 2006.
[CrossRef] [SCOPUS Times Cited 63]


[20] S. McAllister, E. Kirda, and C. Kruegel, "Expanding Human Interactions for In-Depth Testing of Web Applications", 11th Symposium on Recent Advances in Intrusion Detection, Boston, MA, 2008.
[CrossRef] [SCOPUS Times Cited 24]


[21] S. Mcallister, E. Kirda, and C. Kruegel, "Leveraging user interactions for in-depth testing of web applications," Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection, pp. 191-210, 2008.
[CrossRef] [SCOPUS Times Cited 24]


[22] F. Maggi, W. K. Robertson, C. Krugel, and G. Vigna, "Protecting a moving target: Addressing web application concept drift", Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection, pp. 21-40, 2009.
[CrossRef] [SCOPUS Times Cited 30]


[23] Y.-W. Huang, S.-K. Huang, T.-P. Lin, Ch.-H. Tsai, "Web application security assessment by fault injection and behavior monitoring", Proceedings of the 12th international conference on World Wide Web, pp. 148-159, 2003.
[CrossRef] [SCOPUS Times Cited 165]


[24] A. Wiegenstein, F. Weidemann, M. Schumacher, S. Schinzel, "Web Application Vulnerability Scanners - a Benchmark", Virtual Forge GmbH, 2006.

[25] N. Li, T. Xie, M. Jin, C. Liu, "Perturbation-based user-input-validation testing of web applications", Journal of Systems and Software, vol. 83, pp. 2263-2274, 2010.
[CrossRef] [Web of Science Times Cited 8] [SCOPUS Times Cited 15]


[26] Z. Djuric, D. Gasevic, "A Source Code Similarity System for Plagiarism Detection", The Computer Journal, vol. 56, pp. 70-86, 2013.
[CrossRef] [Web of Science Times Cited 8] [SCOPUS Times Cited 13]


[27] J.W. Hunt, M.D. McIlroy, "An Algorithm for Differential File Comparison", Technical Report SECLAB-05-04, Bell Laboratories, 1976.

[28] A. B. Kleiman, T. Kowaltowski, "Qualitative Analysis and Comparison of Plagiarism-Detection Systems in Student Programs", Technical Report IC-09-08. Instituto de Computaçao, UNIVERSIDADE ESTADUAL DE CAMPINAS, 2009.

[29] M.J. Wise, "String similarity via greedy string tiling and running Karp-Rabin matching", Deptartment of CS, University of Sydney, [Online] Available: Temporary on-line reference link removed - see the PDF document

[30] R.M Karp and M.O. Rabin, "Efficient randomized pattern-matching algorithms", IBM Journal of Research and Development - Mathematics and computing, vol. 31, pp. 249-260, 1987.
[CrossRef]


[31] Web Application Security Consortium (WASC). Web application security scanner evaluation criteria. [Online] Available: Temporary on-line reference link removed - see the PDF document

[32] OWASP WebGoat Project, [Online] Available: Temporary on-line reference link removed - see the PDF document

[33] HackMe bank, [Online] Available: Temporary on-line reference link removed - see the PDF document

[34] AltoroMutual, [Online] Available: Temporary on-line reference link removed - see the PDF document

[35] L. Suto, "Analyzing the Accuracy and Time Costs of Web Application Security Scanners", [Online] Available: Temporary on-line reference link removed - see the PDF document



References Weight

Web of Science® Citations for all references: 278 TCR
SCOPUS® Citations for all references: 1,021 TCR

Web of Science® Average Citations per reference: 8 ACR
SCOPUS® Average Citations per reference: 28 ACR

TCR = Total Citations for References / ACR = Average Citations per Reference

We introduced in 2010 - for the first time in scientific publishing, the term "References Weight", as a quantitative indication of the quality ... Read more

Citations for references updated on 2017-06-20 21:35 in 121 seconds.




Note1: Web of Science® is a registered trademark of Thomson Reuters.
Note2: SCOPUS® is a registered trademark of Elsevier B.V.
Disclaimer: All queries to the respective databases were made by using the DOI record of every reference (where available). Due to technical problems beyond our control, the information is not always accurate. Please use the CrossRef link to visit the respective publisher site.

Copyright ©2001-2017
Faculty of Electrical Engineering and Computer Science
Stefan cel Mare University of Suceava, Romania


All rights reserved: Advances in Electrical and Computer Engineering is a registered trademark of the Stefan cel Mare University of Suceava. No part of this publication may be reproduced, stored in a retrieval system, photocopied, recorded or archived, without the written permission from the Editor. When authors submit their papers for publication, they agree that the copyright for their article be transferred to the Faculty of Electrical Engineering and Computer Science, Stefan cel Mare University of Suceava, Romania, if and only if the articles are accepted for publication. The copyright covers the exclusive rights to reproduce and distribute the article, including reprints and translations.

Permission for other use: The copyright owner's consent does not extend to copying for general distribution, for promotion, for creating new works, or for resale. Specific written permission must be obtained from the Editor for such copying. Direct linking to files hosted on this website is strictly prohibited.

Disclaimer: Whilst every effort is made by the publishers and editorial board to see that no inaccurate or misleading data, opinions or statements appear in this journal, they wish to make it clear that all information and opinions formulated in the articles, as well as linguistic accuracy, are the sole responsibility of the author.




Website loading speed and performance optimization powered by: