An effective new penetration test approach to detect web attacks on web applications

Abstract

As web applications increasingly involve sensitive transactions such as e-commerce, online banking, and public services, they have become primary targets for cyberattacks. Therefore, web application penetration testing is vital for discovering and protecting against vulnerabilities in web-based systems. This study introduces an automated penetration testing tool that systematically applies comprehensive penetration testing methodologies to effectively identify and mitigate web application vulnerabilities. The proposed tool uses a hybrid approach that includes automated and manual testing phases for multiple attacks, including SQL Injection, Cross-Site Scripting, and Cross-Site Request Forgery. System diversity is increased, and the penetration testing process is enriched using Python scripts and APIs. The tool provides an effective mechanism for uncovering critical vulnerabilities by simulating real-world attacker behavior. Practical evaluations on various web applications demonstrate the tool's ability to identify vulnerabilities and increase system resilience. This research will help developers and security engineers apply this automated, specialized approach to security as our digital environment becomes more connected.