In this thesis we focus on penetration testing of the web application eQuiz and its server. The focus of this thesis is on different types of cyber-attacks. In addition, best practices in penetration testing are explored. The emphasize will be on identifying vulnerabilities specific to the application layer. The aim is to identify vulnerabilities such as inadequate input validation, inadequate account lockout when incorrect entries are made too often, and access web pages that should not be publicly accessible. We also test the server on which the application is hosted, as servers are often the target of attacks or the entry point. The vulnerabilities found in the server and the application are analysed and assessed according to the level of threat. The final objective of the thesis is
to present the security vulnerabilities found and to propose solutions to them.
|
