Risk Assessment of Web Application Penetration Testing on Cross-Site Request Forgery (CSRF) Attacks and Server-Side Includes (SSI) Injections

Cross-Site Request Forgery (CSRF) and Server-Side Includes (SSI) are the typical web applications vulnerabilities, posing severe threats to the web applications that lack security implementations. Thus, demonstrating various types of attack techniques is necessary to create awareness for web developers regarding the concepts of CSRF and SSI exploitation. However, the current approaches provided limited information since they did not include the risk assessment of severity level for each attack, the limitations, and advantages of the attack techniques. This state of the currently limited information regarding CSRF, and SSI attacks is the primary motivation for this study. Therefore, this research aims to perform risk assessment for CSRF attacks and SSI injections based on each attack technique's characteristics, severity level, limitations, and the advantages by using penetration testing. This research is separated into three main stages. Stage one focuses on finding suitable target web applications and reviewing related studies on existing attack techniques for both vulnerabilities. The second stage involves intelligence gathering, vulnerability scanning using Burp Suite and OW ASP Zed Attack Proxy (ZAP), and exploitation using seven planned testing techniques. The third stage focuses on analyzing the results of testing techniques, including the pros and cons, perform a risk assessment of the results/penetration test findings to identify the severity level of each attack technique used in this study. From the risk assessment results, it is found that SSI vulnerabilities pose an overall higher level of criticality than CSRF vulnerabilities.