Detecção e análise de vulnerabilidades em um servidor OJS utilizando teste de penetração

Abstract

This work aims to detect and analyze potential vulnerabilities in a local OJS server using penetration testing techniques. For this, automated penetration testing techniques were used, through the use of web scanners that scan a system for web vulnerabilities, and also using manual penetration testing techniques with the aid of the Burp Suite tool, with the purpose of finding as many vulnerabilities as possible. The scanners used in this work were Acunetix and OWASP ZAP. The Acunetix tool encountered a larger number of vulnerabilities, and the vulnerabilities found by the OWASP ZAP tool that could harm OJS were the same as those found by Acunetix. The version of OJS used in this work was 3.1.1-4, as it is the most current and stable version of the system. This release proved to be a very secure web system against the current vulnerabilities that most affect web systems today, which can be explained by the fact that OJS is an open source system and there are discussion forums made by PKP, where magazine administrators can give suggestions on improving system security.