icegov2012 proceedings

is with a view to using websites which files has been highly
populated in the search engine database.
3.1 Testing tool
The second phase was to choose a software testing tool to scan for
web vulnerabilities. Several criteria were part of the decision in
choosing the testing tool. First, the testing software must be
compatible with the windows operating system since the test was
carried out on the researchers’ personal computer systems (PC).
Secondly, the software must have specific vulnerability testing
options to scan web sites, as opposed to common server-based
scanning products. After review of different web scanners,
Acunetix Web Vulnerability Scanner was employed. This is noted
to be in the same category with Nmap, which has been widely
used [1]. Acunetix was used to test different web application
vulnerability issues including: Cross-Site Script (XSS), SQL
injection (SQLi), cookie manipulation (CM), unencrypted
password (UP) and broken links (BL) of the web pages, which are
main targets here. The choice of these parameters is premised on
the high impact of its severity compared to others. In addition to
this testing tool, manual testing was also carried out on some few
websites in a way as not to leave footprints on the website. This is
necessary in order to confirm the results generated by Acunetix
web vulnerability scanners.
3.2 Procedure
After launching the web scanner, the desired Universal Resource
Location (URL) is entered in the wizard box provided and the
‘go’ button is fired. If the Internet connection on the computer is
available then the scanner will begin the process. The scanner
(Acunetix), thus virtually crawl the website of any given URL and
presents the analysis of the vulnerability for every run. The
Internet connection used for the exercise is a 3.5G on a High
Speed Downlink Packet Access (HSPDA). The scanning process
took on average 25 minutes, although the times varied from 15
minutes up to 1 hour depending on the size of the entire given
website. The manual test for XSS as well as SQLi was carried out
to confirm the results generated by the vulnerability scanner. This
is possible when such scripts as alert (‘This website is
vulnerable’) is inputted into any available input field
such as: the search, feedback and form fields within the website
and the action button is pressed thereafter. If the web page is
vulnerable, a Java script enabled browser will show a java script
pop-up alert window containing the text in the parenthesis, ‘This
website is vulnerable’. Also to manually test for SQL injection
vulnerabilities, a single quote ( ' ) can be used as input. The single
quote is a special character in SQL, and if it is included in the
SQL query it will most likely generate an SQL statement error.
All the 64 Nigerian government websites were tested over a
period of two weeks within the month of August 2011 and
technical report was produced for each site, listing the types and
numbers of specific vulnerabilities. Each report was divided into
several sections listing four levels of security vulnerability: High,
Medium, Low and Informational. High level – these are critical
problems which could cause high risk damage to the website e.g
website defacement [1], database manipulation and modification
[6], phishing, identity theft [1] amongst others. Medium and Low
level – these are problems that could pose some level of risk to
users of the web application. Informational – these are messages
that probably have little risk to users, but still should be analyzed
238
by web developers because of the possibility of creating high
vulnerabilities. The sites tested were categorized into Agencies,
Judiciary, Law Enforcement/Defence, Media, Ministries,
Parastatals, States and Others categories.
4.0 RESULTS AND DISCUSSION
Out of the 64 Nigerian government sites tested, 27, which
represent 42.2% were vulnerable to XSS while 31.3% are
vulnerable to SQLi. It was also discovered that 37.5% and 70.3%
were vulnerable to unencrypted password and broken links
respectively. These findings are represented and summarized
mathematically in algebraic expressions using set theory as shown
in Table 1.
Table 1: Algebraic representation of e-government vulnerabilities
in Nigeria
Algebraic
Expressions
Interpretations
U = 64 the universal set, i.e total sample tested.
n(XSS) = 27 the number of websites vulnerable to
XSS.
n(SQLi) = 20 the number of websites vulnerable to
SQL injection
n(UP) = 24 the number of websites vulnerable to UP
n(BL) = 45 the number of websites vulnerable to BL
n(SQLi ∪ XSS) =
34
n(SQLi ∩ XSS) =
13
n(SQLi ∩ XSS 1 ) =
7
n(SQLi 1 ∩ XSS) =
14
n(U - (SQLi ∪
XSS) 1 ) = 30
the number of websites vulnerable to
both SQL injection & XSS
the number of websites exclusively
vulnerable to both SQL injection & XSS
the number of websites vulnerable to
SQL injection but not XSS
the number of websites vulnerable to
XSS but not SQL injection
the number of websites vulnerable to
other parameters under test but not XSS
nor SQL injection
Legend: SQLi – Structured Query Language injection
XSS – Cross Site Scripting
UP – Unencrypted Password
BL – Broken Links
Table 2 shows the distribution of vulnerability in each category,
for example apart from other categories which constitute the
highest percentage of XSS vulnerability; the judiciary followed by
one out of every four being vulnerable 25% relative to the
participation in the test.