Definición de un modelo de validación de herramientas para la verificación de la seguridad en aplicaciones web

Abstract

Abstract: The objective of this research is to define a validation model of tools of security in web applications. Nowadays, any web application is exposed to various threats and the existence of a large number of programming languages ​​and frameworks in which they are developed, there is no clear way to select the tools of security that adapt to different web applications. Various scenarios were taken projects on the Github platform where the validation model was applied to each of these. The model consists of 6 phases in which various tools were analyzed. security like Semgrep, OWASP Dependency-Check and SonarQube for static analysis application security analysis (SAST), and OWASP ZAP, Skipfish and Nikto for dynamic analysis Application Security System (DAST). The results show that SonarQube and Semgrep stand out for their performance and ease of use, while OWASP ZAP is distinguished by its easy integration and great documentation.