METHODS FOR TESTING THE SECURITY OF WEB APPLICATIONS

Abstract

Penetration testing is a key method of dynamic security assessment of computer networks, infrastructure, web and mobile applications aimed at identifying and exploiting vulnerabilities by simulating possible attacks by intruders. Traditionally, this process is carried out manually, requiring highly skilled cybersecurity professionals and considerable time to prepare, execute attacks, analyse the results and generate reports. However, with the growing complexity and number of cyber threats, there is a need for automated tools that can speed up the testing process while increasing its efficiency and accuracy. This article provides an overview of modern penetration testing tools, in particular those that use artificial intelligence (AI) methods to improve vulnerability detection and optimise pentesters’ performance. A number of popular commercial solutions are analysed, including RidgeBot, vPenTest, Metasploit Pro, BreachLock PTaaS, Edgescan, Burp Suite Professional, AppCheck, NetSPI, Astra, and Pentest-Tools.com. For each tool, we consider its main capabilities, the platforms it tests on, the main types of vulnerabilities it can detect (such as SQL injection, XSS, CSRF, RCE, etc.), as well as specific technical details of implementation. The article also examines the pricing policy for commercial platforms, which allows assessing the feasibility of their use depending on the needs and specifics of the enterprise. The article emphasises the importance of developing national solutions for penetration testing, in particular in Ukraine, where a tool of this level can play an important role in ensuring information security and reducing the risk of data leakage. The creation of Ukrainian solutions will also help to keep money in the country, supporting the national economy and creating new jobs for specialists. Given the increased level of cyber threats, the development of such tools is an urgent task to strengthen cybersecurity in both the private sector and public institutions.