Decision Making in the Searching Weakness Process of Server Side Web Application.

The vulnerability search process consists of three stages. At the first stage, the weakness of software and firmware components is identified and their suitability for exploitation. The second stage is devoted to choosing an existing or developing a new exploit for the identified weakness. The third stage configures the usability and reliability of the exploit for the identified vulnerability. The vulnerability of the system of the cyber protection object to negative technical impact is always based on the exploitation of its defects. Weakness identification with applicability assessment is a multi-stage process of choosing solutions under conditions of uncertainty. The efficiency of the weakness search process can be improved by using decision making theory. The idea is to reduce uncertainty by using an information model to search for weakness and to make it possible to process it quantitative analysis. For quantitative analysis, classical criteria for choosing solutions under uncertainty conditions were used. The information model is a hierarchy, has four levels and includes four types of elements. First level consists a techniques of Initial Access. First level consists a techniques of Initial Access, second – of category wekness Web Application. The third and fourth levels of assessment, respectively, of weaknesses and vulnerabilities. The expediency, rationality and reasonableness of solutions for finding defects is based on the application of proven sources of world-class expert experience. Thus, Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) defines Server-side Web Application class systems as an attractive attack target for hackers with the highest average number of potential defects in at least three components: Web Server, Web Application Server, DBMS Server. To find out the distribution of Server-side Web Application defects by characteristic classes, it is necessary to use the Open Worldwide Application Security Project (OWASP), for a detailed study of them - Common Weakness Enumeration (CWE). The application of the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE) complements the evaluation of the found defect.