A Review of Web Application Security Risks: Auditing and Assessment of the Dark Web

The Darkweb is an anonymous Internet network that keeps users communicating over an unknown, encrypted and highly anonymous channel. The most vital feature of the dark web is anonymity, and that makes it a favourite place for criminals as it is challenging for Legal Enforcement Agencies (LEAs) to track those IP addresses of hosted services and the dark web users they are hidden services. This point motivated us to review auditing and assessment of various applications on the dark web. In this paper, we proposed a methodology for identifying vulnerabilities in the dark web to understand the negligence of hosting web applications as in the surface web. We used the most common known vulnerabilities and respective Common Vulnerabilities and Exposures (CVEs), which are part of the list of publicly disclosed computer security flaws for around 600 websites and were able to identify 294 (around 50%) websites in the dark web found to be vulnerable and exploitable. Identifying vulnerabilities and exploiting methods helps in tracing users and their transactions with that website. The approach helped our further research integrate with a framework in combating the anonymity and invisible threat for monitoring criminal activities.