A session is a period of time linked to a user, which is initiated when he/she arrives at a web application and it ends when his/her browser is closed or after a certain time of inactivity. Attackers can hijack a user's session by exploiting session management vulnerabilities by means of session fixation and cross-site request forgery attacks.
Very often, session IDs are not only identification tokens, but also authenticators. This means that upon login, users are authenticated based on their credentials (e.g., usernames/passwords or digital certificates) and issued session IDs that will effectively serve as temporary static passwords for accessing their sessions. This makes session IDs a very appealing target for attackers. In many cases, an attacker who manages to obtain a valid ID of user’s session can use it to directly enter that session – often without arising user’s suspicion. A secure session management must be implemented in the development phase of web applications because it is the responsibility of the web application, and not the underlying web server.
Threat modeling is a systematic process that is used to identify threats and vulnerabilities in software and has become popular technique to help system designers think about the security threats that their system might face.
In this paper we design the threat modeling for session’s ID threat by using SeaMonster security modeling software, and then propose a secure session management that avoids the vulnerabilities. The proposed secure session management is designed to give trust authentication between the client and the server to avoid session hijacing attack by using both: server session’s ID and MAC address of the client.Visual Studio. Net 2008 is used in implementing the proposed system
After the software revolution in the last decades, the field of information technology had a tremendous evolution that made many organizations reach the best benefits from this evolution in technologies. The banking sector evolved their old system from ordinary system to the online system. The term E-banking appears to cover almost all bank operations such as money transactions, account management, instant reports, instant notifications. E-banking offers several advantages to clients, but this opens many challenges and motivates unauthorized parties to focus on creating methods and exploiting weaknesses to attack and steal critical information that belongs to the banking system or clients. Iraqi banks recently adopted E-banking se
... Show MoreImage steganography is undoubtedly significant in the field of secure multimedia communication. The undetectability and high payload capacity are two of the important characteristics of any form of steganography. In this paper, the level of image security is improved by combining the steganography and cryptography techniques in order to produce the secured image. The proposed method depends on using LSBs as an indicator for hiding encrypted bits in dual tree complex wavelet coefficient DT-CWT. The cover image is divided into non overlapping blocks of size (3*3). After that, a Key is produced by extracting the center pixel (pc) from each block to encrypt each character in the secret text. The cover image is converted using DT-CWT, then the p
... Show MoreAeromonas hydrophila is widely distributed throughout the world and causes diseases to animals and human exposed to contaminated environments such as water and soil. This study aimed to compare between isolates of A. hydrophila collected from clinical and environmental samples, through investigating the phenotype of some virulence factors in vitro, including hemolysin, protease, lipase, nuclease and biofilm formation ability. Also, the antimicrobial susceptibility for different antibiotics was determined using disc diffusion method. For genotypic identification of isolates and phylogenetic tree construction, 16S rDNA target gene was amplified and sequenced. The phenoty
... Show MoreSkin detection is classification the pixels of the image into two types of pixels skin and non-skin. Whereas, skin color affected by many issues like various races of people, various ages of people gender type. Some previous researchers attempted to solve these issues by applying a threshold that depends on certain ranges of skin colors. Despite, it is fast and simple implementation, it does not give a high detection for distinguishing all colors of the skin of people. In this paper suggests improved ID3 (Iterative Dichotomiser) to enhance the performance of skin detection. Three color spaces have been used a dataset of RGB obtained from machine learning repository, the University of California Irvine (UCI), RGB color space, HSV color sp
... Show MoreThis study aims to Statement of the relationship between Total Quality Management philosophy and Organizational performance from the point of view of the internal customer. A comparison has been made between two companies, one of which applies the requirements of TQM well and the other does not apply these requirements as the (General Company for Electrical Industries/ Diyala) and (General Company for Electrical Industries/ Baghdad) to conduct the search, During the questionnaire prepared for this purpose and distributed to a sample of 30 employees in the General Company for Electric Industries/ Diyala and (20) employees of the General Company for Electrical Industries/ Baghdad. Their answers were analyzed using a simple correlation coef
... Show MoreSoftware Defined Networking (SDN) with centralized control provides a global view and achieves efficient network resources management. However, using centralized controllers has several limitations related to scalability and performance, especially with the exponential growth of 5G communication. This paper proposes a novel traffic scheduling algorithm to avoid congestion in the control plane. The Packet-In messages received from different 5G devices are classified into two classes: critical and non-critical 5G communication by adopting Dual-Spike Neural Networks (DSNN) classifier and implementing it on a Virtualized Network Function (VNF). Dual spikes identify each class to increase the reliability of the classification
... Show MoreThis study aims to determine the petrophysical characteristics of the three wells in the Kifl Oilfield, central Iraq. The well logs were used to characterize hydrocarbon reservoirs to assess the hydrocarbon prospectivity, designate hydrocarbon and water-bearing zones, and determine the Nahr Umr Formation's petrophysical parameters. The Nahr Umr reservoir mainly consists of sandstone at the bottom and has an upper shale zone containing a small proportion of oil. The geophysical logs data from three oil wells include gamma-ray, resistivity, neutron, density, acoustic, and spontaneous potential logs. A gamma-ray log was employed for lithology differentiation, and a resistivity log was used to determine the response of distinct zones
... Show MoreResidential complexes have witnessed a great demand in most countries worldwide, as they are one of the main infrastructure elements, in addition to achieving a developed urban landscape. However, complex residential projects in developing countries face various factors that could be improved in their implementation, especially in Iraq. Sixty-two experts in residential complex projects were interviewed and surveyed to verify these projects' failure factors,. Fifty-one factors were the main failure factors, divided into four main components (leadership, management system, external forces, and project resources). The Relatively Important Index (RII) is used to determine the relative importance factors and obtain the top tw
... Show MoreIn dealing with media management phenomenon, concept and elements, we have tried, as much as possible, to build an abstract concept that can be analyzed and measured by analyzing the elements and components of the concept mentioned and explain it.
Before further consideration of the management of media campaigns, it is necessary to restore some points of media management so as not to understand the subject of campaign management as if it is independent of the concept of media management and the objectives that we seek to ensure its achievement. As we have noted that the concept of media management frames the administration mentioned as:
- Authority to manage the media institution.
- Operations supervised by the me
... Show MoreDigital technologies have come to shake up the traditional paradigm of learning, and to change the existing relationship of "know-teaching" to put in place a key concept of the time is "to accompany through digital tools Our intervention is part of a technical-pedagogical approach and will focus on an action research work in which we will try:
First, to present on line an accessible digital device that facilitates and organizes project planning and provides means to govern and control the quality of administrative acts.
Next, We will show the first results of the experimentation of this tool in our context of research represented by 355 directors of the secondary schools of the provincial delegation of Taza. Morocco, pointing out a