AVART (Automated Vulnerability Analysis and Reporting Tool) is a DAST (Dynamic Analysis and Security Testing) Tool developed to automate the process of vulnerability assessment and analysis of large number of web applications and thereby reduce the time and manual effort required. An easy to use web based interface along with a dashboard was a primary requirement of the tool to make it possible for users with all minimal knowledge of application security to use the application. The user interface of the application is shown in figure 1 through 3. Detecting most common vulnerabilities efficiently Web applications are frequent targets of cyber-attacks. To defend against such attacks, it is imperative to patch vulnerabilities present in a web application and hence vulnerability analysis is an important part of web application security. Manually analyzing a medium to large-sized web application is a time-consuming and error-prone process due to the presence of many components. A tool that can automatically analyze and report vulnerabilities in a web application can reduce the effort needed for vulnerability analysis, thereby enabling web application owners to fix and patch the vulnerabilities before they can be exploited. AVART (Automated Vulnerability Analysis and Reporting Tool) is such a tool that comprises automated vulnerability analysis of web applications and a dashboard for reporting. AVART can detect most common web application issues in a fast and efficient manner. Features of the application The application was designed for vulnerability analysis of production web applications. To prevent damage to production web applications, the application does not perform high risk vulnerability analysis including injection attacks. The application provides the following features for testing common web applications vulnerabilities. • Analyse web applications for SSL issues • Analyse web applications for security misconfiguration like missing HTTP security headers, vulnerable HTTP methods • Analyse web applications for usage of known vulnerable components • Analyse web applications for sensitive information disclosure vulnerabilities • Analyse web servers and discovery of open ports • Scheduled batch analysis of web applications to collectively scan a large number of web applications simultaneously • Dashboard with reporting feature for easy reporting of vulnerabilities discovered along with mitigation measures User Classes and Characteristics • Security Auditors: Security auditors can use the AVART tool to analyse websites for security issues without having to scan each website one by one and let the tool do the scanning automatically for all the websites in the domain of the security auditor. • Project Coordinators: Project coordinators can use the tool periodically on their websites and applications to discover vulnerabilities on their own and fix them based on the solutions provided in the reports. • Developers: Developers can use the tool to discover and subsequently fix vulnerabilities before submitting the application for audit. • Any Other Stake Holder: The application is user friendly and easy to use and hence should be usable by any user with some knowledge about application security. Benefits of the application • Quick and easy analysis of web applications for discovery of common web application vulnerabilities without minimal knowledge of application security. • Easy reporting via dashboard. • No licensing restrictions and hence can be used simultaneously by many users. • Automated scan allows for simultaneous scanning of a large number of web applications thereby reducing the manual effort required for discovery and reporting of vulnerabilities. • Solutions for mitigation enable quick resolution of security issues. Technology used The tool is developed as a web based application and the backend is developed in the form of an API to enable integration with other systems in the future. Following technologies were used for development of the application • Frontend: Angular JS Bootstrap jQuery for the front end • Backend: NodeJs PHP OpenSSL MySQL database Future Road Map To develop a full fledged DAST tool for security analysis and penetration testing of web and mobile applications that can be used for easy, efficient and effective management of various parameters of application security.