Improving Authentication Security In Php Web Based Applications: A Case Study Of Court Case Management System In Zanzibar

ABSTRACT

The focus of this dissertation was Improving Authentication Security Mechanism in Web Based Applications: A Case Study of Court Case Management System in Zanzibar. The study focused on two objectives. The first objective was to analyze the weaknesses of authentication security mechanism on the existing web based CMS. The second one was to devise the secured web based CMS prototype. Three techniques were used in collecting data. These are document review, penetration tests and observation. Document review was used to review different reports, code review, published papers and recommended websites. Penetration test was used to test both the client-side and back-end of the system and observation was used to observe the implementation of SHA1 and MD5 encryption as a default mechanism in ZCMS. The data were collected in Zanzibar high court laboratory.

The researcher found that the username and password based login are widely used approaches to authentication for accessing information in web based systems where an unauthorized user may use SQL malicious code to inject and harm the system.

The researcher analyzed the existed information security patch and control mechanisms by using penetration test methods. He tested both the client-side and back-end of the system. The results indicated that there are vulnerabilities to the existed authentication mechanisms. To handle the problem the researcher has considered password_hash function technology and strong password controlled mechanism as a solution for aforementioned challenge. This technology provided the suitable mechanisms to protect unauthorized operations on electronic case information by enforcing encryption which results in stronger authentication.