"Ejecutar pruebas de seguridad para el sitio web entorno virtual de aprendizaje ( EVA) del instituto superior tecnológico tena"

Abstract

This study evaluates the security of the Virtual Learning Environment (EVA) website of the Instituto Superior Tecnológico Tena through the execution of specialized tests aimed at identifying and mitigating critical vulnerabilities. The research focused on analyzing common web application threats such as SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF), in alignment with the security guidelines established by the OWASP project. To achieve the proposed objectives, dynamic analysis tools such as Pentest-Tools and OWASP ZAP were used. These tools enabled automatic scanning of the live site to detect vulnerabilities without requiring access to the source code. OWASP ZAP was utilized to simulate attacks and assess the system’s behavior under potential exploitation, while Pentest-Tools provided a broader and more detailed scan of the web environment, including insecure configurations, missing HTTP security headers, and outdated technologies. The findings were thoroughly documented, and specific corrective actions were proposed for each identified vulnerability. As a result, a security testing protocol was developed that can be replicated in future versions of the system, strengthening the institution's security posture and promoting a culture of secure development and digital protection in educational environments.