Audit and Evaluation of Information System Security

Abstract

Web application security auditing remains fragmented in practice, with reconnaissance re-sults, testing evidence, vulnerability records, and final reports often distributed across mul-tiple tools and documents. This fragmentation reduces traceability, complicates audit man-agement, and increases the risk of overlooking security findings. This thesis proposes a structured web security auditing methodology based on OWASP WSTG and implements it through PentOS, an integrated platform using React, FastAPI, PostgreSQL, and Redis. PentOS supports target scoping, reconnaissance, vulnerability as-sessment, findings management, CVSS-based risk evaluation, and report generation in one workflow. The approach was validated on an authorized vulnerability disclosure program target (reconnaissance and non-intrusive analysis) and in a DVWA laboratory for confirmation of exploitable classes. The evaluation demonstrated centralized audit activities, traceable evi-dence, hybrid manual and automated testing, and structured reporting. Experimental results included a potential subdomain takeover scenario, validation of the findings workflow, and laboratory confirmation of reflected XSS and SQL injection. Findings were evaluated through contextual risk assessment and aligned with NIST CSF 2.0 and ISO/IEC 27001:2022 controls. The study demonstrates that a structured, reproducible web security auditing process can be supported through an integrated platform combining methodology, tooling, risk analysis, and reporting.