SciELO - Scientific Electronic Library Online

vol.9 issue1A Practical Model to Perform Comprehensive Cybersecurity AuditsAgile Architecture Based on ISA-88 for the Design of Execution Control Chart in Distributed Applications using IEC-61499 author indexsubject indexarticles search
Home Pagealphabetic serial listing  

Services on Demand




Related links

  • Have no similar articlesSimilars in SciELO


Enfoque UTE

On-line version ISSN 1390-6542Print version ISSN 1390-9363


ASTUDILLO, Catalina et al. Attacking an ERP with Open Source Software. Enfoque UTE [online]. 2018, vol.9, n.1, pp.138-148. ISSN 1390-6542.

Information security is a growing concern in companies and organizations, being even higher when linked to financial platforms where sensitive information exists. This article explains the techniques used in the pentesting performed on the ERP software developed in APEX 5 by the University of Azuay. To achieve this goal, six stages has been considered for perform a penetration test: I) Conceptualization, where is defined the scope of the tests to be performed. II) Preparation of the laboratory, which identifies some of the tools used to initiate the safety tests. III) Obtaining of information, where the possible objects are recognized and scanned in greater depth to identify intrinsic characteristics for subsequently exploit them. IV) Analysis of the vulnerabilities found in the previous stage. V) Exploitation of vulnerabilities; and VI) Post-exploitation, a stage that contemplates the destruction of evidence of the attack and the conservation of the connection and the accesses obtained to extract information. All these stages were carried out within the facilities of the “Universidad del Azuay”, considering the development environment in which this software is currently located.

Keywords : Pentesting; IT Security; Hacking; ERP; APEX..

        · abstract in Spanish     · text in Spanish     · Spanish ( pdf )