Abstract
Existing mitigation techniques for cross-site scripting attacks have not been widely adopted, primarily due to imposing impractical overheads on developers, Web servers, or Web browsers. They either enforce restrictive coding practices on developers, fail to support legacy Web applications, demand browser code modification, or fail to provide browser backward compatibility. Moving target defense (MTD) is a novel proactive class of techniques that aim to defeat attacks by imposing uncertainty in attack reconnaissance and planning. This uncertainty is achieved by frequent and random mutation (randomization) of system configuration in a manner that is not traceable (predictable) by attackers. In this paper, we present WebMTD, a proactive moving target defense mechanism that thwarts various kinds of cross-site scripting (XSS) attacks on Web applications. Relying on built-in features of modern Web browsers, WebMTD randomizes values of certain attributes of Web elements to differentiate the application code from the injected code and disallow its execution; this is done without requiring Web developer involvement or browser code modification. Through rigorous evaluation, we show that WebMTD has very a low performance overhead. Also, we argue that our technique outperforms all competing approaches due to its broad effectiveness, transparency, backward compatibility, and low overhead.
Highlights
Despite numerous proposed works on detection and prevention of XSS attacks [1,2,3,4,5,6], they are still among the most common threats on Web applications; examples are the recently discovered XSS vulnerabilities on Amazon [7], EBay [8], Twitter [9], Drupal CMS [10], and WordPress Tooltipy plugin [11].According to a recent report by Akamai on the state of the Internet in 2018 [12], XSS is still among the top three most prevalent classes of attacks on Web applications
We present an Moving target defense (MTD) approach, called WebMTD, that defeats various types of XSS attack on Web applications, including persistent, nonpersistent, and DOMbased XSS, in a manner that is transparent to the Web application, Web browsers, and developers
We present WebMTD, a light-weight defense mechanism for Web applications that is capable of thwarting various types of cross-site scripting (XSS) attacks
Summary
Despite numerous proposed works on detection and prevention of XSS attacks [1,2,3,4,5,6], they are still among the most common threats on Web applications; examples are the recently discovered XSS vulnerabilities on Amazon [7], EBay [8], Twitter [9], Drupal CMS [10], and WordPress Tooltipy plugin [11]. While attackers have traditionally benefited from TOCTOU design flaws [17], defenders can benefit from this flaw by altering certain system parameters in the gap between the implementation of the attacker’s exploit and its execution on the target, to defeat several classes of code injection attacks on Web applications. We present an MTD approach, called WebMTD, that defeats various types of XSS attack on Web applications, including persistent, nonpersistent, and DOMbased XSS, in a manner that is transparent to the Web application, Web browsers, and developers. WebMTD makes a Web application XSS-resistant by automatically adding new attributes to certain HTML elements and randomizing their values over time It automatically inserts necessary security check functions into the Web application and instructs Web browsers to invoke them before interpreting client-side code blocks or event handlers.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
