Cross-site Scripting Vulnerabilities Research Articles

Cross-site scripting (xss) vulnerability in the cirebon district health service web system

Cross-site scripting (xss) vulnerability in the cirebon district health service web system

Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code

Internet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. However, to do so manually is a costly and time-consuming process. To reduce these costs, we designed and implemented Code Auto-Remediation for Enhanced Security (CARES), a web application that automatically identifies and remediates the two most common types of vulnerabilities in Java-based web applications: SQL injection (SQLi) and Cross-Site Scripting (XSS). As is shown by a case study presented in this paper, CARES mitigates these vulnerabilities by refactoring the Java code using the Intercepting Filter design pattern. The flexible, microservice-based CARES design can be readily extended to support other injection vulnerabilities, remediation design patterns, and programming languages.

State-Sensitive Black-Box Web Application Scanning for Cross-Site Scripting Vulnerability Detection

Black-box web application scanning has been a popular technique to detect Cross-Site Scripting (XSS) vulnerabilities without prior knowledge of the application. However, several limitations lead to low efficiency of current black-box scanners, including (1) the scanners waste time by repetitively visiting similar states, such as similar HTML forms of two different products, and (2) using a First-In-First-Out (FIFO) fuzzing order for the collected forms has led to low efficiency in detecting XSS vulnerabilities, as different forms have different potential possibilities of XSS vulnerability. In this paper, we present a state-sensitive black-box web application scanning method, including a filtering method for excluding similar states and a heuristic ranking method for optimizing the fuzzing order of forms. The filtering method excludes similar states by comparing readily available characteristic information that does not require visiting the states. The ranking method sorts forms based on the number of injection points since it is commonly observed that forms with a greater number of injection points have a higher probability of containing XSS vulnerabilities. To demonstrate the effectiveness of our scanning method, we implement it in our black-box web scanner and conduct experimental evaluations on eight real-world web applications within a limited scanning time. Experimental results demonstrate that the filtering method improves the code coverage about 17% on average and the ranking method helps detect 53 more XSS vulnerabilities. The combination of the filtering and ranking methods helps detect 81 more XSS vulnerabilities.

Pengembangan Engine Web Crawler Sebagai Pencari Jejak Serangan Cyber Stored Cross-Site Scripting

Cross-site Scripting (XSS) vulnerability has long been a concern in web application security and is included in the OWASP Top 10 list. In 2017, XSS ranked 6th, but in 2021, it rose to the 4th position in the Injection category. This vulnerability exploits poorly validated input forms. This study aims to identify web pages that are vulnerable to Stored Cross-site Scripting attacks. The research is conducted by performing a search at three levels of depth. Web scraping is used to extract data from web pages, and the source code of the web pages is compared to Stored Cross-site Scripting attack patterns using the Knuth-Morris-Pratt algorithm. The results of the study indicate that some web pages exhibit detected attack patterns and traces of attacks, while others only show attack patterns without visible traces of attacks. Based on manual analysis of 56 randomly selected data from the research, it was found that 5 web pages had true positive values, indicating the presence of attack patterns and traces of attacks. Meanwhile, 49 other web pages had true negative values, where attack patterns were detected but no traces of attacks were found. This research provides insights into web pages vulnerable to Stored Cross-site Scripting attacks. The findings can be used to enhance web application security and reduce the potential for Cross-site Scripting attacks in the future.

N-Gram Tabanlı Tahmin Modeli ile XSS Saldırısı Algılama

The increment developments in technology has empowered the web applications. Meanwhile, the existence of Cross-Site Scripting (XSS) vulnerabilities in web applications has become a concern for users. In spite of the numerous current detection approaches, attackers have been exploiting XSS vulnerabilities for years, causing harm to the internet users. In this paper, a text-mining based approach to detect XSS attacks in web applications is introduced. This approach is built to extract a set of features from a publicly available source code files, which are then used to build a prediction model. The findings include few comparisons between Word Tokenization and N-Gram in accuracy, time spend to build the model and AUC-ROC curve. The results show that N-Gram tokenization outperforms the Word Tokenization.

Grey-Box Fuzzing Based on Reinforcement Learning for XSS Vulnerabilities

Cross-site scripting (XSS) vulnerabilities are significant threats to web applications. The number of XSS vulnerabilities reported has increased annually for the past three years, posing a considerable challenge to web application maintainers. Black-box scanners are mainstream tools for security engineers to perform penetration testing and detect XSS vulnerabilities. Unfortunately, black-box scanners rely on crawlers to find input points of web applications and cannot guarantee all input points are tested. To this end, we propose a grey-box fuzzing method based on reinforcement learning, which can detect reflected and stored XSS vulnerabilities for Java web applications. We first use static analysis to identify potential input points from components (i.e., Java code, configuration files, and HTML files) of the Java web application. Then, an XSS vulnerability payload generation method is proposed, which is used together with the reinforcement learning model. We define the state, action, and reward functions of three reinforcement learning models for XSS vulnerability detection scenarios so that the fuzz loop can be performed automatically. To demonstrate the effectiveness of the proposed method, we compare it against four state-of-the-art web scanners. Experimental results show that our method finds all XSS vulnerabilities and has no false positives.

Implementation of PSO Algorithm for Detection and Removal of XSS Attack

In recent years, managing the security over the web has gained its importance. Use of appropriate security handling techniques help to solve controversies and to extract interesting scenarios based on the content of the web page. Many varieties of vulnerabilities prevail and Cross-Site Scripting (XSS) vulnerability is ranked among the top ten risks found over the web which is a mandatory issue that requires a solution. XSS vulnerability injects malicious code in many ways that rise during the browsing session. Analysis should be made over the web page to identify whether the page is vulnerable or not. A dataset is formulated that contains malicious and benign data. Malicious data are obtained from the XSS archive [source: www.xssed.com] which contains the vulnerable XSS web pages and benign data are the web pages that are obtained through queries from the Google search engine. The major constraint is the number of Lines of Code (LOC) present in the web page. Five samples from the dataset were considered and algorithms are applied. About 24 attributes are used by the classifier. The samples vary in terms of content and size. Different optimization techniques are applied and the results are analyzed. Evaluation measures like Detection Rate (DR), False Detection Rate (FDR) and F Score (FS) are calculated based on the Confusion Matrix. The final content obtained after the „XSS Handler phase? that is to be displayed on the browser is tested using black box testing technique and also using XSS and SQL Injection Scanner tool. The tool is capable of identifying promising XSS code available in web pages. Based on the experiments, it was observed that the generation of paths using PPACO achieves better results in terms of DR, FDR and FS than other algorithms.

An automated approach to Web Offensive Security

Web Application Penetration testing is a popular approach that aims at discovering vulnerabilities by emulating real attacks. Experts often use a variety of publicly available attack tools, define attack methodologies and orchestrate them throughout the separate phases of testing. In doing so, they leverage personal experience and intuition, making any automation effort very challenging. In this paper, we propose the design and implementation of a framework for Web Penetration Testing that allows for the integration, as well as orchestration, of several types of attacks. We identify the generic tasks performed during a penetration test. Then, we provide a way to integrate attacks that implement such tasks in a component responsible for executing them. A further component holds the logic that decides which task to execute and aggregates the results of completed tasks. We also define the communication protocol between the two components to enable the orchestration of tasks across all phases of a testing campaign. As a concrete example of the application of the proposed framework, we show how it is possible to integrate several types of attacks, as well as embed an ad hoc defined behavioral model in order to discover cross-site scripting vulnerabilities.

Automating the Detection of Access Control Vulnerabilities in Web Applications

The importance of automated and reproducible security testing of web applications is growing, driven by increasing security requirements, short software development cycles, and constraints with respect to time and budget. Existing automated security testing tools are already well suited to detect some types of vulnerabilities, e.g., SQL injection or cross-site scripting vulnerabilities. However, other vulnerability types are much harder to uncover in an automated way. One important representative of this type are access control vulnerabilities, which are highly relevant in practice as they can grant unauthorized users access to security-critical data or functions in web applications. In this paper, a practical solution to automatically detect HTTP GET request-based access control vulnerabilities in web applications is presented. The solution is based on previously proposed ideas, which are extended with novel approaches to enable completely automated access control testing with minimal configuration effort, which in turn enables frequent and reproducible testing. An evaluation with seven web applications based on different technologies demonstrates the general applicability of the solution and that it can automatically uncover most access control vulnerabilities while keeping the number of false positives low.

GAXSS: Effective Payload Generation Method to Detect XSS Vulnerabilities Based on Genetic Algorithm

In the fields of social networking, media, and management, web applications on the Internet play a very indispensable role. A large amount of personal privacy information and login tokens make web applications often targeted by hackers. Cross-site scripting attacks are the most common method used to steal data from web applications. To solve the security risks caused by cross-site scripting vulnerabilities, security personnel need to actively discover these vulnerabilities to better defend against the harm. We proposed a novel genetic algorithm-based fuzzing scheme to address this problem. First, a small number of initial attack vectors are generated according to the interactive environment of the web application and then the attack vectors are sequenced into genes. Combined with the grammatical structure features of cross-site scripting and common bypass methods, the gene sequences are iteratively optimized and improved. Finally, the generated high-quality vectors are used to detect potential cross-site scripting threats in the application (we named the implementation of this approach GAXSS). The method we proposed can automatically detect the vulnerability of page interaction points and can obtain better detection results without a large number of test dictionaries, and the time cost is also reasonable. We have conducted vulnerability tests on many common open-source web applications, with a precision rate of 1.0 and an accuracy rate over 0.98. In addition, we also compared GAXSS with other well-known scanners and state-of-the-art detection methods. Its comprehensive performance is better, and it can effectively detect vulnerabilities.

Web Security: Emerging Threats and Defense

Web applications have become a widely accepted method to support the internet for the past decade. Since they have been successfully installed in the business activities and there is a requirement of advanced functionalities, the configuration is growing and becoming more complicated. The growing demand and complexity also make these web applications a preferred target for intruders on the internet. Even with the support of security specialists, they remain highly problematic for the complexity of penetration and code reviewing methods. It requires considering different testing patterns in both codes reviewing and penetration testing. As a result, the number of hacked websites is increasing day by day. Most of these vulnerabilities also occur due to incorrect input validation and lack of result validation for lousy programming practices or coding errors. Vulnerability scanners for web applications can detect a few vulnerabilities in a dynamic approach. These are quite easy to use; however, these often miss out on some of the unique critical vulnerabilities in a different and static approach. Although these are time-consuming, they can find complex vulnerabilities and improve developer knowledge in coding and best practices. Many scanners choose both dynamic and static approaches, and the developers can select them based on their requirements and conditions. This research explores and provides details of SQL injection, operating system command injection, path traversal, and cross-site scripting vulnerabilities through dynamic and static approaches. It also examines various security measures in web applications and selected five tools based on their features for scanning PHP, and JAVA code focuses on SQL injection, cross-site scripting, Path Traversal, operating system command. Moreover, this research discusses the approach of a cyber-security tester or a security developer finding out vulnerabilities through dynamic and static approaches using manual and automated web vulnerability scanners.

Vulnerability Scanning Technology on Web Applications

Modern society is far more dependent on web applications than the previous generations. Even though our dependence is increasing rapidly, the security level is far lower than required. To guarantee the security of the data system in the industry and our daily life, it is especially crucial to find out web application security vulnerabilities quickly and accurately. A vulnerability is a state of being unprotected from the prospect of an attack. It permits an attacker to gain a certain level of command of the site, and possibly the hosting server. One such vulnerability is the cross-site scripting vulnerability. In this exposition, a generic vulnerability scanner is proposed which can be customized to find any number of vulnerabilities. The scanner maps out the website and gives a report of all the vulnerabilities. For the purpose of evaluation, it has been customized to find XSS vulnerability in web applications.

The Limitations of Cross-Site Scripting Vulnerabilities Detection and Removal Techniques

Web applications have become very important tools in our daily activities as we use them to share and get information, conduct businesses, and interact with family and friends on social media through the Internet. Despite their importance, web applications are plagued with many security vulnerabilities that enable hackers to attack them and compromise user information and privacy. Cross-site scripting vulnerabilities are a type of injection vulnerabilities existing in web applications. They can lead to attacks in web applications due to the lack of proper validation of input data in the affected web pages of an application. Many approaches and techniques have been proposed to mitigate this type of vulnerabilities. However, these solutions have some limitations and cross-site scripting vulnerabilities still remain as a major security problem for web applications. This paper explores and presents the existing techniques for detecting and for removing cross-site scripting vulnerabilities in web application. It gives an overview of cross-site scripting as a security issue in web application and its different types. The advantages as well as the limitations of each techniques are highlighted and discussed. Based on the limitations, some possible future research directions are identified, and recommendations are given as reference for researchers interested in this topic.

SIoTFuzzer: Fuzzing Web Interface in IoT Firmware via Stateful Message Generation

Cyber attacks against the web management interface of Internet of Things (IoT) devices often have serious consequences. Current research uses fuzzing technologies to test the web interfaces of IoT devices. These IoT fuzzers generate messages (a test case sent from the client to the server to test its functionality) without considering their dependency, which is unlikely to bypass the early check of the server. These invalid test cases significantly reduce the efficiency of fuzzing. To overcome this problem, we propose a stateful message generation (SMG) mechanism for IoT web fuzzing. SMG addresses two problems in IoT fuzzing. First, we retrieve the message dependency by using web front-end analysis and status analysis. These dependent messages, which can easily bypass the server check, are used as a valid seed. Second, we adopt a multi-message seed format to preserve the dependency of the messages when mutating the seed to get a valid test case, so that the test case can bypass the state check of the server to make a valid test. Message dependency preservation is implemented by our proposed parameter mutation and structural mutation methods. We implement SMG in our IoT fuzzer, SIoTFuzzer, which applies IoT firmware on the latest Linux-based simulation tool, FirmAE. We test nine IoT devices including a router and an IP camera and adopt a vulnerability detection mechanism. Our evaluation results show that (1) SIoTFuzzer is capable of finding real-world vulnerabilities in IoT devices; (2) our SMG is effective as it enables Boofuzz (a popular protocol fuzzer) to find command injection and cross-site scripting (XSS) vulnerabilities; and (3) compared to FirmFuzz, SIoTFuzzer found all the vulnerabilities in our benchmarks, while FirmFuzz found only four—the efficiency of our tool increased by 20.57% on average.

Discovering reflected cross-site scripting vulnerabilities using a multiobjective reinforcement learning environment

Tools that automate testing of web applications for Cross-Site Scripting (XSS) vulnerabilities perform well when they have a strong knowledge base. Though, they heavily rely on brute force, which is not always an effective choice. On the other hand, expert penetration testers adopt exploit methods that are more accurate, but often not structured. We propose to solve the above mentioned problems, by designing and implementing an intelligent agent, called Suggester, that recommends actions to penetration testers. First, a black-box testing methodology inspired by a penetration tester’s behavior, is developed. Such methodology consists of sending a sequence of strings to a web application and observing the responses. Then, an agent is trained to produce attack strings using the framework of a Multiobjective Reinforcement Learning environment (MORL), with a parameterized action space. Each complete attack string is identified as a separate objective to reach. Q-Learning is used to train the agent upon separate, unrelated objectives. Then, the learned actions are suggested to a human-in-the-loop, who performs the actions and collects observations. This allows to orchestrate the agent into pursuing the right objective and selecting the next best action to recommend. The final evaluation proves the scalability of the proposed solution, as well as show an increase in accuracy when compared to other automated scanners.

Nscanner: Vulnerabilities Detection Tool for Web Application

Internet has been dominating the world nearly a decade. Web application is known to be the most widespread platform of the internet especially when it comes to share resources, e-commerce services, education and business platforms. Since the usage of web applications are increasing dramatically, it’s becoming more vulnerable for security attacks. Each year, organizations facing many security attacks towards their web applications. Although many security practices and mitigations have been applying in web application, however there are still some security loophole issues can be found in web application. For instance, these loopholes can be referred as lack of secure coding (standards) implemented in web application, lack of formal security training approach for web developers and improper security testing for their web application. Besides, social engineering attacks also tremendously increasing each year. Many organizations were compromised through phishing attacks due to lack of awareness among users (employees). As a solution to overcome the issues, a research project will be carried out to implement a system called Nscanner to detect Structured Query Language injection (SQLi) and Cross-Site Scripting (XSS) vulnerabilities for web application. Moreover, the developer also will design a malware detection feature based on machine learning approach to detect malware found in attachments from emails in order to prevent malware phishing attacks.

Research on Network Security Vulnerability Detection Method Based on Artificial Intelligence

The Internet is gradually being used in various fields, and people’s lives are increasingly dependent on Internet technology. In network construction, we need to focus on maintaining network security and protecting the legitimate interests of users. In the network security defense system, network security vulnerability detection is an important part. Network attacks and network security vulnerability detection technology updates have shown a confrontational spiral in the field of network information security. One of the key contents of network security protection is how to effectively detect unknown network security vulnerabilities. In terms of network security vulnerability analysis, this paper studies cross-site scripting vulnerability analysis, SSL security vulnerability analysis, and binary vulnerability analysis; in terms of network security vulnerability prediction, it discusses random forest prediction models, convolutional neural network prediction models, and support vector machine predictions. Model; combined with common rules for network security vulnerability detection, comparative analysis of the network security vulnerability detection effects of several typical machine learning methods.

XSS MBot: Mobile Botnet for Stealthy DDoS Attacks

Mobile devices are overgrowing; nowadays people are using mobile devices for different activities. Over the years malware attacks on mobile devices are increasing, the primary intention of the attacker is to steal sensitive information and turn the infected mobile device into a member of the botnet. We studied differences between traditional botnets and mobile botnets, also analyzed different mobile botnet attacks. Mobile malware applications spread through Cross-site Scripting vulnerabilities in trusted websites. Developed a mobile malware which can perform Denial-of-service attacks and used this malware to test and review mobile botnet attacks. We also studied solutions to prevent these mobile botnet attacks.

Decision procedures for path feasibility of string-manipulating programs with complex operations

The design and implementation of decision procedures for checking path feasibility in string-manipulating programs is an important problem, with such applications as symbolic execution of programs with strings and automated detection of cross-site scripting (XSS) vulnerabilities in web applications. A (symbolic) path is given as a finite sequence of assignments and assertions (i.e. without loops), and checking its feasibility amounts to determining the existence of inputs that yield a successful execution. Modern programming languages (e.g. JavaScript, PHP, and Python) support many complex string operations, and strings are also often implicitly modified during a computation in some intricate fashion (e.g. by some autoescaping mechanisms). In this paper we provide two general semantic conditions which together ensure the decidability of path feasibility: (1) each assertion admits regular monadic decomposition (i.e. is an effectively recognisable relation), and (2) each assignment uses a (possibly nondeterministic) function whose inverse relation preserves regularity. We show that the semantic conditions are expressive since they are satisfied by a multitude of string operations including concatenation, one-way and two-way finite-state transducers, replaceall functions (where the replacement string could contain variables), string-reverse functions, regular-expression matching, and some (restricted) forms of letter-counting/length functions. The semantic conditions also strictly subsume existing decidable string theories (e.g. straight-line fragments, and acyclic logics), and most existing benchmarks (e.g. most of Kaluza’s, and all of SLOG’s, Stranger’s, and SLOTH’s benchmarks). Our semantic conditions also yield a conceptually simple decision procedure, as well as an extensible architecture of a string solver in that a user may easily incorporate his/her own string functions into the solver by simply providing code for the pre-image computation without worrying about other parts of the solver. Despite these, the semantic conditions are unfortunately too general to provide a fast and complete decision procedure. We provide strong theoretical evidence for this in the form of complexity results. To rectify this problem, we propose two solutions. Our main solution is to allow only partial string functions (i.e., prohibit nondeterminism) in condition (2). This restriction is satisfied in many cases in practice, and yields decision procedures that are effective in both theory and practice. Whenever nondeterministic functions are still needed (e.g. the string function split), our second solution is to provide a syntactic fragment that provides a support of nondeterministic functions, and operations like one-way transducers, replaceall (with constant replacement string), the string-reverse function, concatenation, and regular-expression matching. We show that this fragment can be reduced to an existing solver SLOTH that exploits fast model checking algorithms like IC3. We provide an efficient implementation of our decision procedure (assuming our first solution above, i.e., deterministic partial string functions) in a new string solver OSTRICH. Our implementation provides built-in support for concatenation, reverse, functional transducers (FFT), and replaceall and provides a framework for extensibility to support further string functions. We demonstrate the efficacy of our new solver against other competitive solvers.

A Survey of Exploitation and Detection Methods of XSS Vulnerabilities

As web applications become more prevalent, web security becomes more and more important. Cross-site scripting vulnerability abbreviated as XSS is a kind of common injection web vulnerability. The exploitation of XSS vulnerabilities can hijack users’ sessions, modify, read and delete business data of web applications, place malicious codes in web applications, and control victims to attack other targeted servers. This paper discusses classification of XSS, and designs a demo website to demonstrate attack processes of common XSS exploitation scenarios. The paper also compares and analyzes recent research results on XSS detection, divides them into three categories according to different mechanisms. The three categories are static analysis methods, dynamic analysis methods and hybrid analysis methods. The paper classifies 30 detection methods into above three categories, makes overall comparative analysis among them, lists their strengths and weaknesses and detected XSS vulnerability types. In the end, the paper explores some ways to prevent XSS vulnerabilities from being exploited.