Scripting Attacks Research Articles

Credential stuffing: new tools and stolen data drive continued attacks

Automated credential-stuffing attacks have been a boon to cyber criminals seeking to use stolen login credentials. The proliferation of data breaches where credentials are stolen has led to huge increases in automated script attacks, where fraudsters will use bots to attempt many account creations at the same time, maximising the chances of success.

JSCSP: a Novel Policy-Based XSS Defense Mechanism for Browsers

To mitigate cross-site scripting attacks (XSS), the W3C group recommends web service providers to employ a computer security standard called Content Security Policy (CSP). However, less than 3.7% of real-world websites are equipped with CSP according to Google's survey. The low scalability of CSP is incurred by the difficulty of deployment and non-compatibility for state-of-art browsers. To explore the scalability of CSP, in this paper, we propose Javascript based CSP (JSCSP), which is able to support most of real-world browsers but also to generate security policies automatically. Specifically, JSCSP offers a novel self-defined security policy which enforces essential confinements to related items, including Javascript functions, DOM elements and data access. Meanwhile, JSCSP has an efficient algorithm to automatically generate the policy directives and enforce them in a cascading way, which is more fine-grained and practical than the functionalities provided by CSP. We further implement JSCSP on a Chrome extension, and our evaluation shows that the extension is compatible with popular Javascript libraries. Our JSCSP extension can detect and block the tested attacking vectors extracted from the prevalent web applications. We state that JSCSP delivers better performance compared to other XSS defense solutions.

Cross-site scripting (XSS) attacks and mitigation: A survey

The results of the Cisco 2018 Annual Security Report show that all analyzed web applications have at least one vulnerability. It also shows that web attacks are becoming more frequent, specific and sophisticated. According to this report, 40% of all attack attempts lead to a method known as Cross-Site Scripting (XSS), which was the most widely used technique. According to the OWASP Top 10 - 2017 security risk, this type of attack is ranked No. 7, and it is noted that XSS is present in approximately two thirds of all web applications.This attack occurs when a malicious user uses a web application to execute or send malicious code on another user’s computer. Also, Cross Site Scripting is a type of cyber attack by which vulnerabilities are searched in a web application to introduce a harmful script. This implies that user information can be affected by stealing cookies, phishing, or attacking a company’s entire network.In this context, we have analyzed a total of 67 documents to collect information of the tools and methods that the scientific community has used to detect and mitigate these type of attack. It has been hypothesized that the trend in the proposal of traditional methods to mitigate XSS attacks is greater than the proposals that use some artificial intelligence technique. Our results show that the trend is increasing in the proposals that analyze the content of web pages (13.20%), as well as those that serve as a toolkit for web browsers (16.98%). Also, we have found that there is a low tendency in the use of artificial intelligence techniques to detect or mitigate this attack, using Web Classifiers (9.43%).

RLXSS: Optimizing XSS Detection Model to Defend Against Adversarial Attacks Based on Reinforcement Learning

With the development of artificial intelligence, machine learning algorithms and deep learning algorithms are widely applied to attack detection models. Adversarial attacks against artificial intelligence models become inevitable problems when there is a lack of research on the cross-site scripting (XSS) attack detection model for defense against attacks. It is extremely important to design a method that can effectively improve the detection model against attack. In this paper, we present a method based on reinforcement learning (called RLXSS), which aims to optimize the XSS detection model to defend against adversarial attacks. First, the adversarial samples of the detection model are mined by the adversarial attack model based on reinforcement learning. Secondly, the detection model and the adversarial model are alternately trained. After each round, the newly-excavated adversarial samples are marked as a malicious sample and are used to retrain the detection model. Experimental results show that the proposed RLXSS model can successfully mine adversarial samples that escape black-box and white-box detection and retain aggressive features. What is more, by alternately training the detection model and the confrontation attack model, the escape rate of the detection model is continuously reduced, which indicates that the model can improve the ability of the detection model to defend against attacks.

Computation analysis and review based on cross-site scripting attack

Computation analysis and review based on cross-site scripting attack

WebMTD: Defeating Cross-Site Scripting Attacks Using Moving Target Defense

Existing mitigation techniques for cross-site scripting attacks have not been widely adopted, primarily due to imposing impractical overheads on developers, Web servers, or Web browsers. They either enforce restrictive coding practices on developers, fail to support legacy Web applications, demand browser code modification, or fail to provide browser backward compatibility. Moving target defense (MTD) is a novel proactive class of techniques that aim to defeat attacks by imposing uncertainty in attack reconnaissance and planning. This uncertainty is achieved by frequent and random mutation (randomization) of system configuration in a manner that is not traceable (predictable) by attackers. In this paper, we present WebMTD, a proactive moving target defense mechanism that thwarts various kinds of cross-site scripting (XSS) attacks on Web applications. Relying on built-in features of modern Web browsers, WebMTD randomizes values of certain attributes of Web elements to differentiate the application code from the injected code and disallow its execution; this is done without requiring Web developer involvement or browser code modification. Through rigorous evaluation, we show that WebMTD has very a low performance overhead. Also, we argue that our technique outperforms all competing approaches due to its broad effectiveness, transparency, backward compatibility, and low overhead.

SEC‐H5: Secure and efficient integration of settings of enhanced HTML5 XSS vector defensive framework on edge network of fog nodes

SummaryThe authors introduce an enhanced HTML5 (H5) Cross‐Site Scripting (H5‐XSS) attack vector defensive model that safeguards and maintains the confidentiality of users accessing the web applications hosted on the fog nodes. Initially, the model performs in self‐training manner and estimates some features of H5 script code at the simulated desktop host systems of cloud infrastructure. Second, a process of H5 feature estimation gets re‐executed for the online generated HTTP response on the edge network of fog device. Any oddity in these two features sets results in the consequent nested context‐familiar sanitization of the distrustful script code on an installed fog nodes. The author design their framework structure on an open application infrastructural structure of Cisco IOx framework of various networked edge devices as fog nodes. The authors configure the tested bed of H5 web platforms on the nodes of the fog computing network for evaluating the malicious script alleviation capability of their model. Evaluation outcomes expose that the author's technique is skilled sufficient for sensing and excluding the suspicious H5 code with sufferable percentage of False Negatives (FNs), False Positives (FPs), and reduced overall performance overhead during the peak congestion of generation of sanitized HTTP response on the fog nodes.

An ensemble learning approach for XSS attack detection with domain knowledge and threat intelligence

Cross-site scripting (XSS) attack is one of the most dangerous attacks for web security. Traditional XSS detection methods mainly focus on the vulnerability itself, relying on static analysis and dynamic analysis, which appear weak in defending the flood of various kinds of payloads. In this paper, the XSS attack detection method is proposed based on an ensemble learning approach which utilizes a set of Bayesian networks, and each Bayesian network is built with both domain knowledge and threat intelligence. Besides, an analysis method is proposed to further explain the results, which sorts nodes in the Bayesian network according to their influences on the output node. The results are explainable to the end users. To validate the proposed method, experiments are performed on a real-world dataset about the XSS attack. The results show the priority of the proposed method, especially when the number of attacks increases. Moreover, the node sorting results could help the security team to cope with the attack in time.

A Framework for Preserving the Privacy of Online Users Against XSS Worms on Online Social Network

This article presents a hybrid framework i.e. OXSSD (Online Social Network-Based XSS-Defender) that explores cross-site scripting (XSS) attack vectors at the vulnerable points in web applications of social networks. Initially, during training phase, it generates the views for each request and formulates the access control list (ACL) which encompasses all the privileges a view can have. It also ascertains all possible injection points for extracting malicious attack vectors. Secondly, during recognition phase, after action authentication XSS attack vectors are retrieved from the extracted injection points followed by the clustering of these attack vectors. Finally, it sanitizes the compressed clustered template in a context-aware manner. This context-aware sanitization ensures efficient and accurate alleviation of XSS attacks from the OSN-based web applications. The authors will evaluate the detection capability of OXSSD on a tested suite of real world OSN-based web applications (Humhub, Elgg, WordPress, Drupal and Joomla). The performance analysis revealed that OXSSD detects injection of illicit attack vectors with very low false positives, false negatives and acceptable performance overhead.

基于代理的跨站脚本攻击防御研究

基于代理的跨站脚本攻击防御研究

Checksec Email Phishi Trasher Tool

In this faster networking world, Phishing has become the most popular practice among the criminals of the web. Various phishing types are deceptive, spear phishing, Email phishing, malware-based phishing, key loggers, session hijacking, man in middle, Trojan, DNS poisoning, cross-site scripting attacks. There is a need for automated tools to solve the problem by the victim side. Existing methods are regularly too tedious to be utilized in reality as far as recognition and relief session. Hence it is decided to propose a model which focuses on detecting and preventing the email phishing attack. In this paper, we present PhishiTrasher, another discovery and relief approach, where we initially propose another system for Deep Packet Inspection afterward use in phishing exercises through email and electronic correspondence. The proposed packet inspection approach comprises parts, vulnerable mark arrangement then continuous DPI. With the help of the phishing assault marks, outline the continuous DPI with the goal that PhishiTrasher can adapt to address the elements of phishing assaults in reality. PhishiTrasher gives better system movement administration to containing phishing assaults since it has the worldwide perspective of a system. Moreover, we assess PhishiTrasher utilizing a true test bed condition and databases comprising of genuine email with installed joins. Our broad test contemplate demonstrates that PhishiTrasher gives a powerful and effective answer for prevent phishing attacks through email. Results demonstrate that profiling should be possible with very high genuine.

Cross Site Scripting Attacks in Web-Based Applications

Web-based applications has turn out to be very prevalent due to the ubiquity of web browsers to deliver service oriented application on-demand to diverse client over the Internet and cross site scripting (XSS) attack is a foremost security risk that has continuously ravage the web applications over the years. This paper critically examines the concept of XSS and some recent approaches for detecting and preventing XSS attacks in terms of architectural framework, algorithm used, solution location, and so on. The techniques were analysed and results showed that most of the available recognition and avoidance solutions to XSS attacks are more on the client end than the server end because of the peculiar nature of web application vulnerability and they also lack support for self-learning ability in order to detect new XSS attacks. Few researchers as cited in this paper inculcated the self-learning ability to detect and prevent XSS attacks in their design architecture using artificial neural networks and soft computing approach; a lot of improvement is still needed to effectively and efficiently handle the web application security menace as recommended.

Towards Cross-site Scripting Vulnerability Detection in Mobile Web Applications

Cross-site scripting vulnerabilities are among the top ten security vulnerabilities affecting web applications for the past decade and mobile version web applications more recently. They can cause serious problems for web users such as loss of personal information to web attackers, including financial and health information, denial of service attacks, and exposure to malware and viruses. Most of the proposed solutions focused only on the Desktop versions of web applications and overlooked the mobile versions. Increasing use of mobile phones to access web applications increases the threat of cross-site scripting attacks on mobile phones. This paper presents work in progress on detecting cross-site scripting vulnerabilities in mobile versions of web applications. It proposes an enhanced genetic algorithm-based approach that detects cross-site scripting vulnerabilities in mobile versions of web applications. This approach has been used in our previous work and successfully detected the said vulnerabilities in Desktop web applications. It has been enhanced and is currently being tested in mobile versions of web applications. Preliminary results have indicated success in the mobile versions of web applications also. This approach will enable web developers find cross-site scripting vulnerabilities in the mobile versions of their web applications before their release.

Systematic adaptation of dynamically generated source code via domain‐specific examples

In modern web-based applications, an increasing amount of source code is generated dynamically at runtime. Web applications commonly execute dynamically generated code (DGC) emitted by third-party, black-box generators, run at remote sites. Web developers often need to adapt DGC before it can be executed: embedded HTML can be vulnerable to cross-site scripting attacks; an API may be incompatible with some browsers; and the program's state created by DGC may not be persisting. Lacking any systematic approaches for adapting DGC, web developers resort to ad-hoc techniques that are unsafe and error-prone. This study presents an approach for adapting DGC systematically that follows the program-transformation-by-example paradigm. The proposed approach provides predefined, domain-specific before/after examples that capture the variability of commonly used adaptations. By approving or rejecting these examples, web developers determine the required adaptation transformations, which are encoded in an adaptation script operating on the generated code's abstract syntax tree. The proposed approach is a suite of practical JavaScript program adaptations and their corresponding before/after examples. The authors have successfully applied the approach to real web applications to adapt third-party generated JavaScript code for security, browser compatibility, and persistence.

A survey of intrusion detection techniques

In today’s world, the number of companies is increasing day by day that help end users to express opinion i.e. social media management, to watch news, payment applications, retail, ecommerce etc. There are large amount of forms, which take personal information’s like username, password, social security number, credit card, debit card and account information. Thus the applications are vulnerable to security issues like phishing attacks, denial of service attacks, cross-site scripting attack and many more. This paper provides literature review of work done in these areas and their respective mitigations.

Plague of Cross-Site Scripting on the Web Applications: A Review, Taxonomy and Challenges

Now a day, web applications are developed by incorporating the advanced latest technologies on the client-side (e.g. AJAX, JavaScript, JFlash, etc.) and as well as server side (CGI, PHP and ASP) for enhancing the user experience of web applications with enhanced interactive response. Since these technologies are used to deliver critical services, they also turn out to be precious target for the attackers. Moreover cross-site scripting (XSS) attack is the topmost vulnerability found in the web applications. This paper presents a survey on the XSS worms on the real world web applications and the platforms of online social network. Numerous existing categories of XSS worms are discussed with the key goal to identify the exploitation of XSS worms on different platforms of web applications.

GMSA: Gathering Multiple Signatures Approach to Defend Against Code Injection Attacks

Code injection attacks (CIAs) exploit security vulnerabilities and computer bugs that are caused by processing invalid codes. CIA is a problem which hackers attempt to introduce to any new method, their objective being to bypass the protection system. In this paper, we present a tool called GMSA, developed to detect a variety of CIAs, for example, cross-site scripting (XSS) attack, SQL injection attack, shell injection attack (command injection attack), and file inclusion attack. The latter consists of local file inclusion and remote file inclusion. Our empirical analysis reveals that compared with existing research, gathering multiple signatures approach (GMSA) executes a precision performance (accuracy of the proposed algorithm is 99.45%). The false positive rate (FPR) of GMSA is 0.59%, which is low compared with what other research has reported. The low FPR is the most important factor. Ideally, the defense algorithm should balance between the FPR and true positive rate (TPR) because with existing methodologies, security experts can defend against a broad range of CIAs with uncomplicated security software. Typical protection methods yield a high FPR. Our method results in high TPR while minimizing the resources needed to address the false positive. GMSA can detect four types of CIA. This is more comprehensive than other research techniques that are restricted to only two major types of CIA, namely, SQL injection and XSS attacks.

Access Control Mechanism to Mitigate Cordova Plugin Attacks in Hybrid Applications

Hybrid application frameworks such as Cordova are more and more popular to create platform-independent applications (apps) because they provide special APIs to access device resources in a platform-agonistic way. By using these APIs, hybrid apps can access device resources through JavaScript. In this paper, we present a novel app-repackaging attack that repackages hybrid apps with malicious code; this code can exploit Cordova's plugin interface to steal and tamper with device resources. We address this attack and cross-site scripting attacks against hybrid apps. Since these attacks need to use plugins to access device resources, we refer to both of these attacks as Cordova plugin attacks. We further demonstrate a defense against Cordova plugin attacks through the use of a novel runtime access control mechanism that restricts access based on the mobile user's judgement. Our mechanism is easy to introduce to existing Cordova apps, and allows developers to produce apps that are resistant to Cordova plugin attacks. Moreover, we evaluate the effectiveness and performance of our mechanism.

Multiple Facets for Dynamic Information Flow with Exceptions

JavaScript is the source of many security problems, including cross-site scripting attacks and malicious advertising code. Central to these problems is the fact that code from untrusted sources runs with full privileges. Information flow controls help prevent violations of data confidentiality and integrity. This article explores faceted values , a mechanism for providing information flow security in a dynamic manner that avoids the stuck executions of some prior approaches, such as the no-sensitive-upgrade technique. Faceted values simultaneously simulate multiple executions for different security levels to guarantee termination-insensitive noninterference. We also explore the interaction of faceted values with exceptions, declassification, and clearance.

Web Application Security: Threats, Countermeasures, and Pitfalls

Penetration testing is a crucial defense against common web application security threats such as SQL injection and cross-site scripting attacks. A proposed web vulnerability scanner automatically generates test data with combinative evasion techniques, significantly expanding test coverage and revealing more vulnerabilities.