Scripting Attacks Research Articles

Cross Channel Scripting and Code Injection Attacks on Web and Cloud-Based Applications: A Comprehensive Review.

Cross channel scripting (XCS) is a common web application vulnerability, which is a variant of a cross-site scripting (XSS) attack. An XCS attack vector can be injected through network protocol and smart devices that have web interfaces such as routers, photo frames, and cameras. In this attack scenario, the network devices allow the web administrator to carry out various functions related to accessing the web content from the server. After the injection of malicious code into web interfaces, XCS attack vectors can be exploited in the client browser. In addition, scripted content can be injected into the networked devices through various protocols, such as network file system, file transfer protocol (FTP), and simple mail transfer protocol. In this paper, various computational techniques deployed at the client and server sides for XCS detection and mitigation are analyzed. Various web application scanners have been discussed along with specific features. Various computational tools and approaches with their respective characteristics are also discussed. Finally, shortcomings and future directions related to the existing computational techniques for XCS are presented.

A Survey on an Investigation of Detection & Prevention Methods for Cross-Site Scripting (XSS) Attacks

Currently, web applications are utilized for constituting data along with service discharges over the World Wide Web. While these are dynamically used for security-primary services, thus they have ended up being a popular and valuable objective for the web-related vulnerabilities. Despite the fact that few suspicious systems have been developing to fortify the cutting edge web applications and improve the impelled against them. Numerous techniques are available to emphasize very serious vulnerability in the advanced web applications. Along with the multiplicity of protection vulnerabilities, Cross site scripting attack is the most probable vulnerability found in the present web applications on SNS condition which to be a infection for the cutting edge web applications. As of late, practically 70% of all vulnerabilities on the web were sorted as XSS-related vulnerabilities. Cross site scripting attacks grant an aggressor to implement the malicious contents on the individual's internet browser to bringing different indications, for example, data conciliation, taking of cookies, credit card numbers, and passwords and so on. This review paper centers on the different identification and remedial strategies utilized in the existing works for XSS attacks, alongside discussion about advantages and disadvantages of every technique. It has additionally discussed about an eminent level of technical categorization of XSS attacks.

Bayesian network structure learning with improved genetic algorithm

As an important model of machine learning, Bayesian networks (BNs) have received a lot of attentions since they can be used for classification via probabilistic inference. However, since it is a complicated combination optimization problem, BN structure learning cannot be solved with classic convex optimization algorithms. Hence, evolutionary algorithms provide an alternative way to find a global solution to BN structure learning problem. In this paper, we improve the biased random-key genetic algorithm to solve the BN structure learning problem. Meanwhile, we apply a local optimization model as its decoder to improve the performance of the proposed algorithm. Finally, we conduct our experiments on nine benchmark networks and a real dataset of cross-site scripting (XSS) attack. Experimental results show that the proposed algorithm can obtain more accurate solutions than other state-of-the-art algorithms and achieve a good performance in XSS attack detection for web security.

XSS and SQL Injection Detection and Prevention Techniques (A Review)

In modern times every human being rely upon the internet for their scant to hefty needs as internet offers vast amount of information to users, so it’s availability to users is indispensable. Major objectives of security are availability, integrity and confidentiality. Cross Site Scripting (XSS) and SQL Injection Attack (SQLIA) is a generic and critical security issue towards to the web application and database security. In general, not well validated and verified web applications are highly prone and vulnerable by the attackers. Due to the creative and dynamic XSS and SQLIA methods and techniques, users can save their valuable, integral and confidential data in the web site to save their market stability towards their self as well as social enrichment. Many tools and techniques are addressed to the references regarding the XSS and SQL Injection issues, but we are present and used pattern matching techniques in SQL statements to implement the SQLIA and XSS in web application. At the outset pattern matching algorithm is used and gets better solution towards on implementation of SQLIA and XSS attacks and preventions.

Cross-Site Scripting Attacks and Defensive Techniques: A Comprehensive Survey

The advancement of technology and the digitization of organizational functions and services have propelled the world into a new era of computing capability and sophistication. The proliferation and usability of such complex technological services raise several security concerns. One of the most critical concerns is cross-site scripting (XSS) attacks. This paper has concentrated on revealing and comprehensively analyzing XSS injection attacks, detection, and prevention concisely and accurately. I have done a thorough study and reviewed several research papers and publications with a specific focus on the researchers’ defensive techniques for preventing XSS attacks and subdivided them into five categories: machine learning techniques, server-side techniques, client-side techniques, proxy-based techniques, and combined approaches. The majority of existing cutting-edge XSS defensive approaches carefully analyzed in this paper offer protection against the traditional XSS attacks, such as stored and reflected XSS. There is currently no reliable solution to provide adequate protection against the newly discovered XSS attack known as DOM-based and mutation-based XSS attacks. After reading all of the proposed models and identifying their drawbacks, I recommend a combination of static, dynamic, and code auditing in conjunction with secure coding and continuous user awareness campaigns about XSS emerging attacks.

GraphXSS: An efficient XSS payload detection approach based on graph convolutional network

With the rapid development of the Internet age today, Web applications have become very common in modern society. Web applications are often applied to a social network, media, management, etc., and usually contain a large amount of personal privacy information, which makes Web applications a common target for hackers. The most common method for stealing private information from web applications is cross-site scripting attacks. Attackers frequently use cross-site scripting vulnerabilities to steal victims’ identity information or hijack login tokens. Therefore, we proposed a cross-site scripting payload detection model based on graph convolutional networks, which could identify the cross-site scripting payload in the content submitted by the user (We termed our implementation of this approach, GraphXSS). We preprocessed the sample, and constructed the processed data into a graph structure, and finally used the graph convolutional network and the residual network to train the cross-site scripting detection model. In experiments, the model based on graph convolutional network (GCN) could achieve AUC value of 0.997 under small sample conditions. Compared with the detection model after adding the residual network structure, the model could converge and stabilize under the multi-layer, and could make the accuracy rate reached 0.996.

An implementation of real-time detection of cross-site scripting attacks on cloud-based web applications using deep learning

Cross-site scripting has caused considerable harm to the economy and individual privacy. Deep learning consists of three primary learning approaches, and it is made up of numerous strata of artificial neural networks. Triggering functions that can be used for the production of non-linear outputs are contained within each layer. This study proposes a secure framework that can be used to achieve real-time detection and prevention of cross-site scripting attacks in cloud-based web applications, using deep learning, with a high level of accuracy. This project work utilized five phases cross-site scripting payloads and Benign user inputs extraction, feature engineering, generation of datasets, deep learning modeling, and classification filter for Malicious cross-site scripting queries. A web application was then developed with the deep learning model embedded on the backend and hosted on the cloud. In this work, a model was developed to detect cross-site scripting attacks using multi-layer perceptron deep learning model, after a comparative analysis of its performance in contrast to three other deep learning models deep belief network, ensemble, and long short-term memory. A multi-layer perceptron based performance evaluation of the proposed model obtained an accuracy of 99.47%, which shows a high level of accuracy in detecting cross-site scripting attacks.

Smart Payment Application Security Optimization from Cross-Site Scripting (XSS) Attacks Based on Blockchain Technology

The digital era is an era everyone has used technology and they are connected to each other very easily. The Smart Payment application is one of the applications that is developing in the digital era. This application is not equipped with security, so there is a concern that hackers will try to change user or even change user data. One of the possible attacks on this application is a cross-site attack (XSS). It is a code injection attack on the user side. Security in the Smart Payment application needs to be improved so that data integrity is maintained. In this research, security optimization is carried out by implementing blockchain. Blockchain has the advantage in terms of security with the concept of decentralization by utilizing a consensus algorithm that can eliminate and make improvements to data changes made by hackers. The result obtained from this study is the implementation of blockchain to maintain the security of payment transaction data on the Smart Payment application from XSS attacks. It is proven by the results of the vulnerability before and after blockchain implementation. Before the implementation of the vulnerability is found, 1 XSS vulnerability had a high level of overall risk. Meanwhile, the result of the vulnerability after blockchain implementation was not found from XSS attacks (the XSS vulnerability was 0 or not found).

A Hybrid Machine Learning Model to Detect Reflected XSS Attack

Since web technologies are getting more advanced with longer codes, the number of vulnerabilities has increased considerably. Cross-site scripting (XSS) attacks are one of the most common attacks that use vulnerabilities in web applications. There are three types of cross-site scripting attacks namely, reflected, stored, and DOM-based attacks. Reflected XSS attacks are the most common type that is usually implemented by injecting a malicious code into the URL and then sending the URL to the targeted system by using phishing methods, which is a significant threat for recent web applications. Our motivation is the lack of a high performance detection method of reflected XSS attacks with high accuracy. In this paper, we propose a hybrid machine learning model to detect vulnerabilities related to reflected XSS attacks for a given URL of a website. Our model uses a scanner to discover vulnerabilities in a web site and convolutional neural networks to predict the most common vulnerabilities that may be used for reflected XSS attacks, which makes the proposed model hybrid. We analyzed the model experimentally. Analyses results show that the proposed model is able to detect vulnerable attack surfaces with 99 % accuracy.

Meningkatkan Keamanan Web Menggunakan Algoritma Advanced Encryption Standard (AES) terhadap Seragan Cross Site Scripting

In the millennial era, the internet has become a very basic need to support community activities in various fields, one of which is education. SMK Maritim Nusantara in supporting the learning process uses a web-based application called e-learning which is used by teachers and students. The school website has several documents in digital form that must be kept confidential, such as student data, teacher data, student grades. After scanning using the Acunetix WVS 10.5 application, information was obtained about the security holes found on the website https://www.e-learning.smkmn.sch.id, with the results of which there were 8 (eight) attacks with details, 2 (two). ) a hight category with the name Cross site scripting (XSS) attack, 4 (four) medium categories with the name HTML form attack without CSRF protection and 2 (two) low categories with the name Password type input attack with auto-complete enabled. The most dangerous attack category / hight is XSS. XSS attack is an attack that inserts malicious code in the form of javascript through an input form that aims to steal cookies and then uses the cookie to enter the web legally so that data can be manipulated and even deleted. For this reason, a strong system is needed to maintain security, confidentiality of school data, one way that can be used is by implementing the Standard Advance Encryption Algorithm (AES), this algorithm has a high level of security and uses little memory in its operation so that it does not burdensome to process and easy to implement. The results of research conducted by applying the AES Algorithm explain that previously there were 2 (two) high category vulnerabilities called XSS attacks, after the implementation of the AES Algorithm, the XSS attack vulnerability was no longer found. Based on the results obtained in the study, it can be concluded that the implementation of the AES Algorithm in tokens can improve the security of the https://www.e-learning.smkmn.sch.id website from XSS attacks.

XGBXSS: An Extreme Gradient Boosting Detection Framework for Cross-Site Scripting Attacks Based on Hybrid Feature Selection Approach and Parameters Optimization

With the widespread popularity of the Internet and the transformation of the world into a global village, Web applications have been drawn increased attention over the years by companies, organizations, and social media, making it a prime target for cyber-attacks. The cross-site scripting attack (XSS) is one of the most severe concerns, which has been highlighted in the forefront of information security experts' reports. In this study, we proposed XGBXSS, a novel web-based XSS attack detection framework based on an ensemble-learning technique using the Extreme Gradient Boosting algorithm (XGboost) with extreme parameters optimization approach. An enhanced feature extraction method is presented to extract the most useful features from the developed dataset. Furthermore, a novel hybrid approach for features selection is proposed, comprising information gain (IG) fusing with sequential backward selection (SBS) to select an optimal subset reducing the computational costs and maintaining the high-performance of detector' simultaneously. The proposed framework has successfully exceeded several tests on the holdout testing dataset and achieved avant-garde results with accuracy, precision, detection probabilities, F-score, false-positive rate, false-negative rate, and AUC-ROC scores of 99.59%, 99.53 %, 99.01%, 99.27%, 0.18%, 0.98%, and 99.41%, respectively. Moreover, it can bridge the existing research gap concerning previous detectors, with a higher detection rate and lesser computational complexity. It also has the potential to be deployed as a self-reliant system, which is efficient enough to defeat such attacks, including zero-day XSS-based attacks.

A hybrid of CNN and LSTM methods for securing web application against cross-site scripting attack

<span>Cross-site scripting (XSS) is today one of the biggest threatthat could targeting the Web application. Based on study published by the open web applications security project (OWASP), XSS vulnerability has been present among the TOP 10 Web application vulnerabilities.Still,an important security-related issue remains how to effectively protect web applications from XSS attacks.In first part of this paper, a method for detecting XSS attack was proposed by combining </span><span lang="EN-GB">convolutional</span><span> neural network (CNN) with long short term memories<strong> (</strong>LSTM), Initially, pre-processing was applied to XSS Data Set by decoding, generalization and tokanization, and then word2vec was applied to convert words into word vectors in XSS payloads. And then we use the combination CNN with LSTM to train and test word vectors to produce a model that can be used in a web application. Based on the obtaned results, it is observed that the proposed model achevied an excellent result with accuracy of 99.4%.</span>

Prevention of XSS attack using Cryptography & API integration with Web Security

The vulnerability of web-based applications has increased manifold primarily due to the ever-increasing time spent on the web. Cross site scripting (XSS) attack are one of the most prominent attacks that are executed when the attacker get success over API key authentication and successfully execute their malicious script code at server end. Of the two types of XSS that are popular in the hacking world i.e. server side XSS and client side XSS, server-side attacks are more frequent and vulnerable. Various methodologies have been developed in the recent past to handle XSS attacks API authentication based techniques, handling access at server end etc. However, these methodologies suffer from one or more limitation of handling the attack from one perspective. In this paper, we demonstrate a multi-layer prevention technique wherein we defend the attacker hit at API key authentication level using an encrypted that prevents the attacker easy access to API directly. In the next layer we convert the script code execution request into plain text which is coming from any untrusted party, so that plain text will not execute over browser. Thus, our proposed framework provides an effective solution to protect our environment from XSS attacks.

Development of web browser prototype with embedded classification capability for mitigating Cross-Site Scripting attacks

Mitigation of Cross-Site Scripting (XSS) with machine learning techniques is the recent interest of researchers. A large amount of research work is reported in this domain. A lack of real-time tools working on the basis of these approaches is a gap in this domain. In this work, a web browser that works on machine learning classification to mitigate XSS attacks is developed. This browser classifies webpages into malicious and non-malicious pages using features identified by observation of malicious web pages and features collected from the different authors works. Classification experiments are conducted to evaluate the effectiveness of these features, and it is found that this approach performs better than other proposed methods in terms of classification accuracy, precision, recall, and F1-score. A web browser is implemented with the open-source browser WebKit. Experiments are conducted to assess the overhead created by the added functionality of classification in the web browser. The browser is found effective in classifying web pages and in real-time browsing scenarios with very less generated overhead. This makes web browser better than other proposed solutions to mitigate (XSS) attacks with minimal overhead. This developed web browser will be beneficial not only for researchers working in this domain but also for the users who can be the victims of XSS attacks.

Data augmentation-based conditional Wasserstein generative adversarial network-gradient penalty for XSS attack detection system.

The rapid growth of the worldwide web and accompanied opportunities of web applications in various aspects of life have attracted the attention of organizations, governments, and individuals. Consequently, web applications have increasingly become the target of cyberattacks. Notably, cross-site scripting (XSS) attacks on web applications are increasing and have become the critical focus of information security experts’ reports. Machine learning (ML) technique has significantly advanced and shown impressive results in the area of cybersecurity. However, XSS training datasets are often limited and significantly unbalanced, which does not meet well-developed ML algorithms’ requirements and potentially limits the detection system efficiency. Furthermore, XSS attacks have multiple payload vectors that execute in different ways, resulting in many real threats passing through the detection system undetected. In this study, we propose a conditional Wasserstein generative adversarial network with a gradient penalty to enhance the XSS detection system in a low-resource data environment. The proposed method integrates a conditional generative adversarial network and Wasserstein generative adversarial network with a gradient penalty to obtain necessary data from directivity, which improves the strength of the security system over unbalance data. The proposed method generates synthetic samples of minority class that have identical distribution as real XSS attack scenarios. The augmented data were used to train a new boosting model and subsequently evaluated the model using a real test dataset. Experiments on two unbalanced XSS attack datasets demonstrate that the proposed model generates valid and reliable samples. Furthermore, the samples were indistinguishable from real XSS data and significantly enhanced the detection of XSS attacks compared with state-of-the-art methods.

Resolving cross-site scripting attacks through genetic algorithm and reinforcement learning

Cross Site Scripting (XSS) is one of the most frequently occurring vulnerability. The impact of XSS can vary from cosmetic to catastrophic damages. However, detection of XSS efficiently is still an open issue. Cross site scripting has been dealt with static and dynamic analysis previously. Both techniques have shortcomings and fail due to frequent variations in XSS payloads. Therefore, in this paper, we have proposed the use of Genetic Algorithm (GA) along with Reinforcement Learning (RL) and threat intelligence to overcome XSS attacks. For validation, the proposed approach is applied on a real dataset of XSS attacks. Results show better performance of our proposed approach when compared to the approaches reported in the literature. In addition to better performance, our method is not only flexible to changes in XSS payloads, but the results are also more understandable to end users. Moreover, our approach shows improvement when the number of attacks is increased.

Meningkatkan Keamanan Web Menggunakan Algoritma Advanced Encryption Standard (AES) Terhadap Seragan Cross Site Scripting

Pada era milenial internet menjadi sebuah kebutuhan yang sangat mendasar guna menunjang aktifitas masyarakat dalam berbagai bidang salah satunya bidang pendidikan. SMK Maritim Nusantara dalam menunjang proses pembelajaran mengunakan aplikasi berbasis web dengan nama e-learning yang digunakan oleh guru dan siswa. Website sekolah memiliki beberapa dokumen dalam bentuk digital yang harus di jaga kerahasianya seperti data siswa, data guru, nilai siswa. Hasil scaning dari aplikasi Acunetix WVS 10.5 diperoleh informasi tentang celah keamanan yang terdapat pada website https://www.e-learning.smkmn.sch.id, dengan hasil diantaranya terdapat 8 (delapan) serangan dengan rincian, 2 (dua) kategori hight dengan nama serangan Cross site scripting (XSS), 4 (empat) kategori medium dengan nama serangan HTML form without CSRF protection dan 2 (dua) kategori low dengan nama serangan Password type input with auto-complete enabled. Kategori serangan yang paling berbahaya/hight yaitu XSS. Serangan XSS adalah serangan yang menyisipkan kode-kode jahat berbentuk javascript melalui form input yang bertujuan untuk mencuri cookie lalu menggunakan cookie tesebut untuk masuk kedalam web secara sah sehingga data dapat dimanipulasi bahkan dihapus. Untuk itu dibutuhan sebuah sistem yang kuat untuk menjaga keamanan, kerahasiaan data-data sekolah, salah satu cara yang dapat digunakan adalah dengan penerapan Algoritma Advance Enkripiton Standart (AES), algoritma ini memiliki tingkat keamanan yang tinggi serta menggunakan memori yang sedikit dalam pengoperasianya sehingga tidak membebani proses dan mudah untuk diterapkan. Hasil penelitian yang dilakukan dengan menerapkan Algoritma AES mejelaskan bahwa sebelumnya terdapat 2 (dua) kerentanan kategori hight dengan nama serangan XSS, setelah implementasi Algoritma AES maka kerentanan serangan XSS tersebut tidak ditemukan lagi. Berdasarkan hasil yang diperoleh dalam penelitian dapat disimpulkan bahwa Implementasi Algoritma AES pada token dapat meningkatkan keamanan website https://www.e-learning.smkmn.sch.id dari serangan XSS

A novel technique to prevent SQL injection and cross-site scripting attacks using Knuth-Morris-Pratt string match algorithm

Structured Query Language (SQL) injection and cross-site scripting remain a major threat to data-driven web applications. Instances where hackers obtain unrestricted access to back-end database of web applications so as to steal, edit, and destroy confidential data are increasing. Therefore, measures must be put in place to curtail the growing threats of SQL injection and XSS attacks. This study presents a technique for detecting and preventing these threats using Knuth-Morris-Pratt (KMP) string matching algorithm. The algorithm was used to match user’s input string with the stored pattern of the injection string in order to detect any malicious code. The implementation was carried out using PHP scripting language and Apache XAMPP Server. The security level of the technique was measured using different test cases of SQL injection, cross-site scripting (XSS), and encoded injection attacks. Results obtained revealed that the proposed technique was able to successfully detect and prevent the attacks, log the attack entry in the database, block the system using its mac address, and also generate a warning message. Therefore, the proposed technique proved to be more effective in detecting and preventing SQL injection and XSS attacks

Case Study: Extenuation of XSS Attacks through Various Detecting and Defending Techniques

Cross-Site Scripting attack (XSS) is the foremost vulnerability identified in the world of the web today. XSS attacks permit an intruder to execute the malevolent code and tainted source on the user browser, which results in various effects like cookies stealing, password attack, hacking credit/debit card numbers or any PIV’s of consumers etc. A detailed analysis of the XSS exploitation along with its detection and protection scheme has been discussed in this paper. The case study concerns with the existing methodologies and approaches used to detect and mitigate XSS attacks and its vulnerabilities. It talks about both the client and server side detection methods with static and dynamic approaches which have been presented so far to detect the attack. Also, it includes the XSS Defense methods and tools used to protect the client as well as the server. The motive of this paper is to give an exclusive look over the extenuation of XSS attacks through various detecting and defending techniques.

Adversarial Examples Detection for XSS Attacks Based on Generative Adversarial Networks

Models based on deep learning are prone to misjudging the results when faced with adversarial examples. In this paper, we propose an MCTS-T algorithm for generating adversarial examples of cross-site scripting (XSS) attacks based on Monte Carlo tree search (MCTS) algorithm. The MCTS algorithm enables the generation model to provide a reward value that reflects the probability of generative examples bypassing the detector. To guarantee the antagonism and feasibility of the generative adversarial examples, the bypassing rules are restricted. The experimental results indicate that the missed detection rate of adversarial examples is significantly improved after the MCTS-T generation algorithm. Additionally, we construct a generative adversarial network (GAN) to optimize the detector and improve the detection rate when dealing with adversarial examples. After several epochs of adversarial training, the accuracy of detecting adversarial examples is significantly improved.