Study of Cross-Site Scripting Attacks and Their Countermeasures
|
|
|
- Evangeline Goodwin
- 8 years ago
- Views:
Transcription
1 Study of Cross-Site Scripting Attacks and Their Countermeasures Gurvinder Kaur University Institute of Engineering and Technology Kurukshetra University India Abstract: - In present-day time, most of the associations are making use of web services for improved services to their clients. With the upturn in count of web users, there is a considerable hike in the web attacks. Thus, security becomes the dominant matter in web applications. The disparate kind of vulnerabilities resulted in the disparate types of attacks. The attackers may take benefit of these vulnerabilities and can misuse the data in the database. Study indicates that more than 80% of the web applications are vulnerable to cross-site scripting (XSS) attacks. XSS is one of the fatal attacks & it has been practiced over the maximum number of well-known search engines and social sites. In this paper, we have considered XSS attacks, its types and different methods employed to resist these attacks with their corresponding limitations. Additionally, we have discussed the proposed approach for countering XSS attack and how this approach is superior to others. Keywords: - Cross-Site Scripting (XSS), Malicious Injection, Web Security, and Web Application Attacks. 1. INTRODUCTION With the everywhere-ness of information superhighway, i.e. Internet, organizations are serving people with their business on web. However, as the owners of the business emphasize greater on their business logic they do not get concerned about the vulnerabilities and security hazards inclined to their websites. Web Security describes the guidelines used to block threats to diminish the web attacks. An attack may be feasible due to the existence of vary types of flaws and bugs in the coding. As per Ponemon Institute Life Threat Intelligence Impact Report 2013 if the actionable intelligence about cyber attacks is available only 60 seconds before then the average cost of exploit could be reduced to 40 percent [1]. That is if we have an appropriate method to handle an attack at the very first step then the cost of the damage caused due to that attack can be diminished largely. The inaccurate authorization and sanitization of data given by web server has brought in the accountability for XSS attacks. It is the attack on the secrecy of customer of a specific website by approving injection of inputs containing HTML tags and JavaScript code. As per OWASP (Open Web Application Security Project) 2013 release cross-site scripting is one of the major attacks performed [2]. Cenzic Application Vulnerability Trends Report 2013 confers that among the top 10 attacks 26% comprises of XSS attacks only [3]. The rest of the paper is organized as follows: Section II discusses the web application architecture. Section III discusses the XSS attacks and its types in detail. Section IV provides the survey explored with their relative weaknesses.section V discusses the proposed approach and how it would be better. Finally, section VI concludes the paper. Fig1: Web Application Security Vulnerability Population [3] 604
2 2. WEB APPLICATION ARCHITECTURE As XSS, attacks occur over the application layer so it is important to know how the web application works over the internet. Web Application has three-layered architecture as shown in Fig 2. WEB SERVER are involved- the attacker, the client and the website. In XSS attacks, the attacker insert malicious scripts to target websites for session hijacking, cookie stealing, and malicious redirection. This attack arises, as the web server does not appropriately assure that generated pages are properly encoded to avert the inadvertent execution of scripts and when input is not justified to prevent malicious HTML from being displayed to the users. Example: <% out.println( welcome + request.getparameter( name )); %> (Example of poorly written code on Web server- saving it as test.jsp) Case 1: Normal User <HTML> <BODY> Welcome Stefan </BODY> </HTML> Fig 2: Web Application Architecture [4] 1.) Presentation Layer: This tier accepts input from end user and display output to user. It functions as a graphical user interface (GUI). It literally attach with the client. 2.) Server Programming Layer: This layer is located between presentation layer and database layer. Data processing is handled in this layer and it can be programmed in any of server scripting languages like JSP, PHP and ASP etc. 3.) Database Layer: This tier stores and manages all the delicate data of web application. This layer is responsible for access of authenticated users and rejection of malicious users. 3. CROSS-SITE SCRIPTING ATTACKS In this section, XSS attacks & its types are discussed in detail. An XSS attack is one of the most common web application attacks that are used by hackers to sneak into web applications. In XSS, attacker embeds malicious script into a website. Whenever a user browser run this code the attacker can shape the browser to do whatever it wants.xss attacks occur whenever an application takes un-trusted data and sends it to web browser without proper validation and sanitization[5]. So in XSS attacks three parties Output: Fig 3: Response of a normal HTML code Case2: Attacker <HTML> <BODY> Welcome <script>alert ("Attacked") </script> </BODY> </HTML> Fig 4: Output after code inserted by attacker 605
3 The example above shows a web site having XSS vulnerability. In Fig 3 a normal user when enters his name it is displayed. In Fig 4, an attacker misleads the application server by entering the JavaScript in place of name. This is quite a simple example. There are primarily three types of cross-site scripting attacks as follows: 1. Stored or Persistent attacks- This attack appears when the malevolent code is sent to a web application where they are stored permanently on the mark server. When a user requests for the stored information this script is executed in its context. Examples for raider favorite targets include web mail messages, forum, comment field, visitor log etc. this attack occurs in the following manner: -Malicious script is inserted into a web form by the attacker, which is then stored by the server in the database. -When a request is send to the infected page by the user, the script is executed in the user s browser and the user s cookies are passed to the attacker. 2. Reflected or Non persistent attacks- In this the malicious code is breed into a URL as a value of parameter, as a HTTP query in such a way that the rebounded content consists of unprocessed script. This attack occurs in a following way: -Attacker examines a website and finds vulnerability on a web page. -Attacker may embed a URL to exploit the weakness and may send an to the user captivating the user to click on a link for the URL under false charade -The URL will point to the normal website, but it will contain attacker s malicious code that the site will reflect -User will visit the URL provided by the attacker while log into the given website -The malicious script is executed on the user s browser as if it came directly from the web server. -By this way, an attacker can steal sensitive information through user s cookies [6]. 3. DOM (Document Object Model)-based XSS attacks- This exists within a site and can be used in a reflected manner. In this case, the malicious data exists solely in the browser and is not sent to the server. A brief example of a DOM-based XSS attacks would be a modifying the web history of a user. 4. RELATED WORK Johns et al. has proposed a passive detection system to identify successful XSS attacks [5]. It uses two different approaches based on generic observations of XSS attacks and web applications. In this reflected attack is detected by a request/response matching which is based on the direct relationship between the input data and the injected scripts. In this the input parameters and the scripts found in final HTML is converted into a non-ambiguous representation by removing all encodings and the appropriate matching is done by constructing a DFA for each of the input parameter. For stored attacks, it adopts a generic XSS detection using a list of known scripts in which they used a training based XSS detector in which list of all outgoing script is matched up with the detector s known list. The weakness of this system is that it uses different implementation schemes for the two types of XSS that increases the overhead. It just detects the already existing attacks and false positives are there. A static analysis for finding XSS vulnerabilities is demonstrated by Wassermann & Su [7] that straightforwardly addresses weak or absent input validation. The approach integrates work on tainted information flow with string analysis. The proposal has two parts: (1) an adapted string analysis to track untrusted substring values, and (2) a check for untrusted scripts based on formal language techniques..string-taint analysis not only represents the set of string values a program may create, it also defines the formal language representation with labels that indicate which substrings come from untrusted sources. The second phase of the method enforces the policy that generated web pages include no untrusted scripts. It has many disadvantages like the tool produces false positives and it failed to resolve certain alias relationships between variables whose values are used for dynamic features. It failed to detect the DOM-based XSS. The string analysis-based tool could not handle arbitrarily complex and dynamic code. Wurzinger et al. [8] introduced a tool known as SWAP (Secure Web Application Proxy), a server-side solution for discovering and preventing cross-site scripting attacks. SWAP contain a reverse proxy that intercepts all HTML responses, as well as a make use of modified Web browser to detect script content. SWAP contains a JavaScript detection component, 606
4 which is able to determine whether script content is present or not, a reverse proxy, which block all HTML responses from the server and subjects them to analysis by the JavaScript detection component and a set of scripts to axiomatically encode/decode scripts/ script IDs. SWAP introduces a performance overhead. It cannot guard counter to other kinds of objectionable content, such as static links pointing to sites including malicious scripts In this paper a result for unit testing and action-level security of Struts Web applications is demonstrated by Wu et al. [9] by experimenting the applications from modelview-controller (MVC) respectively, and safe Struts applications with the help of different access control implementations. The aim of using struts is to neatly separate the model (application logic that communicates with a database) from the view (HTML pages shown to the client) and the controller (instance that passes info between view and model). JUnit tests the model, and StrutsTestCase does the testing of controller, while HttpUnit does the testing of view. The action level security solution comprises of four stages: access control in actions and JSPs, by extending the request processor, access control by servlet filtering, & WEB-INF. The solution of Struts Web application unit testing and action-level security just extended the general Web unit testing methods. The performance of application is degraded. Galan et al. [10] suggested a multi-agent system for the automated scanning of web sites to disclose the existence of XSS vulnerabilities exploitable by a stored-xss attack. The set of agent s part of the proposed architecture and the operation of the scanner are as follows. A webpage parser agent crawl the web application from which information about the different web forms found is used to build a repository of potential injection points (Injection point repository). A script injector agent reads the list of injection points recognized by the parser agent and also makes a selection of vectors attacks from the Attack vector repository. The desired set of attack vectors is launched against each of the potential points of attack of the application. A list of the performed attacks is stored in a Performed attack list. The verificator agent gets the list of the attacks to be verified and crawl the web application looking for each of the attacks. A report about the results of the scanning process is elaborated and stored. This approach has not better performance & accuracy. The approach by Putthacharoen & Bunyatnoparat [11] aims to change the cookies so that they would become impractical for XSS attacks. This technique is called Dynamic Cookie Rewriting enforced in a web proxy where it will automatically put in place of the cookies with the randomized value before sending the cookie to the browser. In this way browser will keep the randomized value rather of original value sent by the web server. At the web server, end the return cookie from the browser over rewritten to its original form at the web proxy before being dispatched to the web server. So in case if XSS attacks swipe the cookies from the browser s database, the cookies cannot be used by the attacker to imitate the users. Four domains are kept to identify the cookie that is Name, Domain, Path, and Port. The initial value of the cookie and the randomized value are also kept in the same table. This table is reserved at the web proxy database server. The web proxy server will use this information to rewrite back cookies. The drawback of this approach is the compatibility problem that occurs while implementing the proxy server and the single point failure issue In [12] a technique is proposed which is invoked when user injects code in the field of web application by V. & Selvekumar..It uses the complete HTML parser and JavaScript Tester to detect the presence of JavaScript for filtering it out. The user created HTML content is passed to the XSS sanitizer and the static tags are checked. The static tags are retained while rests of tags are filtered out. Even static tags contain dynamic content, which are filtered out by JavaScript Tester. After filtering HTML, content is converted into DOM. It includes parse tree generator at client side browser to reduce the anomalous behavior of browsers. It is restricted to server side only and browser source need to be modified for obtaining results. Choudhary & Dhore [13] proposed code injection detection tool based on a Proxy Agent, which classifies the request as scripted request, or query based request. There are two modules: Query Detector and Script Detector. The HTTP request coming from client side is first send to the CIDT within which the request is passed to both modules one by one. Firstly, the Query detector validates the request and the query is rejected if any invalid character is found. Only 607
5 the valid requests are passed to the next module, the Script detector that also filters the request for invalid tags and encodes it before forwarding it to the web server. The disadvantage of this approach is it requires more time to response that is the delay time is more. Matsuda & Koizumi [14] suggested a detection algorithm against cross-site scripting attacks by extracting an attack feature of XSS by considering the appearance position and frequency of symbols. It learns the attack features from given attack samples. In this three modules are presented. The first one is the classification module in which sample of 32 characters is gathered based upon the characters that occur frequent in attacks. The second module will calculate the important degree of characters. The final module will detect the attack-by-attack feature value & threshold that is taken as 15 for the proper detection of the attack in proposed approach. The main disadvantage is it is calculation based and it does not tackle the new attacks effectively. Elhakeem & Barry [15] broach on the issues surrounding cross-site scripting attacks and providing a simple and useful security model to protect websites from such attacks using ZEND framework application. The security model is based on a chain of levels and is built using a combination of tools. It is divided into four levels as: Security Awareness, Server Security, Client Security, & Design Guidelines. The framework described by them is Zend Framework (ZF), which is an open source framework for developing web applications and services with PHP. This loosely coupled architecture allows developers to use components individually and offers a robust Model View Controller (MVC) implementation. The MVC paradigm breaks the application's interface, into three parts which are: Model: The model part of the application is the part that is concerned with the specifics of the data to be displayed, View: The view consists of bits of the application that are concerned with the display to the user, & Controller: The controller ties together the specifics of the model and the view to ensure that the correct data is displayed on the page. It accepts input from the user and instructs the model and view port to perform actions based on that input. It requires lot of tools to be combined so compatibility issues are there. 5. PROPOSED APPROACH Cross-Site Scripting is one of the most dangerous and the common attacks found over the web applications. This survey presents study of the ongoing techniques against XSS attacks. These techniques suffer from the following weaknesses: Built-in limitations Partial implementations Complicated framework Developer s ability Run-time overhead False positives and false negatives Insecure channel between the web server and web browser Response delay Additional infrastructure Cost of deployment Don t prevent DOM based attacks Our proposed system will try to remove almost all of these weaknesses. It will include a two-tier approach- one for detecting persistent and non-persistent XSS attacks and second for prevention of DOM based XSS attacks. For the first tier we will implement our logic of script guard in the controller part of MVC2 architecture of server. The controller receives all requests from the clients & forwards those requests to the respective pages as per request. The controller receives parameters sent by the client and scans these parameter values for suspected XSS attacks. These values are matched with sets of expressions where every expression match means an attack. In case of an attack, the requests do not go beyond the controller and the client is redirected back to the page where he requested. For the second tier that is for prevention of DOM based attacks we will have a small JavaScript code (DOM attack detector script) which is sent to the client with every response. This code acts only at client side and will prevent any sort of DOM based XSS attacks. Thus, our proposed work will detect all types of XSS attacks. Even it will have a little performance overhead but it will have a minimum response delay. There is no need of additional infrastructure and have not a complex framework
![Matsuda & Koizumi [14] suggested a detection algorithm against cross-site scripting attacks by extracting an attack feature of XSS by considering the appearance position and frequency of symbols.](/docs-images/50/15080917/images/page_5.jpg "It learns the attack features from given attack samples. In this three modules are presented.")
6 6. CONCLUSION XSS attack is one of the most common and dangerous web application attacks that can reveal information about a user or company profile. This paper presented what XSS attacks are, what are there types, the previous approaches for prevention of these attacks with there limitations. Then we showed our proposed approach and how it is better. Many industries are employing web services for their benefits on the World Wide Web but for relieving themselves from the additional cost, they do not go for the security of the websites they created. Eventually it harms the users and company too. With the expansion of web applications, it is urgency to have an comprehensive and coherent structure for the prevention of unified XSS and other important web application attacks. 7. REFRENCES [1] [2] ASP_Top_Ten_Project [3] Application-Vulnerability-Trends-Report pdf [4] Jeom-Goo Kim, Injection Attack Detection using the Removal of SQL Query Attribute Values, IEEE, pp. 1-7, [5] Martin Johns, Bjorne Englemann, Joachimm Posegga, XSSDS: Server-side Detection of Cross-site Scripting Attacks, Annual Computer Security Applications Conference, IEEE, pp , [6] [7] Gary Wassermann, Zhendong Su, Static detection of cross-site scripting vulnerabilities, ACM/IEEE 30th International Conference on Software Engineering, ICSE '08. pp , [8] Peter Wurzinger, Christian Platzer, Christian Ludl, Engin Kirda, and Christopher Kruegel, SWAP: Mitigating XSS Attacks using a Reverse Proxy, ICSE Workshop on Software Engineering for Secure Systems, IEEE, pp , [9] Qinglin Wu, Yanzhong Hu, Yan Wang, Unit Testing and Action-Level Security Solution of Struts Web Applications Based on MVC, International Conference on Biomedical Engineering and Computer Science, IEEE, pp. 1-4, [10] E. Galan, A. Alcaide, A. Orfila, J. Blasco, A Multi-agent Scanner to Detect Stored-XSS Vulnerabilities, International Conference for Internet Technology and Secured Transactions (ICITST), IEEE, pp. 1-6, [11] Rattipong Putthacharoen, Pratheep Bunyatnoparat, Protecting Cookies from Cross Site Script Attacks Using Dynamic Cookies Rewriting Technique, 13th International Conference on Advanced Communication Technology (ICACT), IEEE, pp , Feb [12] Sharath Chandra V., S. Selvekumar, BIXAN: Browser Independent XSS Sanitizer for Prevention of XSS Attacks, ACM SIGSOFT, Volume 36 Number 5, September [13] Atul S. Choudhary And M.L Dhore, CIDT: Detection Of Malicious Code Injection Attacks On Web Application, International Journal Of Computing Applications Volume-52-N0.2, pp , August [14] Takeshi Matsuda, Daiki Koizumi, Cross Site Scripting Attacks Detection Algorithm Based on the Appearance Position of Characters, 5 th International Conference on Communications, Computers and Applications, IEEE, pp , October [15] Yousra Faisal Gad Mahgoup Elhakeem, Bazara I. A. Barry, Developing a Security Model to Protect Websites from Cross-site Scripting Attacks Using Zend Framework Application, International Conference on Computing, Electrical and Electronics Engineering (ICCEEE), pp , August
A Multi agent Scanner to Detect Stored XSS Vulnerabilities
A Multi agent Scanner to Detect Stored XSS Vulnerabilities E. Galán, A. Alcaide, A. Orfila, J. Blasco University Carlos III of Madrid, UC3M Leganés, Spain {edgalan,aalcaide,adiaz,jbalis}@inf.uc3m.es Abstract
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) Vijaya
Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications
Journal of Basic and Applied Engineering Research pp. 50-54 Krishi Sanskriti Publications http://www.krishisanskriti.org/jbaer.html Client vs. Server Implementations of Mitigating XSS Security Threats
Web Application Security
Web Application Security John Zaharopoulos ITS - Security 10/9/2012 1 Web App Security Trends Web 2.0 Dynamic Webpages Growth of Ajax / Client side Javascript Hardening of OSes Secure by default Auto-patching
HOD of Dept. of CSE & IT. Asst. Prof., Dept. Of CSE AIET, Lko, India. AIET, Lko, India
Volume 5, Issue 12, December 2015 ISSN: 2277 128X International Journal of Advanced Research in Computer Science and Software Engineering Research Paper Available online at: www.ijarcsse.com Investigation
Protection, Usability and Improvements in Reflected XSS Filters
Protection, Usability and Improvements in Reflected XSS Filters Riccardo Pelizzi System Security Lab Department of Computer Science Stony Brook University May 2, 2012 1 / 19 Riccardo Pelizzi Improvements
Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense
Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense Shashank Gupta Lecturer in Department of Information Technology, Model Institute of Engineering and
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, Uni
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
A Novel Frame Work to Detect Malicious Attacks in Web Applications
Technology, Volume-2, Issue-1, January-March, 2014, pp. 23-28, IASTER 2014, www.iaster.com, Online:2347-5099, Print:2348-0009 A Novel Frame Work to Detect Malicious Attacks in Web Applications N. Jayakanthan
Preventing Abuse of Cookies Stolen by XSS
Preventing Abuse of Cookies Stolen by XSS Hiroya Takahashi Kenji Yasunaga Masahiro Mambo Kwangjo Kim KAIST Korea Heung Youl Youm Soonchunhyang University Korea Abstract Cross Site Scripting (XSS) makes
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Detection of SQL Injection and XSS Vulnerability in Web Application
International Journal of Engineering and Applied Sciences (IJEAS) ISSN: 2394-3661, Volume-2, Issue-3, March 2015 Detection of SQL Injection and XSS Vulnerability in Web Application Priti Singh, Kirthika
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (cjjarabe@ucalgary.ca) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Client Side Filter Enhancement using Web Proxy
Client Side Filter Enhancement using Web Proxy Santosh Kumar Singh 1, Rahul Shrivastava 2 1 M Tech Scholar, Computer Technology (CSE) RCET, Bhilai (CG) India, 2 Assistant Professor, CSE Department, RCET
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
HTTPParameter Pollution. ChrysostomosDaniel
HTTPParameter Pollution ChrysostomosDaniel Introduction Nowadays, many components from web applications are commonly run on the user s computer (such as Javascript), and not just on the application s provider
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
Prevent Cross-site Request Forgery: PCRF
Prevent Cross-site Request Forgery: PCRF Sooel Son University of Texas, Austin samuel@cs.utexas.edu Abstract CSRF attacks are one of the most prevalent and dangerous web threats at the level of XSS, SQL
How To Fix A Web Application Security Vulnerability
Proposal of Improving Web Application Security in Context of Latest Hacking Trends RADEK VALA, ROMAN JASEK Department of Informatics and Artificial Intelligence Tomas Bata University in Zlin, Faculty of
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter conpap@owasp.gr
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
Toward A Taxonomy of Techniques to Detect Cross-site Scripting and SQL Injection Vulnerabilities
NCSU CSC TR 2008-4 1 Toward A Taxonomy of Techniques to Detect Cross-site Scripting and SQL Injection Vulnerabilities Yonghee SHIN, Laurie WILLIAMS, Members, IEEE Abstract Since 2002, over half of reported
A DYNAMIC TOOL FOR DETECTION OF XSS ATTACKS IN A REAL-TIME ENVIRONMENT
A DYNAMIC TOOL FOR DETECTION OF XSS ATTACKS IN A REAL-TIME ENVIRONMENT K. G. Maheswari 1 and R. Anita 2 1 Department of MCA, Institute of Road and Transport Technology, Anna University, Erode, Tamil Nadu,
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilities
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts
Detection of DOM-based Cross-Site Scripting by Analyzing Dynamically Extracted Scripts Suman Saha 1, Shizhen Jin 2,3 and Kyung-Goo Doh 3 1 LIP6-Regal, France Suman.Saha@lip6.fr 2 GTOne, Seoul, Korea jinshzh@gmail.com
Leveraging User Interactions for In-Depth Testing of Web Applications
Leveraging User Interactions for In-Depth Testing of Web Applications Sean McAllister 1,EnginKirda 2, and Christopher Kruegel 3 1 Secure Systems Lab, Technical University Vienna, Austria sean@seclab.tuwien.ac.at
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework ajin25@gmail.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
KEYWORDS: Internet Applications, Security, Languages, Review and evaluation.
[Madhusudhanan, 4(3): March, 2015] ISSN: 2277-9655 IJESRT INTERNATIONAL JOURNAL OF ENGINEERING SCIENCES & RESEARCH TECHNOLOGY WEB SECURITY VULNERABILITY ASSESSMENT AND RECOVERY MACHANISAM M.Madhusudhanan*,
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
NSFOCUS Web Vulnerability Scanning System
NSFOCUS Web Vulnerability Scanning System Overview Most Web application systems are tailor-made and delivered in source codes by Customer Benefits Accurate Analysis on Website Vulnerabilities Fast scan
Cross-site site Scripting Attacks on Android WebView
IJCSN International Journal of Computer Science and Network, Vol 2, Issue 2, April 2013 1 Cross-site site Scripting Attacks on Android WebView 1 Bhavani A B 1 Hyderabad, Andhra Pradesh-500050, India Abstract
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequences
Detection and Prevention of SQL Injection Attacks
Detection and Prevention of SQL Injection Attacks 1 Sailor Pratik, 2 Prof. Jaydeep Gheewala 1 Computer Department 1 Sarvajanik College of Engineering and Technology, Surat, Gujarat, India 1 pratik_sailor@ymail.com,
Common Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
Evaluation of Web Security Mechanisms Using Inline Scenario & Online Scenario
Evaluation of Web Security Mechanisms Using Inline Scenario & Online Scenario M. Durai Ganesh (Research Scholars) Information Technology, St. Peter s University, Chennai- 54, Tamil Nadu, India Dr. G.Gunasekaran,
SECURITY ADVISORY. December 2008 Barracuda Load Balancer admin login Cross-site Scripting
SECURITY ADVISORY December 2008 Barracuda Load Balancer admin login Cross-site Scripting Discovered in December 2008 by FortConsult s Security Research Team/Jan Skovgren WARNING NOT FOR DISCLOSURE BEFORE
Are AJAX Applications Vulnerable to Hack Attacks?
Are AJAX Applications Vulnerable to Hack Attacks? The importance of Securing AJAX Web Applications This paper reviews AJAX technologies with specific reference to JavaScript and briefly documents the kinds
Understanding Cross Site Scripting
Understanding Cross Site Scripting Hardik Shah Understanding cross site scripting attacks Introduction: there are many techniques which a intruder can use to compromise the webapplications. one such techniques
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
Introduction: 1. Daily 360 Website Scanning for Malware
Introduction: SiteLock scans your website to find and fix any existing malware and vulnerabilities followed by using the protective TrueShield firewall to keep the harmful traffic away for good. Moreover
IJMIE Volume 2, Issue 9 ISSN: 2249-0558
Survey on Web Application Vulnerabilities Prevention Tools Student, Nilesh Khochare* Student,Satish Chalurkar* Professor, Dr.B.B.Meshram* Abstract There are many commercial software security assurance
A Survey on Threats and Vulnerabilities of Web Services
A Survey on Threats and Vulnerabilities of Web Services A Thesis submitted in partial fulfillment of the requirements for the degree of Master of Computer Science and Engineering of Jadavpur University
Web application security: Testing for vulnerabilities
Web application security: Testing for vulnerabilities Using open source tools to test your site Jeff Orloff Technology Coordinator/Consultant Sequoia Media Services Inc. Skill Level: Intermediate Date:
Web Server Security and Survey on Web Application Security
_ Web Server Security and Survey on Web Application Security Shaikh Bushra Almin, Department of Information Technology, PIIT, New Panvel. University of Mumbai, India. skbushra78691@gmail.com Abstract A
Application Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
Res. J. Appl. Sci. Eng. Technol., 8(5): 658-663, 2014
Research Journal of Applied Sciences, Engineering and Technology 8(5): 658-663, 2014 ISSN: 2040-7459; e-issn: 2040-7467 Maxwell Scientific Organization, 2014 Submitted: May 09, 2014 Accepted: June 16,
Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
Robust Defence against XSS through Context Free Grammar
Robust Defence against XSS through Context Free Grammar 1 Divya Rishi Sahu, 2 Deepak Singh Tomar 1,2 Dept. of CSE, MANIT, Bhopal, MP, India Abstract JavaScript is one of the world s most widely adopted
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
Annex B - Content Management System (CMS) Qualifying Procedure
Page 1 DEPARTMENT OF Version: 1.5 Effective: December 18, 2014 Annex B - Content Management System (CMS) Qualifying Procedure This document is an annex to the Government Web Hosting Service (GWHS) Memorandum
Penetration Test Report
Penetration Test Report Acme Test Company ACMEIT System 26 th November 2010 Executive Summary Info-Assure Ltd was engaged by Acme Test Company to perform an IT Health Check (ITHC) on the ACMEIT System
The security of Web applications
AARMS Vol. 8, No. 1 (2009) 173 178 INFORMATION SECURITY The security of Web applications VALÉRIA PÓSERNÉ OLÁH Budapest Tech, John Von Neumann Faculty of Informatics, Budapest, Hungary The network (LAN)
Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM
Bank Hacking Live! Ofer Maor CTO, Hacktics Ltd. ATC-4, 12 Jun 2006, 4:30PM Agenda Introduction to Application Hacking Demonstration of Attack Tool Common Web Application Attacks Live Bank Hacking Demonstration
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
Uploaded images filter evasion for carrying out XSS attacks
February 25, 2007 Uploaded images filter evasion for carrying out XSS attacks Digitаl Security Research Group (DSecRG) Alexander Polyakov a.polyakov@dsec.ru http://dsecrg.ru Table of contents Introduction...3
HP WebInspect Tutorial
HP WebInspect Tutorial Introduction: With the exponential increase in internet usage, companies around the world are now obsessed about having a web application of their own which would provide all the
Understanding Web Application Security Issues
Understanding Web Application Security Issues Pankaj Sharma January 30, 2009 Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web
The only False Positive Free. Web Application Security Scanner
The only False Positive Free Web Application Security Scanner State of Security of Web Applications Verizon: 96% of victims subject to PCI DSS have not achieved compliance. 96% of hack attacks were not
Ethical Hacking Penetrating Web 2.0 Security
Ethical Hacking Penetrating Web 2.0 Security Contact Sam Bowne Computer Networking and Information Technology City College San Francisco Email: sbowne@ccsf.edu Web: samsclass.info 2 Two Hacking Classes
Cross Site Scripting in Joomla Acajoom Component
Whitepaper Cross Site Scripting in Joomla Acajoom Component Vandan Joshi December 2011 TABLE OF CONTENTS Abstract... 3 Introduction... 3 A Likely Scenario... 5 The Exploit... 9 The Impact... 12 Recommended
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
Web. Services. Web Technologies. Today. Web. Technologies. Internet WWW. Protocols TCP/IP HTTP. Apache. Next Time. Lecture #3 2008 3 Apache.
JSP, and JSP, and JSP, and 1 2 Lecture #3 2008 3 JSP, and JSP, and Markup & presentation (HTML, XHTML, CSS etc) Data storage & access (JDBC, XML etc) Network & application protocols (, etc) Programming
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense
Document Structure Integrity: A Robust Basis for Cross-Site Scripting Defense Yacin Nadji Illinois Institute Of Technology Prateek Saxena UC Berkeley Dawn Song UC Berkeley 1 A Cross-Site Scripting Attack
Web Application Penetration Testing
Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com
Application security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers
Application Design and Development
C H A P T E R9 Application Design and Development Practice Exercises 9.1 What is the main reason why servlets give better performance than programs that use the common gateway interface (CGI), even though
A Tale of the Weaknesses of Current Client-side XSS Filtering
A Tale of the Weaknesses of Current Client-side XSS Filtering Sebastian Lekies (@sebastianlekies), Ben Stock (@kcotsneb) and Martin Johns (@datenkeller) Attention hackers! These slides are preliminary!
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM
AMIT KLEIN, FORMER DIRECTOR OF SECURITY AND RESEARCH, SANCTUM A whitepaper from Watchfire TABLE OF CONTENTS Introduction 1 Full Explanation The XSS Technique. 1 Scope and Feasibility.. 3 Variations on
Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference
Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance
Rational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168
INTRUSION PROTECTION AGAINST SQL INJECTION ATTACKS USING REVERSE PROXY
INTRUSION PROTECTION AGAINST SQL INJECTION ATTACKS USING REVERSE PROXY Asst.Prof. S.N.Wandre Computer Engg. Dept. SIT,Lonavala University of Pune, snw.sit@sinhgad.edu Gitanjali Dabhade Monika Ghodake Gayatri
Interactive Application Security Testing (IAST)
WHITEPAPER Interactive Application Security Testing (IAST) The World s Fastest Application Security Software Software affects virtually every aspect of an individual s finances, safety, government, communication,
Network Security Exercise #8
Computer and Communication Systems Lehrstuhl für Technische Informatik Network Security Exercise #8 Falko Dressler and Christoph Sommer Computer and Communication Systems Institute of Computer Science,
Defending against XSS,CSRF, and Clickjacking David Bishop
Defending against XSS,CSRF, and Clickjacking David Bishop University of Tennessee Chattanooga ABSTRACT Whenever a person visits a website, they are running the risk of falling prey to multiple types of
External Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
SQL Injection Attack. David Jong hoon An
SQL Injection Attack David Jong hoon An SQL Injection Attack Exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either
CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office
CSUSB, Information Security & Emerging Technologies Office Last Revised: 03/17/2015 Draft REVISION CONTROL Document Title: Author: File Reference: CSUSB Web Application Security Standard Javier Torner
Webapps Vulnerability Report
Tuesday, May 1, 2012 Webapps Vulnerability Report Introduction This report provides detailed information of every vulnerability that was found and successfully exploited by CORE Impact Professional during
Ruby on Rails Secure Coding Recommendations
Introduction Altius IT s list of Ruby on Rails Secure Coding Recommendations is based upon security best practices. This list may not be complete and Altius IT recommends this list be augmented with additional
Institutionen för datavetenskap
Institutionen för datavetenskap Department of Computer and Information Science Final thesis Generating web applications containing XSS and CSRF vulnerabilities by Gustav Ahlberg LIU-IDA/LITH-EX-A--14/054--SE