XSS-SAFE: A Server-Side Approach to Detect and Mitigate Cross-Site Scripting (XSS) Attacks in JavaScript Code

Gupta, Shashank; Gupta, Brij B.

doi:10.1007/s13369-015-1891-7

Cited by 53 publications

(27 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Significant number of solutions have already been proposed in the past for securing the client's authenticated session to the server which addresses the threat of CSRF , as well as for session hijacking . Almost all of the previous works propose an additional communication layer or proxy‐layer between the client and the server.…”

Section: Related Workmentioning

confidence: 99%

CookieArmor: Safeguarding against cross‐site request forgery and session hijacking

Sinha

Tripathy

2019

Security and Privacy

View full text Add to dashboard Cite

Internet browsers use cookies and session‐IDs for maintaining HTTP state information which has led to several security vulnerabilities such as cross‐site request forgery (CSRF) and session hijacking. Several works have been carried out in the past to address these threats and most of these works propose an additional layer between the client‐server communication architecture. While some solutions propose this layer at the client side, others propose it at the server side. This work proposes an efficient client‐side proxy named CookieArmor for addressing the threat of CSRF and cross‐site scripting (XSS). CookieArmor is a two‐token selective CSRF prevention mechanism with restricted relaxation for cross‐origin request. CookieArmor determines whether a script is capable of performing state changing operations and safeguards only such scripts using a two‐token CSRF prevention scheme. CookieArmor uses active Session‐ID filtering to safeguards against session hijacking. CookieArmor also uses quotient‐filter between the proxy and its internal database for improving the performance. Efficiency of CookieArmor demonstrates significant improvement than other solutions.

show abstract

Section: Related Workmentioning

confidence: 99%

CookieArmor: Safeguarding against cross‐site request forgery and session hijacking

Sinha

Tripathy

2019

Security and Privacy

View full text Add to dashboard Cite

show abstract

“…40,41 The authors developed an enhanced sanitization technique and consider certain heuristics for handling the different multiple background of bulk HTML5 script variables. 40,41 The authors developed an enhanced sanitization technique and consider certain heuristics for handling the different multiple background of bulk HTML5 script variables.…”

Section: Transformation From Conventional Context-aware Sanitization mentioning

confidence: 99%

SEC‐H5: Secure and efficient integration of settings of enhanced HTML5 XSS vector defensive framework on edge network of fog nodes

Gupta

Sharma

Kumar

2019

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

The authors introduce an enhanced HTML5 (H5) Cross-Site Scripting (H5-XSS) attack vector defensive model that safeguards and maintains the confidentiality of users accessing the web applications hosted on the fog nodes. Initially, the model performs in self-training manner and estimates some features of H5 script code at the simulated desktop host systems of cloud infrastructure. Second, a process of H5 feature estimation gets re-executed for the online generated HTTP response on the edge network of fog device. Any oddity in these two features sets results in the consequent nested context-familiar sanitization of the distrustful script code on an installed fog nodes. The author design their framework structure on an open application infrastructural structure of Cisco IOx framework of various networked edge devices as fog nodes. The authors configure the tested bed of H5 web platforms on the nodes of the fog computing network for evaluating the malicious script alleviation capability of their model. Evaluation outcomes expose that the author's technique is skilled sufficient for sensing and excluding the suspicious H5 code with sufferable percentage of False Negatives (FNs), False Positives (FPs), and reduced overall performance overhead during the peak congestion of generation of sanitized HTTP response on the fog nodes. KEYWORDSCloud Data Centers (CDC), code injection attacks, context aware sanitization, edge network, HTML5 XSS attack vectors, online social network (OSN) security INTRODUCTIONThe evolution of cloud computing exempted the industries and their consumers from handling the description of countless specifics, like loading resources and computation constraints. 1 It is clearly highlighted in the work of Ponemon 2 that almost 91% of administrations in Europe and UnitedStates approved that drop in the cost is the main motivation for them to move to the platforms of cloud infrastructure. Slight investment, price deduction, and prompt implementation are some of the key aspects that motivate the enterprises to facilitate the services of cloud infrastructure and permit them for putting the emphasis on essential industry worries and main concern, instead of dealing with nominal concerns. Although, such advantages turn out to be problematic for applications, which are latency-sensitive and that need nodes in the area to avail their suspension requests. Smart phones are getting larger utilized in the day-to-day routine lifecycle of the people. Existing cloud computing prototypes cannot satisfy their necessities of motion provision, position alertness, and low latency. 3 In addition, the virtual machines of cloud platforms cannot support end points with rich facilities, comprising the applications with small latency necessities. The reason behind such non-optimal performance is that the data processing is completed at the central of the network of the cloud platforms, which has least connection with ground level.Recently, a new term is coined up, ie, Fog Computing, that extends boundary of cloud platform to an e...

show abstract

“…by the dissemination of JS worms in their profiles on the cloud platforms. XSS attack [5][6][7] is an assault against the Web application wherein an attacker introduces the malicious JavaScript code into the source code of the OSN-based Web applications. Input sanitization is considered to be the most effective mechanism for alleviating and mitigating the effect of JS worms from OSN on the virtual machines of cloud platforms.…”

Section: Introductionmentioning

confidence: 99%

Alleviating the proliferation of JavaScript worms from online social network in cloud platforms

Gupta

2016

2016 7th International Conference on Information and Communication Systems (ICICS)

Self Cite

View full text Add to dashboard Cite

This paper presents a robust framework deployed in the settings of cloud environment that alleviates the propagation of JS worms from Web applications. The proposed framework automates the process of detecting the hidden injection points from the OSN-based web applications. In addition, it also detects the partial JavaScript injection by the attacker and performs the sanitization on the detected JavaScript attack vectors in a context-aware manner. The prototype of our framework was developed in java and installed in the virtual machines of cloud platforms as a Google Chrome extension. The testing of our framework is performed on the platform of real world OSN-based web applications in cloud platform. The performance analysis and experimental results reveal that our framework detects the partial JS worms with low false negative rate and acceptable false positive rate. We have also optimized the sanitization process in a context-aware manner in contrast to the methods adopted by existing defensive methodologies.

show abstract

XSS-SAFE: A Server-Side Approach to Detect and Mitigate Cross-Site Scripting (XSS) Attacks in JavaScript Code

Cited by 53 publications

References 9 publications

CookieArmor: Safeguarding against cross‐site request forgery and session hijacking

CookieArmor: Safeguarding against cross‐site request forgery and session hijacking

SEC‐H5: Secure and efficient integration of settings of enhanced HTML5 XSS vector defensive framework on edge network of fog nodes

Alleviating the proliferation of JavaScript worms from online social network in cloud platforms

Contact Info

Product

Resources

About