An Alarm Aggregation Architecture for Identifying One-Way XSS Attacks

概要

論文の詳細を見る
Cross-Site Scripting (XSS) is caused by the failure of Web applications to properly validate user input before returning it to the client's Web browser. Although some approaches exist for defending against XSS attacks, XSS vulnerabilities continue to appear in Web applications. These weaknesses, which often resulted from poorly developed Web applications and data processing systems, allow attackers to embed maliciuos HTML-based contents, such as JavaScripts, within HTTP requests or response messages. Through embedding HTML code and scripting elements, it is possible to steal session ID information, thus resulting in the leakage of private information. The classic XSS attack involves social engineering to trick the victims to click on a link with embedded scripts created by attackers. The victims do not necessarily have to click on a link. XSS code can also be made to load automatically in an HTML e-mail with certain manipulations of the IMG or IFRAME HTML tags, etc, . We call this the "one-way XSS attack". We propose a system that not only detects and collects XSS attack-related information but also identifies the potential XSS attack codes. This system detects and, more importantly identifies new types of XSS attacks by manipulating HTTP server response. The system also shares collected vulnerability information via a central repository.
社団法人電子情報通信学会の論文
2005-01-12