XSS‐immune: a Google chrome extension‐based XSS defensive framework for contemporary platforms of web applications. Issue 17 (15th August 2016)

• Record Type: Journal Article
• Authors: Gupta, Shashank; Gupta, Brij Bhooshan
• Is Part Of: Security and communication networks. Volume 9:Issue 17(2016)
• Page Start: 3966
• Page End: 3986
• Publication Date: 2016-08-15
• Subjects: XSS worms -- XSS filters -- web browser -- web application vulnerabilities -- JavaScript code injection attacks -- HTTP; Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1579
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract: In this paper, the authors analyzed and discussed the performance issues in the existing cross‐site scripting (XSS) filters and based on that, proposed a JavaScript string comparison and context‐aware sanitization‐based framework, XSS‐immune. It is a browser‐resident framework that compares the set of scripts embedded in hypertext transfer protocol request ( H REQ ) and hypertext transfer protocol response ( H RES ) for discovering any similar untrusted/malicious JavaScript code. This similar code points towards the untrusted JavaScript code that will be utilized by an attacker to exploit the vulnerabilities of XSS worms. In addition, our technique determines the context of such worms and performs the sanitization on them accordingly for alleviating the effect of such XSS worms from the real world web applications. We have also introduced a mechanism that can detect the injection of malicious parameter values by modifying the existing JavaScript code, that is, partial script injections. The prototype of XSS‐immune was developed in Java and installed as an extension on the Google Chrome. In addition, we have verified the implementation of our design of prototype against five open‐source XSS attack vector repositories, and very few XSS attack worms were able to evade our proposed design. Experimental evaluation and testing of XSS‐immune were performed by adding support from the tested suite of real world web applications. The performance evaluation results revealed that our framework is able to detect the XSS worms with acceptable low false positive and false negative rate in comparison with the performance of existing XSS filters. Experimental results also incurred acceptable runtime overhead because of minor alterations on client‐side browser and computationally fast execution of modules deployed in our browser‐resident framework. Copyright © 2016 John Wiley & Sons, Ltd. Abstract : This paper presents a browser‐resident framework that identifies precisely the injection of malicious script content by discovering the similarity of JavaScript code embedded in HTTP request and response messages. This similar code points toward the untrusted JavaScript code that will be utilized by an attacker to exploit the vulnerabilities of XSS attacks. In addition, our technique determines the diverse context of such code and performs the sanitization on them accordingly. Moreover, this paper introduced a mechanism that can detect the injection of malicious parameter values by modifying the existing JavaScript code, that is, partial script injections. The key advantage of this approach is that it eliminates the need of determining the context of all variables of script code embedded in HTTP request and response messages.