Rule-defect oriented browser XSS filter test method

Zhijie GUI; Hui SHU

doi:10.11959/j.issn.2096-109x.2018093

您当前的位置：

首页 >

文章列表页 >

Rule-defect oriented browser XSS filter test method

Papers | 更新时间：2024-06-03

- Rule-defect oriented browser XSS filter test method
- Chinese Journal of Network and Information Security Vol. 4, Issue 11, Pages: 69-77(2018)
- 作者机构：
  
  1. 中国人民解放军信息工程大学网络空间安全学院，河南郑州 450001
  2. 数学工程与先进计算国家重点实验室，河南郑州450001
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018093
  CLC： TP309
- Online First：2018-11，
  
  Published：15 November 2018
- 稿件说明：
移动端阅览
Zhijie GUI, Hui SHU. Rule-defect oriented browser XSS filter test method[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 69-77.
DOI：

Zhijie GUI, Hui SHU. Rule-defect oriented browser XSS filter test method[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 69-77. DOI： 10.11959/j.issn.2096-109x.2018093.

摘要

为了缓解跨站脚本（XSS，cross-site scripting）攻击，现代浏览器使用XSS过滤器进行防御，现有方法很难有效对浏览器XSS过滤器的安全性进行测试与评估。规则缺陷是浏览器XSS过滤器实现过程中的缺陷和安全问题。面向浏览器XSS过滤器规则缺陷，给出其形式化定义，设计测试样例和场景生成算法。为了定量测试与评估不同浏览器XSS过滤器的过滤水平，结合过滤成功率、误报率、输入损耗计算过滤能力。基于所提方法，设计原型系统对几种主流浏览器XSS过滤器进行自动化测试，得到了不同浏览器的XSS过滤能力。经过实际测试，该系统具备发现未公开漏洞的能力。

Abstract

In order to alleviate XSS (cross-site scripting) attacks

modern browsers use XSS filters for defense.It is difficult to effectively test and evaluate the security of browser XSS filters.The rule-defect is the defect and security problem in the implementation process of browser XSS filter.The formal definition

design test sample and scene generation algorithm were presented for browser XSS filter rule-defects.In order to quantitatively test and evaluate the filtering level of different browser XSS filters

combined with filtering success rate

false positive rate

input loss calculation filtering ability.Based on the proposed method

the prototype system is designed to automate the testing of several mainstream browser XSS filters

and the XSS filtering capabilities of different browsers are obtained.Further

after actual testing

the system also has the ability to discover undisclosed vulnerabilities.

关键词

Keywords

references

GUPTA BB , GUPTA S , GANGWAR S , et al . Meena PK (2015) cross-site scripting (XSS) abuse and defense:exploitation on several testing bed environments and its defense [J ] . J Inf Privacy Secur , 11 ( 2 ): 118 - 136 .

ROSS D . IE8 security part IV:the XSS filter [EB/OL ] . http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-thexss-filter http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-thexss-filter .aspx,July 2008.

NAVA E , LINDSAY D . Abusing Internet Explorer 8's XSS filters [C ] // BlackHat Europe . 2010 .

BATES D , BARTH A , JACKSON C . Regular expressions considered harmful in client-side XSS filters [C ] // 19th International World Wide Web Conference . 2010 .

LEKIES S , STOCK B , JOHNS M.2014 . A tale of the weaknesses of current client-side filtering [C ] // Black Hat Europe . 2014 .

刘雅楠 . Web 前端攻击及安全防护技术研究与实现 [D ] . 北京:北京邮电大学 , 2017 .

LIU Y N . Research and implementation of Web front-end attack and protection technology [D ] . Beijing:Beijing University of Posts and Telecommunications , 2017 .

LIU J D , . An improved XSS vulnerability detection method based on attack vector [C ] // 2018 International Conference on Modeling,Simulation and Analysis . 2018 :6.

PAN J K , et al . Taint inference for cross-site scripting in context of URL rewriting and HTML Sanitization [J ] . ETRI Journal , 2016 ( 2 ): 376 - 386 .

黄娜娜 , 万良 . 一种基于序列最小优化算法的跨站脚本漏洞检测技术 [J ] . 信息网络安全 , 2017 ( 10 ): 55 - 62 .

HUANG N N , WAN L . A cross site script vulnerability detection technology based on sequential minimum optimization algorithm [J ] . Netinfo Securi , 2017 ( 10 ): 55 - 62 .

SALUNKE S S . Selenium Web driver in Python:learn with examples [M ] . CreateSpace Independent Publishing Platform , 2014 .

BEKRAR S , BEKRAR C , GROZ R , et al . Finding software vulnerabilities by smart fuzzing [C ] // IEEE Fourth International Conference on Software Testing Verification and Validation . 2011 .

ANASTASIOS S , NTANTOGIAN C , XENAKIS C . Bypassing XSS auditor:taking advantage of badly written PHP code [C ] // IEEE International Symposium on Signal Processing and Information Technology . 2015 : 290 - 295 .

Taint inference for cross-site scripting in context of URL rewriting and HTML sanitization [J ] . ETRI Journal , 2016 ,( 2 ): 376 - 386 .

LIU B W , . XSS vulnerability scanning algorithm based on anti-filtering rules [C ] // International Conference on Computer,Electronics and Communication Engineering . 2017 .

LEKIES S , KOTOWICZ K , GROB S , et al . Code-reuse attacks for the Web:breaking cross-site scripting mitigations via script gadgets [C ] // ACM SIGSAC Conference on Computer and Communications Security . 2017 : 1709 - 1723 .

Views

1121

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰