A Survey on Detection Techniques to Prevent Cross-Site Scripting Attacks on Current Web Applications
---
paper_title: A viable solution to enterprise development and systems integration: a case study of web services implementation

paper_content:

Web services technology provides small/medium enterprises (SMEs) with a new solution for systems integration. Large enterprises have realised the importance of interoperability through cost effective integration applications with their SME partners. These standardised applications provide interoperable and universal products and services for inter and intra-organisation e-business transactions. The article discusses issues and problems pertaining to enterprise systems integration and how web services can provide a universal framework that supports all distributed e-commerce solutions in the near future. A case study of how web services offer interoperable solutions to an insurance company is discussed.
---
paper_title: Secure Web scripting

paper_content:

Current Web scripting languages lack an explicit security model. The model proposed in the article has been implemented for JavaScript in the Mozilla browser source code; it is realized by a "safe" interpreter and based on three basic building blocks: access control, to regulate what data a script can access on a user's machine and in what mode; independence of contexts, to ensure that two scripts executing in different contexts (for example, simultaneously in different browser windows or sequentially in the same browser window) cannot access each other's data at will; and trust management, to regulate how trust is established and terminated among scripts executing simultaneously in different contexts. We also advocate a clear separation between a security policy and an implementation. Different users require different degrees of privacy and security, which translate to different degrees of flexibility when interacting with a Web server; these differences can be expressed in different security policies. A sound implementation, however, should be universally applicable. These are principles that first appeared decades ago in work on secure operating systems.
---
paper_title: A sense of self for Unix processes

paper_content:

A method for anomaly detection is introduced in which ``normal'' is defined by short-range correlations in a process' system calls. Initial experiments suggest that the definition is stable during normal behavior for standard UNIX programs. Further, it is able to detect several common intrusions involving sendmail and lpr. This work is part of a research program aimed at building computer security systems that incorporate the mechanisms and algorithms used by natural immune systems.
---
paper_title: Using programmer-written compiler extensions to catch security holes

paper_content:

This paper shows how system-specific static analysis can find security errors that violate rules such as "integers from untrusted sources must be sanitized before use" and "do not dereference user-supplied pointers." In our approach, programmers write system-specific extensions that are linked into the compiler and check their code for errors. We demonstrate the approach's effectiveness by using it to find over 100 security errors in Linux and OpenBSD, over 50 of which have led to kernel patches. An unusual feature of our approach is the use of methods to automatically detect when we miss code actions that should be checked.
---
paper_title: Noxes: a client-side solution for mitigating cross-site scripting attacks

paper_content:

Web applications are becoming the dominant way to provide access to on-line services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This script code is executed in the context of the user's web browser. To protect the user's environment from malicious JavaScript code, a sand-boxing mechanism is used that limits a program to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading malicious JavaScript code from an intermediate, trusted site. In this case, the malicious script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site scripting (XSS) attacks.In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent malicious scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.
---
paper_title: A proposal and implementation of automatic detection/collection system for cross-site scripting vulnerability

paper_content:

Cross-site scripting (XSS) attacks target Web sites with cookie-based session management, resulting in the leakage of privacy information. Although several server-side countermeasures for XSS attacks do exist, such techniques have not been applied in a universal manner, because of their deployment overhead and the poor understanding of XSS problems. This paper proposes a client-side system that automatically detects XSS vulnerability by manipulating either request or server response. The system also shares the indication of vulnerability via a central repository. The purpose of the proposed system is twofold: to protect users from XSS attacks, and to warn the Web servers with XSS vulnerabilities.
---
paper_title: Precise alias analysis for static detection of web application vulnerabilities

paper_content:

The number and the importance of web applications have increased rapidly over the last years. At the same time, the quantity and impact of security vulnerabilities in such applications have grown as well. Since manual code reviews are time-consuming, error-prone and costly, the need for automated solutions has become evident. In this paper, we address the problem of vulnerable web applications by means of static source code analysis. To this end, we present a novel, precise alias analysis targeted at the unique reference semantics commonly found in scripting languages. Moreover, we enhance the quality and quantity of the generated vulnerability reports by employing a novel, iterative two-phase algorithm for fast and precise resolution of file inclusions.We integrated the presented concepts into Pixy~\cite{jovanovic06:pixy_short}, a high-precision static analysis tool aimed at detecting cross-site scripting vulnerabilities in PHP scripts. To demonstrate the effectiveness of our techniques, we analyzed three web applications and discovered 106 vulnerabilities. Both the high analysis speed as well as the low number of generated false positives show that our techniques can be used for conducting effective security audits.
---
paper_title: Detecting malicious JavaScript code in Mozilla

paper_content:

The JavaScript language is used to enhance the client-side display of web pages. JavaScript code is downloaded into browsers and executed on-the-fly by an embedded interpreter. Browsers provide sand-boxing mechanisms to prevent JavaScript code from compromising the security of the client's environment, but, unfortunately, a number of attacks exist that can be used to steal users' credentials (e.g., cross-site scripting attacks) and lure users into providing sensitive information to unauthorized parties (e.g., phishing attacks). We propose an approach to solve this problem that is based on monitoring JavaScript code execution and comparing the execution to high-level policies, to detect malicious code behavior. To achieve this goal it is necessary to provide a mechanism to audit the execution of JavaScript code. This is a difficult task, because of the close integration of JavaScript with complex browser applications, such as Mozilla. This paper presents the first existing implementation of an auditing system for JavaScript interpreters and discusses the pitfalls and lessons learned in developing the auditing mechanism.
---
paper_title: Static detection of security vulnerabilities in scripting languages

paper_content:

We present a static analysis algorithm for detecting security vulnerabilities in PHP, a popular server-side scripting language for building web applications. Our analysis employs a novel three-tier architecture to capture information at decreasing levels of granularity at the intrablock, intraprocedural, and interprocedural level. This architecture enables us to handle dynamic features of scripting languages that have not been adequately addressed by previous techniques. ::: ::: We demonstrate the effectiveness of our approach on six popular open source PHP code bases, finding 105 previously unknown security vulnerabilities, most of which we believe are remotely exploitable.
---
paper_title: A sense of self for Unix processes

paper_content:

A method for anomaly detection is introduced in which ``normal'' is defined by short-range correlations in a process' system calls. Initial experiments suggest that the definition is stable during normal behavior for standard UNIX programs. Further, it is able to detect several common intrusions involving sendmail and lpr. This work is part of a research program aimed at building computer security systems that incorporate the mechanisms and algorithms used by natural immune systems.
---

Title: A Survey on Detection Techniques to Prevent Cross-Site Scripting Attacks on Current Web Applications

Section 1: Introduction
Description 1: Outline the growing importance of web applications, the associated security concerns, and set the context for focusing on Cross-Site Scripting (XSS) attacks.

Section 2: Cross-Site Scripting Attacks
Description 2: Provide an overview of Cross-Site Scripting (XSS) attacks, including definitions and how they exploit user-browser trust relationships.

Section 3: Persistent XSS Attacks
Description 3: Detail the characteristics and methodologies of Persistent (or Stored) XSS attacks with illustrative examples.

Section 4: Non-Persistent XSS Attacks
Description 4: Elaborate on Non-Persistent (or Reflected) XSS attacks, their mechanisms, and real-world scenarios.

Section 5: Analysis and Filtering of the Exchanged Information
Description 5: Discuss strategies for analyzing and filtering data to mitigate XSS attacks, including both server-side and client-side solutions.

Section 6: Runtime Enforcement of Web Browsers
Description 6: Explore techniques that involve runtime enforcement in web browsers to detect and prevent execution of malicious scripts.

Section 7: Summary and comments on current prevention techniques
Description 7: Summarize the strengths and limitations of current XSS prevention techniques and propose potential directions for future research.

Section 8: Conclusion
Description 8: Conclude by reiterating the significance of addressing XSS vulnerabilities and summarizing the surveyed approaches for preventing XSS attacks.