Identifying cross site scripting vulnerabilities in Web applications

Proceedings - Sixth IEEE International Workshop on Web Site Evolution, WSE 2004

Volumn , Issue , 2004, Pages 71-80

  Di Lucca, G A ^a   Fasolino, A R ^b   Mastroianni, M ^c   Tramontana, P ^b  

^a UNIVERSITY OF SANNIO   (Italy)

^b UNIVERSITY OF NAPLES FEDERICO II   (Italy)

^c SECOND UNIVERSITY OF NAPLES   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

CLIENT SERVER COMPUTER SYSTEMS; CODES (SYMBOLS); COMPUTER PROGRAMMING LANGUAGES; CRYPTOGRAPHY; INFORMATION TECHNOLOGY; PROGRAM DEBUGGING; SECURITY OF DATA; SERVERS; STRUCTURED PROGRAMMING; WEB BROWSERS;

CROSS SITE SCRIPTING (XSS); HYPERTEXTUAL LANGUAGES; INTRUSION DETECTION SYSTEMS (IDS); WEB APPLICATIONS;

WORLD WIDE WEB;

EID: 14944340027     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (23)

1. Michael Benedikt, Juliana Freire, Patrice Godefroid, "VeriWeb: Automatically Testing Dynamic Web Sites", Proceedings of the eleventh international conference on World Wide Web, ACM Press New York, NY, USA, 2002, pp.396-407
2. Security Focus Bugtraq, http://www.securityfocus.com/
3. Securepoint BugTraq, http://msgs.securepoint.com/bugtraq/
4. "CERT® Advisory CA-2000-02 Malicious HTML Tags Embedded in Client Web Requests", http://www.cert.org/advisories/CA-2000-02.html
5. "The Cross Site Scripting FAQ", http://www.cgisecurity.com/ articles/xss-faq.txt
6. Dan Da Costa, Christopher Dahn, Spiros Mancoridis, Vassilis Prevelakis, "Characterizing the 'security vulnerability likelihood' of software functions", Proceedings of International Conference on Software Maintenance, ICSM 2003, IEEE, CS Press, Los Alamitos, CA, 2003, pp.266-274
7. Datamonitor, "Enterprise Security Product Market", Datamonitor report DMTC0913, Jul 2003.
8. G.A. Di Lucca, A.R. Fasolino, F. Faralli, U. De Carlini, "Testing Web applications", Proceedings of International Conference on Software Maintenance, ICSM 2002, IEEE, CS Press, Los Alamitos, CA, 2002, pp. 310-319
9. Yao-Wen Huang, Shih-Kun Huang, Tsung-Po Lin, Chung-Hung Tsai, "Web Application Security Assessment by Fault Injection and Behaviour Monitoring", Proceedings of the twelfth international conference on World Wide Web, ACM Press, New York, NY, USA, 2003, pp. 148-159
10. David Endler, "The evolution of Cross-Site Scripting Attack", http://pgsit.org/pages/2003/gzuchlinski/libox/websecdocs/XSS.pdf
11. The ITsecurity.com Dictionary of Information Security, "Cross Site Scripting (XSS, cross-site malicious content)", http://www.itsecurity.com/ dictionary/xss.htm
12. Alec Main, "Application Security: Building in Security during the Development Stage", Information System Security, May/June 2004, pp. 31-54.
13. D. Ross, I. Brugiolo, J. Coates, M. Roe, "Cross-site Scripting Overview", http://www.microsoft.com/technet/security/news/csoverv.mspx
14. Jeff Offutt, "Quality attributes of Web software applications", IEEE Software, Volume: 19 Issue: 2, March-April 2002, pp.25-32
15. Kazuhito Ohmaki, "Open source software research activities in AIST towards secure open systems", 7th IEEE International Symposium on High Assurance Systems Engineering, 2002. 23-25 Oct. 2002, pp. 37-41
16. K.J.Ottenstein, L.M.Ottenstein, "The program dependence graph in a software development environment", ACM SIGSOFT/SIGPLAN Symposium on Practical Software development environment, 1984, pp.177-184.
17. Filippo Ricca, Paolo Tonella, "Analysis and testing of web applications", Proceedings of the 23rd International Conference on Software Engineering, ICSE 2001, IEEE, CS Press, Los Alamitos, CA, pp. 25-34
18. David Scott, Richard Sharp, "Abstracting Application-Level Web Security", Proceedings of the eleventh international conference on World Wide Web, ACM Press New York, NY, USA, 2002, pp.396-407
19. David Scott, Richard Sharp, "Developing secure Web applications", Internet Computing, IEEE, Volume: 6 Issue: 6, Nov.-Dec. 2002, pp. 38-45
20. Landall J. Stoltenberg, "Application Security: Have We Locked the Windows and Left the Door Open?", Information System Security, May/June 2003, pp. 37-43.
21. Snitz Forum 2000, http://forum.snitz.com/
22. Yury Strashnoy, "The need for Web Application Security", www.elitesecureweb.com/images/pdf/need_for_web_app_security.pdf
23. David A. Wheeler, "Secure Programming for Linux and Unix HOWTO", http://dwheeler.com/secureprograms/Secure-Programs-HOWTO.html