XSS-GUARD: Precise dynamic prevention of cross-site scripting attacks

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 5137 LNCS, Issue , 2008, Pages 23-43

  Bisht, Prithvi ^a   Venkatakrishnan, V N ^a  

^a 1120 Science and Engineering Offices   (United States)

Author keywords

Attack Prevention; Cross site scripting (XSS); Filtering; Security

Indexed keywords

ATTACK PREVENTION; CROSS-SITE SCRIPTING; CROSS-SITE SCRIPTING (XSS); DEFENSE MECHANISMS; DYNAMIC PREVENTION; FILTERING; INPUT VALIDATION; INTERNATIONAL CONFERENCES; MALWARE; REAL-WORLD; SECURITY; SERVER SIDE; USER INPUT; VULNERABILITY ASSESSMENTS; WEB APPLICATIONS;

COMPUTER CRIME; COMPUTER PROGRAMMING LANGUAGES; HTML; INFORMATION MANAGEMENT; MARKUP LANGUAGES; WEB SERVICES; WEIGHT CONTROL; WORLD WIDE WEB;

MECHANISMS;

EID: 49949119476     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-70542-0_2     Document Type: Conference Paper

References (23)

1. Alexa top sites United States, http://www.alexa.com
2. Soot: A Java Optimization Framework, http://www.sable.mcgill.ca/soot/
3. The Web Application Security Consortium, http://www.webappsec.org/ projects/wafec
4. XSS (Cross Site Scripting) Cheat Sheet. Esp: for filter evasion, http://ha.ckers.org/xss.html
5. Hackers broaden reach of cross-site scripting attacks. ComputerWeekly.com (March 2007)
6. Symantec Internet Security Threat Report. Technical report, Symantec Corporation (March 2007)
7. Apache. The JMeter Project, http://Jakarta.apache.org/jmeter
8. Bandhakavi, S., Bisht, P., Madhusudan, P., Venkatakrishnan, V.N.: CANDID: Preventing SQL Injection Attacks using Dynamic Candidate Evaluations. In: Proceedings of the 14th ACM Conference on Computer and Communications Security, pp. 12-24 (2007)
9. Nguyen-Tuong, A., et al.: Automatically Hardening Web Applications using Precise Tainting. In: 20th International Information Security Conference (2005)
10. Balzarotti, D., et al.: Multi-Module Vulnerability Analysis of Web-based Applications. In: 14th ACM Conference on Computer and Communications Security, pp. 25-35 (2007)
11. Balzarotti, D., et al.: Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications. In: IEEE Symposium on Security and Privacy (2008)
12. Kirda, E., et al: Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks. In: Proceedings of the 2006 ACM Symposium on Applied Computing (2006)
13. Wassermann, G., et al.: Static Detection of Cross-Site Scripting Vulnerabilities. In: Proceedings of the 30th International Conference on Software Engineering (May 2008)
14. Jovanovic, N., et al.: Pixy: A Static Analysis Tool for Detecting Web Application Vulnerabilities. In: IEEE Symposium, on Security and Privacy (May 2006)
15. Vogt, P., et al: Cross-Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. In: NDSS, San Diego (2007)
16. Pietraszek, T., et al: Defending Against Injection Attacks through Context-Sensitive String Evaluation. In: Recent Advances in Intrusion Detection (2005)
17. Jim, T., et al.: BEEP: Browser-Enforced Embedded Policies. In: International WWW Conference (2007)
18. Su, Z., et al.: The Essence of Command Injection Attacks in Web Applications. In: ACM Symposium on Principles of Programming Languages (POPL) (2006)
19. Livshits, V.B., Lam, M.S.: Finding Security Vulnerabilities in Java Applications with Static Analysis (2005)
20. MITRE. Common Vulnerabilities and Exposures List, http://eve.mitre.org
21. Samy. I'm popular (2005), http://namb.la/popular
22. Xie, Y., Aiken, A.: Static Detection of Security Vulnerabilities in Scripting Languages. In: USENIX Security Symposium (2006)
23. Xu, W., Bhatkar, S., Sekar, R.: Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks. In: USENIX Security Symposium (2006)