XSS filter on Server side
- 1. MITIGATION OF XSS USING SIGNATURE BASED MODEL ON SERVER SIDE SEMINAR BY Dhanashree Waikar Abhijeet Kate Shailesh Khachane GUIDED BY Mrs. M.A. Pradhan (Head Of Department)
- 2. XSS ? ? ? ? (Cross Site Scripting) Allow code injection by malicious web users XSS attacks the end user -- it runs arbitrary code in their browser. The browser is behind your firewall and is acting within the user’s security context
- 3. JavaScript power JavaScript can control what appears on screen. JavaScript has access to your history. Sites often store session tokens in GET request. JavaScript can intercept cookies. JavaScript can enumerate your network.
- 4. EXAMPLE Code:- <script>alert("/XSS"/)</script> <script>alert("XSS")</script> <script>alert("XSS")</script>; <script>alert(String.fromCharCode(88,83,83))</script> Effect
- 5. Available options to prevent XSS attacks Signature Based Positive signature Negative signature Behavior based Client side or server side
- 6. Signature based model Prevention using negative signature based model Configurable black listed tags Placed at the top most layer of the web application. Recognized attacks are blocked
- 7. Modules for xss prevation Blocker Parser Validator Tag cluster
- 8. Blocker Checks for the existence of special characters For example ‘<’, ‘>’, ‘%’, ‘&’, ‘\\’, ‘&#’ are few of the special characters used to embed JavaScript functions in the tags Blocker is responsible to allow or to reject the input string from the user According to the status which it receives from validator
- 9. Parser Called by the Blocker Breaks the input into multiple tokens, as tags and attributes Stores it as a element in a vector object The vector object created by the parser component which invokes the validator For <img src=http://www.sample.com/image1.gif> The vector elements are img, src=http://www.sample.com/image1.gif
- 10. Validator Checks input for vulnarability by executing the rules using the tag cluster Compares tags or attributes of input script If mached then marked as vulnabrable Verifier() detectMalicious()
- 11. Tag cluster The prohibited tags and the prohibited attributes of tags are categorized as black listed cluster Rules for vulnerability identification
- 12. Flow diagram
- 13. Future Enhancements modular based . Modules for Other web application attacks can be added easily. E.g. sql injection, Buffer-overflow attacks Updates can be provided for the tag cluster
- 14. Limitations Only known attacks can be blocked Web application’s response performance is reduced.
- 15. Conclusion The presented server side solution approach meets the need to protect the web Applications with the perspective to improve the response time while addressing the XSS attacks
- 16. References 1. G. A. Di Lucca, A. R. Fasolino, M. Mastoianni, P. Tramontana, "Identifying Cross Site Scripting Vulnerabilities in Web Applications," Sixth IEEE International Workshop on Web Site Evolution(WSE'04) , pp. 71-80, , 2004. 2. M. M. Burnett and J. C. Foster, “Hacking the Code: ASP.NET Web Application Security,” Chapter 5 - Filtering User Input, Syngress Publishing © 2004 3. Scott, D., Sharp, R. “Developing Secure Web Applications.” IEEEInternet Computing, 6(6), pp. 38-45, Nov 2002. 4. Jin-Cherng Lin, Jan-Min Chen, "An Automatic Revised Tool for Anti-Malicious Injection," cit, p. 164, Sixth IEEE International Conference on Computer and Information Technology (CIT'06), 2006. 5. Zhendong Su, Gary Wassermann, “The essence of command injection attacks in web applications,” Annual Symposium on Principles of Programming Languages, Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles 6. Christopher Krugel, G.Vigna, William Robertson, “A multimodel approach to the detection of web based attacks,”Computer Networks 48 (2005) pp.717-738 – ELSEVIER, 2005.
- 17. Thank you We would like to specially thank Mrs. M. A. Pradhan madam , Mrs. Vaishali Vairale madam, and all respected teachers for their continuous help and support.
- 18. THANK YOU
- 19. QUESTIONS