Prevention of Cross-Site Scripting using Hash Technique

Prevention of Cross-Site Scripting using Hash
Technique
Dr.Muna M.T.Jawhar
Dept. of Software Engineering
College of Computer Sc. & Math, University of Mosul.
Mosul, Iraq.
Abstract— Cookies are the mechanisms that maintain an
authentication state between the user and web application.
Therefore cookies are the possible targets for the attackers. Cross
Site Scripting (XSS) attack is one of such attacks against the web
applications in which a user has to compromise its browser’s
resources (e.g. cookies). In this paper, a novel technique of
SHA_512 Hash Technique is introduced whose aim is to make
cookies worthless for the attackers. The work done in HTTP
protocol with windows10.
Keywords-component; Cookies, HTTP protocol, Cross-Site
Scripting Attacks, Hash function.
I. INTRODUCTION
Normally, users in client side through web browsers
request the resources from the server side through web server
of the web application, and the web server respond with the
resources through HTTP protocol [1] in which no sessions are
retained [2]. Therefore, web applications generally use cookies
to provide a mechanism for creating stateful HTTP sessions.
Cookies are often used to store the session [3] for the web
applications that require authentication. Since the cookies can
both identify and authenticate the users [4], this makes the
cookies a very interesting target for the attackers. Now-a-days,
Cross-Site Scripting (XSS) attack is a common vulnerability
which is being exploited in modern web applications through
the injection of advanced HTML tags and Java Script
functions. A weak input validation on the web application
causes the stealing of cookies from the web browser’s database.
In many cases, the attacker who can obtain the valid cookies
from XSS attack can directly hijack the user’s session.
Cross-Site Scripting attack continuously leads the most wide
spread web application vulnerabilities lists (e.g. OWASP [5]
etc.). XSS are broadly classified into two main attacks which
are Persistent and Non-Persistent Attacks [6] [7]. Persistent
attack (also called as stored attack) holes exist when an attacker
post the malicious code on the vulnerable web application’s
repository. As a result, if the stored malicious code gets
executed by the victim’s browser, then stored attack gets
exploited on the victim’s web browser. Secondly non-persistent
attack (also called as reflected attack) means that the vulnerable
malicious code is not persistently stored on a web server but it
is immediately displayed by the vulnerable web application
back to the victim’s web browser. If so, then the malicious
code gets executed on the victim’s web browser and finally,
victim’s browser has to compromise its resources (e.g.
cookies). The rest of the paper is organized as follows. Section
II discusses the related works, and section III mention
background of cookies and the XSS attack, detection and
prevention of XSS attacks. Section IV discusses our proposed
technique. Section V discusses our proposed technique. Finally
we conclude and brief the future work in last section.
II. RELATED WORK
A.S. Christensen, A. Moller, and M.I. Schwartzbach suggested
the study of static string analysis for imperative languages.
They have shown usefulness of string analysis for analyzing
reflective code in Java programs and checking for errors in
dynamically generated SQL queries. They used finite state
automata (FSAs) as a target language representation to analyze
Java. Methods from computational linguistics were also
applied to generate good Finite State Automata approximation
of CFGs [8].
Y.W Huang and others used counterexample traces to
minimize the number of sanitization routines inserted and to
identify the reason of errors that enhance the precision of both
code instrumentation and error reports [9]. Variables
representing current trust level were assigned states which
further were used in verifying the legal information flow in a
web application. Now in order to verify the correctness of all
safety states of program Abstract Interpretation, Bounded
Model Checking technique was used[10].
In [11] the authors provide an approach to address security
risks by using proven security library known as Enterprise
Security API from Open Web Application Security Project.
They also provided an assessment of the approach against the
existing way of handling cross site scripting vulnerabilities.
In [11], a Webmail XSS fuzzer called L-WMxD (Lexical based
Webmail XSS Discoverer), which works on a lexical based
mutation engine is an active defence system to discover XSS
before the webmail application is online for service. The
researchers have run the L-WMxD on over 26 real-world
Webmail applications and found vulnerabilities in 21 Webmail
services, including some of the most widely used Yahoo-Mail.
International Journal of Computer Science and Information Security (IJCSIS),
Vol. 16, No. 3, March 2018
44 https://sites.google.com/site/ijcsis/
ISSN 1947-5500

In [12] authors conduct a thorough analysis of the current state-
of-the-art in browser-based XSS filtering and uncover a set of
conceptual shortcomings, that allow efficient creation of filter
evasions, especially in the case of DOM-based XSS. To
validate their findings, they reported on practical experiments
using a set of 1,602 real-world vulnerabilities, achieving a rate
of 73% successful filter bypasses. Motivated by their findings,
they proposed an alternative filter design for DOM-based XSS,
that utilizes runtime taint tracking and taint-aware parsers to
stop the parsing of attacker controlled syntactic content. To
examine the efficiency and feasibility of their approach, they
presented a practical implementation based on the open source
browser Chromium.
III. CROSS-SITE SCRIPTING
Cross-site scripting (XSS) attack is one of the most
common vulnerabilities in web applications. It considered as
one of the top 10 web application vulnerabilities of 2013 by the
Open Web Application Security Project (OWASP) [13].
According Cenzic Application Vulnerability Trends Report
(2013) Cross Site Scripting represents 26% of the total
population respectively [14] and considers as top most first
attack. Two recent incidents highlighted the severity of xss
vulnerability are Apple Developer Site (July 18, 2013) and
Ubuntu Forums (July 14 and July 20, 2013) [15]. Cross Site
Scripting attack carried out using HTML, JavaScript,
VBScript, ActiveX, Flash, and other client-side languages. A
weak input validation on the web application leads Cross Site
Scripting attacks to gather data from account hijacking,
changing of user settings, cookie theft. Detection or prevention
of XSS is a topic of active research in the industry and
academia. To achieve those purposes, automatic tools and
security system have been implemented, but none of them are
complete or accurate enough to guarantee an absolute level of
security on web application. One of the important reasons of
this shortcoming is that there is lack of common and complete
methodology for the evaluation either in terms of performance
or needed source code modification which in an overhead for
an existing system. A mechanism which will easily deployable
and provide a good performance to detect and prevent the
Cross-site scripting (XSS) attack is essential one.
Figure 1. Web Application Security Vulnerability Population (2013)
Types of Cross-Site Scripting Attack
There are three distinct types of XSS attacks: non persistent,
persistent, and DOM-based.
A. Persistent XSS Attack:
In the persistent XSS an attacker can inject the malicious
code into the page persistently and that means the code will be
stored in the target servers as an html text, such as in a
database, in a comment field, messages posted on forums, etc.,
and this code will be stored in the page which will show to the
user victim later on. If the user victim goes to the page which is
embedded with XSS attacking code, the code will execute on
the user victim’s browser, which, in turn sends the user’s
sensitive information from his site to the attacker’s site. The
persistent XSS attack is also known as stored XSS attack.
Compared with “REFLECTED XSS”, this type of XSS does
more serious harm. If the “STORED XSS” vulnerability is
successfully exploited by hackers, it will persistently attack the
users until administrator remove this vulnerability. The
following Figure 2. shows architecture of exploiting the
persistent XSS attack by a malicious attacker.
Figure 2. Architecture of Exploiting the Persistent XSS Attack
B. Non-persistent XSS Attack:
Non-persistent cross-site scripting vulnerability is the
common type of XSS attacks. The attack code is not
persistently stored, but, instead, it is immediately reflected back
to the user. It is also known as reflected XSS attack. In this
type the injected code is sent back to the user victim off the
server, such as in an error message, search result, or any other
response that includes some or all of the input sent to the server
as part of the request. To do this, the attacker sends a link to the
user victim (e.g., by email). If the user victim clicks on the link,
the vulnerable web application displays the requested web page
with the information passed to it in this link. This information
contains the malicious code which is now part of the web page
that is sent back to the web browser of the user, where it is
executed. The following Figure 3 is an architecture which
shows the sequence of steps of exploiting the reflected XSS
vulnerability by a malicious attacker.
Vol. 16, No. 3, March 2018
ISSN 1947-5500

Figure 3. Architecture of Exploiting the Non-persistent XSS Attack
C. DOM-based XSS:
DOM-based cross-site scripting attacks are performed
by modifying the DOM “environment” in the client side
instead of sending any malicious code to server. DOM is
short for Document Object Model and it is a platform and
language neutral interface. DOM allows the scripting to
change the HTML or XML document, the HTML or XML
document can be modified by a hacker’s scripting or
program. Therefore, DOM-based XSS uses DOMs
vulnerability to make the XSS come true. This type of XSS
vulnerability is totally different from the reflected or stored
XSS attack and it does not inject malicious code into a
page. So, it is the problem of the insecure DOM object
which can be controlled by the client side in the web page
or application. For this reason, hackers can let the attack
payload execute in the DOM environment to attack the
Victim side. The following Figure 4 is an architecture
which shows the sequence of steps of exploiting the
reflected XSS vulnerability by a malicious attacker.
Figure 4. Architecture of Exploiting the DOM-based XSS Attack
IV. WHAT IS A COOKIE?
Cookies are the best current way to identify users and allow
persistent sessions[16]. Cookies are small repositories of data
that are stored within your web browser by a web server.
Cookies were first developed by Netscape but now are
supported by all major browsers[17]. They are rife with
security concerns, and some of them can even track your online
activity. Whenever you visit a web site, the cookie stored in
your browser serves as a type of ID card. Each additional time
you login or request resources from the same web server, the
cookie saved in your browser sends its stored data to the web
server. This allows web site administrators, and even Internet
marketers, to see which of their pages are getting the most hits,
how long users stay on each page, which links they click on,
and a wealth of other information.
And believe it or not, cookies are extremely prevalent these
days. Have you ever purchased something from Amazon.com?
If so, then you’ve used cookies before, whether you knew it or
not. It’s quite common for online ecommerce sites to use
cookies to record and store personal information you’ve
entered, which products you’ve searched for, which items are
in your online shopping cart, and other information so it
doesn’t need to be tediously reentered each time you want to
make a purchase.
Furthermore, cookies are used to make a website more
personal. Many sites offer preference options to let you
customize the look, feel, and experience of any given web
service. Once you revisit the site or resource, you’ll find that all
your preferences were preserved. Though cookies make
browsing the web a lot more convenient, they do have a lot of
security drawbacks, as we’ll discuss next.
V. TYPES OF COOKIES AND SECURITY PROBLEMS
We can classify cookies broadly into two types:
session cookies and persistent cookies. A session cookie is a
temporary cookie that keeps track of settings and preferences
as a user navigates a site. A session cookie is deleted when the
user exits the browser. Persistent cookies can live longer; they
are stored on disk and survive browser exits and computer
restarts. Persistent cookies often are used to retain a
configuration profile or login name for a site that a user visits
periodically. The only difference between session cookies and
persistent cookies is when they expire [18].
There are two different versions of cookie
specifications in use: Version 0 cookies (sometimes called
"Netscape cookies"), and Version 1 ("RFC 2965") cookies.
Version 1 cookies are a less widely used extension of Version 0
cookies [15].
The cookie contain the following information:
Vol. 16, No. 3, March 2018
ISSN 1947-5500

TABLE I. THE COOKIE CONTAIN THE FOLLOWING INFORMATION
Information Value Optional or
original
Cookie
attribute
NAME=VALUE. Original
Expires contain the time and date. Optional
Domain A browser sends the cookie only
to server hostnames in the
specified domain like
"acme.com"
Optional
Path This attribute lets you assign
cookies to particular documents
on a server
Optional
even though your browser has ways to manage cookies,
some are nearly impossible to delete. The problem is that
special types of cookies aren’t stored within your browser,
so even if you opt for a different web browser (Firefox,
Chrome, etc.), the cookie will still be active. And many of
these types of cookies are much larger than the average
4KB HTTP cookies – some of them ranging to 100KB or
even 1MB. If you attempt to delete the cookie but notice
that it keeps coming back every time you restart your
browser, you’ve discovered a zombie cookie and may need
special security software to remove it.
VI. PROPOSED METHOD
In this section, we present a novel procedure whose main
objective is to make the cookies useless for the attackers. This
approach is easily implemented on the web server without any
changes required on the web browser. In this paper the web
server will produce a hash of value of name attribute and
domain in the cookie and send this hash value to the browser,
so the browser will keep the hash value of cookie in its
database rather than the original value. Now each time, if the
browser wants to reconnect as a part of active connection, the
browser has to include the hash cookie value into its
corresponding request so that the web server will also rewrite
this hash cookie value to the original value, which is generated
by the web server. Rewriting of hash value to original value is
necessary to be done at the server side, so that the user at the
browser side will get authenticated by the web server. As the
browser stores the hash value of cookies, so even the XSS
attack can steal the cookies from browser’s database, the
cookies cannot be used later to hijack or take off the user’s
session.
We have conducted the experiments on version 0 cookies in
which three attributes (name, domain) are specified for the
identifying the cookies uniquely. First we must bring the
cookies by capture it. We used Web cookies sniffer for capture
the cookies as in the figure (5), it is a program to capture
cookies in real time from network is a Windows utility, a new
application by Nirsoft that captures all cookies saved on your
computer by websites via browsers and applications, and then
provide you with all information about the saved cookie[19].
Figure 5: capture program
The cookies stored in files, then we take the name and domain
to generate the hash value, all the other attributes will remain
same.
We take this cookies, name and path
hp@microsoft
microsoft.com/
We have used the SHA Hashing function for generate hashing
value. Following are some of the steps which are used to
explain the SHA-512 Hashing Technique[18][20]:-
 Append padding bits.
 Append length.
 Initialize hash buffer.
 Process the message in 1024 bit (128 word) which
forms the heart of the algorithm.
 Output the final state value as the resulting hash.
The hash output for the previous cookies is :
fe6eb4f1e09bb3ca5cea07ba9f5f5a8aa462a1adb1634104fbe60d
64ab1d33dfd08f0344eeeea5033efb066d7ba23bd84d428e3b789
64fcc7c2a96b7037968ba
Figure 6: the output of SHA-512
The user on the Clint side submits the user-id and password to
the web server of the web application with HTTP protocol.
 The web server submits the corresponding
information from the browser and generates a cookie.
 Now the web server will dynamically generate the
hash of value of the name attribute in the cookie and
store both these values (original as well as hash value)
in the form of a table on the server side.
TABLE II: THE COOKIE CONTAIN THE FOLLOWING
INFORMATION
 Subsequently, the web server will send the hash value
of the name attribute in the cookie to the web browser.
Cookies Hash value
hp@micr
osoft
microsoft
.com/
fe6eb4f1e09bb3ca5cea07ba9f5f5a8aa462a1adb1634104fbe
60d64ab1d33dfd08f0344eeeea5033efb066d7ba23bd84d428
e3b78964fcc7c2a96b7037968ba
Vol. 16, No. 3, March 2018
ISSN 1947-5500

 The web browser will store this hash value into its
repository.
Since the cookies at the browser’s database now are not valid
for the web applications. Therefore XSS attack will not be able
to impersonate the user using stolen cookies which are
converted into its hash form. Now if the browser wants to
reconnect to the web server as a part of the active connection, it
has to include cookie (hash value) with its corresponding
request to the web server. The web server will use the
information in the table to rewrite back the values of name
attribute in the cookie (sent by the web browser) to the original
value generated by the web server as shown in the next Figure.
Figure 7: communication between user and web server
VII. CONCLUSION AND FUTURE WORK
This paper has presented the SHA-152 Hash function
technique, whose main purpose is to make the cookies
worthless for the attackers even if the attacker successfully
exploits the vulnerabilities of victim’s web browser. This
technique has been implemented on the web server and the
results showed that our technique worked well with the Version
0 cookies on the modern web browsers with HTTP protocol.
Currently we are working on how our proposed technique
works with the Version 1 cookies on the real world websites. In
future, we would also like to develop an analysis on the Clint.
REFERENCES
[1] D. Gourley, B. Totty, M. Sayer, S. Reddy, and A. Aggarwal, HTTP The
Definitive Guide, 1st ed., O’Reilly Media, US, 2002.
[2] Behrouz A. Forouzan, TCP/IP protocol suite, third edition, 2008.
[3] D. Kristol, “HTTP State Management Mechanism,”, in Internet Society,
2000. Available: http:// www.ietf.org/rfc/rfc2965.txt.
[4] “Cross Site Scripting Techniques and mitigation,”, GovCertUK, revision
1.0, October 2009. Available: www.govcertuk.gov.uk.
[5] Open Web Application Security Project, “The ten most critical web
application security vulnerabilities”, 2007,
www.owasp.org/index.php/OWASP_Top_Ten_Project.
[6] J. Garcia-Alfaro and G. Navarro-Arribas, “Prevention of Cross-Site
Scripting Attacks on Current Web Applications,”, Available:
http://hacks-galore.org/guille/pubs/is-otm-07.pdf.
[7] S. Saha, “Consideration Points: Detecting Cross-Site Scripting,”
(IJCSIS) International Journal of Computer Science and Information
Security,Vol. 4, No. 1 & 2, 2009.
[8] A. S. Christensen, A. Mǿller and M. I. Schwartzbach, “Precise analysis
of string expression”, In proceedings of the 10th international static
analysis symposium, LNCS, Springer-Verlag, vol. 2694, pp. 1-18.
[9] Y. W Huang, F. Yu, C. Hang, C. H. Tsai, D. Lee and S. Y. Kuo,
“Verifying Web Application using Bounded Model Checking,” In
Proceedings of the International Conference on Dependable Systems and
Networks, (2004).
[10] Bhanu Prakash Gopularam1 and N. Nalini2," Cross Site Scripting
Security Vulnerabilities and Risk Mitigation Using Enterprise Security
API for Web-Apps on Public Infrastructure", Elsevier Publications 2013.
[11] Zhushou Tang, Haojin Zhu, Zhenfu Cao, Shuai Zhao, L-WMxD: Lexical
Based Webmail XSS Discoverer, IEEE Conference on Computer
Communications Workshops (INFOCOM WKSHPS), pp. 976-981,
2011.
[12] Ben Stock, Sebastian Lekies and Tobias Mueller ,"Precise client-side
protection against DOM-based Cross-Site Scripting", This paper is
included in the Proceedings of the 23rd USENIX Security Symposium.
August 20–22, 2014.
[13] https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.
[14] H. Chen and M. V. Gundy, “Using randomization to enforce information
flow tracking and thwart crosssite scripting attacks,” In Proceedings of
the 16th Annual Network and Distributed System Security Symposium
(NDSS), (2009).
[15] D. Gourley, B. Totty, M. Sayer, S. Reddy, and A. Aggarwal, HTTP The
Definitive Guide, 1st ed., O’Reilly Media, US, 2002.
[16] http://www.thewindowsclub.com/capture-cookies-save-computer-
webcookiessniffer
[17] William Stallings, "Cryptography and network security, principles and
practices", fifth edition, 2008.
[18] Aumasson J.P, Meier W., phan R. and Henzen L., "the hash function
black", 2014.
[19] V. Nithya1, S. Lakshmana Pandian2 and C. Malarvizhi3, " A Survey on
Detection and Prevention of Cross-Site Scripting Attack", International
Journal of Security and Its Applications Vol. 9, No. 3 (2015), pp. 139-
152
[20] https://isis.poly.edu/~jcappos/papers/tr-cse-2013-02.pdf.
Vol. 16, No. 3, March 2018
ISSN 1947-5500

Prevention of Cross-Site Scripting using Hash Technique

More Related Content

What's hot (19)

Similar to Prevention of Cross-Site Scripting using Hash Technique (20)

Recently uploaded (20)

Prevention of Cross-Site Scripting using Hash Technique