• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Journal of Parallel and Distributed Computing >TT-XSS: A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting
【24h】

TT-XSS: A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting

机译：TT-XSS：一种用于DOM跨站点脚本的新颖的基于污点跟踪的动态检测框架

获取原文
获取原文并翻译 | 示例
       
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Most work on DOM Cross-Site Scripting (DOM-XSS) detection methods can be divided into three kinds: black-box fuzzing, static analysis, and dynamic analysis. However, black-box fuzzing and static analysis suffer much from high false negative rates and high false positive rates respectively. Current dynamic analysis is complex and expensive, though it can obtain more efficient results. In this paper, we propose a dynamic detection framework (TT-XSS) for DOM-XSS by means of taint tracking at client side. We rewrite all JavaScript features and DOM APIs to taint the rendering process of browsers. To this end, new data types and methods are presented to extend the semantic description ability of the original data structure, based on which we can analyze the taint traces through tainting all sources, sinks and transfer processes during pages parsing. In this way, attack vectors are derived to verify the vulnerabilities automatically. Compared to AWVS 10.0, our framework detects more 1.8% vulnerabilities, and it can generate the corresponding attack vectors to verify 9.1% vulnerabilities automatically.
机译：关于DOM跨站点脚本（DOM-XSS）检测方法的大多数工作可以分为三种：黑盒模糊测试，静态分析和动态分析。然而，黑盒模糊测试和静态分析分别遭受高假阴性率和高假阳性率的困扰。尽管当前的动态分析可以获得更有效的结果，但它既复杂又昂贵。在本文中，我们通过客户端的污点跟踪提出了一种针对DOM-XSS的动态检测框架（TT-XSS）。我们重写了所有JavaScript功能和DOM API，以污染浏览器的呈现过程。为此，提出了新的数据类型和方法以扩展原始数据结构的语义描述能力，在此基础上，我们可以通过在页面解析过程中污染所有源，接收器和传输过程来分析污染痕迹。通过这种方式，可以得出攻击向量来自动验证漏洞。与AWVS 10.0相比，我们的框架检测到1.8％的漏洞，并且可以生成相应的攻击向量来自动验证9.1％的漏洞。

著录项

  • 来源
    《Journal of Parallel and Distributed Computing》 |2018年第1期|100-106|共7页
  • 作者

    Ran Wang; Guangquan Xu; Xianjiao Zeng; Xiaohong Li; Zhiyong Feng;

  • 作者单位

    Tianjin Key Laboratory of Advanced Networking (TANK), School of Computer Science and Technology, Tianjin University;

    Tianjin Key Laboratory of Advanced Networking (TANK), School of Computer Science and Technology, Tianjin University;

    Tianjin Key Laboratory of Advanced Networking (TANK), School of Computer Science and Technology, Tianjin University;

    Tianjin Key Laboratory of Advanced Networking (TANK), School of Computer Science and Technology, Tianjin University;

    Tianjin Key Laboratory of Advanced Networking (TANK), School of Computer Science and Technology, Tianjin University;

  • 收录信息
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类
  • 关键词

    DOM Cross-Site Scripting; Static analysis; Dynamic analysis; Vulnerabilities;

    机译：DOM跨站点脚本;静态分析;动态分析;漏洞;

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号