A proposal and implementation of automatic detection/collection system for cross-site scripting vulnerabilities

摘要

Cross-site scripting (XSS) attacks target web sites with Cookie-based session management, resulting in the leakage of privacy information. Although several server-side countermeasures for XSS attacks do exist, such techniques have not been applied in a universal manner, because of their deployment overhead and the poor understanding of the XSS problem. This paper proposes a client-side system that automatically detects XSS vulnerability by manipulating either client request or server response. The system also shares the indication of vulnerability via central repository. The purpose of the proposed system is two-fold: to protect users from XSS attacks, and to warn web servers with XSS vulnerabilities.