25 million flows later: large-scale detection of DOM-based XSS
作者： Sebastian Lekies , Ben Stock , Martin Johns
关键词: Javascript engine 、 Scripting language 、 World Wide Web 、 Scale (map) 、 Cross-site scripting 、 JavaScript 、 Database 、 Computer science 、 Exploit
摘要: … detect and validate DOM-based XSS vulnerabilities, consisting of a taint-aware JavaScript engine and corresponding DOM … examined sites carry at least one DOMbased XSS problem. …
acm.org
ben-stock.de参考文章(27)
Alex Aiken, Yichen Xie, Static detection of security vulnerabilities in scripting languages usenix security symposium. pp. 13- ,(2006)
Michael Martin, Monica S. Lam, Automatic generation of XSS and SQL injection attacks with goal-directed model checking usenix security symposium. pp. 31- 43 ,(2008)
Mario Heiderich, Gareth Heyes, David Lindsay, Eduardo Alberto Vela Nava, Web Application Obfuscation: '-/Wafs..Evasion..Filters//Alert(/Obfuscation/)-' ,(2010)
Engin Kirda, Christopher Krügel, Nenad Jovanovic, Giovanni Vigna, Philipp Vogt, Florian Nentwich, Cross Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. network and distributed system security symposium. ,(2007)
Anh Nguyen-Tuong, Salvatore Guarnieri, Doug Greene, Jeff Shirley, David Evans, Automatically Hardening Web Applications Using Precise Tainting information security conference. pp. 295- 307 ,(2004) , 10.1007/0-387-25660-1_20
Fabrizio d'Amore, Mauro Gentile, Automatic and Context-Aware Cross-Site Scripting Filter Evasion Research Papers in Economics. ,(2012)
Yacin Nadji, Prateek Saxena, Dawn Song, Document Structure Integrity: A Robust Basis for Cross-site Scripting Defense. network and distributed system security symposium. ,(2009)
Juan José Conti, Alejandro Russo, A taint mode for python via a library nordic conference on secure it systems. ,vol. 7127, pp. 210- 222 ,(2010) , 10.1007/978-3-642-27937-9_15
Prithvi Bisht, V. N. Venkatakrishnan, XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks international conference on detection of intrusions and malware and vulnerability assessment. pp. 23- 43 ,(2008) , 10.1007/978-3-540-70542-0_2
Benjamin Livshits, Abhishek Prateek, K Vikram, Ripley: Automatically Securing Distributed Web Applications Through Replicated Execution pp. 27- ,(2008)