Methods for determining cross-site scripting and related vulnerabilities in applications

a cross-site scripting and vulnerability technology, applied in the direction of instruments, computing, electric digital data processing, etc., can solve the problem that testing will fail to detect the vulnerability in the web si

Inactive Publication Date: 2016-08-18
BELVA KENNETH F
View PDF2 Cites 8 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Benefits of technology

This approach effectively detects XSS vulnerabilities across different technologies and contexts, providing a more accurate and comprehensive assessment than traditional signature-based methods.

Problems solved by technology

However, there is a fundamental drawback to these conventional methods, namely, if the exact string does not work (reflect) in the test, the test will fail to detect the vulnerability in the web site even though the vulnerability may, nevertheless, exist.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Methods for determining cross-site scripting and related vulnerabilities in applications
  • Methods for determining cross-site scripting and related vulnerabilities in applications
  • Methods for determining cross-site scripting and related vulnerabilities in applications

Examples

Experimental program
Comparison scheme
Effect test

example 1

GET Method Example 1

[0160]

Step 1:h-t-t-p-: / / 192.168.56.103 / testScripts / reflect.php?HTMLtext=HTML2ndtext&HTMLtext=HTMLtext&HTMLattDQ=HTMLattDQ&HTMLattSQ=HTMLattSQ&scriptattr=scriptattr&scripttag=scripttagSteps 2 and 3:HTMLtext=HTML2ndtextStep 4:2f6b4e8Steps 5 and 6:HTMLtext=2f6b4e8Step 7:h-t-t-p-: / / 192.168.56.103 / testScripts / reflect.php?HTMLattDQ=2f6b4e8&HTMLattSQ=HTMLattSQ&HTMLtext=HTML2ndtext&scriptattr=scriptattr&scripttag=scripttag

example 2

GET Method Example 2

[0161]

Step 1:h-t-t-p-: / / 192.168.56.103 / testScripts / reflect.php?HTMLtext=HTML2ndtext&HTMLtext=HTMLtext&HTMLattDQ=HTMLattDQ&HTMLattSQ=HTMLattSQ&scriptattr=scriptattr&scripttag=scripttagStep 2 and 3:HTMLattSQ=HTMLattSQStep 4:78752efSteps 5 and 6:HTMLattSQ=78752efStep 7:h-t-t-p-: / / 192.168.56.103 / testScripts / reflect.php?HTMLattSQ=78752ef&HTMLattDQ=HTMLattDQ&HTMLtext=HTML2ndtext&scriptattr=scriptattr&scripttag=scripttag

POST Method Example (Parameters are Parsed from HTML Form Tags)

[0162]

Step 1:h-t-t-p-: / / 192.168.56.103 / testScripts / reflect.phpSteps 2 and 3:HTMLattSQ=HTMLattSQStep 4:78752efSteps 5 and 6:HTMLattSQ=78752efStep 7:h-t-t-p-: / / 192.168.56.103 / testScripts / reflect.php{u′post-data′: {u′HTMLattDQ′: u″, u′HTMLtext′: u″, u′scripttag′: u″,u′scriptattr′: u″, u′HTMLattSQ′: u′78752ef′}}

[0163]For the following original URL, examples are provided thereafter of URL-tested (URL-slugged versions) generated and submitted.

Original URL: h-t-t-p-: / / 192.168.56.103 / testScripts / refl...

case 1 example

[0205]

md5sum = 5a105e8b9d40e1329780d62ea2265d8aStep 1:5a105e8b9d40e1329780d62ea2265d8aStep 2:5a105e8b9d40e1329780d62ea2265d8a 5a105e8b9d40e1329780d62ea2265d8a5a105e8b9d40e1329780d62ea2265d8a >5a105e8b9d40e1329780d62ea2265d8a5a105e8b9d40e1329780d62ea2265d8a / 5a105e8b9d40e1329780d62ea2265d8a5a105e8b9d40e1329780d62ea2265d8a (5a105e8b9d40e1329780d62ea2265d8a5a105e8b9d40e1329780d62ea2265d8a ′5a105e8b9d40e1329780d62ea2265d8a5a105e8b9d40e1329780d62ea2265d8a )5a105e8b9d40e1329780d62ea2265d8aStep 3:5a105e8b9d40e1329780d62ea2265d8aalert(‘xss’) 5a105e8b9d40e1329780d62ea2265d8aStep 4:(Part 1)(Part 2)Step 5:5a105e8b9d40e1329780d62ea2265d8a pt>alert(‘xss’) 5a105e8b9d40e1329780d62ea2265d8aStep 6:alert(‘xss’)

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention provides computer-implemented methods and computer systems for testing applications such as web-based (HTTP) applications for cross-site scripting (XSS) and related security vulnerabilities and permits the discovery of previously unknown XSS and related vulnerabilities in applications without relying on known or previously generated static XSS signatures. The invention may be applied to any type of XSS or related vulnerability for any variation of application code.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application is a continuation of U.S. application Ser. No. 14 / 658,393 filed Mar. 16, 2015, which claims the benefit of U.S. provisional application Ser. Nos. 62 / 126,412 filed Feb. 27, 2015, 62 / 029,625 filed Jul. 28, 2014 and 61 / 953,775 filed Mar. 15, 2014, each of which is hereby incorporated by reference in its entirety.FIELD OF THE INVENTION[0002]The invention relates to the field of testing applications for cross-site scripting vulnerabilities.BACKGROUND OF THE INVENTION[0003]Currently, cross-site scripting (XSS) detection tools and programs that check for XSS use signature (or “payload”) based methods to determine if such vulnerabilities exist in the webpage of an application. What this means is that the tool will take a known signature / payload and use it to determine if XSS exists. For example,[0004]<scri-pt>alert(10)< / scri-pt>is a known test payload for XSS. Tools will append, replace or comingle this signature / payl...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & AuthorityApplications(United States)
IPC IPC(8): H04L29/06
CPCH04L63/1466H04L63/1416H04L63/1433G06F21/577G06F2221/033H04L67/02
InventorBELVA, KENNETH F.
OwnerBELVA KENNETH F