TIIS (한국인터넷정보학회)
Current Result Document : 4,117 / 4,121
| 한글제목(Korean Title) |
Assessment of Dynamic Open-source Cross-site Scripting Filters for Web Application |
| 영문제목(English Title) |
Assessment of Dynamic Open-source Cross-site Scripting Filters for Web Application |
| 저자(Author) |
Nurul Atiqah Abu Talib
Kyung-Goo Doh
|
| 원문수록처(Citation) |
VOL 15 NO. 10 PP. 3750 ~ 3770 (2021. 10) |
한글내용
(Korean Abstract) |
|
영문내용
(English Abstract) |
This study investigates open-source dynamic XSS filters used as security devices in web applications to account for the effectiveness of filters in protecting against XSS attacks. The experiment involves twelve representative filters, which are examined individually by placing them into the final output function of a custom-built single-input-form web application. To assess the effectiveness of the filters in their tasks of sanitizing XSS payloads and in preserving benign payloads, a black-box testing method is applied using an automated XSS testing framework. The result in working with malicious and benign payloads shows an important trade-off in the filters’ tasks. Because the filters that only check for dangerous or safe elements, they seem to neglect to validate their values. As some safe values are mistreated as dangerous elements, their benign payload function is lost in the way. For the filters to be more effective, it is suggested that they should be able to validate the respective values of malicious and benign payloads; thus, minimizing the trade-off. This particular assessment of XSS filters provides important insight regarding the filters that can be used to mitigate threats, including the possible configurations to improve them in handling both malicious and benign payloads. |
| 키워드(Keyword) |
Cross-site scripting
filters
open-source
web application
security
assessment
|
| 파일첨부 |
PDF 다운로드
|
