Advertisement

Cookie Scout: An Analytic Model for Prevention of Cross-Site Scripting (XSS) Using a Cookie Classifier

  • Germán Eduardo Rodríguez
  • Diego Eduardo Benavides
  • Jenny Torres
  • Pamela Flores
  • Walter Fuertes
Conference paper
Part of the Advances in Intelligent Systems and Computing book series (AISC, volume 721)

Abstract

Cross-Site Scripting (XSS) attack is a vulnerability typical of Web applications, where malicious scripts are injected into trusted websites. It allows attackers to execute scripts in the victims browser which can hijack user sessions, deface websites, steal cookies or redirect the user to malicious sites. This paper presents Cookie Scout, an analytical model for preventing XSS attacks, which main goal is to classify cookies according to their parameters. For this purpose we collect, analyse and classify the type of traffic in a botnet using the Browser Exploitation Framework (Beef) tool for execute attacks and malicious code remotely in a controlled testing environment. With the parameters obtained from the traffic analysis, an algorithm was designed to detect suspicious websites based on the reputation of their cookies. The results obtained showed that the parameters of the cookies were a good reference to determine malicious websites.

Keywords

XSS Hook Beef JavaScript Cookies 

References

  1. 1.
  2. 2.
  3. 3.
    Cross-site Scripting (XSS) OWASP (2017), https://www.owasp.org/index.php
  4. 4.
    Bisht, P., Venkatakrishnan, V.N.: XSS-GUARD: precise dynamic prevention of cross-site scripting attacks, pp. 23–43. Springer, Heidelberg (2008)Google Scholar
  5. 5.
    Gundy, M.V., Chen, H.: Noncespaces: using randomization to defeat cross-site scripting attacks. Comput. Secur. 31(4), 612–628 (2012)CrossRefGoogle Scholar
  6. 6.
    Gupta, S., Gupta, B.B.: Cross-site scripting (XSS) attacks and defense mechanisms: classification and state-of-the-art. Int. J. Syst. Assur. Eng. Manag. 8(1), 512–530 (2017)CrossRefGoogle Scholar
  7. 7.
    Kirda, E., Jovanovic, N., Kruegel, C., Vigna, G.: Client-side cross-site scripting protection. Comput. Secur. 28(7), 592–604 (2009)CrossRefGoogle Scholar
  8. 8.
    Putthacharoen, R., Bunyatnoparat, P.: Protecting cookies from cross site script attacks using dynamic cookies rewriting technique. In: 13th International Conference on Advanced Communication Technology (ICACT 2011), pp. 1090–1094 (2011)Google Scholar
  9. 9.
    Jim, N. Swamy, M.H.: Beep: browser-enforced embedded policies. In: 16th International WorldWide Web Conference (WWW 2007), pp. 1090–1094 (2007)Google Scholar
  10. 10.
    Takahashi, H., Yasunaga, K., Mambo, M., Kim, K., Youm, H.Y.: Preventing abuse of cookies stolen by XSS. In: 2013 Eighth Asia Joint Conference on Information Security, pp. 85–89 (2013)Google Scholar

Copyright information

© Springer International Publishing AG 2018

Authors and Affiliations

  • Germán Eduardo Rodríguez
    • 1
  • Diego Eduardo Benavides
    • 1
    • 2
  • Jenny Torres
    • 1
  • Pamela Flores
    • 1
  • Walter Fuertes
    • 1
    • 2
  1. 1.Systems Engineering FacultyEscuela Politécnica NacionalQuitoEcuador
  2. 2.Universidad de las Fuerzas Armadas ESPEQuitoEcuador

Personalised recommendations