Cookie Scout: An Analytic Model for Prevention of Cross-Site Scripting (XSS) Using a Cookie Classifier
Cross-Site Scripting (XSS) attack is a vulnerability typical of Web applications, where malicious scripts are injected into trusted websites. It allows attackers to execute scripts in the victims browser which can hijack user sessions, deface websites, steal cookies or redirect the user to malicious sites. This paper presents Cookie Scout, an analytical model for preventing XSS attacks, which main goal is to classify cookies according to their parameters. For this purpose we collect, analyse and classify the type of traffic in a botnet using the Browser Exploitation Framework (Beef) tool for execute attacks and malicious code remotely in a controlled testing environment. With the parameters obtained from the traffic analysis, an algorithm was designed to detect suspicious websites based on the reputation of their cookies. The results obtained showed that the parameters of the cookies were a good reference to determine malicious websites.
- 1.NOSCRIPT (2007), https://addons.mozilla.org/es/firefox/addon/noscript/
- 2.NOXSS (2007), https://addons.mozilla.org/en-us/firefox/addon/noxss/
- 3.Cross-site Scripting (XSS) OWASP (2017), https://www.owasp.org/index.php
- 4.Bisht, P., Venkatakrishnan, V.N.: XSS-GUARD: precise dynamic prevention of cross-site scripting attacks, pp. 23–43. Springer, Heidelberg (2008)Google Scholar
- 8.Putthacharoen, R., Bunyatnoparat, P.: Protecting cookies from cross site script attacks using dynamic cookies rewriting technique. In: 13th International Conference on Advanced Communication Technology (ICACT 2011), pp. 1090–1094 (2011)Google Scholar
- 9.Jim, N. Swamy, M.H.: Beep: browser-enforced embedded policies. In: 16th International WorldWide Web Conference (WWW 2007), pp. 1090–1094 (2007)Google Scholar