Abstract
Along with the wide use of web application, XSS vulnerability has become one of the most common security problems and caused many serious losses. In this paper, on the basis of database query language technique, we put forward a static analysis method of XSS defect detection of Java web application by analyzing data flow reversely. This method first converts the JSP file to a Servlet file, and then uses the mock test method to generate calls for all Java code automatically for comprehensive analysis. We get the methods where XSS security defect may occur by big data analysis. Originated from the methods where XSS security defect may occur, we analyze the data flow and program semantic reversely to detect XSS defect by judging whether it can be introduced by user input without filter. Moreover, to trace the taint path and to improve the analysis precision, we put forward bidirectional analysis. Originated from the results of the reverse analysis, we analyze the data flow forward to trace the taint path. These two methods have effectively reduced analyzing tasks which are necessary in forward ways. It was proved by experiments on some open source Java web projects, bidirectional and reverse methods not only improved the efficiency of detection, but also improved the detection accuracy for XSS defect.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Yawen, W.: Defect model based software testing technology. Beijing Univ. Posts Telecommun. (2009)
Di Lucca, G.A., Fasolino, A.R., Mastoianni, M., Tramontana, P.: Identifying cross site scripting vulnerabilities in Web applications. In: 26th Annual International Telecommunications Energy Conference, INTELEC 2004, pp. 71–80, 11 September 2004
Open Web Application Security Project. Types of Cross-Site. October 2013 Scripting (2013). https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting
Zhong Chenming, X.S.: Web Front-endReveal Hacking Techniques. Electronic Industry Press, Beijing (2013)
Martin, M., Lam, M.S.: Automatic generation of XSS and SQL injection attacks with goal-directed model checking. In: Proceedings of the 17th Conference on Security Symposium, (pp. 31–43). USENIX Association (2008)
Bisht, P., Venkatakrishnan, V.N.: XSS-GUARD: precise dynamic prevention of cross-site scripting attacks. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol. 5137, pp. 23–43. Springer, Heidelberg (2008)
Fonseca, J., Vieira, M., Madeira, H.: Testing and comparing Web vulnerability scanning tools for SQL injection and XSS attacks. In: 13th Pacific Rim International Symposium on Dependable Computing, 2007, PRDC 2007, pp. 365–372. IEEE (2007)
Wurzinger, P., Platzer, C., Ludl, C., Kirda, E., Kruegel, C.: SWAP: Mitigating XSS attacks using a reverse proxy. In: Proceedings of the 2009 ICSE Workshop on Software Engineering for Secure Systems, pp. 33–39. IEEE Computer Society (2009)
Klein, A.: DOM based cross site scripting or XSS of the third kind. Web Application Security Consortium, Articles, 4 (2005)
Fonseca, J., Vieira, M., Madeira, H.: Testing and comparing Web vulnerability scanning tools for SQL injection and XSS attacks. In: 13th Pacific Rim International Symposium on Dependable Computing, 2007, PRDC 2007, pp. 365–372. IEEE (2007)
Paros, Y.: Paros Proxy [DB/OL] (2006). http://sourceforge.net/projects/paros/
Mozilla. XSS-Me [DB/OL] (2012). http://labs.securitycompass.com/exploit-me/xss-me/
Vogt, P., Nentwich, F., Jovanovic, N., Kirda, E., Kruegel, C., Vigna, G.: Cross Site scripting prevention with dynamic data tainting and static analysis. In: NDSS (2007)
Wassermann, G., Su, Z.: Static detection of cross-site scripting vulnerabilities. In: ACM/IEEE 30th International Conference on Software Engineering, 2008, ICSE 2008, pp. 171–180. IEEE (2008)
Benjamin Livshits, V., Lam, M.S.: Finding security vulnerabilities in java applications with static analysis. In: USENLX Technology Symposiu (2005)
Kirkegaard, C., Møller, A.: Static analysis for java servlets and JSP. In: Yi, K. (ed.) SAS 2006. LNCS, vol. 4134, pp. 336–352. Springer, Heidelberg (2006)
Chess, B., West, J.: Secure Programming with Static Analysis. Pearson Education, USA (2007)
Haviv, Y.A., Tripp, O., Weisman, O.U.S.: Patent No. 8,726,245. Washington, DC: U.S. Patent and Trademark Office (2014)
Whaley, J., Dzintars, A., et al.: Using datalog with binary decision diagrams for program analysis. In: Third Asian Symposium (2005)
Whaley, J., Lam, M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: Proceedings of the ACM SIGPLAN 2004 Conference on Programming Language Design and Implementation (PLDI) (2004)
Whaley, J., Lam, M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: ACM SIGPLAN Notices, vol. 39, no. 6, pp. 131–144. ACM (2004)
Tripp, O., Pistoia, M., Cousot, P., Cousot, R., Guarnieri, S.: Andromeda: accurate and scalable security analysis of web applications. In: Cortellessa, V., Varró, D. (eds.) FASE 2013 (ETAPS 2013). LNCS, vol. 7793, pp. 210–225. Springer, Heidelberg (2013)
Schneier, B.: Applied Cryptography: Protocols, Algorithms, and Source Code. Wiley, New York (2007)
Acknowledgments
This work was supported by National Natural Science? Foundation of China (No.61170268, 61100047, 61272493)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2015 Springer-Verlag Berlin Heidelberg
About this chapter
Cite this chapter
Cui, B., Hou, T., Long, B., Xu, L. (2015). Bidirectional Analysis Method of Static XSS Defect Detection Technique Based On Database Query Language. In: Nguyen, N., Kowalczyk, R., Xhafa, F. (eds) Transactions on Computational Collective Intelligence XIX . Lecture Notes in Computer Science(), vol 9380. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-49017-4_3
Download citation
DOI: https://doi.org/10.1007/978-3-662-49017-4_3
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-662-49016-7
Online ISBN: 978-3-662-49017-4
eBook Packages: Computer ScienceComputer Science (R0)