DMCA
Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers (2009)
Cached
Download Links
| Venue: | 30TH IEEE SYMPOSIUM ON SECURITY AND PRIVACY |
| Citations: | 46 - 2 self |
BibTeX
@MISC{Louw09blueprint:robust,
author = {Mike Ter Louw and V. N. Venkatakrishnan},
title = {Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers},
year = {2009}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
As social networking sites proliferate across the World Wide Web, complex user-created HTML content is rapidly becoming the norm rather than the exception. User-created web content is a notorious vector for cross-site scripting (XSS) attacks that target websites and confidential user data. In this threat climate, mechanisms that render web applications immune to XSS attacks have been of recent research interest. A challenge for these security mechanisms is enabling web applications to accept complex HTML input from users, while disallowing malicious script content. This challenge is made difficult by anomalous web browser behaviors, which are often used as vectors for successful XSS attacks. Motivated by this problem, we present a new XSS defense strategy designed to be effective in widely deployed existing web browsers, despite anomalous browser behavior. Our approach seeks to minimize trust placed on browsers for interpreting untrusted content. We implemented this approach in a tool called BLUEPRINT that was integrated with several popular web applications. We evaluated BLUEPRINT against a barrage of stress tests that demonstrate strong resistance to attacks, excellent compatibility with web browsers and reasonable performance overheads. 1.
Keyphrases
robust prevention cross-site scripting attack web browser reasonable performance overhead confidential user data several popular web application notorious vector complex user-created html content social networking site new x defense strategy successful x attack user-created web content anomalous web browser behavior malicious script content web application stress test anomalous browser behavior complex html input strong resistance untrusted content excellent compatibility recent research interest render web application security mechanism threat climate cross-site scripting world wide web target website
