DMCA
Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks (2006)
Cached
Download Links
| Citations: | 113 - 11 self |
BibTeX
@MISC{Kirda06noxes:a,
author = {Engin Kirda and Christopher Kruegel and Giovanni Vigna and Nenad Jovanovic},
title = {Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks},
year = {2006}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
access to on-line services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This script code is executed in the context of the user's web browser. To protect the user's environment from malicious JavaScript code, a sandboxing mechanism is used that limits a program to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading malicious JavaScript code from an intermediate, trusted site. In this case, the malicious script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site scripting (XSS) attacks.
Keyphrases
client-side solution cross-site scripting attack malicious javascript code dynamic client-side behavior malicious script on-line service security mechanism javascript code sandboxing mechanism web page full access script code authentication token web application web application vulnerability origin site cross-site scripting
