Research On Defense Techniques Of Cross-Site Scripting Attack

Web 2.0 applications are very attractive to the developers and end-users, because they provide friendly interface, plenty of functions and high practicality. A significant feature of Web2.0 is that plenty of computing works and logical processing are carried out in the client side, by Client-side scripting technology such as JavaScript, VBscript, which brings a lot of convenience and ease of use, as well as potentially secure threats at the same time. At present, Cross-Side Scripting (XSS) is one of the most serious security problems in the Web. Its essential reason is the weakness in security mechanism of web application, that is, the lack of adequate inspection and filtering for the user's input. Report from WebCohort indicates that 80% web sites have the flaw of Cross-Side Scripting, and many large-scale web sites have been ever attacked because of such kind of vulnerability.This paper firstly studies deeply in cross-site scripting attack and treats of three kinds of cross-site scripting including reflected XSS, stored XSS and DOM-based XSS. Then it analyzes various kinds of the attack trigger mechanism, and also makes a summary about the way how Hackers rewrite the scripts to bypass the detection mechanism.After that, this paper designs a XSS defense system on the server side, which is comprised of the core engine, the management module and the database. The core engine, as the most essential part, consists of the pre-processing part, the detecting part, the output ?ltering part and the journal monitoring part. The pre-processing part is responsible for SSL decoding, encoding the input and normalization for the character set. And this part can achieve the goal of decoding HTTPS bit stream and prevent every mutation attack. The detecting part is designed to match the input with rules to detect XSS. The output ?ltering part can escape the special characters in untrusted content, thus completely eliminating the risk of unknown cross-site scripting attacks. But to some extent it will affect users' experience. The journal part records all of the error messages, and adopts the hash function and message authentication code to achieve the integrity and consistency of the system for the convenience of further analysis and demonstration.By deploying the defense system in the reverse proxy server, we can protect the site from XSS attack without changing the existing Web server codes. The security vulnerabilities in different web sites cannot be totally the same.The system we design provides an operational solution to adpat these differences, which can help web sites prevent XSS attacks effectively. Meanwhile, the defense system will increase the response time.At last, traditional XSS defense method has a certain limitation. It just defenses the attack, but doesn't make the best use of the detetion information to realize self-reparing. So this paper proposes a self-healing mechanism, which can help to automatically detect and fix the XSS vulnerability. We do some important reaserch on the mechanism including architecture, procedure, detect method and the exchange of flaw messages.