Paper Info
Title
JS-SAN: defense mechanism for HTML5-based web applications against javascript code injection vulnerabilities
Abstract
AbstractThis paper presents an injection and clustering-based sanitization framework, i.e. JS-SAN JavaScript SANitizer for the mitigation of JS code injection vulnerabilities. It generates an attack vector template by performing the clustering on the extracted JS attack vector payloads corresponding to their level of similarity. As a result, it then sanitizes the extracted JS attack vector template by an automated technique of placement of sanitizers in the source code of generated templates of web applications. We have also performed the deepest possible crawling of web pages for finding the possible user-injection points and injected the latest HTML5-based XSS attack vectors for testing the mitigation capability of our framework. The implementation of our design was done on the browser-side JavaScript library and tested as an extension on the Google Chrome. The attack mitigation capability of JS-SAN was evaluated by incorporating the support from a tested suite of open source web applications that are vulnerable to JS code injection vulnerabilities. The proposed framework validates its novelty by producing a less rate of false negatives and tolerable runtime overhead as compared to existing sanitization-based approaches. Copyright © 2016 John Wiley & Sons, Ltd.
Year
DOI
Venue
2016
10.1002/sec.1433
Periodicals
Keywords
DocType
Volume
javascript (JS) code injection vulnerabilities,cross-site scripting (XSS) attack,sanitization,HTML5,clustering
Journal
9
Issue
ISSN
Citations 
11
1939-0114
1
PageRank 
References 
Authors
0.35
0
2
Name
Order
Citations
PageRank
shashank gupta16011.35
B. B. Gupta251846.49