• Journal of Digital Convergence
• /
• v.11 no.12
• /
• pp.327-332
• /
• 2013

XSS is an attacker on the other party of the browser that is allowed to run the script. It is seized session of the users, or web site modulation, malicious content insertion, and phishing attack which is available. XSS attacks are stored XSS and reflected XSS. In that, two branch attacks. The form of XSS attacks are cookie sniffing, script encryption, bypass, the malignant cord diffusion, Key Logger, Mouse Sniffer, and addition of lie information addition. XSS attacks are target of attack by script language. Therefore, the countermeasure of XSS is presented and proposed to improve web security.

• Journal of Digital Convergence
• /
• v.13 no.2
• /
• pp.177-183
• /
• 2015

Cross Site Scripting enables hackers to steal other user's information (such as cookie, session etc.) or to do abnormal functions automatically using vulnerability of web application. This attack patterns of Cross Site Scripting(XSS) can be divided into two types. One is Reflect XSS which can be executed in one request for HTTP and its reply, and the other is Stored XSS which attacks those many victim users whoever access to the page which accepted the payload transmitted. To correspond to these XSS attacks, some measures have been suggested. They are data validation for user input, output validation during HTML encoding procedures, and removal of possible risk injection point to prevent from trying to insert malicious code into web application. In this paper, the methods and procedures for these two types are explained and a penetration testing is done. With these suggestions, the attack by XSS could be understood and prepared by its countermeasures.

• Journal of Information Processing Systems
• /
• v.13 no.4
• /
• pp.1014-1028
• /
• 2017

Social networking services (SNSs) such as Twitter, MySpace, and Facebook have become progressively significant with its billions of users. Still, alongside this increase is an increase in security threats such as cross-site scripting (XSS) threat. Recently, a few approaches have been proposed to detect an XSS attack on SNSs. Due to the certain recent features of SNSs webpages such as JavaScript and AJAX, however, the existing approaches are not efficient in combating XSS attack on SNSs. In this paper, we propose a machine learning-based approach to detecting XSS attack on SNSs. In our approach, the detection of XSS attack is performed based on three features: URLs, webpage, and SNSs. A dataset is prepared by collecting 1,000 SNSs webpages and extracting the features from these webpages. Ten different machine learning classifiers are used on a prepared dataset to classify webpages into two categories: XSS or non-XSS. To validate the efficiency of the proposed approach, we evaluated and compared it with other existing approaches. The evaluation results show that our approach attains better performance in the SNS environment, recording the highest accuracy of 0.972 and lowest false positive rate of 0.87.

• Nuclear Engineering and Technology
• /
• v.47 no.7
• /
• pp.791-803
• /
• 2015

The effective cross sections (XSs) in the direct whole core calculation code nTRACER are evaluated by the equivalence theory-based resonance-integral-table method using the WIMS-based library as an alternative to the subgroup method. The background XSs, as well as the Dancoff correction factors, were evaluated by the enhanced neutron-current method. A method, with pointwise microscopic XSs on a union-lethargy grid, was used for the generation of resonance-interference factors (RIFs) for mixed resonant absorbers. This method was modified by the intermediate-resonance approximation by replacing the potential XSs for the non-absorbing moderator nuclides with the background XSs and neglecting the resonance-elastic scattering. The resonance-escape probability was implemented to incorporate the energy self-shielding effect in the spectrum. The XSs were improved using the proposed method as compared to the narrow resonance infinite massbased method. The RIFs were improved by 1% in $^{235}U$, 7% in $^{239}Pu$, and >2% in $^{240}Pu$. To account for thermal feedback, a new feature was incorporated with the interpolation of pre-generated RIFs at the multigroup level and the results compared with the conventional resonance-interference model. This method provided adequate results in terms of XSs and k-eff. The results were verified first by the comparison of RIFs with the exact RIFs, and then comparing the XSs with the McCARD calculations for the homogeneous configurations, with burned fuel containing a mixture of resonant nuclides at different burnups and temperatures. The RIFs and XSs for the mixture showed good agreement, which verified the accuracy of the RIF evaluation using the proposed method. The method was then verified by comparing the XSs for the virtual environment for reactor applicationbenchmark pin-cell problem, as well as the heterogeneous pin cell containing burned fuel with McCARD. The method works well for homogeneous, as well as heterogeneous configurations.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.663-664
• /
• 2009

OWASP에서 발표한 2007년 웹 애플리케이션 취약점 중 하나인 XSS 공격이 사용자 브라우저에서 스크립트를 실행하게 함으로써 사용자의 세션을 가로채거나 웜을 업로드하여 악성코드를 삽입하는 공격이다[2]. 하지만 많은 XSS 방어 기법에서는 단순 스크립트 우회기법과 강제적인 스크립트 차단 방법을 채택하고 있다. 또한 강제적인 XSS 필터 적용으로 과탐지로 인한 정상적인 웹 페이지가 출력 되지 않는 사례가 나타나고 있다. 따라서 본 연구는 효율적인 정규식을 이용하여 XSS 공격 특징을 분석하여 특징점들을 추출하고 이 특징점들을 기반으로 특정한 규칙을 가진 문자열들을 모든 문자가 유효한지 확인할 수 있는 정규식 표현 방법을 이용하여 다양한 응용프로그램에 적용할 수 있는 기술을 연구하고자 한다. 또한 이를 기반으로 포털 사이트와 브라우저에서 제공하는 XSS 필터들과 비교하여 과탐지율 및 오탐지율 서로 비교하여 본 연구가 효율성 면에서 효과가 있는지 우위를 둘 것이며, 브라우저 벤더, 포털 사이트, 개인 PC 등 충분한 시험 평가와 수정을 통해서 응용할 수 있는 계기를 마련할 것이다

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.1234-1237
• /
• 2007

웹 서비스를 기반으로 구축된 IT 환경에서 Dynamic Web page 를 동작하도록 하는 것이 CGI(Common Gateway Interface)이다. 이런 CGI 를 사용하는 Web page 에서는 XSS(Cross Site Scripting)에 취약점을 가지고 있다. XSS 의 취약점을 이용하여 Web page 의 변조, Cookie 의 가로채기 등의 악의적인 행동으로 인해 많은 피해사례가 있다. 기존의 연구들은 이러한 문제를 해결하기 위해서 게시판 입력 값을 체크하여 Meta character 를 필터링 하는 방법으로 XSS 공격을 대응하였다. 그러나 이러한 방법은 각 페이지 마다 필터링 스크립트를 사용하기 때문에 웹 서버의 성능에 많은 부하를 초래 하는 단점이 있었다. 따라서 본 논문에서는 이러한 웹 서버의 부하를 줄이기 위해 필터링 스크립트를 DLL(Dynamic link library) 화 시켜 모듈화된 함수를 각 페이지에서 호출하여 사용함으로써 웹 서버의 성능 향상을 제안 한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.15 no.10
• /
• pp.3750-3770
• /
• 2021

This study investigates open-source dynamic XSS filters used as security devices in web applications to account for the effectiveness of filters in protecting against XSS attacks. The experiment involves twelve representative filters, which are examined individually by placing them into the final output function of a custom-built single-input-form web application. To assess the effectiveness of the filters in their tasks of sanitizing XSS payloads and in preserving benign payloads, a black-box testing method is applied using an automated XSS testing framework. The result in working with malicious and benign payloads shows an important trade-off in the filters' tasks. Because the filters that only check for dangerous or safe elements, they seem to neglect to validate their values. As some safe values are mistreated as dangerous elements, their benign payload function is lost in the way. For the filters to be more effective, it is suggested that they should be able to validate the respective values of malicious and benign payloads; thus, minimizing the trade-off. This particular assessment of XSS filters provides important insight regarding the filters that can be used to mitigate threats, including the possible configurations to improve them in handling both malicious and benign payloads.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.6
• /
• pp.1689-1705
• /
• 2023

To deal with the potential XSS vulnerabilities in the source code of the power communication network, an XSS vulnerability detection method combining the static analysis method with the dynamic testing method is proposed. The static analysis method aims to analyze the structure and content of the source code. We construct a set of feature expressions to match malignant content and set a "variable conversion" method to analyze the data flow of the code that implements interactive functions. The static analysis method explores the vulnerabilities existing in the source code structure and code content. Dynamic testing aims to simulate network attacks to reflect whether there are vulnerabilities in web pages. We construct many attack vectors and implemented the test in the Selenium tool. Due to the combination of the two analysis methods, XSS vulnerability discovery research could be conducted from two aspects: "white-box testing" and "black-box testing". Tests show that this method can effectively detect XSS vulnerabilities in the source code of the power communication network.

• Proceedings of the Korean Information Science Society Conference
• /
• 2011.06d
• /
• pp.102-104
• /
• 2011

최근 스마트폰 사용자가 빠른 속도로 늘어나면서 'QR(Quick Response)코드가 새로운 마케팅 및 정보의 전달 수단으로 크게 각광받고 있다. 또한, QR코드는 인터넷 주소(URL), 사진 및 동영상 정보, 지도 정보, 명함 정보 등을 제공하는 매우 효율적인 수단으로 작용하고 있다. 하지만 스마트폰으로 무심코 인식한 QR 코드로 인해 악성코드에 감염될 가능성이 높아 사용자 주의가 필요하다. 로그인된 웹 사이트에서 QR 코드를 읽어 웹 브라우저로 접근할 때 XSS(Cross Site Scripting)을 통해 해당 웹사이트의 로그인 정보를 획득하거나 게시판 회원정보와 같은 데이터를 수정할 수도 있기 때문이다. 이에 본 논문에서는 QR 코드의 XSS 공격에 대한 대응방안을 상세히 기술하여 QR 코드를 사용하는 유저들에게 도움이 되고자 한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2010.05a
• /
• pp.303-306
• /
• 2010

Personal information being leaked, and personal assets that through a malicious web site for hackers to exploit. Other confidential information via the web site of the country, and your personal information by illegally accessing the data has been obtained who Hacker forces are operating in some countries. Due to the problem of web site management has many vulnerabilities that web sites, as well as programs. In this paper, in the trend world, as well as domestic XSS, SQL Injection, Web Shell analysis of the vulnerability to attacks and XSS, SQL Injection, Web Shell is a direct attack to attack. Security measures are presented what after the attack demonstrated the hack to data collection, analysis. In this study, web site management, web site security and safety can be improved and research will contribute.