Can I read State-Sensitive Black-Box Web Application Scanning for Cross-Site Scripting Vulnerability Detection on EtoBox?

State-Sensitive Black-Box Web Application Scanning for Cross-Site Scripting Vulnerability Detection by Tianxiang Zhang; Hui Huang; Yuliang Lu; Kailong Zhu; Jiazhen Zhao is a Engineering article available to read on EtoBox.

What is State-Sensitive Black-Box Web Application Scanning for Cross-Site Scripting Vulnerability Detection about?

Black-box web application scanning has been a popular technique to detect Cross-Site Scripting (XSS) vulnerabilities without prior knowledge of the application. However, several limitations lead to low efficiency of current black-box scanners, including (1) the scanners waste time by repetitively visiting similar states, such as similar HTML forms of two different products, and (2) using a First-In-First-Out (FIFO) fuzzing order for the collected forms has led to low efficiency in detecting XSS vulnerabilities, as different forms have different potential possibilities of XSS vulnerability. In this paper, we present a state-sensitive black-box web application scanning method, including a filtering method for excluding similar states and a heuristic ranking method for optimizing the fuzzing order of forms. The filtering method excludes similar states by comparing readily available characteristic information that does not require visiting the states. The ranking method sorts forms based on the number of injection points since it is commonly observed that forms with a greater number of injection points have a higher probability of containing XSS vulnerabilities. To demonstrate the effe

Who reads State-Sensitive Black-Box Web Application Scanning for Cross-Site Scripting Vulnerability Detection?

Author

Tianxiang Zhang; Hui Huang; Yuliang Lu; Kailong Zhu; Jiazhen Zhao

Publisher

MDPI AG

Published

2023

Language

EN

Field

Engineering (Physical Sciences)