No abstract

Cross-site Scripting (XSS) has emerged to one of the most prevalent type of security vulnerabilities. While the reason for the vulnerability primarily lies on the serverside, the actual exploitation is within the victim's web browser on the client-side. Therefore, an operator of a web application has only very limited evidence of XSS issues. In this paper, we propose a passive detection system to identify successful XSS attacks. Based on a prototypical implementation, we examine our approach's accuracy and verify its detection capabilities. We compiled a data-set of 500.000 individual HTTP request/response-pairs from 95 popular web applications for this, in combination with both real word and manually crafted XSS-exploits; our detection approach results in a total of zero false negatives for all tests, while maintaining an excellent false positive rate for more than 80% of the examined web applications.

No abstract

The term 'Session Fixation vulnerability' subsumes issues in Web applications that under certain circumstances enable the adversary to perform a Session Hijacking attack through controlling the victim's session identifier value. A successful attack allows the attacker to fully impersonate the victim towards the vulnerable Web application. We analyse the vulnerability pattern and identify its root cause in the separation of concerns between the application logic, which is responsible for the authentication processes, and the framework support, which handles the task of session tracking. Based on this result, we present and discuss three distinct server-side measures for mitigating Session Fixation vulnerabilities. Each of our countermeasures is tailored to suit a specific real-life scenario that might be encountered by the operator of a vulnerable Web application.

No abstract

No abstract

No abstract

Abstract. The paper presents a novel approach t o J a v a b yte code veri cation: The veri cation process is performed o ine" on a network server, instead of incorporating it in the client. Furthermore, the most critical part of the veri cation process is based upon a formal model and uses a model checker for checking the veri cation conditions. The result of the veri cation process can be securely communicated to the runtime platform with cryptographic means. The major advantages of our approach are twofold: on the one hand, it o ers a higher degree of security, since the veri cation process is based on a formal framework. Secondly, i t s a v es resources on the client's side, since the process of byte code veri cation can be replaced by a simple check of a digital signature. This paper concentrates on Java smart cards, where resource limitations inhibit fully-edged byte code veri cation within the client, but the demand for security i s v ery high. However, our approach can also be applied to other variants of Java.