Hunting for DOM-Based XSS vulnerabilities in mobile cloud-based online social network

Gupta, Shashank; Gupta, Brij B.; Chaudhary, Pooja

doi:10.1016/j.future.2017.05.038

Cited by 42 publications

(19 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Physically testing for DOM-based XSS emerging from URL parameters includes a similar process: setting a few basic interesting inputs, utilizing the browser's designer tools to look the DOM for this input, and testing each area to decide whether it is exploitable [10]. However, other sorts of DOM XSS are harder to identify.…”

Section: Discussion -Conclusionmentioning

confidence: 99%

See 1 more Smart Citation

A Tutorial on Cross Site Scripting Attack - Defense

Papaspirou¹,

Μαγλαράς²,

Ferrag³

2020

Preprint

View full text Add to dashboard Cite

The danger is still very large from cross site scripting attacks. When designing web applications We must follow as much as we can prevention rules and don’t leave any loophole to our programs. Experience is a great factor for programmers to know these attacks and for a trainee programmer is a difficult task to spot all the weak points. In this article we present a tutorial on launching an XSS attack and also we propose simple solutions.

show abstract

Section: Discussion -Conclusionmentioning

confidence: 99%

“…XSS attacks can also be categorized into two groups: stored and reflected. There is a third, much less well-known type of XSS attack called DOM Based XSS [10].…”

mentioning

confidence: 99%

A Tutorial on Cross Site Scripting Attack - Defense

Papaspirou¹,

Μαγλαράς²,

Ferrag³

2020

Preprint

View full text Add to dashboard Cite

show abstract

“…[37][38][39] On the other hand, the rest of the solutions demand major alterations in the existing settings of such defensive frameworks. [37][38][39] On the other hand, the rest of the solutions demand major alterations in the existing settings of such defensive frameworks.…”

Section: Secure and Efficient Integration Of Proposed Security Model mentioning

confidence: 99%

SEC‐H5: Secure and efficient integration of settings of enhanced HTML5 XSS vector defensive framework on edge network of fog nodes

Gupta

Sharma

Kumar

2019

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

The authors introduce an enhanced HTML5 (H5) Cross-Site Scripting (H5-XSS) attack vector defensive model that safeguards and maintains the confidentiality of users accessing the web applications hosted on the fog nodes. Initially, the model performs in self-training manner and estimates some features of H5 script code at the simulated desktop host systems of cloud infrastructure. Second, a process of H5 feature estimation gets re-executed for the online generated HTTP response on the edge network of fog device. Any oddity in these two features sets results in the consequent nested context-familiar sanitization of the distrustful script code on an installed fog nodes. The author design their framework structure on an open application infrastructural structure of Cisco IOx framework of various networked edge devices as fog nodes. The authors configure the tested bed of H5 web platforms on the nodes of the fog computing network for evaluating the malicious script alleviation capability of their model. Evaluation outcomes expose that the author's technique is skilled sufficient for sensing and excluding the suspicious H5 code with sufferable percentage of False Negatives (FNs), False Positives (FPs), and reduced overall performance overhead during the peak congestion of generation of sanitized HTTP response on the fog nodes. KEYWORDSCloud Data Centers (CDC), code injection attacks, context aware sanitization, edge network, HTML5 XSS attack vectors, online social network (OSN) security INTRODUCTIONThe evolution of cloud computing exempted the industries and their consumers from handling the description of countless specifics, like loading resources and computation constraints. 1 It is clearly highlighted in the work of Ponemon 2 that almost 91% of administrations in Europe and UnitedStates approved that drop in the cost is the main motivation for them to move to the platforms of cloud infrastructure. Slight investment, price deduction, and prompt implementation are some of the key aspects that motivate the enterprises to facilitate the services of cloud infrastructure and permit them for putting the emphasis on essential industry worries and main concern, instead of dealing with nominal concerns. Although, such advantages turn out to be problematic for applications, which are latency-sensitive and that need nodes in the area to avail their suspension requests. Smart phones are getting larger utilized in the day-to-day routine lifecycle of the people. Existing cloud computing prototypes cannot satisfy their necessities of motion provision, position alertness, and low latency. 3 In addition, the virtual machines of cloud platforms cannot support end points with rich facilities, comprising the applications with small latency necessities. The reason behind such non-optimal performance is that the data processing is completed at the central of the network of the cloud platforms, which has least connection with ground level.Recently, a new term is coined up, ie, Fog Computing, that extends boundary of cloud platform to an e...

show abstract

“…That means that there are multiple sources of information that are used to understand the real users' needs, and at the same time, they make the recommendation effectiveness relative, since the nature of these data is unstable and relative. For example, a recommended cloud service via a social network [110][111][112] could satisfy customers, because it represents the user's opinion and behavior. However, not all the clients will reach the same level of satisfaction or all the time the selected service is adequate and certain adaptively.…”

Section: Cloud Service Recommendationmentioning

confidence: 99%

Multi-Criteria Decision Analysis Methods in the Mobile Cloud Offloading Paradigm

Bangui

Bühnová

et al. 2017

JSAN

View full text Add to dashboard Cite

Abstract:Mobile cloud computing (MCC) is becoming a popular mobile technology that aims to augment local resources of mobile devices, such as energy, computing, and storage, by using available cloud services and functionalities. The offloading process is one of the techniques used in MCC to enhance the capabilities of mobile devices by moving mobile data and computation-intensive operations to cloud platforms. Several techniques have been proposed to perform and improve the efficiency and effectiveness of the offloading process, such as multi-criteria decision analysis (MCDA). MCDA is a well-known concept that aims to select the best solution among several alternatives by evaluating multiple conflicting criteria, explicitly in decision making. However, as there are a variety of platforms and technologies in mobile cloud computing, it is still challenging for the offloading process to reach a satisfactory quality of service from the perspective of customers' computational service requests. Thus, in this paper, we conduct a literature review that leads to a better understanding of the usability of the MCDA methods in the offloading operation that is strongly reliant on the mobile environment, network operators, and cloud services. Furthermore, we discuss the challenges and opportunities of these MCDA techniques for offloading research in mobile cloud computing. Finally, we recommend a set of future research directions in MCDA used for the mobile cloud offloading process.

show abstract

Hunting for DOM-Based XSS vulnerabilities in mobile cloud-based online social network

Cited by 42 publications

References 6 publications

A Tutorial on Cross Site Scripting Attack - Defense

A Tutorial on Cross Site Scripting Attack - Defense

SEC‐H5: Secure and efficient integration of settings of enhanced HTML5 XSS vector defensive framework on edge network of fog nodes

Multi-Criteria Decision Analysis Methods in the Mobile Cloud Offloading Paradigm

Contact Info

Product

Resources

About