Abstract:Ransomware has appeared to be the most damaging and devastating type of malware attack in any cyber physical system. The resilience of a web browser to deal with the malware attack is of significance importance, however, evaluating the performance of a browser to tackle these attacks is a challenging task. Due to various automation techniques, web applications can be tested without human intervention. Technologies such as Junit, Chakram, and Selenium are useful in automated testing but the problem is that the attacker uses harmful code and automated web approaches to distribute their malware. In this research,our contribution is twofold. Firstly, we examine a new attack vector that cyber adversaries can possibly use in the future to infect an operating system with a malware. Currently, attackers use various techniques to gain access to victims' personal computers. Secondly, we present a novel automated web defence to countermeasure these malware attacks. The proposed research aims to provide a better understanding of the new computer virus-spreading techniques that intruders can use in the future. We provide the insight of these attacks and present ways to countermeasure the attacks and to reduce the attack surface. Experiments and flow diagrams have been used to demonstrate the attack and defence approach. To offer malware lateral movement and to encrypt the date of users' device, we use Selenium automation tool on a social media platform. For our experimentation, we developed an application which has been tested on a variety of browsers including Google Chrome, Firefox, and Safari. Our research has revealed that we have an 85 percent success rate when testing in a head-on environment. We have expanded our experiments on headless applications and interestingly, the accuracy rate improved and the probability of success increased to 95 percent. Lastly, we have demonstrated a unique method for detecting and stopping web automation that is generally applicable.

Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs

AMF: Efficient Browser Interprocess Communication Fuzzing

Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications

Detecting and Defending CSRF at API-Level

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

XSS Peeker: A Systematic Analysis of Cross-site Scripting Vulnerability Scanners

A Formal Approach to Exploiting Multi-Stage Attacks based on File-System Vulnerabilities of Web Applications (Extended Version)

HARMer: Cyber-attacks Automation and Evaluation

CARONTE: Crawling Adversarial Resources Over Non-Trusted, High-Profile Environments

Crook-sourced intrusion detection as a service

Towards Automated Security Analysis of Smart Contracts Based on Execution Property Graph

algoXSSF: Detection and analysis of cross-site request forgery (XSRF) and cross-site scripting (XSS) attacks via Machine learning algorithms

SCANTRAP: Protecting Content Management Systems from Vulnerability Scanners with Cyber Deception and Obfuscation

CORMAND2: A Deception Attack Against Industrial Robots

Break the Wall from Bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls

Automatic Web Security Unit Testing: XSS Vulnerability Detection

Off-Path Attacking the Web

Generative Adversarial Network (GAN)-Based Autonomous Penetration Testing for Web Applications

Ransomware Attacks in Cyber-Physical Systems: Countermeasure of Attack Vectors Through Automated Web Defenses

Bridging the Gap: Automated Analysis of Sancus

Mitigating CSRF attacks on OAuth 2.0 and OpenID Connect