Abstract:In the fields of social networking, media, and management, web applications on the Internet play a very indispensable role. A large amount of personal privacy information and login tokens make web applications often targeted by hackers. Cross-site scripting attacks are the most common method used to steal data from web applications. To solve the security risks caused by cross-site scripting vulnerabilities, security personnel need to actively discover these vulnerabilities to better defend against the harm. We proposed a novel genetic algorithm-based fuzzing scheme to address this problem. First, a small number of initial attack vectors are generated according to the interactive environment of the web application and then the attack vectors are sequenced into genes. Combined with the grammatical structure features of cross-site scripting and common bypass methods, the gene sequences are iteratively optimized and improved. Finally, the generated high-quality vectors are used to detect potential cross-site scripting threats in the application (we named the implementation of this approach GAXSS). The method we proposed can automatically detect the vulnerability of page interaction points and can obtain better detection results without a large number of test dictionaries, and the time cost is also reasonable. We have conducted vulnerability tests on many common open-source web applications, with a precision rate of 1.0 and an accuracy rate over 0.98. In addition, we also compared GAXSS with other well-known scanners and state-of-the-art detection methods. Its comprehensive performance is better, and it can effectively detect vulnerabilities.

Design and Applying of Web Application Security Detecting System

Design and implementation of a web application vulnerability detection system

Research and Implementation of Security Vulnerability Detection in Application System of WEB Static Source Code Analysis Based on JAVA

Research on Information Security Model and Security System Design

A web page malicious script detection system

Architecture of Multi-Dimension Web Application Security Based on OWASP and WASC

Supporting secure programming in web applications through interactive static analysis.

Study of Intrusion Detecton Mondels for Web Applications

Design and Implementation of Intrusion Detection System Based on Web

Design and Implementation of Website Information Disclosure Assessment System

Development of A Web System for Water Quality Monitoring Information Management

Study and Implementation of a Software Development Pattern for Online Transient Security Early Warning and Protecting System

Intelligent detection system of asset security vulnerability hidden danger under multiple and heterogeneous Web network

Detecting Malicious Websites in Depth through Analyzing Topics and Web-pages

D-WAV: A Web Application Vulnerabilities Detection Tool Using Characteristics of Web Forms

Design and implementation of computer network security detection and control system

Web Vulnerability Scanning Software

The Detection and Defense Mechanism for SQL Injection Attack Based on Web Application

GAXSS: Effective Payload Generation Method to Detect XSS Vulnerabilities Based on Genetic Algorithm

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

Research on the technology of detecting the SQL injection attack and non-intrusive prevention in WEB system