Abstract:With the rising demand for E-commerce, Social Networking websites, it has become essential to develop security protocols over the World Wide Web that can provide security and privacy to Internet users all over the globe. Several traditional encryption techniques and attack detection protocols can secure the data transmitted over public networks. However, hackers can effortlessly exploit them to acquire access to the users’ sensitive information such as user ID, session ID, cookies, passwords, bank account details, contact numbers, private PINs, database information, etc. Researchers have continuously innovated new techniques to build a secure and robust system that cannot be easily hacked and manipulated. Still, there is much scope for novelty to provide security against contemporary techniques used by intruders. The motivation of this survey is to observe the recent developments in Cross-Site Scripting attacks and techniques used by researchers to secure confidential information. Cross-Site Scripting (XSS) has been recognized as one of the top 10 online application security risks by the Open Web Application Security Project (OWASP) for decades. Therefore, dealing with this security flaw in web applications has become essential to avoid further personal and financial damage to Internet users and business organizations. There is a need for an extensive survey of recent XSS attack detection techniques that can provide the right direction to researchers and security professionals. We present a complete overview of recent machine learning and neural network-based XSS attack detection techniques in this paper, covering deep neural networks, decision trees, web-log-based detection models, and many more. This paper also highlights the research gaps that must be addressed while designing attack detection models. Further, challenges researchers face during the development of recent techniques are also discussed. Finally, future directions are provided to reflect on new concepts that can be used in forthcoming research works to improve XSS attack detection techniques.

A Survey on XSS Attack Detection and Prevention in Web Applications

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

Detection of cross-site scripting (XSS) attacks using machine learning techniques: a review

Cross-site Scripting Attack Defense Method of Server-client Cooperation

Design and implementation of a web application vulnerability detection system

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

XSS Peeker: A Systematic Analysis of Cross-site Scripting Vulnerability Scanners

Cross Channel Scripting and Code Injection Attacks on Web and Cloud-Based Applications: A Comprehensive Review

Machine Learning for Detection and Mitigation of Web Vulnerabilities and Web Attacks

Protection of Web Applications from Cross-Site Scripting Attacks in Browser Side

Automatic Web Security Unit Testing: XSS Vulnerability Detection

A Survey of Prevent and Detect Access Control Vulnerabilities

Security Study of Service Worker Cross-Site Scripting

Exploring Defense of SQL Injection Attack in Penetration Testing

GAXSS: Effective Payload Generation Method to Detect XSS Vulnerabilities Based on Genetic Algorithm

Detection and Prevention of Code Injection Attacks on HTML5-Based Apps

A Robust Server-Side JavaScript Feature Injection-Based Design for JSP Web Applications Against XSS Vulnerabilities

Poster: A Path-Cutting Approach To Blocking Xss Worms In Social Web Networks

Black-box adversarial attacks on XSS attack detection model

Access Control Vulnerabilities Detection for Web Application Components

Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications