kirancodes.me
To Proof Maintenance & Beyond!
FSE 2015

DexterJS: robust testing platform for DOM-based XSS vulnerabilities

Inian Parameshwaran, Enrico Budianto, Shweta Shinde, Hung Dang, Atul Sadhu, Prateek Saxena

PDFDOI 10.1145/2786805.2803191dblp

Abstract

DOM-based cross-site scripting (XSS) is a client-side vulnerability that pervades JavaScript applications on the web, and has few known practical defenses. In this paper, we introduce DEXTERJS, a testing platform for detecting and validating DOM-based XSS vulnerabilities on web applications. DEXTERJS leverages source-to source rewriting to carry out character-precise taint tracking when executing in the browser context—thus being able to identify vulnerable information flows in a web page. By scanning a web page, DEXTERJS produces working exploits that validate DOM-based XSS vulnerability on the page. DEXTERJS is robust, has been tested on Alexa’s top 1000 sites, and has found a total of 820 distinct zero-day DOM-XSS confirmed exploits automatically.

BibTeX
@inproceedings{Parameshwaran-al:FSE15,
  author    = {Inian Parameshwaran and
               Enrico Budianto and
               Shweta Shinde and
               Hung Dang and
               Atul Sadhu and
               Prateek Saxena},
  title     = {{DexterJS:} robust testing platform for {DOM-based} {XSS} vulnerabilities},
  booktitle = {{ESEC/SIGSOFT} {FSE}},
  pages     = {946--949},
  publisher = {{ACM}},
  year      = {2015},
}

Related papers