| Summary: | 碩士 === 國立中央大學 === 資訊工程研究所 === 97 === In this thesis, we will introduce a mechanism to automatically protect cookies with authenticated identity information which being stolen by XSS attackers. Cross Site Scripting (XSS) is an application-level attack which injects script via web application vulnerability. One of the general ways to defend XSS is to identify possible attacking strings, filter them, and disobey to access them. But attackers use varieties of coding to package attacking scripts to skip string filter. The other way is to protect sensitive information in cookies. Taint them and trace data flow not only statically but also dynamically, and finally validate its destination so that offensive attacker cannot get this sensitive information easily. But it hardly covers whole data flow in large Internet applications.
In order to defend XSS attacks, programmers require sufficient network security knowledge and fix possible vulnerabilities that may be attacked. We set up a mechanism into server side in Linux kernel which automatically protect authenticated cookie – for popular dynamical web script language, get packets first, then validate cookies in system. So attackers are unable to pass identification by stolen session ID from cookie.
|
|---|
