• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.6
• /
• pp.1689-1705
• /
• 2023

To deal with the potential XSS vulnerabilities in the source code of the power communication network, an XSS vulnerability detection method combining the static analysis method with the dynamic testing method is proposed. The static analysis method aims to analyze the structure and content of the source code. We construct a set of feature expressions to match malignant content and set a "variable conversion" method to analyze the data flow of the code that implements interactive functions. The static analysis method explores the vulnerabilities existing in the source code structure and code content. Dynamic testing aims to simulate network attacks to reflect whether there are vulnerabilities in web pages. We construct many attack vectors and implemented the test in the Selenium tool. Due to the combination of the two analysis methods, XSS vulnerability discovery research could be conducted from two aspects: "white-box testing" and "black-box testing". Tests show that this method can effectively detect XSS vulnerabilities in the source code of the power communication network.

• Journal of Information Processing Systems
• /
• v.6 no.4
• /
• pp.563-574
• /
• 2010

The growing number of web applications in the global economy has made it critically important to develop secure and reliable software to support the economy's increasing dependence on web-based systems. We propose an intercepting filter approach to mitigate the risk of injection flaw exploitation- one of the most dangerous methods of attacking web applications. The proposed approach can be implemented in Java or .NET environments following the intercepting filter design pattern. This paper provides examples to illustrate the proposed approach.

• Proceedings of the Korean Information Science Society Conference
• /
• 2011.06d
• /
• pp.102-104
• /
• 2011

최근 스마트폰 사용자가 빠른 속도로 늘어나면서 'QR(Quick Response)코드가 새로운 마케팅 및 정보의 전달 수단으로 크게 각광받고 있다. 또한, QR코드는 인터넷 주소(URL), 사진 및 동영상 정보, 지도 정보, 명함 정보 등을 제공하는 매우 효율적인 수단으로 작용하고 있다. 하지만 스마트폰으로 무심코 인식한 QR 코드로 인해 악성코드에 감염될 가능성이 높아 사용자 주의가 필요하다. 로그인된 웹 사이트에서 QR 코드를 읽어 웹 브라우저로 접근할 때 XSS(Cross Site Scripting)을 통해 해당 웹사이트의 로그인 정보를 획득하거나 게시판 회원정보와 같은 데이터를 수정할 수도 있기 때문이다. 이에 본 논문에서는 QR 코드의 XSS 공격에 대한 대응방안을 상세히 기술하여 QR 코드를 사용하는 유저들에게 도움이 되고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.10a
• /
• pp.784-786
• /
• 2015

사물인터넷 시대가 도래함에 따라, 사물과 인터넷 간의 연결을 위한 무선 공유기의 활용이 증가하고 있다. 그러나 무선 공유기의 보안 취약점을 악용한 침해 사고도 지속적으로 발생하고 있어, 공유기 보안이 심각한 문제로 대두된 상황이다. 본 논문에서는 국내에서 사용되는 3사의 공유기가 제공하는 웹 기반 관리자 인터페이스에서 발견된 크로스 사이트 스크립팅(cross-site scripting) 취약점을 분석한다. 발견된 취약점을 기반으로, 가능한 공격 시나리오와 패치 발표 이전까지 임시 대응할 수 있는 방법을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.1234-1237
• /
• 2007

웹 서비스를 기반으로 구축된 IT 환경에서 Dynamic Web page 를 동작하도록 하는 것이 CGI(Common Gateway Interface)이다. 이런 CGI 를 사용하는 Web page 에서는 XSS(Cross Site Scripting)에 취약점을 가지고 있다. XSS 의 취약점을 이용하여 Web page 의 변조, Cookie 의 가로채기 등의 악의적인 행동으로 인해 많은 피해사례가 있다. 기존의 연구들은 이러한 문제를 해결하기 위해서 게시판 입력 값을 체크하여 Meta character 를 필터링 하는 방법으로 XSS 공격을 대응하였다. 그러나 이러한 방법은 각 페이지 마다 필터링 스크립트를 사용하기 때문에 웹 서버의 성능에 많은 부하를 초래 하는 단점이 있었다. 따라서 본 논문에서는 이러한 웹 서버의 부하를 줄이기 위해 필터링 스크립트를 DLL(Dynamic link library) 화 시켜 모듈화된 함수를 각 페이지에서 호출하여 사용함으로써 웹 서버의 성능 향상을 제안 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.2
• /
• pp.263-277
• /
• 2021

Taint analysis techniques are popularly used to detect web vulnerabilities originating from unverified user input data, such as Cross-Site Scripting (XSS) and SQL Injection, in web applications written in JavaScript. To detect such vulnerabilities, it would be necessary to trace variables affected by user-submitted inputs. However, because of the dynamic nature of JavaScript, it has been a challenging issue to identify those variables without running the web application code. Therefore, most existing taint analysis tools have been developed based on dynamic taint analysis, which requires the overhead of running the target application. In this paper, we propose a novel static taint analysis technique using symbol information obtained from the TypeScript (a superset of JavaScript) compiler to accurately track data flow and detect security vulnerabilities in TypeScript code. Our proposed technique allows developers to annotate variables that can contain unverified user input data, and uses the annotation information to trace variables and data affected by user input data. Since our proposed technique can seamlessly be incorporated into the TypeScript compiler, developers can find vulnerabilities during the development process, unlike existing analysis tools performed as a separate tool. To show the feasibility of the proposed method, we implemented a prototype and evaluated its performance with 8 web applications with known security vulnerabilities. We found that our prototype implementation could detect all known security vulnerabilities correctly.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.14 no.4
• /
• pp.57-61
• /
• 2014

Zeroboard is a public bulletin board that can support PHP and MySQL. It has been used by many people because it is easy to use, but there is no more updates after Zeroboard4. So, there is a problem that its administrator will have nothing to do about it if zeroboard has a vulnerability. In this paper, we will discuss about CSRF(Cross Site request Forgery) which is developed and expanded by XSS(Cross Site Scripting). Also, we will find CSRF attacks and suggest an alternative method using VM-ware. The main features and contributions of the proposed method are as follows. First, make an environment construction using VM-ware and other tools. Second, analyze and prepare vulnerabilities using Proxy server. Performance evaluation will be conducted by applying possible countermeasure.

• Convergence Security Journal
• /
• v.18 no.3
• /
• pp.37-44
• /
• 2018

Today we live in a flood of web sites and access numerous websites through the Internet to obtain various information. However, unless the security of the Web site is secured, Web site security can not be secured from various malicious attacks. Hacking attacks, which exploit Web site security vulnerabilities for various reasons, such as financial and political purposes, are increasing. Various attack techniques such as SQL-injection, Cross-Site Scripting(XSS), and Drive-By-Download are being used, and the technology is also evolving. In order to defend against these various hacking attacks, it is necessary to remove the vulnerabilities from the development stage of the website, but it is not possible due to various problems such as time and cost. In order to compensate for this, it is important to identify vulnerabilities in Web sites through web vulnerability checking and take action. In this paper, we investigate web vulnerabilities and diagnostic techniques and try to understand the priorities of vulnerabilities in the development stage according to the actual status of each case through cases of actual web vulnerability diagnosis.

• IEIE Transactions on Smart Processing and Computing
• /
• v.3 no.5
• /
• pp.319-324
• /
• 2014

Web applications make life more convenient. Many web applications have several kinds of user input (e.g. personal information, a user's comment of commercial goods, etc.) for the activities. On the other hand, there are a range of vulnerabilities in the input functions of Web applications. Malicious actions can be attempted using the free accessibility of many web applications. Attacks by the exploitation of these input vulnerabilities can be achieved by injecting malicious web code; it enables one to perform a variety of illegal actions, such as SQL Injection Attacks (SQLIAs) and Cross Site Scripting (XSS). These actions come down to theft, replacing personal information, or phishing. The existing solutions use a parser for the code, are limited to fixed and very small patterns, and are difficult to adapt to variations. A machine learning method can give leverage to cover a far broader range of malicious web code and is easy to adapt to variations and changes. Therefore, this paper suggests the adaptable classification of malicious web code by machine learning approaches for detecting the exploitation user inputs. The approach usually identifies the "looks-like malicious" code for real malicious code. More detailed classification using sequence information is also introduced. The precision for the "looks-like malicious code" is 99% and for the precise classification with sequence is 90%.

• Convergence Security Journal
• /
• v.12 no.3
• /
• pp.85-92
• /
• 2012

Today, the typical web hacking attacks are cross-site scripting(XSS) attacks, injection vulnerabilities, malicious file execution and insecure direct object reference included. Web hacking security systems, access control solutions, access only to the web service and flow inside but do not control the packet. So you have been illegally modified to pass the packet even if the packet is considered as a unnormal packet. The defense system is to fail to appropriate controls. Therefore, in order to ensure a successful web services diagnostic system development is necessary. Web application diagnostic system is real and urgent need and alternative. The diagnostic system development process mu st be carried out step of established diagnostic systems, diagnostic scoping web system vulnerabilities, web application, analysis, security vulnerability assessment and selecting items. And diagnostic system as required by the web system environment using tools, programming languages, interfaces, parameters must be set.