臺灣博碩士論文加值系統

跨站腳本攻擊(Cross-site Scripting)利用網站開發時輸入驗證的漏洞，將惡意程式碼嵌入伺服器的網頁中。當使用者瀏覽到問題網站時，惡意程式隨即被載入客戶端。在使用者不經意的點選後，惡意程式碼隨即執行，進行竊取使用者儲存在Cookie中的使用者私人資訊或植入其他木馬及後門程式，造成機密資訊外流或電腦中毒的問題。

為了要防止惡意程式碼嵌入伺服器中，現有的防禦機制大多是在伺服器端程式附加驗證模組，過濾輸入字串內容。這個方法會增加伺服器程式上工作負擔，影響運作效能。

本論文提出將跨站腳本攻擊的輸入驗證機制，從伺服器端移至客戶端，使用相同過濾Pattern的常規表示式(Regular Expression)所組成的黑名單，在客戶端進行輸入驗證及過濾。希望能在不影響伺服器端程式的運作效能，在客戶端阻止惡意指令碼嵌入伺服器中。

Cross-site scripting is an attack that exploits vulnerabilities of a web application to inject some malicious code or command into a web page. When a user visits the web page, the malicious code would be downloaded to the user’s computer. If the malicious code is executed, it may be used to steal the user’s information or to inject trojan horse or other backdoor programs to the user’s computer.

To prevent such attacks, extra modules for input string validation at the server side are needed. This may increase the loading of a server and thus degrades its performance.

In this thesis, we perform input string validation at client side, using the same filter pattern of regular expression. It should be able to prevent cross-site scripting attacks without degrading the performance of a server.

目錄

中文摘要 I
Abstract II
致謝 III
目錄 IV
圖形目錄 VI
表格目錄 VII
第一章 簡介 1
1.1 前言 1
1.2 動機與目的 2
1.3 章節概述 3
第二章 背景知識 4
2.1 跨站腳本攻擊 (Cross-site Scripting) 4
2.2 實際案例 5
2.3防禦作法 6
2.3.1 伺服器防禦 6
2.3.1.1 Automatic Mechanism 6
2.3.1.2 Static Detection 7
2.3.2 客戶端 8
2.3.2.1 Local Proxy 8
2.3.2.2 NOXES 10
2.3.2.3 BEEP 10
第三章 系統架構 12
3.1 伺服器端前處理 14
3.2 客戶端輸入驗證 15
3.3 伺服器端簡易檢查 16
第四章 系統實作 17
4.1 開發環境與實作說明 17
4.2 過濾規則 18
4.3 攻擊字串 19
4.4 實作測試及數據結果 20
4.4.1 使用Microsoft Internet Explorer測試 20
4.4.2 使用Mozilla Firefox測試 21
4.4.3 測試數據結果 22
4.4.4 討論 23
4.5 客戶端輸入驗證與相關研究之比較 24
第五章 結論與未來展望 25
參考文獻 26
作者簡介 28

圖形目錄

圖一 正常使用結果 5
圖二 遭受XSS攻擊結果 5
圖三 Automatic Mechanism 7
圖四 Local Proxy 9
圖五 Local Proxy - Response Change Mode 9
圖六 Local Proxy - Request Change Mode 9
圖七 客戶端輸入驗證之架構及運作流程 13
圖八 伺服器前處理流程 14
圖九 客戶端輸入驗證流程 16
圖十 伺服器簡易檢查流程 16
圖十一 Internet Explorer瀏覽之初始畫面 20
圖十二 Internet Explorer之客戶端輸入驗證之檢查結果 20
圖十三 Mozilla Firefox之初始畫面 21
圖十四 Mozilla Firefox之客戶端輸入驗證之檢查結果 21


表格目錄

表格一 過濾規則列表 18
表格二 攻擊字串列表 19
表格三 客戶端輸入驗證與Automatic Mechanism之比較 24

[1]Open Web Application Security Project. Cross-Site Scripting. April 2009. http://www.owasp.org/index.php/Top_10_2007-A1
[2]David Endler. The Evolution of Cross-Site Scripting Attacks. Technical Report, iDEFENSE Labs, 20 May 2002.
[3]CERT/CC. CERT Advisory CA-2000-02 Malicious HTML Tags Embedded In Client Web Requests. April 2009. http://www.cert.org/advisories/CA-2000-02.html
[4]G. A. D. Lucca, A. R. Fasolino, M. Mastoianni and P. Tramontana. Identifying Cross Site Scripting Vulnerabilities in Web Applications. In Proceedings of 6th IEEE International Workshop on Web Site Evolution 2004, WSE’04, 2004, pp.71-80.
[5]Jin-Cherng Lin, Jan-Min Chen and Cheng-Hsiung Liu. An Automatic Mechanism for Sanitizing Malicious Injection. In The 9th International Conference for Young Computer Scientists, ICYCS 2008, Nov 2008, pp. 1470 – 1475.
[6]Gary Wassermann and Zhendong Su. Static Detection of Cross-Site Scripting Vulnerabilities. In Proceedings of the 30th International Conference on Software Engineering 2008, ICSE’08, May 2008, pp. 171-180.
[7]Omar Ismail, Masashi Etoh, Youki Kadobayashi and Suguru Yamaguchi. A Proposal and Implementation of Automatic Detection/Collection System for Cross-Site Scripting Vulnerability. In Proceedings of the 18th International Conference on Advanced Information Networking and Application 2004, AINA’04, 2004, pp. 145-151.
[8]Engin Kirda, Christopher Kruegel, Giovanni Vigna and Nenad Jovanovic. Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks. In Proceedings of the 2006 ACM symposium on Applied computing 2006, SAC’06, April 2006, pp. 330-337.
[9]Trevor Jim, Nikhil Swamy and Michael Hicks. Defeating Script Injection Attacks with Browser-Enforced Embedded Policies. In Proceedings of the 16th international conference on World Wide Web 2007, WWW’07, May 2007, pp. 601-610.

[10]Jin-Cherng Lin, Jan-Min Chen and Cheng-Hsiung Liu. An Automatic Mechanism for Adjusting Validation Function. In Proceedings of the 22nd International Conference on Advanced Information Networking and Application - Workshops 2008, AINAW’08, March 2008, pp. 602-607.
[11]Dev ArticlesTM. JavaScript Security, June 2009 http://www.devarticles.com/c/a/JavaScript/JavaScript-Security/
[12]Regular Expression Library. April 2009. http://regexlib.com/Default.aspx
[13], XSS Attacks Information. July 2009. http://www.xssed.com/
[14]Mozilla Org. JavaScript Security : Signed Scripts. June 2009.
http://www.mozilla.org/projects/security/components/signed-scripts.html
[15]Mozilla Org. Signed Scripts & Privileges : An Example. June 2009.
http://www.mozilla.org/projects/security/components/signed-script-example.html