MITIGATION AGAINST CROSS SITE SCRIPTING (XSS) ATTACK – A SURVEY

Computer Engineering (Cyber Security)

As we know the most of web applications are used by an organizations to grow their business. The security of web application is most essential concern for the continuous business without interruption of any cyber attack. The Cross Site Scripting often known as XSS attack is common injection vulnerability which is also specified in OWASP (Open Web Application Security Project) Top 10 Web Application Risk in 2010, 2013, 2017. By exploiting the Cross Site Scripting vulnerability, an attacker may capture sessions of users and also able to change, view and delete the web application data, execute the malicious script over the web application, and manipulate the victim to attack other targeted servers. This paper describes the types of Cross Site Scripting and demonstrate the exploitation of the Cross Site Scripting vulnerability on DVWA (Damn Vulnerable Web App) website. Also, the paper include a mechanism to apply the security against Cross Site Scripting vulnerabilities by implementing the Web Application Firewall (WAF) such as Modsecurity. We can deploy Web Application Firewall (WAF) to safeguard web applications. It protect the web applications from various types of attacks such as cross-site-scripting, SQL injection, and cross-site request forgery etc. A Web Application Firewall is providing the security against various vulnerabilities on OSI (Open Systems Interconnection) Layer 7 which is Application Layer. This firewall will work effectively when it is configured with proper rules. By writing the strong custom rules, it ensures the Web Application Firewall (WAF) correctly detects attacks and also block them if any rule violated or takes appropriate action.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.