XSSDS: Server-side Detection of Cross-site Scripting Attacks

Cross-site Scripting (XSS) has emerged to one of the most prevalent type of security vulnerabilities. While the reason for the vulnerability primarily lies on the server-side, the actual exploitation is within the victim’s web browser on the client-side. Therefore, an operator of a web application has only very limited evidence of XSS is-sues. In this paper, we propose a passive detection system to identify successful XSS attacks. Based on a prototypi-cal implementation, we examine our approach’s accuracy and verify its detection capabilities. We compiled a data-set of 500.000 individual HTTP request/response-pairs from 95 popular web applications for this, in combination with both real word and manually crafted XSS-exploits; our detection approach results in a total of zero false negatives for all tests, while maintaining an excellent false positive rate for more than 80 % of the examined web applications. 1