Securing Server/Client side Applications against XSS attack via XSS-Obliterator

Abstract — In the modern technological epoch, the internet advancement is at its peak and the web services are emerging more towards dynamic than static web pages. In order to serve the demands, websites holds many applications that extensively opens door for several script-languages. Contrarily, Cross-site-scripting (XSS) attack exploits wide variety of Script-languages and various programming techniques that can easily breach the security of the website. This paper presents a model of XSS-obliterator which supplements the security at client/server side with the mechanism of two-way filter and delivers a platform-independent elucidation to cater security against enormous variants of XSS attack. To address the security issues, an open-source PHP based website is evaluated to render threat against XSS-vectors injected in input fields, URL and source-code using two commercial browsers. As a result of evaluation, the vulnerable sections of the website are declared as high/low recommendation for the proposed model. Considering the extracted artifacts, an experiment has been conducted on the website using the proposed model for detecting and sanitizing all the variants of XSS vectors