BUILDING A SYSTEM FOR SEARCHING FOR WEB APPLICATION ENTITIES VULNERABLE TO CROSS-SITE SCRIPTING

Shipulin Georgy Farizovich, Shabalin Aleksandr Denisovich, Spevakova Svetlana Viktorovna

The article is devoted to the issues related to the search for web application entities vulnerable to cross-site scripting. The paper considered the concept of cross-site scripting (XSS vulnerabilities), its main types (Reflected XSS, Stored XSS and DOM-based XSS), and described a general approach to finding this type of vulnerability in web applications. In addition, based on the analysis of existing automated search tools for web application entities vulnerable to cross-site scripting (XSS vulnerability scanners), their main limitations are identified (insufficient accuracy in identifying vulnerable entities and lack of support for processing all types of entities), the architecture of the developed system for searching for web application entities vulnerable to cross-site scripting and the relationship of its modules. The developed system covers the analysis of various types of web application entities, including user input elements, URL parameters, HTTP protocol headers, and dynamic DOM tree elements.

Keywords:cross-site scripting, web application, vulnerability scanning, security analysis, vulnerability scanners