Automated detection of cross site scripting attacks
Embodiments detect cross site scripting attacks. An embodiment captures a web request and captures a response to the captured web request. In turn, it is determined if one or more elements associated with the captured web request and one or more elements of the captured response, in combination, cause a malicious action. A cross site scripting attack is then declared in response to determining the one or more elements associated with the captured web request and the one or more elements of the captured response, in combination, cause a malicious action. Embodiments can take one or more protection actions in response to declaring a cross site scripting attack.
1. A method of detecting a cross site scripting attack, the method comprising:
capturing a web request provided by a user, after the web request is decrypted and decoded, by capturing the web request at an entrance to a Hypertext Transfer Protocol (HTTP) pipeline;
capturing a response to the captured web request;
determining if one or more elements associated with the captured web request and one or more elements of the captured response, in combination, cause a malicious action, wherein the determining is based on (i) presence of interpreter syntax in user input, provided by the user, in the captured web request, and at least one of (ii) status of the user input being included in interpreter input, (iii) execution status of the interpreter, and (iv) presence of interpreter syntax in the captured response; and
declaring a cross site scripting attack in response to determining the one or more elements associated with the captured web request and the one or more elements of the captured response, in combination, cause a malicious action.
2. The method of claim 1 wherein the one or more elements associated with the captured web request and the one or more elements of the captured response include at least one of:
a scripting verb; and
a Document Object Model (DOM).
3. The method of claim 1 wherein the one or more elements associated with the captured web request include a first scripting verb and the one or more elements of the captured response include a second scripting verb and where, if the first scripting verb and the second scripting verb match, the determining identifies the first scripting verb in combination with the second script verb cause a malicious action.
4. The method of claim 1 wherein the one or more elements associated with the captured web request include a first Document Object Model (DOM) element and the one or more elements of the captured response include a second DOM element.
5. The method of claim 4 wherein:
the determining identifies the first DOM element in combination with the second DOM element cause a malicious action; and
the declared cross site scripting attack is a DOM scripting attack.
6. The method of claim 1 wherein the determining and the declaring are performed by computer programming code implemented in a browser associated with the web request.
7. The method of claim 6 wherein the computer programming code is in a scripting language.
8. The method of claim 1 wherein the captured response includes both a database response and a HTTP response.
9. The method of claim 8 wherein the one or more elements associated with the captured web request include a first scripting verb and the one or more elements of the captured response include a second scripting verb in the database response and a third scripting verb in the HTTP response.
10. The method of claim 9 wherein:
if the first scripting verb and the third scripting verb match: (i) the determining identifies the first scripting verb in combination with the third scripting verb cause a malicious action and (ii) the declared cross site scripting attack is a reflected cross site scripting attack; and
if the first scripting verb and the second scripting verb match: (i) the determining identifies the first scripting verb in combination with the second scripting verb cause a malicious action and (ii) the declared cross site scripting attack is a stored cross site scripting attack.
11. The method of claim 1 further comprising:
in response to declaring the cross site scripting attack, implementing a protection action.
12. The method of claim 11 wherein the protection action is at least one of:
executing a user indicated script;
terminating an Internet Protocol (IP) connection;
terminating a web session;
providing a compensating control to a web application firewall; and
displaying an indication of the cross site scripting attack to a user.
13. A system for detecting a cross site scripting attack, the system comprising:
a processor; and
a memory with computer code instructions stored thereon, the processor and the memory, with the computer code instructions, being configured to cause the system to:
capture a web request provided by a user, after the web request is decrypted and decoded, by capturing the web request at an entrance to a Hypertext Transfer Protocol (HTTP) pipeline;
capture a response to the captured web request;
determine if one or more elements associated with the captured web request and one or more elements of the captured response, in combination, cause a malicious action, wherein the determining is based on (i) presence of interpreter syntax in user input, provided by the user, in the captured web request, and at least one of (ii) status of the user input being included in interpreter input, (iii) execution status of the interpreter, and (iv) presence of interpreter syntax in the captured response; and
declare a cross site scripting attack in response to determining the one or more elements associated with the captured web request and the one or more elements of the captured response, in combination, cause a malicious action.
14. The system of claim 13 wherein the one or more elements associated with the captured web request and the one or more elements of the captured response include at least one of:
a scripting verb; and
a Document Object Model (DOM).
15. The system of claim 13 wherein the one or more elements associated with the captured web request include a first Document Object Model (DOM) element and the one or more elements of the captured response include a second DOM element.
16. The system of claim 15 wherein:
the determining identifies the first DOM element in combination with the second DOM element cause a malicious action; and
the declared cross site scripting attack is a DOM scripting attack.
17. The system of claim 13 wherein (i) the captured response includes both a database response and a HTTP response and (ii) the one or more elements associated with the captured web request include a first scripting verb and the one or more elements of the captured response include a second scripting verb in the database response and a third scripting verb in the HTTP response, and where:
if the first scripting verb and the third scripting verb match: (i) the determining identifies the first scripting verb in combination with the third scripting verb cause a malicious action and (ii) the declared cross site scripting attack is a reflected cross site scripting attack; and
if the first scripting verb and the second scripting verb match: (i) the determining identifies the first scripting verb in combination with the second scripting verb cause a malicious action and (ii) the declared cross site scripting attack is a stored cross site scripting attack.
18. The system of claim 13 wherein the processor and the memory, with the computer code instructions, are further configured to cause the system to:
in response to declaring the cross site scripting attack, implement a protection action.
19. A computer program product for detecting a cross site scripting attack, the computer program product comprising:
one or more non-transitory computer read-able storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions, when loaded and executed by a processor, cause an apparatus associated with the processor to:
capture a web request provided by a user, after the web request is decrypted and decoded, by capturing the web request at an entrance to a Hypertext Transfer Protocol (HTTP) pipeline;
capture a response to the captured web request;
determine if one or more elements associated with the captured web request and one or more elements of the captured response, in combination, cause a malicious action, wherein the determining is based on (i) presence of interpreter syntax in user input, provided by the user, in the captured web request, and at least one of (ii) status of the user input being included in interpreter input, (iii) execution status of the interpreter, and (iv) presence of interpreter syntax in the captured response; and
declare a cross site scripting attack in response to determining the one or more elements associated with the captured web request and the one or more elements of the captured response, in combination, cause a malicious action.