NDLI: SCRIPTGARD: automatic context-sensitive sanitization for large-scale legacy web applications

Please wait, while we are loading the content...

Reflections on the evolution of internet threats: the growing imperative for a cyber secure society

VIPER: verifying the integrity of PERipherals' firmware

Composition theorems without pre-established session identifiers

On the requirements for successful GPS spoofing attacks

Text-based CAPTCHA strengths and weaknesses

Trust-based anonymous communication: adversary models and routing algorithms

App isolation: get the security of multiple browsers with just one

Deobfuscation of virtualization-obfuscated software: a semantics-based approach

Trace equivalence decision: negative tests and non-determinism

Cryptographic primitives for building secure and privacy respecting protocols

Process out-grafting: an efficient "out-of-VM" approach for fine-grained process execution monitoring

How to break XML encryption

Fashion crimes: trending-term exploitation on the web

Proofs of ownership in remote storage systems

iSpy: automatic reconstruction of typed input from compromising reflections

WAPTEC: whitebox analysis of web applications for parameter tampering exploit construction

Android permissions demystified

Practical PIR for electronic commerce

Poster: Destabilizing BitTorrent's clusters to attack high bandwidth leechers

Unicorn: two-factor attestation for data security

Composability of bellare-rogaway key exchange protocols

Protecting consumer privacy from electric load monitoring

An efficient user verification system via mouse movements

Cirripede: circumvention infrastructure using router redirection with plausible deniability

Crouching tiger - hidden payload: security risks of scalable vectors graphics

The power of procrastination: detection and mitigation of execution-stalling malicious code

Extracting and verifying cryptographic models from C protocol code by symbolic execution

SICE: a hardware-level strongly isolated computing environment for x86 multi-core platforms

Ciphers that securely encipher their own keys

SURF: detecting and measuring search poisoning

How to tell if your cloud files are vulnerable to drive crashes

Televisions, video privacy, and powerline electromagnetic interference

Context-sensitive auto-sanitization in web templating languages using type qualifiers

These aren't the droids you're looking for: retrofitting android to protect data from imperious applications

Countering GATTACA: efficient and secure testing of fully-sequenced human genomes

Poster: a geometric approach for multicast authentication in adversarial channels

Combining control-flow integrity and static analysis for efficient and validated data sandboxing

A composable computational soundness notion

PaperSpeckle: microscopic fingerprinting of paper

Policy auditing over incomplete logs: theory, implementation and applications

Forensic investigation of the OneSwarm anonymous filesharing system

Fear the EAR: discovering and mitigating execution after redirect vulnerabilities

MIDeA: a multi-parallel intrusion detection architecture

Modular code-based cryptographic verification

AmazonIA: when elasticity snaps back

Password-protected secret sharing

Cloak and dagger: dynamics of web search cloaking

Sedic: privacy-aware data intensive computing on hybrid clouds

(sp)iPhone: decoding vibrations from nearby keyboards using mobile phone accelerometers

SCRIPTGARD: automatic context-sensitive sanitization for large-scale legacy web applications

Privacy and accountability for location-based aggregate statistics

Automatically optimizing secure computation

Demo: a comprehensive framework enabling data-minimizing authentication

On the vulnerability of FPGA bitstream encryption against power analysis attacks: extracting keys from xilinx Virtex-II FPGAs

Automatic error finding in access-control policies

Stealthy traffic analysis of low-latency anonymous communication using throughput fingerprinting

Automated black-box detection of side-channel vulnerabilities in web applications

BitShred: feature hashing malware for scalable triage and semantic analysis

Information-flow types for homomorphic encryptions

Eliminating the hypervisor attack surface for a more secure cloud

Practical delegation of computation using multiple servers

Predictive mitigation of timing channels in interactive systems

Fortifying web-based applications automatically

Auctions in do-not-track compliant internet advertising

VMCrypt: modular software architecture for scalable secure computation

Demo: the $f_{f}$ hardware prototype for privacy-preserving RFID authentication

Poster: the quest for security against privilege escalation attacks on android

Poster: a path-cutting approach to blocking XSS worms in social web networks

Poster: control-flow integrity for smartphones

Poster: arbitrators in the security infrastructure, supporting positive anonymity

Poster: attribute based broadcast encryption with permanent revocation

Poster: SMURFEN: a rule sharing collaborative intrusion detection network

Poster: applying unsupervised context-based analysis for detecting unauthorized data disclosure

Poster: online spam filtering in social networks

Poster: on trust evaluation with missing information in reputation systems

Poster: collaborative policy administration

Poster: using quantified risk and benefit to strengthen the security of information sharing

Poster: CUD: crowdsourcing for URL spam detection

Poster: DIEGO: a fine-grained access control for web browsers

Poster: privacy-preserving profile similarity computation in online social networks

Poster: practical embedded remote attestation using physically unclonable functions

Poster: mimicry attacks against wireless link signature

Poster: fast, automatic iPhone shoulder surfing

Poster: preliminary analysis of Google+'s privacy

Poster: shaping network topology for privacy and performance

Poster: trans-organizational role-based access control

Poster: towards attribute based group key management

Poster: making the case for intrinsic personal physical unclonable functions (IP-PUFs)

Poster: uPro: a compartmentalization tool supporting fine-grained and flexible security configuration

Poster: recoverable botnets: a hybrid C&C approach

Poster: an implementation of the fully homomorphic smart-vercauteren crypto-system

Poster: $ESPOON_{ERBAC}:$ enforcing security policies in outsourced environments with encrypted RBAC

Poster: inference attacks against searchable encryption protocols

Demo: secure computation in JavaScript

Poster: can it be more practical?: improving mouse dynamics biometric performance

Poster: Towards detecting DMA malware

Poster: LBMS: load balancing based on multilateral security in cloud

Poster: protecting information in systems of systems

Poster: a certificateless proxy re-encryption scheme for cloud-based data sharing

Poster: towards formal verification of DIFC policies

Poster: on quantitative information flow metrics

Poster: temporal attribute-based encryption in clouds

SCRIPTGARD: automatic context-sensitive sanitization for large-scale legacy web applications

Content Provider	ACM Digital Library
Author	Saxena, Prateek Livshits, Benjamin Molnar, David
Abstract	We empirically analyzed sanitizer use in a shipping web ap- plication with over 400,000 lines of code and over 23,244 methods, the largest empirical analysis of sanitizer use of which we are aware. Our analysis reveals two novel classes of errors: context-mismatched sanitization and inconsistent multiple sanitization. Both of these arise not because sanitizers are incorrectly implemented, but rather because they are not placed in code correctly. Much of the work on crosssite scripting detection to date has focused on finding missing sanitizers in programs of average size. In large legacy applications, other sanitization issues leading to cross-site scripting emerge. To address these errors, we propose ScriptGard, a system for ASP.NET applications which can detect and repair the incorrect placement of sanitizers. ScriptGard serves both as a testing aid to developers as well as a runtime mitigation technique. While mitigations for cross site scripting attacks have seen intense prior research, we consider both server and browser context, none of them achieve the same degree of precision, and many other mitigation techniques require major changes to server side code or to browsers. Our approach, in contrast, can be incrementally retrofitted to legacy systems with no changes to the source code and no browser changes. With our optimizations, when used for mitigation, ScriptGard incurs virtually no statistically significant overhead.
Starting Page	601
Ending Page	614
Page Count	14
File Format	PDF
ISBN	9781450309486
DOI	10.1145/2046707.2046776
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2011-10-17
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Cross-site scripting Runtime analysis Web applications
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in