Static Analysis Tools Against Cross-site Scripting Vulnerabilities in Web Applications : An Analysis

Nurul Atiqah Abu Talib; Doh, Kyung-Goo (도경구)

doi:10.29056/jsav.2021.12.14

Static Analysis Tools Against Cross-site Scripting Vulnerabilities in Web Applications : An Analysis

Journal of Software Assessment and Valuation
Abbr : JSAV
2021, 17(2), pp.125~142
DOI : 10.29056/jsav.2021.12.14
Publisher : Korea Software Assessment and Valuation Society
Research Area : Engineering > Computer Science
Received : November 30, 2021
Accepted : December 20, 2021
Published : December 31, 2021

Nurul Atiqah Abu Talib ¹, Doh, Kyung-Goo ¹

¹한양대학교

Accredited

ABSTRACT

Reports of rampant cross-site scripting (XSS) vulnerabilities raise growing concerns on the effectiveness of current Static Analysis Security Testing (SAST) tools as an internet security device. Attentive to these concerns, this study aims to examine seven open-source SAST tools in order to account for their capabilities in detecting XSS vulnerabilities in PHP applications and to determine their performance in terms of effectiveness and analysis runtime. The representative tools - categorized as either text-based or graph-based analysis tools - were all test-run using real-world PHP applications with known XSS vulnerabilities. The collected vulnerability detection reports of each tool were analyzed with the aid of PhpStorm's data flow analyzer. It is observed that the detection rates of the tools calculated from the total vulnerabilities in the applications can be as high as 0.968 and as low as 0.006. Furthermore, the tools took an average of less than a minute to complete an analysis. Notably, their runtime is independent of their analysis type.

KEYWORDS

Cross-site scripting, Open-source Static Analysis Security Testing Tools, Detection

Citation status

* References for papers published after 2023 are currently being built.

[web] / Vulnerability distribution of cve security vulnerabilities by types / https://www.cvedetails.com/vulnerabilities-by-types.php

[web] / CVE - Search Results / https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=XSS

[web] OWASP / Source Code Analysis Tools - OWASP / https://www.owasp.org/index.php/Source_Code_Analysis_Tools

[web] Floe / Phpcs-security-audit / https://github.com/FloeDesignTechnologies/phpcssecurity-audit

[web] Bob / CodeSniffer Part 4: How does CodeSniffer Work | King Kludge / http://www.kingkludge.net/2009/02/codesniffer-part-4-how-does-codesniffer-work/

[confproc] Paulo Nunes / 2015 / PhpSAFE: A Security Analysis Tool for OOP Web Application Plugins / Proc. Int. Conf. Dependable Syst. Networks 2015 : 299~306

[confproc] Nenad Jovanovic / 2006 / Pixy: a static analysis tool for detecting Web application vulnerabilities / 2006 IEEE Symp. Secur. Priv. : 6~

[journal] Johannes Dahse / 2010 / RIPS-A static source code analyser for vulnerabilities in PHP scripts / Retrieved Febr. 28 : 2012~

[web] Nick Dunn / Visual Code Grepper / https://github.com/nccgroup/VCG

[confproc] Ibéria Medeiros / 2014 / Automatic detection and correction of web application vulnerabilities using data mining to predict false positives / Proc. 23rd Int. Conf. World wide web - WWW '14 : 63~74

[web] Michael V. Scovetta / Yasca: Yet Another Source Code Analyzer / http://scovetta.github.io/yasca/

[web] / PMD / https://pmd.github.io/

[web] Jakob Kallin / Excess XSS: A comprehensive tutorial on cross-site scripting / https://excessxss.com/

[web] Andreas Gohr / DokuWiki / https://github.com/splitbrain/dokuwiki

[web] / PHPMyWind / http://phpmywind.com/

[web] PHP Outburst / Ultimate PHP Board / https://github.com/PHP-Outburst/MyUPB

[web] Bobcares / Gift Certificate Creator / https://wordpress.org/plugins/gift-certificate-creator/

[web] Robot with Emotions / Slideshow Gallery Pro - WordPress Plugins / https://wordpress.org/plugins/slideshow-gallery-pro/

[book] Alfred V. Aho / 2006 / Compilers: Principles, Techniques, and Tools

[book] Flemming Nielson / 1999 / Principles of Program Analysis / Springer Berlin Heidelberg

[journal] Misha Zitser / 2004 / Testing static analysis tools using exploitable buffer overflows from open source code / ACM SIGSOFT Software Engineering Notes / Association for Computing Machinery (ACM) 29(6) : 97~106

[journal] Nurul Atiqah Abu Talib / 2021 / Assessment of Dynamic Open-source Cross-site Scripting Filters for Web Application / KSII Transactions on Internet and Information Systems / 한국인터넷정보학회 15(10) : 3750~3770

[journal] D. Pasetto / 2010 / Tools for Very Fast Regular Expression Matching / Computer / Institute of Electrical and Electronics Engineers (IEEE) 43(3) : 50~58

[confproc] Yao-Wen Huang / 2004 / Securing web application code by static analysis and runtime protection / Proc. 13th Conf. World Wide Web - WWW '04 : 40~

[journal] H. G. Rice / 1953 / Classes of recursively enumerable sets and their decision problems / Transactions of the American Mathematical Society / American Mathematical Society (AMS) 74(2) : 358~366

[journal] B. Chess / 2004 / Static analysis for security / IEEE Security and Privacy Magazine / Institute of Electrical and Electronics Engineers (IEEE) 2(6) : 76~79

[journal] Michael Buckland / 1994 / The relationship between Recall and Precision / Journal of the American Society for Information Science / Wiley 45(1) : 12~19

[journal] M. Belyaev / 2016 / Fast and Safe Concrete Code Execution for Reinforcing Static Analysis and Verification / Modeling and Analysis of Information Systems / P.G. Demidov Yaroslavl State University 22(6) : 763~772

[book] Görel Hedin / 2015 / Compiler Construction, vol. 9031

[confproc] Lucas Torri / 2010 / An evaluation of free/open source static analysis tools applied to embedded software / 2010 11th Lat. Am. Test Work. : 1~6

[confproc] Aniqua Z. Baset / 2017 / IDE Plugins for Detecting Input-Validation Vulnerabilities

[web] Larry Suto / 2010 / Analyzing the Accuracy and Time Costs of Web Application Security Scanners / https://www.beyondtrust.com/wpcontent/uploads/Analyzing-the-Accuracy-and-Time-Costs-of-Web-Application-Security-Scanners.pdf

[journal] Mansour Alsaleh / 2017 / Performance- Based Comparative Assessment of Open Source Web Vulnerability Scanners / Secur. Commun. Networks 2017 : 1~14

[confproc] Nuno Antunes / 2009 / Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services / 2009 15th IEEE Pacific Rim Int. Symp. Dependable Comput. : 301~306

[book] Nuno Antunes / 2013 / Security Testing in SOAs: Techniques and Tools BT - Innovative Technologies for Dependable OTS-Based Critical Systems: Challenges and Achievements of the CRITICAL STEP Project / Springer Milan : 159~174

KJCKorea
Journal Central

Journal of Software Assessment and Valuation 2023 KCI Impact Factor : 0.35

Static Analysis Tools Against Cross-site Scripting Vulnerabilities in Web Applications : An Analysis

ABSTRACT

KEYWORDS

Citation status

* References for papers published after 2023 are currently being built.

Journal of Software Assessment and Valuation 2023 KCI Impact Factor : 0.35

Static Analysis Tools Against Cross-site Scripting Vulnerabilities in Web Applications : An Analysis

ABSTRACT

KEYWORDS

Statistics

Tools

Issue List

Citation status

KCI Citation Counts (0)

REFERENCES (35) * References for papers published after 2023 are currently being built.

Search PDF

Citation

* References for papers published after 2023 are currently being built.