博碩士論文 965202017 完整後設資料紀錄

DC 欄位 語言
DC.contributor資訊工程學系zh_TW
DC.creator王貞力zh_TW
DC.creatorJhen-Li Wangen_US
dc.date.accessioned2009-7-23T07:39:07Z
dc.date.available2009-7-23T07:39:07Z
dc.date.issued2009
dc.identifier.urihttp://ir.lib.ncu.edu.tw:88/thesis/view_etd.asp?URN=965202017
dc.contributor.department資訊工程學系zh_TW
DC.description國立中央大學zh_TW
DC.descriptionNational Central Universityen_US
dc.description.abstract本篇論文我們在伺服器端,建立了一個自動化防禦跨站腳本攻擊(XSS)的機制,當包含我們身份驗證資訊的cookie被攻擊者偷走時,無法成功登入系統。Cross Site Scripting (XSS),是一種攻擊者利用網路應用程式的漏洞,將腳本注入所引起的網路攻擊,而現今一般防禦XSS的方式分為兩種,第一種是辨認出可能造成攻擊的字串將其過濾掉,禁止其執行,但由於攻擊者會運用各種編碼方式來包裝攻擊的腳本,而導致惡意字串繞過了過濾器達到攻擊效果,第二種則是保護個人的敏感資訊,如:cookie,標記(taint)起來,並使用動態和靜態追蹤,一路追蹤其資料流向,判斷最後送出的目的地是否為合法的,來達到保護個人敏感資訊不會流出到惡意攻擊者,但現今網路上的應用推陳出新,使得動態和靜態追蹤方式很難完全涵蓋所有的資料流向。 而一般伺服器端的網路應用程式撰寫者,若想防禦XSS攻擊,需要程式撰寫者擁有充足的網路安全知識,針對可能產生的漏洞各別撰寫保護程式,於是我們系統在伺服器端的Linux核心中,對於網路上常見的動態網頁撰寫語言,自動化的保護其身份認證cookie,將進入系統的封包進行cookie萃取、確認和判別的動作,當XSS攻擊發生時,攻擊者則無法利用偷取到的cookie中的session ID執行身分驗證,來冒充使用者。 zh_TW
dc.description.abstractIn this thesis, we will introduce a mechanism to automatically protect cookies with authenticated identity information which being stolen by XSS attackers. Cross Site Scripting (XSS) is an application-level attack which injects script via web application vulnerability. One of the general ways to defend XSS is to identify possible attacking strings, filter them, and disobey to access them. But attackers use varieties of coding to package attacking scripts to skip string filter. The other way is to protect sensitive information in cookies. Taint them and trace data flow not only statically but also dynamically, and finally validate its destination so that offensive attacker cannot get this sensitive information easily. But it hardly covers whole data flow in large Internet applications. In order to defend XSS attacks, programmers require sufficient network security knowledge and fix possible vulnerabilities that may be attacked. We set up a mechanism into server side in Linux kernel which automatically protect authenticated cookie – for popular dynamical web script language, get packets first, then validate cookies in system. So attackers are unable to pass identification by stolen session ID from cookie. en_US
DC.subject跨站腳本攻擊zh_TW
DC.subject網路安全zh_TW
DC.subjectcookie竊取zh_TW
DC.subjectCross Site Scriptingen_US
DC.subjectNetwork Securityen_US
DC.subjectCookie Stealingen_US
DC.title一個伺服器端關於cookie竊取之XSS攻擊的防禦機制zh_TW
dc.language.isozh-TWzh-TW
DC.titleA Server Solution for Cookie-Stealing-Based XSS Attacksen_US
DC.type博碩士論文zh_TW
DC.typethesisen_US
DC.publisherNational Central Universityen_US

若有論文相關問題,請聯絡國立中央大學圖書館推廣服務組 TEL:(03)422-7151轉57407,或E-mail聯絡  - 隱私權政策聲明