.png){kind=icon}
返回
NodeXP: NOde.js server-side JavaScript injection vulnerability DEtection and eXPloitation
.png){kind=icon}
OA
AI
DOI：10.1016/j.jisa.2021.102752.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Web applications are widely used, and new ways for easier and cost-effective methods to develop them are constantly introduced. A common omission among the new development and implementation techniques when designing them is security; Node.js is no exception, as Server-Side JavaScript Injection (SSJI) attacks are possible due to the use of vulnerable functions and neglecting to sanitize data input provided by untrusted sources. This specific kind of injection attack stands out because it has the potential to compromise servers, where the JavaScript code is executed. In this work, we fill a significant gap in the literature by introducing NodeXP, which, to the best of our knowledge, is the first methodology (presented as a software tool) that detects and automatically exploits SSJI vulnerabilities. Beyond the capabilities of the current state-of-the-art tools, NodeXP uses obfuscation methods, making it more stealth and adaptive to the current needs of red teaming. To this end, we provide a thorough analysis of SSJI attacks and the foundation upon which they rely on, along with concrete examples to facilitate the reader to comprehend the underlying concepts. Finally, we evaluate NodeXP, compare it to its peers, and discuss its efficacy.
Keyword:
Code injection
Server-Side Javascript Injection
Detection
Exploitation
Deep learning
Node.js
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
3.7
论文数:
1.9K
被引数:
4.9K
机构
引用论文
分享收藏Thermal analysis of marginal conditions to facilitate cryopreservation by vitrification using a semi-empirical approach.png)
CryobiologyOAAI
CryobiologyIF0
OAAI分享收藏
分享收藏分享收藏MTHFR C677T and A1298C polymorphisms as a risk factor for congenital heart defects in Down syndrome
PREAI
分享收藏 没有更多内容
没有更多内容