********* XSS *********

  1. is a class of code-injection vulnerabilities in the browser" - ScriptProtect
  2. allowing an adversary to execute arbitrary JavaScript code in the context of a vulnerable application" - Don’t Trust The Locals]
  3. is a code injection attack, in which an adversary is able to add JavaScript code of her choosing to a vulnerable site." - Don’t Trust The Locals]
  4. a type of injection vulnerability in which an attacker can inject arbitrary code into a running web application - Riding out DOMsday
  5. occur when input is improperly sanitized, allowing attackers to inject arbitrary JavaScript code into a victim’s browser." - Detecting DOM XSS Vulnerabilities with ML
  6. the ability to inject attacker-controlled scripts into the context of a web application" - CSP Is Dead, Long Live CSP!
  7. the ability to inject and execute untrusted scripts in a vulnerable application - CSP Is Dead, Long Live CSP!
  8. describes a class of string-based code injection vulnerabilities that let adversaries inject HTML and/or JS into Web content" - Scrpt Gadgets

********* CSP *********

  1. is is the most popular example of code-filtering mitigation" - Scrpt Gadgets
  2. is activated by a client’s browser when the X-Content-Security-Policy HTTP header is provided in a HTTP response" - Reining in the web with CSP
  3. means of mitigating injection attacks" - Inconsistent Click-Jacking Protection
  4. was initially designed to grant Web developers more control over the content loaded by their Web sites" - Deployed CSP Analysis
  5. is a security mechanism originally aimed at mitigating the severe dangers of XSS attacks" - Site Policy
  6. is meant to ensure that only resources explicitly allowed by the developer of a page can be included therein" - Site Policy
  7. is a defense-in-depth security mechanism which deployed on a page, defines content that are allowed or disallowed to load" - The Remote on the Local
  8. is a web platform mechanism designed to mitigate cross-site scripting (XSS)" - CSP Is Dead, Long Live CSP!
  9. is a browser feat. that a web dev. can configure to define a policy that allows the browser to whitelist the JS code that belongs to the app." - Script Gadgets
  10. is a list of directives, restricting content inclusion for web pages by means of a white-listing mechanism. - Semantics CSP
  11. mitigate content injection attacks against web applications directly within the browser. - Why is CSP Failing?
  12. is an especially promising browser-based security framework for refining the same-origin policy (SOP), the basis of traditional web security. - Why is CSP Failing?
  13. is a declarative policy mechanism that allows web application developers to define which client-side resources can be loaded and executed by the browser" - CSP Is Dead, Long Live CSP!
  14. is a key response header that provides strong defence mechanisms against XSS and other client-side injection attacks by whitelisting allowed sources and disabling certain insecure JavaScript features." - HTTP security headers analysis of top 1M websites
  15. is a declarative mechanism that allows web authors to specify a number of security restrictions on their applications, to be enforced by supporting user agents." - CSP Is Dead, Long Live CSP!
  16. provides a mechanism to allow websites to explicitly indicate what kind of JS code can be executed within their origins to prevent injection of attacker-controlled scripts" - API hardening
  17. is fundamentally a specification for defining policies to control where content can be loaded from, granting significant power to developers to refine the default SOP - Why is CSP Failing?
  18. is a language for defining restrictions on the functionality of web pages, ideally to limit their capabilities to the least set of privileges they need to work correctly - Semantics CSP
  19. is a client-server defense mechanism: content security policies are specified by web developers using HTTP(S) headers or meta elements in HTML pages, while their enforcement is performed at the browser side on a per-page basis - Semantics CSP
  20. is deployed through the Content-Security-Policy HTTP header in either the HTTP response or via an HTML meta element with http-equiv attribute. - Data Exfil CSP

********* Script Gadgets *********

  1. legitimate JavaScript fragments within an application’s legitimate code base - Script Gadgets
  2. is piece of JavaScript code which reacts to the presence of specifically formed DOM content in the Web document - Script Gadgets

========= Nonce =========

  1. allows the policy to specify a one-time value that acts as an authorization token for scripts" - CSP Is Dead, Long Live CSP!

========= Hash =========

  1. allows the developer to list cryptographic hashes of expected scripts within the page - Script Gadgets

========= Mixed Content =========

  1. is the inclusion of unencrypted content into HTTPS sessions, which reduces the bene t of encryption. - Why is CSP Failing?

********* DOM XSS *********

  1. is the exploitation of an input validation vulnerability that is caused by the client, not the server."
    2. - XSS Exploits
  2. can be seen as an information flow problem where portions of strings — potentially under attacker’s control - e.g., URL, cookie value] — are being evaluated as code through JavaScript code evaluation functions like eval- ] or being used in unsafe dynamic DOM constructions, such as via document.write or innerHTML" - DexterJS1
  3. is a client-side code injection vulnerability that results from unsafe dynamic code generation in JavaScript applications"- DexterJS1
  4. a vulnerability class subsuming all Cross-site Scripting problems that are caused by insecure handling of untrusted data through JavaScript" - taint25M
  5. is a code injection vulnerability in which a web attacker is able to inject malicious JavaScript in a client’s web session."- DexterJS2
  6. client-side code injection" - Systematic Analysis of XSS Sanitization
  7. is a subtype of Cross-site Scripting - XSS] problems that results from unsafe processing of untrusted data from sources controlled by the attacker"- DomXssMicro
  8. occur when client-side code uses untrusted input data in dynamic code evaluation constructs without sufficient validation." - Symbolic Execution

********* HTML Sanitizers *********

  1. These are libraries used by developers to clean untrusted HTML into HTML that is safe to use within the application. This category contains examples such as DOMPurify1 and Google Closure2 HTML sanitizer." - Script Gadgets
  2. automatically transform untrustworthy strings into safe-to-render HTML markup or safe-to-follow URLs by removing parts that may lead to XSS" - Script Gadgets

********* Exploit *********

  1. Exploit = BreakOutSequence + AttackVector + EscapeSequence" - DexterJS1

********* Source *********

  1. the source locations of incoming data" - DomXssMicro
  2. denotes a code fragment, which embodies a vulnerable node from the DOM abstraction, implemented on the client-side of the Web-App. It represents the start node of a possible data flow, where an untrusted, malicious input data is collected and with greater likelihood acquired for processing of the Web-Application." - DOM XSS Attacks
  3. are to be considered starting points where untrusted input data is taken by an application." - Google DOM XSS Wiki
  4. the program input that supplies the data for an attack" - Symbolic Execution

********* Sink *********

  1. Sinks are meant to be the points in the flow where data depending from sources is used in a potentially dangerous way resulting in loss of Confidentiality, Integrity or Availability - the CIA triad]." - Google DOM XSS Wiki
  2. potentially vulnerable code evaluation construct" - Symbolic Execution
  3. is a point in the client-side code where data is used with special privilege, such as in a code evaluation construct, or as an application-specific command to a backend logic or as cookie data." - FLAX]

********* Propagation *********

  1. the statements which propagate tainted values from the source to the sink without modifying them" - DomXssMicro

********* Context *********

  1. represents the surrounding context where the tainted content locates - DomXssMicro
  2. reflects the state of the browser at a given point reading a particular piece of input HTML." - ScriptGard
  3. the intuitive notion of where untrusted data appears" - Systematic Analysis of XSS Sanitization

********* Input Validation *********

  1. only allow data into the application if it matches its specification. - Script-templates for the CSP

********* Output encoding *********

  1. encode all potential syntactic content of untrusted data before inserting it into an HTTP response. - Script-templates for the CSP
  2. is changing input so that it cannot be interpreted as code" - XSS for beginners…

********* DOM *********

  1. is the standardized application programming interface - API] for scripts running in a browser to interact with the HTML document" - SOP: Evaluation in Modern Browsers

//////// Dynamic Analysis ////////

  1. the ability to monitor code as it executes" - DynamicTaintAnalysis

//////// Dynamic Taint Analysis ////////

  1. runs a program and observes which computations are affected by predefined taint sources such as user input" - DynamicTaintAnalysis

--------- Browser XSS Filters ---------

  1. These filters are implemented as part of the browser navigation and rendering, and they attempt to detect an XSS attack and neuter it. Internet Explorer, Edge, and Chrome implement XSS filters as part of their default configuration. Firefox does not have one, but the popular NoScript3 AddOn implements one." - API hardening

--------- Web Application Firewalls ---------

  1. This is software that runs on the server, and attempts to allow benign requests from web trac, while detecting and blocking malicious requests. An example of an open-source Web Application Firewall is ModSecurity4 with OWASP Common Rule Set" - Script Gadgets
  2. are request filtering mitigations deployed as hardware in front of web servers, as well as as software next to the web server itself. - Script Gadgets

--------- Mod Security ---------

  1. is an open-source Web Application Firewall, commonly used with the OWASP Core Rule Set." - Script Gadgets

--------- Web Application Firewalls ---------

  1. This is software that runs on the server, and attempts to allow benign requests from web trac, while detecting and blocking malicious requests. An example of an open-source Web Application Firewall is ModSecurity4 with OWASP Common Rule Set" - Script Gadgets
  2. are request filtering mitigations deployed as hardware in front of web servers, as well as as software next to the web server itself. - Script Gadgets

========= Cross-Origin Resource Sharing - [2009] =========

  1. is an extension of the XMLHttpRequest API to allow cross-origin content in the browser through explicit authorization" - Careful Who You Trust
  2. is proposed to olve the problems of JSON-P, and to provide a protocol support of authorized access cross-origin network resources." - Empirical Study of CORS
  3. is an access control model regulating access to cross-origin network resources - including sending requests and reading responses] between browsers and servers." - Empirical Study of CORS
  4. is the most important access control mechanism to segregate static contents and active scripts from different origins."- Cookies Lack Integrity
  5. is a set of server-side headers, enforced by the client, which allow a server to allow read access from JavaScript" - Careful Who You Trust

========= Origin =========

  1. is a 3-tuple, consisting of the scheme, the domain and the port number" - Cookies Lack Integrity
  2. for a given URL is defined by a 3-tuple: scheme - or protocol], e.g. HTTP or HTTPS, domain - or host], and port - not supported by IE]" - Cookies Lack Integrity
  3. the triple consisting of scheme, host, and port of the involved resources." - XSSI
  4. The combination of protocol, subdomain - or hostname], and port constitutes an origin as defined by RFC 6454 - 3]." - Site Policy
  5. is defined as the triple consisting of scheme, host, and port of the involved resources" - Privacy Breach by Exploiting postMessage

========= Same-Origin Policy =========

  1. only permits to exchange data with other documents sharing the same protocol, host, and port"- Careful Who You Trust
  2. guards web resources from being accessed by scripts from another origin" - Empirical Study of CORS
  3. defines the security boundary of a resource by its origin, the URI scheme/host/port tuple" - Empirical Study of CORS
  4. specifies trust by URI"- RFC The Web Origin Concept
  5. restricts access to resources as soon as the origin - protocol, host, and port] differs from the requesting page’s own values" - Careful Who You Trust
  6. defines how code from mutually untrusted principals are separated." - ZigZag
  7. automatically prevents client-side code from distinct origins from interfering with each others’ code and data" - ZigZag
  8. is used to denote a complex set of rules which governs the interaction of different Web Origins within a web application" - SOP: Evaluation in Modern Browsers
  9. strongly separates mutually distrusting Web content within the Web browser through origin-based compartmentalization" - XSSI
  10. allows a given JavaScript access only to resources that have the same origin" - XSSI
  11. ensures two pages with different origins are not allowed to access each other - e.g., through JavaScript." - Site Policy
  12. the fundamental isolation strategy for client-side web application security." - Empirical Study of CORS
  13. is a corner stone of web security, guarding the web content of one domain from the access from another domain" - Cookies Lack Integrity
  14. is the principal security policy in Web browsers" - XSSI
  15. is a fundamental security mechanism that provides boundaries between Web sites and prevents unauthorized access to sensitive information - Careful Who You Trust
  16. can effectively separate mutually distrusting Web content within the Web browser through origin-based compartmentalization."" - Privacy Breach by Exploiting postMessage
  17. is the baseline defense mechanism implemented in web browsers to provide confidentiality and integrity guarantees for contents provided by unrelated websites. - CSP Semantics Analysis

========= postMessage =========

  1. is a primitive that enables crossorigin communication within the web browser" - Emperor's New API
  2. is a message passing mechanism that can be used for secure communication of primitive strings between browser windows." - Emperor's New API
  3. allows two iframe tags from different origins to communicate." - CORS in Action
  4. is a client-side primitive to enable cross-origin communication at the browser side." - Emperor's New API
  5. aims to provide a simple, purely client-side cross-origin channel for exchanging primitive strings." - Emperor's New API
  6. is an exemption by design to enable cross-origin communication" - pMForce
  7. allows for cross-domain message exchange whenever two sites are rendered in the same browser tab - or popup window]" - Uncovering History We Insecurity
  8. allows to send serialized messages between two documents." - Careful Who You Trust
  9. allows to exchange data across origin and site boundaries" - Careful Who You Trust
  10. is a stringbased message passing mechanism proposed for inclusion in HTML 5" - FLAX]
  11. enables applications to communicate with each other purely within the browser, and are not subject to the classical same origin policy - SOP]." - ZigZag
  12. enables web content from different origins being exchanged between different service providers." - Privacy Breach by Exploiting postMessage
  13. is a browser API designed for interframe communication" - Securing Frames
  14. The Web’s most basic security policy" - Careful Who You Trust
  15. is a fundamental security mechanism that provides boundaries between Web sites and prevents unauthorized access to sensitive information" - Careful Who You Trust
  16. creates a security barrier around an application which is bounded by the origin" - Careful Who You Trust
  17. allows sending serializable JavaScript objects from one frame to another" - pMForce
  18. enables a script to send a message to a window regardless of their respective origins" - The Postman Always Rings Twice
  19. allowing a script to send a string to any window in the same or different origin" - The Postman Always Rings Twice
  20. is a stringbased message passing mechanism proposed for inclusion in HTML 5." - FLAX]

********* Web Storage *********

  1. two persistent storage abstractions" - Emperor's New API
  2. is a mechanism that allows a Web application to store structured data within the user’s Web browser via Javascript." - WebStorage-driven Content Caching
  3. is a mechanism that allows a piece of Javascript to store structured data within the user’s browser" - WebStorage-driven Content Caching
  4. is, thereby, an umbrella term for two related functionalities - SessionStorage and LocalStorage." - WebStorage-driven Content Caching
  5. summarizes a set of browser-based technologies that allow application-level persistent storage of key/values pairs on the client-side" - WebStorage-driven Content Caching
  6. is a specification that allows web applications to create a persistent key-value store in the browser, the content of which is maintained either until the end of a session - Session Storage], or beyond - Local Storage]"- Client-side storage APIs

========= Client-side validation vulnerability =========

  1. represent bugs in JavaScript programs that allow for unauthorized actions via untrusted input." - Don’t Trust The Locals]
  2. arise from unsafe usage of untrusted data in the client-side code of the web application that is typically written in JavaScript." - FLAX]
  3. as one which results from unsafe usage of untrusted data in the client-side code of the web application." - FLAX]
  4. a programming bug which results from using untrusted data in a critical sink operation without sufficient validation" - FLAX]

********* Local Storage *********

  1. is a key/value store tied to an application’s origin." - Emperor's New API
  2. is only one of many ways to persist data across multiple HTTP requests as Cookies, WebStorage or the File API exist nowadays.." - Beyond XSS Auditor]
  3. is persistent across sessions, while data within SessionStorage is discarded whenever the corresponding session is closed." - WebStorage-driven Content Caching

********* Cookie *********

  1. simple key-value stores used by browsers to persist small pieces of string data, which are sent along in every HTTP request to matching servers" - Don’t Trust The Locals]
  2. is a short piece of data that a website sends to a visiting client, either via HTTP response headers or by using client-side scripting"- client-side storage APIs
  3. are a browser-side assisted state management mechanism that are pervasively used by web applications"- Cookies Lack Integrity
  4. are small pieces of text communicated via an HTTP header or set via JavaScript, which map a key to a value and have optional attributes" - Site Policy

********* Indexed DB *********

  1. It defines a JavaScript-based interface for an embedded transactional database system" - Client-side storage APIs
  2. is an object-oriented database" - Client-side storage APIs
  3. is an asynchronous API" - Learn Typescript 3

========= Service Worker =========

  1. is an event-driven and browsermanaged process triggered by the registration of a JavaScript code hosted by a web application, and registered to manage all or part of an application" - The Remote on the Local
  2. is a script that can be registered to control one or more pages of your site. Once installed, a service worker sits outside of any single browser window or tab." - The Remote on the Local

========= robots.txt =========

  1. is called “The Robots Exclusion Protocol”." - A Study of Different Web-Crawler Behaviour

========= Web crawler =========

  1. is software for downloading pages from the Web automatically. It is also called web spider or web robot" - Web Crawler: Extracting the Web Data
  2. are full text search engines which assist users in navigating the web" - Web Crawler: Extracting the Web Data
  3. - also known as a robot or a spider] is a system for the bulk downloading of web pages" - Web Crawling
  4. is a programme or a suit of programmes that is used to retrieve contents of web pages" - Reviews of Web Crawlers
  5. is a computer program that browses the World Wide Web in a methodical, automated manner or in an orderly fashions" - WEB CRAWLER - AN OVERVIEW
  6. also known as spider or web robotis a program that automatically traverses the large numbers of web pages by following hyperlinks, index them and stores the traversed web pages links for prospect use" - A Methodical Study of Web Crawler
  7. is a vital part of the search engine. It is a program that navigates the web and downloads the references of the web pages" - A Methodical Study of Web Crawler

========= Web crawler =========

  1. is software for downloading pages from the Web automatically. It is also called web spider or web robot" - Web Crawler: Extracting the Web Data
  2. are full text search engines which assist users in navigating the web" - Web Crawler: Extracting the Web Data

========= Breadth First Crawler =========

  1. starts with a small set of pages and then explores other pages by following links in the breadth-first - 6] fashion." - Web Crawler: Extracting the Web Data p.3

========= Breadth-First Algorithm =========

  1. It is the simplest crawling strategy. It was designed in 1994. It uses the frontier as the FIFO queue and crawls the links in the order in which they are encountered. It is basically used as a baseline crawler. Main drawback of this approach is that it traverses the URLs in the order in which they are entered into the frontier. It is good to implement this approach if the numbers of pages are less. In real life a lot of useless links are produced by useless pages which results in the wastage of time and memory of the frontier. Therefore a useful page should always be selected from the frontier." - Web Crawler: Extracting the Web Data p.3

========= Blind Traversing Approach =========

  1. Firstly a seed URL is decided and the crawling process is applied. This process is called blind as there is particular method for selecting the next URL from the frontier. Breadth- First search is a very common example of this approach." - Web Crawler: Extracting the Web Data p.3

========= Excluded Content =========

  1. "The site’s robot.txt file needs to be fetched before fetching a page from the site so that it can be determined whether the web master has specified about how much file can be crawled - 9]." - Web Crawler: Extracting the Web Data

========= Form Focused Crawler =========

  1. is software for downloading pages from the Web automatically. It is also called web spider or web robot" - Web Crawler: Extracting the Web Data
  2. are full text search engines which assist users in navigating the web" - Web Crawler: Extracting the Web Data

========= Focused Web crawlers =========

  1. is a type of web crawler that crawls web pages which are specific to a pre-defined topic or domain." - Reviews of Web Crawlers

========= Hidden Web Crawlers =========

  1. A lot of data on the web actually resides in the database and it can only be retrieved by posting appropriate queries or by filling out forms on the web. Recently interest has been focused on access of this kind of data called “deep web” or “hidden web”. Current day crawlers’ crawl only publicly indexable web - PIW] i.e., set of pages which are accessible by following hyperlinks ignoring search pages and forms which require authorization or prior registration. In reality they may ignore huge amount of high quality data, which is hidden behind search forms." - Web Crawler: Extracting the Web Data

========= Parallel Crawlers =========

  1. As the size of the Web grows, it becomes more difficult to retrieve the whole or a significant portion of the Web using a single process. Therefore, many search engines often run multiple processes in parallel to perform the above task, so that download rate is maximized. This type of crawler is known as a parallel crawler." - Web Crawler: Extracting the Web Data

========= Distributed Web Crawler =========

  1. G.Distributed Web Crawler: This crawler runs on network of workstations. Indexing the web is a very challenging task due to growing and dynamic nature of the web. As the size of web is growing it becomes mandatory to parallelize the process of crawling to finish the crawling process in a reasonable amount of time. A single crawling process even with multithreading will be insufficient for the situation. In that case the process needs to be distributed to multiple processes to make the process scalable. It scales up to several hundred pages per second. The rate at which size of web is growing it is imperative to parallelize the process of crawling. In distributed web crawler a URL server distributes individual URLs to multiple crawlers, which download web pages in parallel. The crawlers then send the downloaded pages to a central indexer on which links are extracted and sent via the URL server to the crawlers. This distributed nature of crawling process reduces the hardware requirements and increases the overall download speed and reliability - 2]. FAST Crawler - 20] is a distributed crawler, used by Fast Search & Transfer." - Web Crawler: Extracting the Web Data

========= Politeness policy=========

  1. Crawling algorithms should be designed in such a way that only one request is send to the server at a time. For this purpose, a politeness delay needs to be inserted between the requests. This will help reduce the risks." - Web Crawler: Extracting the Web Data
  2. It limited the rate of requests to each site, it allowed web sites to exclude themselves from purview through the nascent robots exclusion protocol, and it provided a “black-list” mechanism that allowed the crawl operator to exclude sites" - Web Crawling
    3. >
  3. states how to avoid overloading Web sites" - Web Crawling

========= Duplicate Content =========

  1. Crawlers should be able to recognize and eliminate duplicate data available on different URLs. Methods like checksum, visitor counter, fingerprinting etc. are needed for this purpose." - Web Crawler: Extracting the Web Data

========= Continuous Crawling =========

  1. Carrying out full crawling after regular intervals is not a beneficial approach to follow. This results in low-value and static pages" - Web Crawler: Extracting the Web Data

========= Duplicate Content =========

  1. Crawlers should be able to recognize and eliminate duplicate data available on different URLs. Methods like checksum, visitor counter, fingerprinting etc. are needed for this purpose." - Web Crawler: Extracting the Web Data

========= Best First Heuristic Approach =========

  1. This was developed in 1998 to overcome the problems of blind traversing approach. The links are selected from the frontier on the basis of some estimation, score or priority. Always the best available link is opened and traversed. Various mathematical formulas are also used." - Web Crawler: Extracting the Web Data

========= Duplicate Content =========

  1. Crawlers should be able to recognize and eliminate duplicate data available on different URLs. Methods like checksum, visitor counter, fingerprinting etc. are needed for this purpose." - Web Crawler: Extracting the Web Data

========= Parallelization policy =========

  1. states how to coordinate distributed Web crawlers." - WEB CRAWLER - AN OVERVIEW

========= Selection policy =========

  1. states which pages to download." - WEB CRAWLER - AN OVERVIEW

========= Re-visit policy =========

  1. states when to check for changes to the pages." - WEB CRAWLER - AN OVERVIEW

######### Obfuscation #########

  1. is to make a program unintelligible while preserving its functionality" - Hiding in Plain Site
  2. when the intentional behavior of a script cannot be fully realized until execution." - Hiding in Plain Site
  3. if the interactions of code with its underlying system cannot be deduced from static analysis of its source code." - Hiding in Plain Site

######### Minification #########

  1. rewriting the source code to be more compact without changing its functionality." - Hiding in Plain Site

========= DOM clobbering =========

  1. allows markup to override variables in JavaScript execution environment, making it possible to trigger specific script behavior" - Script Gadgets

========= URL Redirection =========

  1. is a popular technique that automatically navigates users to an intended destination webpage without user awareness - Redirection Trail
  2. allows a webpage to be accessible via multiple URLs. - Redirection Trail
  3. is an automatic redirection of one URL to another, usually indicated by the 3xx HTTP status code. - Script Gadgets CSP

--------- Access Control ---------

  1. provides a line of defense to prevent exploits by blocking unauthorized access. - Tracking the Provenance of AC Decisions
  2. is a pervasive security mechanism which is used in virtually all systems. Automated Inference of AC Policies for Web Apps
  3. restricts the subjects (e.g., users and programs) that may perform operations (e.g., read and write) over objects (e.g., files and records). Automated Inference of AC Policies for Web Apps

--------- Broken access control ---------

  1. is a widely recognised security issue in web applications; it leads to unauthorised accesses to sensitive data and system resources. Automated Inference of AC Policies for Web Apps

--------- Insecure Direct Object References ---------

  1. refers to the exposure of direct references to internal resources (such as files). Automated Inference of AC Policies for Web Apps

--------- Broken Authentication and Session Management ---------

  1. relates to the authentication and session management of an access control mechanism. Automated Inference of AC Policies for Web Apps