Voir la source de 4MMSR-Network Security-2012-2013-taint assisted dom xss fuzzing

{{4MMSR-2012-2013-project_template

|title=Taint Assisted DOM-XSS Fuzzing with Dominator Pro

|references=
* [http://www.webappsec.org/projects/articles/071105.shtml DOM Based Cross Site Scripting or XSS of the Third Kind, Amit Klein, 2005]
* [https://www.owasp.org/images/7/76/AnalyzingDOMXssWithDOMinator.pdf Finding DOM XSS with Dominator Pro, Stefano di Paola, 2011]
* [http://car-online.fr/en/spaces/fabien_duchene/publications/2012-04-SecTest-ICST/ XSS Vulnerability Detection Using Model Inference Assisted Evolutionary Fuzzing, Fabien Duchene & Sanjay Rawat & Roland Groz & Jean-Luc Richier, 2012]
* [http://www.spacios.eu/deliverables.php SPaCIoS, D3.3 "Methodology and technology for vulnerability-driven security testing", section "An Evolutionary Smart-Fuzzing Approach for Detecting XSS Injections Attacks", 2013]
* [http://www.youtube.com/watch?v=fh21ly5LNkg DOM XSS on Google.com Page using DOMinatorPro Fuzzer, 2012]

|keywords=fuzzing,DOM/type-0 XSS,data tainting

|description=DOM XSS is an injection vulnerability for which few attack grammars do exist. The problem formalization can be derived from [http://car-online.fr/en/spaces/fabien_duchene/publications/2012-04-SecTest-ICST/]. There exist a fuzzer integrated in the penetration testing tool Dominator Pro [https://dominator.mindedsecurity.com/]. It is not clear how this fuzzing module does perform: it is likely that this module iteratively submits all values from a dictionary and keeps iterating until a given test verdict is obtained. In this mini research exercise, we want to address this fuzzing process in the following ways: 
* how to generate an input sequence knowing previously submitted sequences? 
** which input parameters to choose?
** which values to provide on those?
* how to assess if a given input sequence is promising towards triggering this bug?

|expected_output=

* formalize the DOM XSS problem
* explain how the DOMinator Pro fuzzer does work
* list and content of existing DOM XSS attack grammars
* write a DOM-XSS attack grammar
* interface with Dominator Pro to programmatically obtain: 
** the number of tainted nodes
** the list of performed transformations on sources
** if a DOM XSS attack did occur or not (test verdict)
* write a fitness function for directing DOM XSS fuzzing
* write an evolutionary fuzzer


|research_questions=
* propose a methodology for producing a DOM-XSS grammar
* what are the intuitions for writing the most relevant fitness function dimensions?
* compare the built-in DOMinator Pro fuzzer with the one you wrote (criteria to be defined)

|tools=
* [https://dominator.mindedsecurity.com/ dominator pro]




}}