Earticle

웹 서비스 사용자가 증가하면서 웹 애플리케이션을 공격하는 방법들이 여러 가지 유형들로 나타나면서 웹 애플리케이션 보안에 관한 중요성의 인식도 증가하고 있다. 정보통신기술 발달과 함께 도래한 지식정보사회는 급변하는 사회에서 창의성과 인성 교육에 필요한 웹사이트의 구축이 절실히 요구되고 있다. 본 논문에서는 창의․인성 교육기반의 디지털 큐레이션 시스템에서 제공하는 교육 콘텐츠에 대한 SQL Injection과 XSS에 대한 공격 방법과 취약점을 분석한다. 그리고 SQL Injection과 XSS에 대한 웹 공격에 대응하는 방법을 제시하고자 한다.

With the growing number of people that use web services, the perception of the importance of securing web applications is also increasing. There are many different types of attacks that target web applications. In the rapidly-changing knowledge and information society, which came into being with the advancements made in information and communication technology, there is currently an urgent need for building web sites for the purposes of developing one's creativity and character. In this paper, attack schemes that use SQL injections and XSS and target educational digital curation systems which provide educational contents with the aim of developing of one's creativity and character are analyze, in terms of how the attacks are carried out and their vulnerabilities. Furthermore, it suggests ways of dealing appropriately with these web-based attacks that use SQL injections and XSS.

웹 해킹 대책을 적용할 경우 어느 한가지 기술이나 방법보다 통합된 대책을 구성하고 정보보안을 단계적으로 실행하는 방법이 필요하다. 웹 해킹 대응을 어느 한가지 방법에만 의존 시 많은 보안 공백을 발생 시킬 수 있다. 본 연구에서는 Cross-site scripting 공격 프로세스를 진단하여 웹 해킹 대응절차를 설계한다. 대응체계는 프레임워크를 구성하고정보보안을 단계적으로 실행하는 방법이다. 단계적 대응모델은 대책의 구조를 시스템 설계단계, 운용단계, 사용단계로구성하는 방법이다. 시스템 설계단계는 방법은 개발 라이프 사이클에 기초하여 시큐어코딩 설계로 보안 효율성을 높인다. 사용단계에서는 사용자의 보안 이행사항을 체계화한다. 본 방법론을 실무현장에 적용할 경우 현장에서 필요한 종합적인 접근방법론 모델로 활용할 수 있다.

When applying web hacking techniques and methods it needs to configure the integrated step-by-step and runan information security. Web hackings rely upon only one way to respond to any security holes that can cause alot. In this study the diagnostic process of cross-site scripting attacks and web hacking response procedures aredesigned. Response system is a framework for configuring and running a step-by-step information security. Stepresponse model of the structure of the system design phase, measures, operational step, the steps in the methodused. It is designed to secure efficiency of design phase of the system development life cycle, and combines theway in secure coding. In the use user's step, the security implementation tasks to organize the details. Themethodology to be applied to the practice field if necessary, a comprehensive approach in the field can be used as amodel methodology.

크로스사이트 스크립팅은 웹 애플리케이션의 취약점으로 사용자의 정보(쿠키, 세션 등)를 탈취하거나, 비정 상적인 기능을 자동으로 수행하게 하거나 할 수 있다. 크로스사이트 스크립팅(XSS) 공격유형은 한 번의 HTTP 요청 과 응답에서 행해지는 XSS인 반사 XSS(reflect XSS)와 페이로드를 전송한 뒤 다수의 피해자가 해당 페이지에 접속 하면 XSS 공격에 노출되는 저장 XSS(Stored XSS)로 나눌 수 있다. 그리고 크로스사이트 스크립팅 공격에 대한 방어 로 사용자 입력하는 데이터에 대한 입력 값 검증, HTML 인코딩 과정에서의 출력 값에 대한 검증, 사용자가 악의적 코드를 웹 어플리케이션에 삽입하기 위한 시도를 막기 위해 위험 가능성 삽입지점 제거를 제시하였다. 본 논문에서 는 이 두 가지 방법에 대한 공격방법과 절차를 제시하고 모의해킹을 수행하였다. 이를 통해 크로스사이트 스크립팅 공격에 대한 이해가 가능하고 대응책을 통해 공격에 대비할 수 있도록 하였다.

Cross Site Scripting enables hackers to steal other user's information (such as cookie, session etc.) or to do abnormal functions automatically using vulnerability of web application. This attack patterns of Cross Site Scripting(XSS) can be divided into two types. One is Reflect XSS which can be executed in one request for HTTP and its reply, and the other is Stored XSS which attacks those many victim users whoever access to the page which accepted the payload transmitted. To correspond to these XSS attacks, some measures have been suggested. They are data validation for user input, output validation during HTML encoding procedures, and removal of possible risk injection point to prevent from trying to insert malicious code into web application. In this paper, the methods and procedures for these two types are explained and a penetration testing is done. With these suggestions, the attack by XSS could be understood and prepared by its countermeasures.

In present-day time, securing the web application against hacking is a big challenge. One of the common types of hacking technique to attack the web application is Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) vulnerabilities are being exploited by the attackers to steal web browser’s resources such as cookies, credentials etc. by injecting the malicious JavaScript code on the victim’s web applications. Since Web browsers support the execution of commands embedded in Web pages to enable dynamic Web pages attackers can make use of this feature to enforce the execution of malicious code in a user’s Web browser. The analysis of detection and prevention of Cross-Site Scripting (XSS) help to avoid this type of attack. We describe a technique to detect and prevent this kind of manipulation and hence eliminate Cross-Site Scripting attack.

Currently, web applications are gaining in prevalence. In a web application, an input may not be appropriately validated, making the web application susceptible to cross-site scripting (XSS), which poses serious security problems for Internet users and websites to whom such trusted web pages belong. A taint inference is a type of information flow analysis technique that is useful in detecting XSS on the client side. However, in existing techniques, two current practical issues have yet to be handled properly. One is URL rewriting, which transforms a standard URL into a clearer and more manageable form. Another is HTML sanitization, which filters an input against blacklists or whitelists of HTML tags or attributes. In this paper, we make an analogy between the taint inference problem and the molecule sequence alignment problem in bioinformatics, and transfer two techniques related to the latter over to the former to solve the aforementioned yet-to-be-handled-properly practical issues. In particular, in our method, URL rewriting is addressed using local sequence alignment and HTML sanitization is modeled by introducing a removal gap penalty. Empirical results demonstrate the effectiveness and efficiency of our method.