diff --git a/document/Dissertation/LaTeX file/00_Thesis.pdf b/document/Dissertation/LaTeX file/00_Thesis.pdf index 1b5d667fbb591af99628d3c99e69110fc84ab2a4..069631459b2e026db34670eee4b6dd5fa753c94f 100644 Binary files a/document/Dissertation/LaTeX file/00_Thesis.pdf and b/document/Dissertation/LaTeX file/00_Thesis.pdf differ diff --git a/document/Dissertation/LaTeX file/00_Thesis.synctex.gz b/document/Dissertation/LaTeX file/00_Thesis.synctex.gz index a79d0afefc83e9093f3e524b7e704b823c6f1846..ab0841535d773031ce64138d6af570fc1244b375 100644 Binary files a/document/Dissertation/LaTeX file/00_Thesis.synctex.gz and b/document/Dissertation/LaTeX file/00_Thesis.synctex.gz differ diff --git a/document/Dissertation/LaTeX file/00_Thesis.tex b/document/Dissertation/LaTeX file/00_Thesis.tex index 3adc14f1d6fc2c6751c0ef78d0ea50d6421f0fc1..22dce14adc8a6ace78a05ade589b78ff6d0caf40 100644 --- a/document/Dissertation/LaTeX file/00_Thesis.tex +++ b/document/Dissertation/LaTeX file/00_Thesis.tex @@ -18,6 +18,8 @@ \usepackage{array} \usepackage{colortbl} % for color in tables \usepackage{listings} % for code block +%\usepackage{geometry} +%\geometry{a4paper, left=5.7cm, right=0.7cm,top=5.35cm, bottom=0cm} \usepackage{hyperref} \usepackage{bookmark} @@ -54,7 +56,7 @@ \begin{abstract} - Cross-site scripting (XSS) attack is a computer vulnerability that allow attacker to insert their own script to the web page to modify the web page in a way they want. By using XSS attack, attacker can modified the web page, stealing information from user, etc. These days, developer usually fix known XS vulnerabilities before been attack, or clean up the suspicious input using firewall before it send to the server. Both approach can not let developer react to the attack if a XSS attack really happen. This project focuses on building a server side detection tool using pattern matching technique based on regular expression, the tool will notify the developer for possible XSS attacks and in this case make developer react earlier when XSS happened real time. We use three attack script to attack a server and use our detection tool on server side to test the effectiveness of the tool. The final result show both advantage and disadvantage of this detection technique. + Cross-site scripting (XSS) attack is a computer vulnerability that allow attacker to insert their own script to the web page to modify the web page in a way they want. By using XSS attack, attacker can modified the web page, stealing information from user, etc. These days, developer usually fix known XS vulnerabilities before been attack, or clean up the suspicious input using firewall before it send to the server. Both approach can not let developer react to the attack if a XSS attack really happen. To answer the question that ``Through adding attack detection tools on server side, how much improvement on the efficiency can a system get when it is attacked?'', his project focuses on building a server side detection tool using pattern matching technique based on regular expression, the tool will notify the developer for possible XSS attacks and in this case make developer react earlier when XSS happened real time. We use three attack script to attack a server and use our detection tool on server side to test the effectiveness of the tool. The final result show both advantage and disadvantage of this detection technique. \end{abstract} diff --git a/document/Dissertation/LaTeX file/02_BackgroundAndLiteratureReview.tex b/document/Dissertation/LaTeX file/02_BackgroundAndLiteratureReview.tex index 7b69b3b324fce8dbf3c6d21d1872cb687e4bf789..c1695093b54a871d625bd37b38a5fc1f41af317d 100644 --- a/document/Dissertation/LaTeX file/02_BackgroundAndLiteratureReview.tex +++ b/document/Dissertation/LaTeX file/02_BackgroundAndLiteratureReview.tex @@ -104,7 +104,7 @@ \subsubsection{Zad Attack Proxy} - OWASP$^\circledR$ Zad Attack Proxy (ZAP) is a well known web application scanner (\cite{ZAP}). It is based on Java and currently maintained by an international volunteers team. It provides scripts for multiple vulnerabilities, including XSS, cross site request forgery (CSRF) and much more. ZAP can run on both command line and GUI, and OWASP has provided a detailed documentation for there users. This project use ZAP v2.9.0 during the test. + OWASP$^\circledR$ Zad Attack Proxy (ZAP) is a well known web application scanner (\cite{ZAP}). It is based on Java and currently maintained by an international volunteers team. It provides scripts for multiple vulnerabilities, including XSS, cross site request forgery (CSRF) and much more. ZAP can run on both command line and GUI, and OWASP has provided a detailed documentation for users. This project use ZAP v2.9.0 during the test. \begin{figure}[H] diff --git a/document/Dissertation/LaTeX file/06_ConclusionAndFurtherWork.tex b/document/Dissertation/LaTeX file/06_ConclusionAndFurtherWork.tex index cef7d9721b8d1121fb97cf189402ec87738d4ed2..ccb8a612aec7f4f8a841536732fdd432e705574e 100644 --- a/document/Dissertation/LaTeX file/06_ConclusionAndFurtherWork.tex +++ b/document/Dissertation/LaTeX file/06_ConclusionAndFurtherWork.tex @@ -25,7 +25,7 @@ \section{Legal aspect} - There is one legal aspect about this project should be discussed. the main point is that our tool been build in this tool is a tool that is designed to be used for protect a server, not attacking one. + There is one legal aspect about this project should be discussed. The main point is that our tool been build in this tool is a tool that is designed to be used for protect a server, not attacking one. To make sure the tool won't be used for attacking a server, this tool use pycap package, which is Python package for internet package listening, it can only be used to log the package go through, not modifying it. this make sure that the tool can be used for changing the data in Package.