Content sniffing

Abstract: Content sniffing attacks occur if browsers render non-HTML files embedded with malicious HTML contents or JavaScript code as HTML files. The rendering of these embedded contents might cause unwanted effects such as the stealing of sensitive information through the execution of malicious JavaScript code. The primary source of these attacks can be stopped if the uploading of malicious files can be prevented from the server side. However, existing server side content sniffing attack detection approaches suffer from a number of limitations. First, file contents are checked only to a fixed amount of initial bytes whereas attack payloads might reside anywhere in the file. Second, these approaches do not provide any mechanism to assess the malicious impact of the embedded contents on browsers. This paper addresses these issues by developing a server side content sniffing attack detection mechanism based on content analysis using HTML and JavaScript parsers and simulation of browser behavior via mock download testing. We have implemented our approach in a tool that can be integrated in web applications written in various languages. In addition, we have developed a benchmark suite for the evaluation purpose that contains both benign and malicious files. We have evaluated our approach on three real world PHP programs suffering from content sniffing vulnerabilities. The evaluation results indicate that our approach can secure programs against content sniffing attacks by successfully preventing the uploading of malicious files.

Abstract: Many Web sites such as MySpace, Facebook and Twitter allow their users to upload files. However when a Web site's Content-Sniffing algorithm differs from a browser's Content-Sniffing algorithm, an attacker can often mount a Content-Sniffing XSS attack on the visitor. That is, by carefully embedding HTML code containing malicious script into a non-HTML file and uploading this file to the Web site, an attacker can deceive the visitor's browser into assuming the file as HTML file and run the script code. However Content-Sniffing XSS attack can be avoided if files uploaded on the server are checked for HTML codes. In this paper we propose a server-side ingress filter that aims to protect vulnerable browsers which may treat non-HTML files as HTML files. Our filter examines user-uploaded files against a set of potentially dangerous HTML elements (a set of regular expressions). The results of our experiment show that the proposed automata-based scheme is highly efficient and more accurate than existing signature-based approach.

Abstract: : Models of security-sensitive code enable reasoning about the security implications of code. In this paper we present an approach for extracting models of security-sensitive operations directly from program binaries, which lets third-party analysts reason about a program when the source code is not available. Our approach is based on string-enhanced white-box exploration, a new technique that improves the effectiveness of current white-box exploration techniques on programs that use strings, by reasoning directly about string operations, rather than about the individual byte-level operations that comprise them. We implement our approach and use it to extract models of the closed-source content sniffing algorithms of two popular browsers: Internet Explorer 7 and Safari 3.1. We use the generated models to automatically find recently studied content-sniffing XSS attacks, and show the benefits of string-enhanced white-box exploration over current byte-level exploration techniques.

Abstract: 2 Abstract: In today's scenario content sniffing and cross-site scripting (XSS) vulnerabilities are the major security threats today when we are in the server-client environment or using any web browser. Contents sniffers alter the content or the source code of the web pages used in their attacks to mimic changes to legitimate websites. So the content transmission and receiving in several forms are not transaction safe. In this paper we put our significant study in the direction of content sniffing and want to find the better security prevention mechanism and discuss on attack detection strategy, so that the attack alert should be sent in a specific time duration.