Techniques for protecting web-browsers against cross-site scripting exploitation attacks
AssigneeRadware, Ltd.
InventorsAlon Tamir, Amir Marmor, David Aviv
Life of this patent
Estimating the term…
Abstract
A method and system for detecting client-side cross-site scripting exploitation attacks according to an embodiment are disclosed. The method includes downloading an access list from a remote server; capturing a request to access an external resource, wherein the request is initiated by a script executed over the web browser, wherein the external web resource is external to the web browser executed on a client device; determining, based on the access list, if the requested external web resource can be accessed; and applying a mitigation action on the request to access the external web resource when it is determined that the external web resource cannot be accessed.
Claims18
A method for detecting client-side cross-site scripting exploitation attacks, comprising:
- downloading, by a client-side defense agent of a web browser that is executing on a client device, an access list from a remote server;
- capturing, by the client-side defense agent, a request to access an external web resource, wherein the request is initiated by a script being executed by the web browser, wherein the external web resource is external to the web browser;
- and
- when it is determined by the client-side defense agent, based on the access list, that the requested external web resource cannot be accessed, applying, by the client-side defense agent, a mitigation action on the request to access the external web resource.
A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry of a client-side defense agent of a web browser that is executing on a client device to execute a process, the process comprising:
- downloading, by the client-side defense agent of the web browser that is executing on the client device, an access list from a remote server;
- capturing, by the client-side defense agent, a request to access an external web resource, wherein the request is initiated by a script being executed by the web browser, wherein the external web resource is external to the web browser;
- and
- when it is determined by the client-side defense agent, based on the access list, that the requested external web resource cannot be accessed, applying, by the client-side defense agent, a mitigation action on the request to access the external web resource.
A system for detecting client-side cross-site scripting exploitation attacks, the system implementing a client-side defense agent of a web browser that is executing on a client device, the system comprising:
- a processing circuitry;
- and
- a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- download into the client-side defense agent an access list from a remote server;
- capture, by the client-side defense agent, a request to access an external web resource, wherein the request is initiated by a script being executed by the web browser, wherein the external web resource is external to the web browser;
- and
- when it is determined, by the client-side defense agent, based on the access list, that the requested external web resource cannot be accessed, apply a mitigation action on the request to access the external web resource when it is determined that the external web resource cannot be accessed.
Dependencies are inferred from the claim text.