{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T14:48:01Z","timestamp":1781102881151,"version":"3.54.1"},"reference-count":40,"publisher":"IGI Global Scientific Publishing","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019,1]]},"abstract":"<jats:p>This article presents a hybrid framework i.e. OXSSD (Online Social Network-Based XSS-Defender) that explores cross-site scripting (XSS) attack vectors at the vulnerable points in web applications of social networks. Initially, during training phase, it generates the views for each request and formulates the access control list (ACL) which encompasses all the privileges a view can have. It also ascertains all possible injection points for extracting malicious attack vectors. Secondly, during recognition phase, after action authentication XSS attack vectors are retrieved from the extracted injection points followed by the clustering of these attack vectors. Finally, it sanitizes the compressed clustered template in a context-aware manner. This context-aware sanitization ensures efficient and accurate alleviation of XSS attacks from the OSN-based web applications. The authors will evaluate the detection capability of OXSSD on a tested suite of real world OSN-based web applications (Humhub, Elgg, WordPress, Drupal and Joomla). The performance analysis revealed that OXSSD detects injection of illicit attack vectors with very low false positives, false negatives and acceptable performance overhead.<\/jats:p>","DOI":"10.4018\/ijitwe.2019010105","type":"journal-article","created":{"date-parts":[[2018,10,31]],"date-time":"2018-10-31T16:07:39Z","timestamp":1541002059000},"page":"85-111","source":"Crossref","is-referenced-by-count":8,"title":["A Framework for Preserving the Privacy of Online Users Against XSS Worms on Online Social Network"],"prefix":"10.4018","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0766-0530","authenticated-orcid":true,"given":"Pooja","family":"Chaudhary","sequence":"first","affiliation":[{"name":"National Institute of Technology, Kurukshetra, Kurukshetra, Haryana, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"B. B.","family":"Gupta","sequence":"additional","affiliation":[{"name":"National Institute of Technology, Kurukshetra, Kurukshetra, Haryana, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2124-9388","authenticated-orcid":true,"given":"Shashank","family":"Gupta","sequence":"additional","affiliation":[{"name":"Birla Institute of Technology and Science, Pilani, India"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2432","reference":[{"key":"IJITWE.2019010105-0","doi-asserted-by":"publisher","DOI":"10.1145\/2742854.2745719"},{"key":"IJITWE.2019010105-1","doi-asserted-by":"crossref","first-page":"174","DOI":"10.4018\/978-1-4666-6559-0.ch008","article-title":"BDS: browser dependent XSS sanitizer","author":"S.Gupta","year":"2015","journal-title":"Handbook of Research on Securing Cloud-Based Databases with Biometric Applications"},{"key":"IJITWE.2019010105-2","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1016\/j.procs.2016.02.014","article-title":"Automated discovery of javascript code injection attacks in PHP web applications.","volume":"78","author":"S.Gupta","year":"2016","journal-title":"Procedia Computer Science"},{"key":"IJITWE.2019010105-3","doi-asserted-by":"crossref","unstructured":"Gupta, S., & Gupta, B. B. (2016, April). Alleviating the proliferation of JavaScript worms from online social network in cloud platforms. In Information and Communication Systems (ICICS), 2016 7th International Conference on (pp. 246-251). IEEE.","DOI":"10.1109\/IACS.2016.7476119"},{"issue":"2","key":"IJITWE.2019010105-4","first-page":"118","article-title":"Cross-Site Scripting (XSS) abuse and defense: Exploitation on several testing bed environments and its defense. Special Issue of Secured Communication in Wireless and Wired Networks in Journal of Information Privacy and Security","volume":"11","author":"B. B.Gupta","year":"2015","journal-title":"Taylor & Francis Online"},{"key":"IJITWE.2019010105-5","doi-asserted-by":"crossref","first-page":"98","DOI":"10.1007\/978-3-319-46298-1_7","article-title":"An infrastructure-based framework for the alleviation of JavaScript worms from OSN in mobile cloud platforms.","author":"S.Gupta","year":"2016","journal-title":"International conference on network and system security"},{"issue":"4","key":"IJITWE.2019010105-6","doi-asserted-by":"crossref","first-page":"1","DOI":"10.4018\/IJWSR.2017100101","article-title":"Smart XSS attack surveillance system for OSN in virtualized intelligence network of nodes of fog computing.","volume":"14","author":"S.Gupta","year":"2017","journal-title":"International Journal of Web Services Research"},{"key":"IJITWE.2019010105-7","doi-asserted-by":"publisher","DOI":"10.1145\/2480359.2429115"},{"key":"IJITWE.2019010105-8","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046775"},{"key":"IJITWE.2019010105-9","article-title":"FLAX: Systematic Discovery of Client-side Validation Vulnerabilities in Rich Web Applications.","author":"P.Saxena","year":"2010","journal-title":"NDSS Symposium"},{"key":"IJITWE.2019010105-10","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046776"},{"key":"IJITWE.2019010105-11","article-title":"Fast and precise sanitizer analysis with BEK.","author":"P.Hooimeijer","year":"2011","journal-title":"Proceedings of the 20th USENIX conference on Security"},{"key":"IJITWE.2019010105-12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.22"},{"key":"IJITWE.2019010105-13","unstructured":"Hansen, R. (n.d.). XSS (cross site scripting) cheat sheet. Owasp. Retrieved from https:\/\/www.owasp.org\/index.php\/XSS Filter Evasion Cheat Sheet"},{"key":"IJITWE.2019010105-14","unstructured":"Heiderich, M. (n.d.). Html5 security cheatsheet. Retrieved from http:\/\/html5sec.org"},{"key":"IJITWE.2019010105-15","unstructured":"XSS vectors available. (n.d.). Retrieved from http:\/\/xss2.technomancie.net\/vectors"},{"key":"IJITWE.2019010105-16","unstructured":"Vulnerability Lab. (n.d.). Technical Attack Sheet for Cross Site Penetration Tests. Retrieved from http:\/\/www.vulnerability-lab.com\/resources\/documents\/531.txt"},{"key":"IJITWE.2019010105-17","unstructured":"@XSS Vector Twitter Account. (n.d.). Retrieved from https:\/\/twitter.com\/XSSVector"},{"key":"IJITWE.2019010105-18"},{"key":"IJITWE.2019010105-19","unstructured":"Microsoft. (2010). Boonana Java worm. Retrieved from http:\/\/www.microsoft.com\/security\/portal\/Threat\/Encyclopedia\/Entry.aspx%?Name=Worm%3AJava%2FBoonana"},{"key":"IJITWE.2019010105-20","unstructured":"XSS worm on Renren social network. (2009). Retrieved from http:\/\/issmall.isgreat.org\/blog\/archives\/2"},{"key":"IJITWE.2019010105-21","unstructured":"Myspace samy worm. (n.d.). Retrieved from http:\/\/namb.la\/popular\/tech.html"},{"key":"IJITWE.2019010105-22","unstructured":"Kawamoto, D. (2006). Spaceflash worm on MySpace. CNET. Retrieved from http:\/\/news.cnet.com\/Worm-lurks-behind-MySpace-profiles\/2100-7349_3-609%5533.html"},{"key":"IJITWE.2019010105-23","unstructured":"Leyden, J. (2006, June 12). JavaScript worm targets Yahoo! The Register. Retrieved from http:\/\/www.theregister.co.uk\/2006\/06\/12\/javscript_worm_targets_yahoo\/"},{"key":"IJITWE.2019010105-24","unstructured":"Bilbao-Osorio, B., Dutta, S., & Lanvin, B. (2013). State of the Media - The Social Media Report 2012. The Nielsen Company. Retrieved from http:\/\/www.nielsen.com\/us\/en\/insights\/reports\/2012\/state-of-the-media-the-social-media-report-2012.html"},{"key":"IJITWE.2019010105-25","unstructured":"Wikipedia. (n.d.). Cross-site scripting. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Cross-site_scripting"},{"key":"IJITWE.2019010105-26","unstructured":"DP. (2010, September 27). Twitter and Orkut XSS worms in the news. Xssed. Retrieved from http:\/\/www.xssed.com\/news\/120\/Twitter_and_Orkut_XSS_worms_in_the_news\/"},{"key":"IJITWE.2019010105-27","unstructured":"Wikipedia. (n.d.). Koobface. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Koobface"},{"key":"IJITWE.2019010105-28","unstructured":"Elgg social networking engine. (n.d.). Retrieved from https:\/\/elgg.org"},{"key":"IJITWE.2019010105-29","unstructured":"Humhub social networking site. (n.d.). Retrieved from https:\/\/www.humhub.org\/en"},{"key":"IJITWE.2019010105-30","unstructured":"Joomla social networking site. (n.d.). Retrieved from https:\/\/www.joomla.org\/download.html"},{"key":"IJITWE.2019010105-31","unstructured":"Drupal social networking site. (n.d.). Retrieved from https:\/\/www.drupal.org\/download"},{"key":"IJITWE.2019010105-32","doi-asserted-by":"publisher","DOI":"10.1145\/2414456.2414458"},{"issue":"5","key":"IJITWE.2019010105-33","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2020976.2020996","article-title":"BIXSAN: Browser Independent XSS Sanitizer for prevention of XSS attacks.","volume":"36","author":"V. S.Chandra","year":"2011","journal-title":"Software Engineering Notes"},{"key":"IJITWE.2019010105-34","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420952"},{"key":"IJITWE.2019010105-35","doi-asserted-by":"crossref","unstructured":"Bisht, P., & Venkatakrishnan, V. N. (2008). XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks. In 5th international Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Paris, France, July 10-11 (pp. 23-43).","DOI":"10.1007\/978-3-540-70542-0_2"},{"key":"IJITWE.2019010105-36","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2803191"},{"key":"IJITWE.2019010105-37","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCI.2015.7275912"},{"key":"IJITWE.2019010105-38","doi-asserted-by":"crossref","first-page":"1419","DOI":"10.1145\/2810103.2813625","article-title":"From facepalm to brain bender: Exploring client-side cross-site scripting.","author":"B.Stock","year":"2015","journal-title":"Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security"},{"key":"IJITWE.2019010105-39","doi-asserted-by":"publisher","DOI":"10.1109\/PAAP.2014.10"}],"container-title":["International Journal of Information Technology and Web Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=217696","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,5]],"date-time":"2022-05-05T15:56:24Z","timestamp":1651766184000},"score":1,"resource":{"primary":{"URL":"http:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/IJITWE.2019010105"}},"subtitle":[""],"short-title":[],"issued":{"date-parts":[[2019,1]]},"references-count":40,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.4018\/ijitwe.2019010105","relation":{},"ISSN":["1554-1045","1554-1053"],"issn-type":[{"value":"1554-1045","type":"print"},{"value":"1554-1053","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,1]]}}}