Analysis of Oauth and CORS vulnerabilities in the wild

Thanks to the wide range of features offered by the World Wide Web (WWW), many web applications have been published and developed through different libraries and programming languages. Adapting to new changes, the Web quickly evolved into a complex ecosystem, introducing many security problems to its users. To solve these problems, instead of re-designing the Web, the vendors added the security patches (protocols, mechanisms)to the Web platform to provide a more convenient and more secure environment for web users. However, not only did these patches not completely resolve the security problems, but their implementations also introduced other security risks unbeknownst to website operators and users. In this thesis, I propose a novel research on two different security patches to understand and analyze their deployment in real-world scenarios and discover the unseen, neglected factors and the elements involved in exploiting their use: one security protocol, OAuth, and one security mechanism, CORS. As this thesis is based on offensive approaches, I develop automated methodologies, including novel strategies for analyzing and measuring the security qualities of the OAuth protocol and CORS mechanism in real-world scenarios.

Grantor dc:publisher

Università degli studi di Trento

Year dc:date

2022

Author dc:creator

• Arshad, Elham

Contributors dc:contributor

• Crispo, Bruno

• Protocol, mechanism, OAuth, privacy, CSRF, CORS, Cross-Origin Resource Sharing, Same-Origin Policy, SOP

Statement dc:rights

• info:eu-repo/semantics/openAccess
• license:Tutti i diritti riservati (All rights reserved)
• license uri:iris.PRI01

Language dc:language

enm

Identifier

http://dx.doi.org/10.15168/11572_361123
10.15168/11572_361123

OAI identifier oai:identifier

oai:iris.unitn.it:11572/361123