Detection and prevention of XSS vulnerabilities in MOODLE

Other Title(s)

اكتشاف و منع ثغرة في نظام XSS المودل

Dissertant

al-Azayizah, Rula Jabir Abd al-Aziz

Thesis advisor

Barhum, Tawfiq Sulayman

Comitee Members

Barhum, Ibrahim Khalil
Maghari, Ashraf Yunus

University

Islamic University

Faculty

Faculty of Information Technology

Department

Information Technology

University Country

Palestine (Gaza Strip)

Degree

Master

Degree Date

2016

English Abstract

MOODLE (Modular Object-oriented Dynamic Learning Environment) is one of the most popular e-learning environment in the world, MOODLE is same as web application that vulnerable to illegal attacks so, the need for confidentiality, Integrity and availability in e-learning is extremely complex problem to meet the security requirements.

One of the serious attacks to the MOODLE is Cross site Scripting (XSS).

XSS is a web application vulnerability that occur whenever a web application takes data from user without proper encoding or validation and sends it to the browser.

XSS allow attacker to executes scripts that can hijack victims session and deface web sites.

MOODLE resources (file, page and student's assignment) are still vulnerable to XSS attacks.

For this we need to secure the MOODLE against XSS attacks to keep both teachers and students information secure.

A lot of researches have handled XSS attacks in CMS but most of these researches have a little attention on XSS attacks on MOODLE.

So, we discussed PHP's functions that used to prevent XSS attacks.

Additionally we conducted a comparative study between four published filters to determine their weakness, then RT_XSS_Cln filter was developed to prevent XSS attacks.

RT_XSS_Cln filter is written using PHP language.

RT_XSS_Cln filter provide a high protection against XSS attacks comparing with the other filters.

RT_XSS_Cln filter evaluated by performing offline and online testing, offline testing is done by nearly 80 files contain nearly 1000 malicious scripts, while online testing is done by plugging RT_XSS_Cln on the Moodle from both sides teacher's side and students' side to protect both of them.

RT_XSS_Cln filter overcomes that other filters' weaknesses, it's more accurate than the other filters due to its ability able to prevent all XSS tested scripts (1000 scripts), also RT_XSS_Cln filter is faster than the other filters it has a little processing mean time than the others nearly 0.002s.

Main Subjects

Information Technology and Computer Science

No. of Pages

79

Table of Contents

Table of contents.

Abstract.

Abstract in Arabic.

Chapter One : Introduction.

Chapter Two : Theoretical background.

Chapter Three : Related works.

Chapter Four : Defenses model.

Chapter Five : Proposed method.

Chapter Six : Experimental setup and implementation.

Chapter Seven : Conclusion and future work.

References.

American Psychological Association (APA)

al-Azayizah, Rula Jabir Abd al-Aziz. (2016). Detection and prevention of XSS vulnerabilities in MOODLE. (Master's theses Theses and Dissertations Master). Islamic University, Palestine (Gaza Strip)
https://search.emarefa.net/detail/BIM-724517

Modern Language Association (MLA)

al-Azayizah, Rula Jabir Abd al-Aziz. Detection and prevention of XSS vulnerabilities in MOODLE. (Master's theses Theses and Dissertations Master). Islamic University. (2016).
https://search.emarefa.net/detail/BIM-724517

American Medical Association (AMA)

al-Azayizah, Rula Jabir Abd al-Aziz. (2016). Detection and prevention of XSS vulnerabilities in MOODLE. (Master's theses Theses and Dissertations Master). Islamic University, Palestine (Gaza Strip)
https://search.emarefa.net/detail/BIM-724517

Language

English

Data Type

Arab Theses

Record ID

BIM-724517