Efficient classiffication of True Positive and False Positive vulnerabilities for XSS and CSRF vulnerabilities

Abstract

Security testing is an essential part of software testing. If the software or a web application is not secured enough, it is very easy for an attacker to invade the security and do malicious activity. Testing tools used to test the application detects the vulnerability which can be True positive or False Positive. In order to classify them, tester tests these vulnerabilities manually. In this article, we propose an approach that will test two of the popular vulnerabilities Cross Site Scripting(XSS) and Cross Site Request Forgery(CSRF) with a single script and classify them into True positive and False positive. This will reduce the total testing timing as in a single scan both the vulnerabilities will be tested