Generating Test Paths to Detect XSS Vulnerabilities of Web Applications

Web technologies have developed rapidly because web applications are currently leading the trends in software development. In the face of emerging security issues, preventing software security vulnerabilities is a great concern for developers, vendors, and customers. In fact, the cross-site scripting (XSS) attack is a very popular type of attack that causes security vulnerabilities in web systems. However, when testing to detect XSS attacks for web applications, optimizing the test paths still has some problems with the time or space of the test paths. Therefore, in this paper, we propose a method to solve this problem. Our approach uses Q-learning in generating automated test paths to test XSS vulnerabilities for web applications. The proposed method consists of generating the graph of the web application, setting the weight for the graph, building the memory matrix, and generating test paths. We have experimented proposed approach with the online learning website system. The experimental results show a significant reduction in the number of test paths and this helps to reduce the test case space and test time to detect XSS vulnerabilities of web applications.