English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Since the first publication of the "OWASP Top 10" (2004), cross-sitescripting (XSS) vulnerabilities have always been among the top 5 webapplication security bugs. Black-box vulnerability scanners are widely used inthe industry to reproduce (XSS) attacks automatically. In spite of thetechnical sophistication and advancement, previous work showed that black-boxscanners miss a non-negligible portion of vulnerabilities, and reportnon-existing, non-exploitable or uninteresting vulnerabilities. Unfortunately,these results hold true even for XSS vulnerabilities, which are relativelysimple to trigger if compared, for instance, to logic flaws.  Black-box scanners have not been studied in depth on this vertical: knowingprecisely how scanners try to detect XSS can provide useful insights tounderstand their limitations, to design better detection methods. In thispaper, we present and discuss the results of a detailed and systematic study on6 black-box web scanners (both proprietary and open source) that we conductedin coordination with the respective vendors. To this end, we developed anautomated tool to (1) extract the payloads used by each scanner, (2) distillthe "templates" that have originated each payload, (3) evaluate them accordingto quality indicators, and (4) perform a cross-scanner analysis. Unlikeprevious work, our testbed application, which contains a large set of XSSvulnerabilities, including DOM XSS, was gradually retrofitted to accomodate forthe payloads that triggered no vulnerabilities.  Our analysis reveals a highly fragmented scenario. Scanners exhibit a widevariety of distinct payloads, a non-uniform approach to fuzzing and mutatingthe payloads, and a very diverse detection effectiveness.

XSS Peeker: A Systematic Analysis of Cross-site Scripting Vulnerability Scanners