BOOKIE: Cookie Theft through XSS Attacks and its Relationship with Personal Data Leakage: a Framework to Demonstrate it to University Students.

Abstract

This doctoral thesis addresses web security, focusing on leaking personal data by stealing cookies via XSS attacks. A comprehensive analysis between 2013 and 2023 revealed trends in combating XSS attacks, including browser-specific tools and web content analysis to identify vulnerabilities. AI methods for classifying web pages and mitigating XSS attacks were also explored. In this context, a framework we have named BOOKIE was developed. The results showed that a significant percentage of cookies allow the execution of commands, evidencing security risks and deficiencies in their properties. The research also established a relationship between browsing history and cookie attributes to develop a classifier based on decision trees, improving security measures. The use of web scraping tools to collect third-party cookies was evaluated, concluding that browsing simulation techniques allow the automatic generation of necessary cookies, optimizing data capture and the functionality of our framework. In addition, the impact of XSS attacks on personal data leakage and student competency in cookie decryption was evaluated. The findings highlighted the need for continuing education in cybersecurity and practical application to address evolving threats. In conclusion, this thesis contributes significantly to understanding and mitigating web security threats, improving cybersecurity measures and educational frameworks to address emerging risks.