Differences

This shows you the differences between two versions of the page.

--- security:web_vulnerabilities [2026/08/27 13:43] – Create security:web_vulnerabilities: methods and denominators for XSS/CSRF/SOP measurement on live sites (30 wild of 99 web+crawled). Authored by Claude. karel.kubicek.claude
+++ security:web_vulnerabilities [2026/08/27 14:08] (current) – Headers child exists: 44 measured papers. Authored by Claude. karel.kubicek.claude
@@ Line 12: / Line 12: @@
   * **99** are web **and** crawled (**11.3%** of 880; **8.8%** of 1,120 crawled papers).
   * **433 of 880 (49.2%)** are ''offline'' (program analysis of software) — a paper-level platform tag, and a paper can have several platforms.
-  * Of the 99, a hand map splits **30 wild / 27 lab / 8 cve / 34 offtopic**. The **30** are the papers that crawled live (or archived) sites to measure a web-application or client-side vulnerability class. **30 of 1,120 crawled papers (2.7%)**. Treating 880, 209 or 99 as "the field measured XSS in the wild" is the mistake this page exists to stop.
+  * Of the 99, a hand map splits **30 wild / 27 lab / 8 cve / 34 offtopic**. The **30** are the papers that crawled live **or archived** sites to measure a web-application or client-side vulnerability class. **30 of 1,120 crawled papers (2.7%)**. **2 of those 30 papers** used an archive as the surface (Lerner et al. rewriting history; Stock et al. {[stock2017web]} on Wayback). The other **28 papers** crawled then-live sites. Treating 880, 209 or 99 as "the field measured XSS in the wild" is the mistake this page exists to stop.
 The 99 is a paper-level conjunction: it does not by itself mean the crawl is how the vulnerability was found. Nuclei / Nikto / w3af / OpenVAS together hit **24** papers in full text — too thin for a scanner-tool page; they are a residue here.
@@ Line 31: / Line 31: @@
 ^ Role ^ Papers of 99 ^ Share of 99 ^ Share of 1,120 crawled ^ Meaning ^
-| wild | 30 | 30.3% | 2.7% | Crawled live or archived sites to measure a web-application or client-side vulnerability class. |
+| wild | 30 | 30.3% | 2.7% | Then-live crawl (**28 papers**) or an archive as the surface (**2 papers**) to measure a web-application or client-side vulnerability class. |
 | lab | 27 | 27.3% | 2.4% | Evaluated a scanner, fuzzer or analyser on known applications or a testbed. |
 | cve | 8 | 8.1% | 0.7% | Mapped CVE/NVD/Snyk/Wooyun labels onto libraries, patches or crawled resources. |
@@ Line 63: / Line 63: @@
 **Stored (server).** The payload is written and replayed later. Spider-Scents {[olsson2024_spider]} and Black Widow {[eriksson2021_black]} are detector papers on known apps, not a live-web prevalence. Counting "the scanner alerted" as "the site is vulnerable" is the next section.
-**DOM / client-side.** The source and the sink are both in the page's JavaScript. Lekies et al. {[lekies2013_million]} taint-tracked the Alexa top 5,000 and **validated by executing a payload** — **69,987 of 181,238** generated payloads ran. Steffens et al. {[steffens2019_dont]} added **persistent** client-side XSS: the source is ''document.cookie'' or Web Storage, so a payload that stuck yesterday fires on a later visit. Of domains that used stored data in a sink, **21%** were vulnerable; of the **418** exploitable domains, a network attacker could use **293** and a web attacker **65**. Stock et al. {[stock2017web]} put an 8% client-side XSS rate on 2016 sites in a Wayback crawl. That taint-and-confirm pipeline is what the 2024–2026 specialised browsers still do — see [[Programming:Crawler:Foxhound]] and [[Programming:Crawler:PanoptiChrome]].
+**DOM / client-side.** The source and the sink are both in the page's JavaScript. Lekies et al. {[lekies2013_million]} taint-tracked the Alexa top 5,000 and **validated by executing a payload** — **69,987 of 181,238** generated payloads ran. Steffens et al. {[steffens2019_dont]} added **persistent** client-side XSS: the source is ''document.cookie'' or Web Storage, so a payload that stuck yesterday fires on a later visit. Of domains that used stored data in a sink, **21%** were vulnerable; of the **418** exploitable domains, a network attacker could use **293** and a web attacker **65**. Stock et al. {[stock2017web]} put an 8% client-side XSS rate on 2016 sites in a Wayback crawl. [[Programming:Crawler:Foxhound]] is that taint-and-confirm pipeline in a current browser; [[Programming:Crawler:PanoptiChrome]] is the same family (in-browser taint, configurable sources and sinks). Sabino et al. {[sabino2026_detection]} add interaction fuzzing **on top of** a taint pass, because a load-and-taint crawl misses flows that exist only after a click.
 Related client-side classes that this corpus **did** measure in the wild, and that a "we crawled for XSS" paper will miss if it only looks at ''innerHTML'':
@@ Line 315: / Line 315: @@
 | OWASP Top 10 letter for XSS | A7 in 2017; folded into A03 Injection in 2021 | **A05:2025 Injection** (XSS is CWE-79 inside it). Broken Access Control is **A01:2025**. Do not cite A7 as current. |
-Heuristic-rules is the modal classification method in the 99 (**33 of 99, 33.3%**), then manual-labelling (**28, 28.3%**), then dynamic-analysis (**19, 19.2%**). Those are methods on the conjunction, not on the 30, and a paper can name several.
+Among the **30 wild**, dynamic-analysis is the modal classification method (**14 of 30, 46.7%**), then heuristic-rules (**12, 40.0%**), then manual-labelling (**8, 26.7%**). A paper can name several. Among the **99** the order flips: heuristic-rules **33 of 99 (33.3%)**, manual-labelling **28 (28.3%)**, dynamic-analysis **19 (19.2%)** — that is a schema-conjunction summary, not how live-site papers classify.
 ===== What to report =====
@@ Line 337: / Line 337: @@
   * [[Programming:Interaction]] — why the landing page is a systematically atypical page.
   * [[Privacy:JavaScript]] — script behaviour without an exploitability claim.
-  * [[Security:Headers]] — CSP/HSTS as crawlable artefacts (still a red link until that item is written).
+  * [[Security:Headers]] — CSP, HSTS, XFO, SRI: 44 measured papers out of a 176-hit probe.
   * [[Security:Phishing]] — cloaking and feeds, not XSS on honest sites.