Automatic Detection of Second-Order XSS Vulnerabilities

Cross-Site Scripting (XSS) is a widespread security issue in many modern Web applications. One way to detect these vulnerabilities is to use fully automated tools such as Web Vulnerability Scanners. But recent research shows that the detection rate of certain types of XSS vulnerabilities is rather disappointing. In particular, scanners face problems in detecting stored XSS properly. This diploma thesis investigates the reasons why Web Vulnerability Scanners fail to detect these types of XSS and