# Strategies and Challenges in Detecting XSS Vulnerabilities Using an Innovative Cookie Collector
## 2 Cookies and the Rising Threat of XSS Vulnerabilities: A Literature Review
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref** & **Results** & **Methods Used** & **Limitations** \\ \hline \multirow{4}{*}{[31]} & Agreeing to cookie banners raises security-sensitive data flows by 63\% and makes 55\% more websites vulnerable to XSS exploits. & The paper proposes an automated way to increase cookie banner consent and examines its security impact through large crawls. & The study does not consider the prevalence of vulnerabilities on the Web. Few studies state the vantage point of their measurements. \\ \hline \multirow{4}{*}{[32]} & Encrypting cookie values at a cryptographic local proxy can protect them from XSS attacks. & Encryption the session-ID cookie attribute value at the cryptographic local proxy before sending it to the browser. & Cookies store user info but have size limits and need secure transport. XSS prevention techniques have limits. \\ \hline \multirow{4}{*}{[33]} & Learning about identifying and protecting against cookie vulnerabilities in XSS attacks using effective methods and tools. & Secure cookies from XSS attacks with efficient methods. & Not defined. \\ \hline \multirow{4}{*}{[34]} & Learning about XSS exploitation using CORS and discovering the shortcomings of automated security scanners. & Mitigation techniques for cross-site scripting (XSS). Automated security scans and manual security assessments for vulnerability detection. & \multirow{4}{*}{Relying too much on automated security scans has serious disadvantages and limitations.} \\ \hline \multirow{4}{*}{[35]} & Web applications are still vulnerable to XSS attacks, and current approaches are inadequate in preventing more dangerous payloads. & Injection, detection, and prevention of stored-based XSS, reflected XSS, and DOM-based XSS. Use of security measures to block third-party intrusion. & Not defined. \\ \hline \multirow{4}{*}{[20]} & Google and Bank of America have cookie vulnerabilities that can lead to privacy violations, online victimization, financial loss, and account hijacking. & In-depth empirical assessment of cookie injection attacks. Discussion of mitigation strategies and presentation of a proof-of-concept browser extension. & Web browsers are vulnerable to cookie-related issues, and e-commerce sites with mixed content can be attacked. \\ \hline \multirow{4}{*}{[36]} & Use a sandbox environment to prevent XSS vulnerabilities on localhost servers and social networking sites. & This proposal addresses the exploitation of XSS vulnerabilities in XAMPP servers, social networking sites, and blogs. & Existing techniques cannot completely eliminate XSS vulnerabilities. Weak input validation and lack of awareness of latest web technologies. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Overview of approaches and findings on cookie vulnerabilities to XSS. Cookies used in web applications have limitations when it comes to protecting against cross-site scripting (XSS) attacks. These limitations include vulnerabilities such as user information exposure, lack of randomness, insecure transport, and size restrictions. Several techniques have been proposed to detect and prevent XSS attacks, but these have limitations, as seen in Figure 1.  
For example, encrypting the cookie value using a cryptographic proxy before sending it to the browser has been proposed, making it useless to attackers even if it is stolen [32]. Another proposal has used one-time passwords and challenge-response authentication to identify the valid owner of the cookie and prevent its abuse [37]. On the other hand, a technique called \"Dynamic Cookies Rewriting\" has been proposed to render cookies useless for XSS attacks by automatically rewriting them on a web proxy [38]. Despite these techniques, XSS vulnerabilities and cookie theft remain major security problems for web applications [42].