# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 5 Experiment and Result
### Security Attack Behaviour Analysis of Installed Web Compromise (XSS through HTTP Query String)  
**Vulnerability Model (VM)**: **(1) Threat**: An adversary convinces a victim to submit a malicious HTTP query string into a vulnerable web application, **Target**: software (web browser), **attack pattern:** XSS Through HTTP query strings, and **parallel attack:** DOM-based XSS. **Attack-Mechanism Model (AM)**: seven attack mechanisms were captured, namely, (1) XSS through HTTP query string; (2) use a browser or an automated tool; (3) attempt variations in input parameters; (4) exploit vulnerabilities; (5) steal session IDs, credentials, page contents; (6) content spoofing; and (7) forceful browsing. **Tasks**: 10 specific tasks have been captured, namely: (1) use spidering tool to follow and record all links, (2) use a proxy tool to record all links visited, (3) use a browser to manually explore and analyse the website, (4) use a list of XSS probe strings to inject in the parameter of known URLs; (5) use a proxy tool to record the results of the manual input of XSS probes in known URIs, (6) develop malicious JavaScript that is injected through vectors and send information to the attacker, (7) develop malicious JavaScript that is injected through vectors and take and cause the browser to execute it, (8) develop malicious JavaScript that is injected through vectors and perform actions on the same website, (9) develop malicious JavaScript that is injected through vectors, and (10) cause the browser to execute requests to other websites. **Behavioural Model (BM)**: A formal behavioural annotation for the sub-attack \"XSS through HTTP query String\" is (G1; (G2 # G3)) #. That is, first, use a browser or automated tool, then repeatedly attempt input parameter variations and exploit vulnerabilities. A formal behavioural annotation for the sub-attack G2 (**Use a browser or an automated tool**) is T1; (T2 # T3); that is, the sub-attack G2 (use a browser or automated tool) has a formal behavioural annotation. T1 (use spidering tool to record links) should be completed first, followed by T2 (use proxy toll to record links), and T3 (use browser to manually explore and analyse website). Formal behaviour annotation for G3 sub-attack (**attempt variations on input parameters**) is (T4 # T5), which involves interleaved fulfilment (T4: inject XSS probe strings into known URL parameters) and (T5: record manual XSS probe input results in known URLs) using a proxy tool. Formal behaviour annotation for G5 sub-attack (**stealsession IDs, credentials, page content) is (T6; T7), which involves developing malicious JavaScript that is injected through vectors and sending information to the attacker first, followed by taking and causing the browser to execute. Formal behaviour annotation for (**exploit vulnerabilities**) (G5; G6 # G7) suggests stealing session IDs, credentials, and page content first, followed by forced browsing and content spoofing. **Event Model (EM)**: This model captures the security events E1: links recorded, E2: website explored, E3: visited links recorded, E4: known URLs injected, E5: results of manual input of XSS probes recorded: E6: information sent, E7: attacker's command executed by the browser, E8: action performed on the same website, E9: request executed to other website, and E8: invalid information exposed to the user. The two remaining analyses for user compromise and misconfiguration (phishing) utilise the same steps as previously explained. The framework has effectively described one attack pattern for user compromise attacks, one attack pattern for parallel attacks, four sub-attack mechanisms, and three domain assumptions. In addition, a grand total of eight tasks and eight security events have been captured following the enhancement of sub attacks and a behavioural annotation was performed. Two attack patterns, one primary and one parallel, have been identified for the type of attack referred to as misuse of resources (relative path traversal).