ANALYZING A FRAMEWORK FOR CROSS-SITE SCRIPTING ON DIFFERENT WEB SERVERS

This study investigates the susceptibility of three prominent web servers—Apache, Nginx and IIS—to Cross-Site Scripting (XSS) attacks, addressing a gap in research that typically focuses on application-layer defences. The purpose is to compare how each server handles reflected, stored and DOM-based XSS attacks under default and hardened configurations. The methodology involves a controlled experimental design using the Damn Vulnerable Web Application (DVWA) and custom test platforms in virtualized environments (Ubuntu 20.04 LTS for Apache and Nginx, Windows Server 2019 for IIS), with tools like OWASP ZAP and Burp Suite to simulate 900 test cases. Results show that default configurations are highly vulnerable, with success rates averaging 87%, but hardened configurations, incorporating modules like mod_security and NAXSI, reduce this to 13%, achieving an 85% mitigation rate and 85% detection rate. Specifically, Apache’s hardened configuration reduced success rates to 10-16%, Nginx to 14-20% IIS to 8-12%, with IIS showing the lowest vulnerability post-hardening. The study concludes that server-level defenses are critical, recommending the activation of Web Application Firewalls, Content Security Policy implementation, regular updates and ongoing testing. Future research should expand to other servers, advanced payloads and real-world conditions to enhance web security comprehensively.