WebMTD: Defeating Cross-Site Scripting Attacks Using Moving Target Defense

Code 12

User’s instance.

<script type="text/javascript">

var runtimeId = "59b6d485c9f5b";

[codes for MutationObserver and

beforescriptexecute]

...

</script>

...

<script runtimeId="59b6d485c9f5b" type="text/

javascript">

[Some legitimate code]

</script>

...

<script runtimeId="59b6d298f36ae" type="text/

javascript" >

[Some malicious code]

</script>