«上一篇/Previous Article|本期目录/Table of Contents|下一篇/Next Article»

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:

期数:

2013年03期

页码:

147-151

栏目:

安全与防范

出版日期:

1900-01-01

文章信息/Info

Title:

Research on Cross-site Scripting Vulnerability Detection Method Based on Penetration Testing

文章编号:

1673-629X（2013）03-0147-05

作者:

王强; 蔡皖东; 姚烨

西北工业大学 计算机学院

Author(s):

WANG Qiang; CAI Wan-dong; YAO Ye

关键词:

跨站脚本漏洞; 渗透测试; Web安全; cookie

Keywords:

XSS vulnerability; penetration testing; Web security; cookie

文献标志码:

A

摘要:

目前,跨站脚本漏洞已经成为互联网上最为严重的安全漏洞之一,文中针对跨站脚本漏洞的自动化检测问题,提出了一种基于渗透测试的检测方法.在向Web服务器提交攻击向量之前,对检测点使用合法输入进行探测,通过与Web服务器的一次交互可以排除一部分不包含跨站脚本漏洞的检测点,从而大量减少在分析检测点阶段与Web服务器交互的次数.另外,通过对获取的检测点进行去重,可有效防止对不同页面中相同检测点的重复检测.实验结果表明,该方法可有效提高跨站脚本漏洞的检测效率

Abstract:

Cross-site scripting vulnerability has become one of the most serious vulnerabilities in the Internet. In order to auto-detect XSS vulnerabilities,propose a XSS detection method based on penetration testing. Submit simple string that will not filtered by Web server be-fore submit attack vectors,interact with Web server once and then exclude part of the detection points that will not contain cross-site scripting vulnerabilities. When detect the detection points,the times of interaction with Web server will be reduced by this method. Delete the repeated detection points,prevent detecting the same detection points extracted from the Web pages. The experiment result shows that this method can detect XSS vulnerabilities effectively

常用功能

更新日期/Last Update: 1900-01-01