基于Selenium的安全自动测试技术的研究与实现

发布时间：2018-01-17 00:22

本文关键词：基于Selenium的安全自动测试技术的研究与实现　出处：《广东工业大学》2015年硕士论文　论文类型：学位论文

【摘要】：伴随着科学技术高速发展,互联网也迎来了一个最美好的时代。人们利用互联网从原来的单纯浏览信息到现在办理各项其他事情,越来越多的事务从线下转移到线上,无论是买车票、缴纳水电费或是购置其他商品,都可以在网上进行,互联网已经成为民众生活不可或缺的一部分,Web应用因此得到了一个爆发性的增长。然而Web应用之中存在的漏洞越来越多样化,使得安全测试工作难以支撑Web应用的发展。传统的安全测试是采用手工模拟攻击者的手段对Web安全进行渗透测试,而手工测试缺缺乏效率,而且人为产生的错误因素也经常会影响测试结果,不能确保测试结果的准确性。目前商用的自动化测试工具价格不菲,对于广大中小企业来说使用商用的自动化测试工具并不具有可操作性。本文分析与研究了基于Selenium的安全自动测试技术,Selenium是一个开源的工具,采用Selenium进行开发可以有效地降低测试成本。本文利用Selenium对当前主流的漏洞设计并实现了漏洞扫描功能,并发挥了Selenium的可拓展性的特点,从而设计出一款可用性高,具有良好性能的安全测试工具。它能够对Web应用进行自动化的安全测试,不仅可以在Web应用上线前进行安全测试,还能够在上线后进行测试,从而可以提前做好相应对策,减少损失。本文主要工作如下：1.分析当前Web应用的安全态势,对国内国外自动化测试的研究现状做了介绍,详细分析了当前Web应用所受到的安全威胁,并举出数据说明危害,说明开发一款能够进行自动化进行安全测试的系统的重要性。2.对Web应用当前存在的不同类型漏洞的特性进行分析,重点分析了SQL注入漏洞和XSS跨站漏洞的产生原因、检测方式以及防御方法等,并介绍了一些现阶段比较流行的自动化测试工具,包括本文使用的Selenium自动化测试工具。3.针对获取Web应用存在的漏洞信息,对HTTP协议、URL获取、网页内容获取、网页中表单的提取等等进行了相关研究,设计了能够对目标网站进行爬取并过滤构建URL的网络爬虫模块。4.在获取了网页信息之后,利用selenium测试目标的交互、可拓展性的特点,设计了SQL注入漏洞和XSS跨站漏洞的漏洞扫描模块,通过自动化的测试能够生成详细的测试报告。最后,通过搭建实验环境,对系统进行了功能测试和性能测试,验证了系统的可用性和可靠性。
[Abstract]:With the rapid development of science and technology, the Internet has also ushered in the most beautiful era. More and more business from offline to online, whether it is to buy tickets, pay utilities or other goods, can be carried out online, the Internet has become an indispensable part of people's lives. Web applications have thus achieved an explosive growth. However, the vulnerabilities in Web applications are becoming more and more diverse. It is difficult for security testing to support the development of Web application. The traditional security test uses manual simulation of attackers to conduct penetration testing of Web security, but manual testing is inefficient. And man-made error factors often affect the test results, can not ensure the accuracy of test results. At present, commercial automated testing tools are expensive. For the majority of small and medium-sized enterprises, the use of commercial automated testing tools is not operable. This paper analyzes and studies the security automatic testing technology based on Selenium. Selenium is an open source tool. Using Selenium to develop can effectively reduce the cost of testing. This paper uses Selenium to design and realize the vulnerability scanning function of the current mainstream vulnerabilities. The extensibility of Selenium is brought into play, and a security testing tool with high availability and good performance is designed. It can automate the security test of Web application. It can not only test the security before the Web application goes on line, but also test after going online, so that the corresponding countermeasures can be made in advance. The main work of this paper is as follows: 1. Analyze the security situation of current Web application and introduce the research status of automation test at home and abroad. The security threats to the current Web application are analyzed in detail, and the data are given to illustrate the harm. Explain the importance of developing a system that can automate security testing. 2. Analyze the characteristics of different types of vulnerabilities in Web applications. This paper mainly analyzes the cause of SQL injection vulnerability and XSS cross-site vulnerability, and introduces some popular automated testing tools at the present stage. Including the Selenium automated testing tool used in this paper. 3. In order to obtain the vulnerability information of the Web application, the HTTP protocol and the content of the web page are obtained. The extraction of forms from web pages and other related research, designed to crawl the target website and filter the construction of URL web crawler module. 4. After obtaining the page information. Taking advantage of the interaction and expansibility of selenium test target, the vulnerability scanning module of SQL injection vulnerability and XSS cross-site vulnerability is designed. In the end, the function test and performance test of the system are carried out to verify the availability and reliability of the system.
【学位授予单位】：广东工业大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP393.08

【相似文献】