跨站脚本漏洞渗透测试技术

发布时间：2018-03-13 12:04

本文选题：跨站脚本漏洞　切入点：渗透测试　出处：《哈尔滨工程大学学报》2017年11期 　论文类型：期刊论文

【摘要】：为提升跨站脚本(XSS)漏洞检测方法的检测效果,本文提出了基于隐马尔科夫模型(HMM)的攻击向量动态生成和优化方法。采用决策树模型和代码混淆策略对攻击向量进行分类和变形,获得测试用攻击向量。使用注入点去重处理和探子技术去除一部分不存在XSS漏洞的Web页面,避免重复检测不同Web页面中相同的漏洞注入点,减少测试阶段与Web服务器的交互次数;进一步采用XPath路径定位技术提高漏洞检测结果分析的效率。对比实验结果表明,本文提出的方法降低了响应时间和漏报率,提高了检测效率。
[Abstract]:In order to improve the detection effect of XSS-based vulnerability detection method, an attack vector dynamic generation and optimization method based on Hidden Markov Model (hmm) is proposed in this paper. Decision tree model and code confusion strategy are used to classify and deform the attack vector. Get the test attack vector. Remove a portion of the Web page that does not have a XSS vulnerability by using injection point rescheduling and snooping techniques to avoid repeated detection of the same vulnerability injection point in different Web pages. Reduce the number of interaction between the test phase and the Web server, and further improve the efficiency of vulnerability detection results analysis by using the XPath path location technology. The comparison experiment results show that the method proposed in this paper reduces the response time and the missing report rate. The detection efficiency is improved.
【作者单位】：北京工业大学计算机学院;
【基金】：国家自然科学基金重大研究计划培育项目(91546111) 北京市自然科学基金项目(4173072) 信息网络安全公安部重点实验室开放课题项目
【分类号】：TP393.08

【相似文献】