基于用户行为模拟的XSS漏洞检测

发布时间：2018-06-11 20:54

本文选题：XSS漏洞 + 检测　；参考：《大连理工大学学报》2017年03期

【摘要】：为改进XSS漏洞检测系统中对复杂网页漏洞注入点发现不够充分、动态地分析目标站点的响应信息不足等问题,改善XSS漏洞检测系统的注入点提取、攻击测试向量生成和响应分析等,提出了基于用户行为模拟的XSS漏洞检测方法.通过分析网页结构找到多种非格式化注入点,并通过综合考虑字符串长度、字符种类等因素对攻击向量进行了优化,以绕过服务器的过滤函数,缩短漏洞测试所用的时间.测试结果表明所提方法提高了漏洞注入点的检测覆盖率,提升了XSS漏洞的检测效果.
[Abstract]:In order to improve the detection of complex web page vulnerability injection points in XSS vulnerability detection system, and to dynamically analyze the lack of response information of the target site, and improve the XSS vulnerability detection system injection point extraction. An XSS vulnerability detection method based on user behavior simulation is proposed based on attack test vector generation and response analysis. By analyzing the structure of the web page, we find a variety of unformatted injection points, and optimize the attack vector by taking into account the length of the string and the type of characters, so as to bypass the filter function of the server and shorten the time used for vulnerability testing. The test results show that the proposed method improves the detection coverage of the vulnerability injection point and improves the detection effect of the XSS vulnerability.
【作者单位】：北京工业大学计算机学院;
【基金】：国家自然科学基金重大研究计划培育项目(91546111) 北京市自然科学基金资助项目(4173072)
【分类号】：TP393.092

【相似文献】