Automatic Detection of Page Flow Defect in Web Application

摘要

This paper introduces an automatic detecting method for page flow defect in Web application.It detects potential vulnerabilities in the pages firstly,and extracts state views and diversion information at the same time.Inter-page analysis constructs a flow diagram of views with the views and diversion information, which is the state transition graph of the Web application,then detects whether it exists available diversion between views,which isn't showed in the diagram.We give the illegal diversion a name of page flow defect. We also illuminate the effectiveness of this method by a simple Web application. The method not only detects vulnerabilities in the pages,but also considers state transition between pages and detects page flow defects by a modeling approach.