基于渗透测试的跨站脚本漏洞检测方法研究

摘要

目前，跨站脚本漏洞已经成为互联网上最为严重的安全漏洞之一，文中针对跨站脚本漏洞的自动化检测问题，提出了一种基于渗透测试的检测方法。在向Web服务器提交攻击向量之前，对检测点使用合法输入进行探测，通过与Web服务器的一次交互可以排除一部分不包含跨站脚本漏洞的检测点，从而大量减少在分析检测点阶段与Web服务器交互的次数。另外，通过对获取的检测点进行去重，可有效防止对不同页面中相同检测点的重复检测。实验结果表明，该方法可有效提高跨站脚本漏洞的检测效率。%Cross-site scripting vulnerability has become one of the most serious vulnerabilities in the Internet. In order to auto-detect XSS vulnerabilities,propose a XSS detection method based on penetration testing. Submit simple string that will not filtered by Web server be-fore submit attack vectors,interact with Web server once and then exclude part of the detection points that will not contain cross-site scripting vulnerabilities. When detect the detection points,the times of interaction with Web server will be reduced by this method. Delete the repeated detection points,prevent detecting the same detection points extracted from the Web pages. The experiment result shows that this method can detect XSS vulnerabilities effectively.