跨站脚本漏洞渗透测试技术

Cross-site script vulnerability penetration testing technology

为提升跨站脚本(XSS)漏洞检测方法的检测效果,本文提出了基于隐马尔科夫模型(HMM)的攻击向量动态生成和优化方法。采用决策树模型和代码混淆策略对攻击向量进行分类和变形,获得测试用攻击向量。使用注入点去重处理和探子技术去除一部分不存在XSS漏洞的Web页面,避免重复检测不同Web页面中相同的漏洞注入点,减少测试阶段与Web服务器的交互次数;进一步采用XPath路径定位技术提高漏洞检测结果分析的效率。对比实验结果表明,本文提出的方法降低了响应时间和漏报率,提高了检测效率。

To improve the detection results of cross site scripting(XSS)vulnerability,a dynamic attack vector generation and optimization scheme was proposed based on hidden Markov model.The mutated attack vector was generated by using decision tree model to classify the attack vectors and the code confusion strategy to deform the attack vector.To reduce the interactions between the test phase and the web server,an injection point de duplication and probe algorithm are designed to remove web pages that do not include XSS vulnerabilities and to avoid detecting the same injection point in different web pages.XPath path location technology was adopted to improve the analysis efficiency for vulnerability detection results.Experimental results show that the proposed method can reduce the response time and the miss report,and improve the detection efficiency.