基于EBNF和二次爬取策略的XSS漏洞检测技术

XSS vulnerability detection technology based on EBNF and twice crawling strategy

跨站脚本(XSS)攻击是目前互联网安全的最大威胁之一。针对传统基于渗透测试技术的漏洞检测方法中攻击向量复杂度低易被过滤、整体检测流程繁琐等问题,提出了一种基于扩展的巴科斯范式(EBNF)的攻击向量自动生成方法和XSS漏洞二次爬取策略。通过定义EBNF规则生成规则解析树,按层次遍历获得高复杂度攻击向量。在首次爬取页面时,将输入点信息嵌入到攻击向量后请求注入,之后进行二次爬取,请求合法参数获得返回页面。最后设计实现了原型系统,并使用两个平台进行漏洞检测。通过对比实验证明,该系统检测流程简单,在一定程度上提高了漏洞检测数,降低了漏洞误报率。

Cross-site scripting (XSS) attacks have been one of the biggest threats to Internet security. Aiming at the problems of traditional vulnerability detection method based on penetration testing technology, such as attack vectors of low complexity easy to filter and overall detection process cumbersome, this paper proposed a new attack vectors automatic generation method which based on extended Backus-naur form (EBNF) and a XSS vulnerability twice crawling strategy. By defining the EBNF rule, the method generated a rule-parsing tree, and then it traversed hierarchically the tree to obtain high-complexity attack vectors. In the first page crawling, the strategy inserted input point information to attack vectors and requested injection. Then it carried on the second crawling and requested legal parameters to get the return page. In the final, this paper designed and implemented a prototype system, and used two platforms for vulnerability detection. The comparative experiments prove that the system has a simple detection process, and to a certain extent, it improves the number of vulnerability detection and reduces the false positive rate.