一种防止Web应用程序非授权参数攻击的方法研究

On the Method of Unauthorized Parameter to Prevent the Attack of Web Application Program

Web应用程序面临的严重攻击之一是对逻辑分组中的非授权参数攻击,漏洞自动扫描程序不能识别这些攻击,多数情况下需要人为干预。为解决这个问题,提出了一种优化、集中、高效的解决方法,该方法的基本思想是防止用户以不常用的方式修改参数,从而提升客户端与服务器之间交互的安全性。实验结果表明,该方法能在大多数情况下更加灵活、可靠、高效地阻止参数攻击。此外,该方法不仅能用于基于Web的应用程序,而且还可以应用到预备应用程序中。

One of the serious attacks faced by the web application program is grouping parameters processing in logic attack; it can't be recognized while the vulnerability is scanning automatically. In most cases,it needs human intervention. The paper puts forward an optimized,concentrated and efficient parameters processing method to prevent the interchange between the client-side and server based on the users' access level. The practice aims at modifying some important parameter values by the ways that the users do not usually adopt. The result of the experiment shows that this method can make the application program be more flexible,reliable and efficient to prevent parameters attacking in most cases. In addition,this method can be used both in web application program and preparatory application program.