XSS (Cross Site Scripting) testing method and XSS testing system based on DOM (Document Object Model)

Abstract

The invention provides an XSS (Cross Site Scripting) testing method based on a DOM (Document Object Model). The XSS testing method comprises the following steps of obtaining source codes of a destination page, and extracting script codes in the source codes; traversing all the script codes, and obtaining all dirty data inlets and variables passed by the dirty data inlets from the script codes by utilizing a predefined dirty data inlet; traversing all the script codes again, obtaining output functions in the script codes, extracting parameters of the output functions for being matched with the dirty data inlets and the variables passed by the dirty data inlets, and determining that bugs exist if the parameters of the output functions can be matched with the dirty data inlets and the variables passed by the dirty data inlets; and recording information of the bugs. The invention also provides an XSS testing device based on the DOM for realizing the XSS testing method. According to the XSS testing method based on the DOM and the XSS testing device based on the DOM, which are provided by the invention, the problem that XSS based on the DOM cannot be accurately tested can be solved.

Description

technical field [0001] The present application relates to the technical field of computer network security testing, in particular to a DOM-based cross-site scripting vulnerability testing method and system. Background technique [0002] Cross Site Scripting (Cross Site Scripting, often abbreviated as XSS) is a vulnerability in the web application when it outputs data to the web page, which allows the attacker to display the constructed malicious data on the page. The malicious code injected by the cross-site scripting attack runs in the browser, which can control the user's browser, obtain the user's computer information, intercept the user's keyboard input, spy on the user's local area network information, and even attack other websites. Among them, DOM (Document Object Model, Document Object Model) is a page output by JavaScript, and cross-site scripting vulnerabilities based on DOM are vulnerabilities that appear in JavaScript codes. [0003] Black-box testing is often u...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved in this application is to provide a DOM-based cross-site scripting vulnerability testing method and system, which can solve the problem that the DOM-based cross-site scripting vulnerability cannot be accurately tested

Images