Cross-site scripting attack vulnerability detection method and device based on document object model

Abstract

The invention discloses a cross-site scripting attack vulnerability detection method, device and terminal based on a document object model. The method includes: obtaining a set of parameter value pairs in the original URL of the webpage to be detected, the set of parameter value pairs including at least one parameter value pair; for each parameter value pair in the set of parameter value pairs, using a feature script to replace the parameter value Form the test URL of the webpage to be detected; the characteristic script is malicious code that contains malicious characters and can be uniquely identified in the document object model tree of the webpage to be detected; obtain the page content of the test website; convert the page content into a document object model tree; According to the document object model tree and the characteristic script, detect whether there is a cross-site scripting attack vulnerability in the current parameter value pair. By adopting the above scheme, the present invention can effectively find DOM XSS loopholes only by looking for inserted feature scripts in the converted DOM tree without triggering execution of the feature scripts, which greatly improves loophole discovery capabilities and detection efficiency.

Description

technical field [0001] The present invention relates to the field of network technology, in particular to a method, device and terminal for detecting a cross-site scripting attack (Cross Site Script, XSS) vulnerability based on a Document Object Model (Document ObjectModel, DOM). Background technique [0002] XSS vulnerability is the most common vulnerability on the Internet today, and it can be triggered in various browsers such as IE, Chrome, and FireFox, causing great harm. [0003] Usually, XSS is that malicious attackers add malicious codes to webpages and induce users to visit. When visitors browse the webpages, malicious codes will be executed on the user's machine, resulting in malicious attackers stealing user information, or Carry out a hanging horse attack on the machine and remotely gain control of the user's machine. Ordinary reflective XSS has obvious echo characteristics in the source code of the returned page, which is relatively easy to detect. DOM XSS is ...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the present invention, the inventor has found that the prior art has at least the following problems: the existing DOM XSS vulnerability detection scheme needs to trigger the execution of the inserted characteristic JS script to find the XSS vulnerability, and only when the inserted characteristic JS script It is possible to trigger the execution of characteristic JS scripts only when they fully match the context syntax of dynamic web content, which results in the need to try enough types of characteristic JS scripts, and it takes a lot of time to try to execute JS scripts each time, which greatly reduces the vulnerability Discovery capability and detection efficiency

Images