Offline detection method and system for cross-site scripting vulnerability

Abstract

The invention discloses an offline detection method and system for a cross-site scripting vulnerability. The offline detection method includes that a control device acquires the IP of a function test server and a function test project virtualization website HOST; a resource isolating device carries out resource isolation on a target function test environment, packs standard resource isolating mirror images and deploys in a safety test environment; a transmitting device deployed in the target function test environment transmits network flow which conforms to the function test project to a scheduling device; the scheduling device carries out data encapsulation on the transmitted network flow and sends the encapsulated test data to a test device; the test device sends a safety test request to the safety test environment, analyzes the page returned from the safety test environment to find out the cross-site scripting safety vulnerability, and sends to the control device; the control device confirms the safety test project of the safety vulnerability according to the IP of the function test server and the function test project HOST. The offline detection method and system for the cross-site scripting vulnerability enable the coverage and automatic degree of the safety test to be improved.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a method and a system for detecting cross-site scripting vulnerabilities (XSS). Background technique [0002] At present, in the security testing of Web program projects, security testers not only need to conduct security tests on the program, but also have a full understanding of the logic of the program in order to cover the security test of the program as much as possible. The coverage rate of security testing is always lower than that of functional testing, resulting in the inability to test all possible program branches and online security vulnerabilities. [0003] The technical scheme of prior art one is as follows: [0004] Obtain the source code of the target page and extract the script code in it, traverse all the script codes, and use the predefined dirty data entry to obtain all the dirty data entries in the script code and the variables passed by the dirty ...

AI Technical Summary

Problems solved by technology

[0011] 1. The crawler may grab a large number of useless pages, and the pages cannot be customized; in this way, using multiple vulnerability verification scripts will generate a large amount of garbage data and delete normal content; this not only consumes a lot of time, but also reduces business logic coverage

[0012] 2. The crawling rate of crawlers cannot be controlled, and many Web 2.0 pages now require browser parsing or interaction to generate request operations. These URLs cannot be obtained by crawlers

[0013] 3. To sum up, the test coverage rate of crawlers cannot meet the security testing requirements under the current technology

Images