XSS vulnerability detection method based on simulating browser behavior

Abstract

The invention relates to an XSS vulnerability detection method based on simulating a browser behavior. A crawler module is contained with a core of a browser, JavaScript can be analyzed and Ajax can be loaded by simulating the browser behavior to obtain a hidden type decanting point of a page. Compared with a traditional condition, the system increases covering of the decanting point greatly. A vulnerability detection module uses a black-box detection method to detect whether an abnormal condition occurs on the page or not by simulating the browser behavior after the attack vector is improved, namely whether the browser executes a page script or not can be detected, whether a current decanting point has vulnerability or not is judged directly, and the method is more accurate compared with the traditional method. In addition, the method is exploited through the python language, the advantages of being easy to maintain and being easy to conduct secondary development are possessed, and a great application value is possessed to the detection and research of the XSS vulnerability.

Description

technical field [0001] The invention relates to an XSS loophole detection method based on simulated browser behavior, and belongs to the field of computer software cross-site scripting loopholes. Background technique [0002] In recent years, with the widespread use of Web applications, Web security issues have become increasingly prominent. Among the top ten web application security risks released by OWASP in 2013, cross-site scripting vulnerability XSS (Cross Site Scripting) ranked third, which shows that XSS vulnerability has become one of the common security risks that all kinds of websites need to face. [0003] XSS vulnerabilities arise when untrusted data from the user is processed by the application without validation and reflected back to the browser without encoding or escaping, causing the browser engine to execute code. Many websites ignore the necessary input validation during the development process and lack sufficient security. Such websites are easily attack...

AI Technical Summary

Problems solved by technology

However, the injection point is likely to be hidden in the dynamic content of the web page, and requires user actions, such as clicking a button, to make the browser parse JavaScript or load Ajax to generate

Because traditional crawlers cannot simulate browser behavior, it is difficult to parse JavaScript or load Ajax, thus ignoring hidden injection points

At the same time, when parsing the page, they also need to extract the entire form content, obtain the attributes of the form to analyze the way of submitting data to the server before submitting the attack vector, which is relatively complicated, and cannot dynamically analyze the response information of the target site in terms of vulnerability detection, so It may not be possible to determine whether an XSS vulnerability exists

Images