Method and apparatus for detecting loophole of WebSocket cross-site request forgery

Abstract

The embodiments of the invention relate to the field of telecommunication, and in particular to a method and apparatus for detecting a loophole of a WebSocket cross-site request forgery, aiming at detecting whether a to-be-tested server has the loophole of WebSocket cross-site request forgery. According to the embodiments of the invention, the method comprises the following steps: when it is determined that a handshake connection request is based on the WebSocket protocol, based on the handshake connection request, generating at least one forgery request based on the WebSocket protocol, transmitting the at least one forgery request to a to-be-tested server, determining whether the to-be-tested server may be deceived by the forgery request based on the WebSocket protocol so as to verify whether the to-be-tested server has the loophole of WebSocket cross-site request forgery and the risk level of the loophole.

Description

technical field [0001] The embodiment of the present invention relates to the communication field, and in particular to a method and device for detecting WebSocket cross-site request forgery vulnerabilities. Background technique [0002] In order to realize instant messaging, many websites use polling (called polling in English). Polling is to send an HTTP request (HTTPrequest in English) by the browser to the server to be tested at a specific time interval (such as every 1 second), and then the server to be tested returns the latest data to the browser. This traditional HTTP request mode brings obvious disadvantages: the browser needs to continuously send requests to the server to be tested, but the header field of the HTTP request (called header in English) is very long, and the useful data contained in the HTTP request may be Just a small value, so it will take up a lot of bandwidth. [0003] Based on the above content, a new web socket protocol (called WebSocket protoc...

AI Technical Summary

Problems solved by technology

This traditional HTTP request mode brings obvious disadvantages: the browser needs to continuously send requests to the server to be tested, but the header field of the HTTP request (called header in English) is very long, and the useful data contained in the HTTP request may be Just a small value, so it will take up a lot of bandwidth

[0004] Specifically, the browser and the server to be tested first perform a handshake connection using the HTTP protocol. After the HTTP handshake connection has been successful, the browser sends a handshake connection request based on the WebSocket protocol to the server to be tested. How should the test server authenticate the user's identity during the handshake phase? That is to say, in the prior art, the handshake connection request of the WebSocket protocol is not verified. In this way, hackers may forge the handshake request based on the WebSocket protocol to establish a WebSocket with the server to be tested. Link

[0005] Cross-site request forgery (Cross-site request forgery, referred to as CSRF), as a network attack method, can send a forged access request to the server under attack in the name of the victim, which may cause the leakage of the victim's personal information, thereby making the The security of the server under test is compromised

Images