Vulnerability detection method and apparatus

A vulnerability detection and vulnerability technology, applied in the field of Web application testing, can solve problems such as undetectable XSS vulnerabilities

Inactive Publication Date: 2017-06-27
SECZONE TECH CO LTD +2
View PDF6 Cites 6 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, because the above vulnerability detection method only detects the source code of the request response, this part of the dynamically generated page elements cannot be detected because the JavaScript and CSS scripts in the page are not executed, that is, the XSS vulnerability of the dynamic page generation elements cannot be detected

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Vulnerability detection method and apparatus
  • Vulnerability detection method and apparatus
  • Vulnerability detection method and apparatus

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0040] Embodiments of the present invention will now be described with reference to the drawings, in which like reference numerals represent like elements.

[0041] Please refer to figure 1 , is a flowchart of the vulnerability detection method according to the first embodiment of the present invention. As shown in the figure, the method may include the following steps:

[0042] S101. Receive a response result from a web server to a processing request.

[0043] Specifically, the XSS detection tool (that is, the vulnerability detection device described below) first sends a processing request to the Web server, wherein the processing request is a request with characteristic values ​​constructed by the XSS detection tool. The web server receives the processing request, responds to it to obtain a response result, and further returns the response result to the XSS detection tool. Wherein, the response result includes page source code.

[0044] It should be noted that the charac...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses a vulnerability detection method and apparatus. The method comprises the steps of receiving a response result of a Web server to a processing request, wherein the processing request comprises an eigenvalue, and the response result comprises a page source code; analyzing the page source code according to a virtual analyzer to obtain an analysis result, wherein the analysis result comprises a html page; and performing eigenvalue detection on the html page to obtain an XSS vulnerability, wherein the XSS vulnerability corresponds to a dynamic page generation element. According to the method and the apparatus, a virtual analysis technology of a class browser is introduced for analyzing the page source code of a response to the Web server, thereby obtaining a finally generated HTML structure (namely, the html page); and further, the page is subjected to eigenvalue detection, so that the purpose of XSS vulnerability detection on the dynamic page generation element is achieved.

Description

technical field [0001] The invention relates to the technical field of Web application testing, in particular to a loophole detection method and a device thereof. Background technique [0002] In recent years, with the widespread use of Web applications, Web security issues have become increasingly prominent. Among them, XSS (Cross-site scripting, cross-site scripting attack) vulnerability has become one of the most common vulnerabilities in web applications, therefore, automatic detection of XSS vulnerabilities has also become an important technology. [0003] At present, XSS detection tools are generally used to detect XSS vulnerabilities. The specific process is as follows: (1) XSS detection tools capture http requests sent by clients (browsers); (2) XSS detection tools construct requests with characteristic values; (3) The XSS detection tool sends a request with a characteristic value to the Web server, and the Web server responds to the request; (4) The XSS detection t...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & AuthorityApplications(China)
IPC IPC(8): G06F21/57
CPCG06F21/577
Inventor万振华
OwnerSECZONE TECH CO LTD