Method and system for preventing cross-site scripting attacks

Abstract

The invention discloses a method and system for preventing cross-site scripting attacks, relating to the field of website security. The method includes the following steps: establishing a keyword blacklist for JavaScript events and JavaScript script contents according to a specific architecture of a website to facilitate filtering review, using a filtering module to perform filtering review on contents of a page element tag in a capture stage of an event model for three stages of a standard browser event model, preventing the trigger of sensitive events, detecting the changes in a page DOM tree, monitoring each static script file loaded on the page, performing filtering review on the script files by using the filtering module, preventing the execution of suspicious scripts, and uploading all intercepted suspicious events and suspicious script information to a server. According to the scheme of the invention, the execution of the sensitive events and attack scripts can be effectively prevented in the case that a Web page has vulnerabilities or the attack scripts are injected into the Web page, the security of the system can be improved, and the cross-site scripting attacks can be effectively prevented.

Description

technical field [0001] The invention discloses a method and system for defending against attacks, and relates to the field of website security, in particular to a method and system for defending against cross-site scripting attacks. Background technique [0002] Among various website security vulnerabilities, cross-site scripting attack (Cross Site Script, that is, CSS attack) is a common network security problem. Specifically, a cross-site scripting attack means that an attacker embeds malicious executable scripts or HTML codes in a web page, and when a user visits the page, the embedded malicious scripts or codes will be executed. Attackers can harm users in a variety of ways, including obtaining user session information to pretend to be users to access authorized websites, stealing user information and accounts, reading, tampering, adding, and deleting companies, and stealing important and commercially valuable assets of companies. data, resulting in significant losses. ...

AI Technical Summary

Problems solved by technology

However, the existing defense technology is to filter on the server after the attack occurs to prevent the attack from causing harm to the server. This method increases the pressure and complexity of the server

In addition, vulnerability scanning is performed on web pages to detect potential vulnerabilities. Scanning can only be performed after the code is online. After a vulnerability is found, it will take a certain period of time to be repaired. There is a lag, and vulnerability scanning is a black-box mechanism that cannot find all problems.

Images