Web frame injection vulnerability detection method and device

Abstract

The invention discloses a web frame injection vulnerability detection method and device. The method comprises the following steps that a client sends a first detection request comprising a random character string for triggering an exception response to a web application; when the first response content comprises the random character string for triggering the exception response, the client determines a potential framework injection loophole injection point of the web application and generates a to-be-closed label group, and sends a corresponding second detection request to the web application to obtain second response content after a detection code is generated for an input data processing characteristic detection rule group and the character string for triggering the exception response viathe web application and the detection code is injected into a potential framework injection loophole injection point; a framework code is generated, the framework code is injected into a potential framework injection loophole injection point, a corresponding third detection request is sent, and third response content is obtained; when that the injection framework code is executed is determined, that the web application has the framework injection vulnerability is determined; the problem that in the prior art, the web framework injection vulnerability cannot be efficiently and comprehensivelydetected is solved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and device for detecting web framework injection vulnerabilities. Background technique [0002] With the popularization of Internet technology, the scale of web applications is getting bigger and bigger, and the intrusion threats faced by web applications are also getting bigger and bigger. Once the web application is attacked, it will cause serious consequences. Common vulnerabilities in web applications include XSS injection, frame injection, and link injection, among which frame injection is one of the common vulnerabilities in the field of network security. If the vulnerabilities of web applications are exploited by hackers, hackers can steal user login credentials, steal user accounts, or even control the entire web application and obtain server permissions of the web application, causing irreparable losses and serious harm to web applications an...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present application provides a method and device for detecting web framework injection vulnerabilities, which are used to solve the problems in the prior art that the framework injection vulnerability detection scenarios of web applications are not fully covered, and there are missing and false positives.

Images