A cross-site scripting vulnerability detection method, device and equipment

Abstract

The application provides a cross-site scripting vulnerability detection method, comprising: obtaining injection point information of a target website; determining an access path of a candidate page based on the injection point information; constructing an initial test case and sending the initial test case to the candidate page based on the access path to obtain corresponding first response data; analyzing the first response data to obtain first state features corresponding to vulnerability trigger points, the first state features being used to describe environmental information where the vulnerability trigger points are located, the environmental information including context information of the vulnerability trigger points; processing the first state features by using a target model to obtain a first test case; sending the first test case to the candidate page based on the access path to obtain corresponding second response data; analyzing the second response data to determine whether a cross-site scripting vulnerability is triggered, and if so, positioning the cross-site scripting vulnerability based on the second response data. The method can improve the detection capability and detection efficiency for unknown cross-site scripting vulnerabilities.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer security, and particularly relates to a cross-site scripting vulnerability detection method, device and equipment. BACKGROUND

[0002] Internet has become an important part of modern society. However, with the popularity of the Internet, network security problems have become increasingly prominent. And because of its convenience, web application has become an important carrier of network activities, and web application security has become a crucial part of network space security.

[0003] Cross-site scripting (XSS) vulnerability is a typical representative of web application vulnerabilities. Cross-site scripting vulnerabilities account for the largest proportion in the existing vulnerability type distribution. As can be seen, cross-site scripting vulnerabilities still exist widely in current web applications. At the same time, attackers can execute malicious scripts on the user's browser by exploiting this vulnerability, and then steal the user's session credentials, or even completely control the victim's interaction with the web application. Detecting and repairing cross-site scripting vulnerabilities in web applications is the most effective means to protect web applications from cross-site scripting vulnerabilities. Given the widespread existence of cross-site scripting vulnerabilities, relying solely on manual analysis cannot meet the detection needs, so automatic detection of cross-site scripting vulnerabilities has always been the focus of researchers.

[0004] There are mainly three successful exploitation conditions for cross-site scripting vulnerabilities: ① There is a cross-site scripting vulnerability injection point; ② The malicious code that triggers the cross-site scripting vulnerability can be injected; ③ The victim accesses the page injected with malicious code, resulting in successful execution of the malicious code.

[0005] In existing solutions, there are two categories of cross-site scripting vulnerability detection schemes, one is a cross-site scripting vulnerability detection scheme based on static analysis, and the other is a cross-site scripting vulnerability detection scheme based on dynamic analysis. The two schemes specifically involve static analysis, gray box fuzzing and black box fuzzing. However, research has found that the three methods have the following problems:

[0006] The first type of cross-site scripting vulnerability detection scheme based on static analysis has high vulnerability coverage in theory, and can even detect all cross-site scripting vulnerabilities in theory. However, it still has the following two problems: the first problem is that this scheme can only provide possible vulnerability points, and has a high false positive rate, for example, it is believed that 10 places may have vulnerabilities, but in fact only 1 place has vulnerabilities, or there are no vulnerabilities at all; The second problem is that the analysis of this scheme is based on the source code of the web application, so it is affected by the language type and version of the developed web application, and needs to be adjusted for different languages and different versions.

[0007] The second type of scheme for detecting cross-site scripting vulnerabilities by using a gray-box fuzzing method uses information in the source code to guide the variation of web requests. The variation strategy adopted by the current scheme is random, and it is not targeted at specific cross-site scripting vulnerabilities. Therefore, a large number of invalid test cases can be generated for one vulnerability injection point, thereby reducing the efficiency of vulnerability detection.

[0008] The third type of scheme for detecting cross-site scripting vulnerabilities by using a black-box fuzzing method regards the entire web application as a black box and does not analyze the source code of the web application. The scheme extracts injection points related to cross-site scripting vulnerabilities by using a web crawler, and then iterates through test cases in a test case database to verify whether the injection points have cross-site scripting vulnerabilities. The detection effect depends on the completeness of the test case database, and for each injection point, the test case database needs to be iterated through until a vulnerability is successfully triggered or the entire test case database is iterated through. Therefore, the test cases of the scheme are also not targeted at specific cross-site scripting vulnerabilities, and the iteration of the test case database greatly reduces the efficiency of vulnerability detection. SUMMARY

[0009] The technical problem to be solved by the present application is to provide a cross-site scripting vulnerability detection method, device and equipment that can improve the detection capability for unknown cross-site scripting vulnerabilities and improve the detection efficiency for cross-site scripting vulnerabilities.

[0010] The content of the present application includes a cross-site scripting vulnerability detection method, comprising:

[0011] Obtaining injection point information of a target website, wherein the injection point information at least includes a request address of a candidate page having a cross-site scripting vulnerability, a request mode, and a request parameter corresponding to the injection point;

[0012] Determining an access path of the candidate page based on the injection point information;

[0013] Constructing an initial test case and sending the initial test case to the candidate page based on the access path to obtain corresponding first response data;

[0014] Analyzing the first response data to obtain first state features of a vulnerability trigger point, wherein the first state features are used to describe environmental information of the vulnerability trigger point, and the environmental information includes context information of the vulnerability trigger point;

[0015] Processing the first state features by using a target model to obtain a first test case;

[0016] Sending the first test case to the candidate page based on the access path to obtain corresponding second response data;

[0017] analyzing the second response data to determine whether the cross-site scripting vulnerability is triggered, and if so, locating the cross-site scripting vulnerability based on the second response data.

[0018] In some embodiments, the method further comprises:

[0019] If the cross-site scripting vulnerability is not triggered, analyzing the second response data to obtain a second state feature corresponding to the vulnerability trigger point;

[0020] processing the second state feature using the target model to obtain a second test case;

[0021] sending the second test case to the candidate page based on the access path to obtain corresponding third response data;

[0022] analyzing the third response data to determine whether the cross-site scripting vulnerability is triggered, and if so, locating the cross-site scripting vulnerability based on the third response data.

[0023] In some embodiments, the obtaining of the injection point information of the target website comprises:

[0024] scanning the target website using a black box scanner to obtain the injection point information;

[0025] wherein the injection point information is different for different types of cross-site scripting vulnerabilities, when the cross-site scripting vulnerability is a reflective cross-site scripting vulnerability, the injection point information includes the request address of the candidate page, the request method, and the request parameter corresponding to the injection point, when the cross-site scripting vulnerability is a stored cross-site scripting vulnerability, the injection point information includes the request address of the candidate page, the request method, the request parameter corresponding to the injection point, and the candidate request address that triggers the stored cross-site scripting vulnerability.

[0026] In some embodiments, the constructing of the initial test case and the sending of the initial test case to the candidate page based on the access path to obtain the corresponding first response data comprises:

[0027] constructing a random string as an initial test case, the test case being used for locating the vulnerability trigger point of the cross-site scripting vulnerability in the candidate page;

[0028] sending the initial test case to the candidate page based on the access path to obtain the corresponding response page;

[0029] wherein when the type of the cross-site scripting vulnerability is reflective, the response page fed back by the target website is directly obtained;

[0030] When the type of the cross-site scripting vulnerability is a storage type, access is performed based on a candidate request address that triggers the storage type cross-site scripting vulnerability in the corresponding injection point information to obtain the response page.

[0031] In some embodiments, analyzing the first response data to obtain a first state feature corresponding to a vulnerability trigger point includes:

[0032] Analyzing the first response data to determine an output context, test repetition, and a test result of the initial test case in the page, wherein the output context represents an environment in which the corresponding test case is output; the test repetition includes repetition of test actions and reuse of test cases; the test actions correspond to elements in the test case; and the test result represents whether a cross-site scripting vulnerability is successfully triggered;

[0033] Determining test case characteristics of the initial test case based on the first response data and the initial test case analysis, the test case characteristics including elements retained and elements filtered out of the test case in the current response data;

[0034] Determine characteristic information of the vulnerability trigger point based on the output context, test case characteristics, and test results;

[0035] A first state feature corresponding to the vulnerability trigger point is determined based on the feature information.

[0036] In some embodiments, the target model is a reinforcement learning model having a reward function and an action space, wherein the action space includes a plurality of different rules for generating new test cases, and the target model is used to generate test cases that are more targeted at trigger points of cross-site scripting vulnerabilities through state features and corresponding rewards;

[0037] The method further comprises:

[0038] Determining a reward value for the initial test case based on the first state feature, wherein the reward value is used to evaluate the effectiveness of an action of the initial test case under the state represented by the first state feature;

[0039] The first state feature is processed by using the target model to obtain a first test case:

[0040] The first state feature and the reward value are input into the target model, so that the target model processes the first state feature and the reward value to obtain the first test case.

[0041] In some embodiments, the action space includes a generation rule of a basic test case and a variation rule of the test case, the generation rule of the basic test case is used for detecting false positives of a judgment condition whether a current test case successfully triggers a vulnerability, and the variation rule of the test case is used for enabling the test case to bypass a cleaning function of a website and enabling a part of content of the test case to be in a context environment capable of being successfully executed.

[0042] In some embodiments, the inputting the first state feature and the reward value into the target model, so that the target model processes the first state feature and the reward value, to obtain the first test case, includes:

[0043] The first state feature and the reward value are input into the target model, so that the target model determines a target action through analysis of the first state feature and the reward value, and executes the target action, and then obtains the first test case based on an execution result.

[0044] Another embodiment of the present application simultaneously provides a cross-site scripting vulnerability detection device, which comprises:

[0045] An obtaining module is configured to obtain injection point information of a target website, wherein the injection point information at least includes a request address, a request mode and a request parameter corresponding to an injection point of a candidate page where a cross-site scripting vulnerability exists;

[0046] A first determining module is configured to determine an access path of the candidate page according to the injection point information;

[0047] A constructing module is configured to construct an initial test case, and send the initial test case to the candidate page based on the access path, to obtain corresponding first response data;

[0048] A first analyzing module is configured to analyze the response data, to obtain state features of a corresponding vulnerability trigger point, wherein the state features are used to describe environment information where the vulnerability trigger point is located, and the environment information includes context information of the vulnerability trigger point;

[0049] A first processing module is configured to process the state features by using a target model, to obtain a first test case;

[0050] A first sending module is configured to send the first test case to the candidate page according to the access path, to obtain corresponding second response data;

[0051] A second determining module is configured to analyze the second response data, to determine whether the cross-site scripting vulnerability is triggered, and if yes, to locate the cross-site scripting vulnerability based on the second response data.

[0052] Another embodiment of the present application also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the cross-site scripting vulnerability detection method according to any one of the above embodiments.

[0053] The present application has the beneficial effect that test cases for cross-site scripting vulnerabilities can be generated even when the test cases triggering the cross-site scripting vulnerabilities are unknown. Since the prior art relies on a test case database to verify cross-site scripting vulnerabilities, if there is no test case in the test case database that can trigger a specific cross-site scripting vulnerability, the cross-site scripting vulnerability cannot be verified, and thus the vulnerability will not be reported. However, the present application can generate new test cases according to the characteristics of different vulnerabilities to verify the vulnerabilities, thereby effectively improving the detection capability for unknown cross-site scripting vulnerabilities. In addition, the present application does not need to traverse the test case database when generating corresponding test cases for different cross-site scripting vulnerabilities, thereby improving the efficiency of cross-site scripting vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed in the description of the specific embodiments or the prior art will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0055] Figure 1 The flowchart of the cross-site scripting vulnerability detection method in the embodiments of the present application.

[0056] Figure 2 The application flowchart of the cross-site scripting vulnerability detection method in the embodiments of the present application.

[0057] Figure 3 Another application flowchart of the cross-site scripting vulnerability detection method in the embodiments of the present application.

[0058] Figure 4 The example diagram of the injection point information in the embodiments of the present application.

[0059] Figure 5 The example diagram of the context information of the vulnerability trigger point in the embodiments of the present application.

[0060] Figure 6 The example diagram of the state characteristic change process of the vulnerability trigger point and the corresponding action in the embodiments of the present application.

[0061] Figure 7Context information change process example diagram for the vulnerability trigger point in the embodiment of the present application.

[0062] Figure 8 Structure block diagram of the cross-site scripting vulnerability detection device in the embodiment of the present application. DETAILED DESCRIPTION

[0063] Hereinafter, specific embodiments of the present application will be described in detail with reference to the accompanying drawings. However, the present application should not be construed as being limited to the following embodiments.

[0064] It should be understood that various modifications can be made to the embodiments disclosed herein. Therefore, the description should not be construed as limiting, but merely as the basis for the claims.

[0065] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the general description of the present disclosure given above, and the detailed description of the embodiments given below, serve to explain the principles of the present disclosure.

[0066] These and other characteristics of the present application will become apparent from the following description of the preferred forms given, by way of non-limiting example only, with reference to the attached drawings.

[0067] It should also be understood that, although the present application has been described above with reference to certain specific embodiments, many other equivalents forms of the present application will be apparent to those of ordinary skill in the art in view of the above teachings, the general principles described above and the attached claims. Accordingly, the present application is not intended to be limited to the specific forms shown but is to be accorded the widest scope consistent with the requirements and definitions of the attached claims.

[0068] The features and advantages of the present disclosure will become more apparent from the detailed description in which:

[0069] Specific embodiments of the present disclosure are described hereinafter, with reference to the drawings; however, it will be understood that the disclosed embodiments are merely examples of the present disclosure, which can be implemented in numerous ways. Well-known and / or redundant functions and structures are not described in detail to avoid obscuring the present disclosure unnecessarily. Therefore, specific structural and functional details disclosed herein are not intended to limit, but merely as a basis for the claims and a representative basis for teaching one skilled in the art to variously employ the present disclosure in virtually any appropriate detailed structure.

[0070] The specification can use phrases such as "in one embodiment", "in another embodiment", "in yet another embodiment", or "in other embodiments", which can refer to one or more of the same or different embodiments under the present disclosure.

[0071] Hereinafter, specific embodiments of the present application will be described in detail with reference to the accompanying drawings. However, the present application should not be construed as being limited to the following embodiments.

[0072] As Figure 1 shown, the present application includes a cross-site scripting vulnerability detection method, comprising:

[0073] S1: obtaining injection point information of a target website, the injection point information at least including a request address, a request method and an injection point corresponding request parameter of a candidate page where a cross-site scripting vulnerability exists;

[0074] S2: determining an access path of the candidate page based on the injection point information;

[0075] S3: constructing an initial test case, and sending the initial test case to the candidate page based on the access path to obtain corresponding first response data;

[0076] S4: analyzing the first response data to obtain first state features of a corresponding vulnerability trigger point, the first state features being used to describe environmental information of the vulnerability trigger point, the environmental information including context information of the vulnerability trigger point;

[0077] S5: processing the first state features by using a target model to obtain a first test case;

[0078] S6: sending the first test case to the candidate page based on the access path to obtain corresponding second response data;

[0079] S7: analyzing the second response data to determine whether the cross-site scripting vulnerability is triggered, and if so, positioning the cross-site scripting vulnerability based on the second response data.

[0080] Based on the above content, as Figure 2 and Figure 3 shown, in the embodiment, the system obtains injection point information of a target website to obtain a webpage that may have a cross-site scripting vulnerability, i.e., a candidate page. Then, the system determines an access path, i.e., an access address, of the candidate page based on the injection point information. The system constructs an initial test case, and sends the initial test case to the target website based on the access address, so that the target website goes to the candidate page, and obtains corresponding first response data, i.e., a first response page. The system analyzes the first response data to obtain first state features of a vulnerability trigger point of the cross-site scripting vulnerability, the first state features being used to describe context information of the vulnerability trigger point in the first response page. The system inputs the first state features into a target model, and generates a new first test case from the target model based on the first state features, the first test case having content that is more likely to trigger the vulnerability trigger point of the cross-site scripting vulnerability. When the system obtains the first test case, the system sends the first test case to the candidate page again to obtain corresponding second response data, and determines whether the vulnerability is triggered based on the second response data, and if so, determines a vulnerability point position.

[0081] The scheme of the embodiment can generate a test case for a cross-site scripting vulnerability in a case where a test case triggering the cross-site scripting vulnerability is unknown. Since the prior art relies on a test case database to verify a cross-site scripting vulnerability, if there is no test case in the test case database that can trigger a specific cross-site scripting vulnerability, the cross-site scripting vulnerability cannot be verified, and thus the vulnerability will not be reported. However, the scheme of the present application can generate new test cases according to the characteristics of different vulnerabilities to verify the vulnerabilities, and thus the detection capability for unknown cross-site scripting vulnerabilities can be effectively improved. In addition, the present application does not need to traverse the test case database when generating corresponding test cases according to the characteristics of different cross-site scripting vulnerabilities, and thus the efficiency of cross-site scripting vulnerability detection is improved.

[0082] In an embodiment, the method further comprises:

[0083] S8: If the cross-site scripting vulnerability is not triggered, analyzing the second response data to obtain a second state feature corresponding to the vulnerability trigger point;

[0084] S9: Processing the second state feature by using the target model to obtain a second test case;

[0085] S10: Sending the second test case to a candidate page based on the access path to obtain corresponding third response data;

[0086] S11: Analyzing the third response data to determine whether the cross-site scripting vulnerability is triggered, and if so, positioning the cross-site scripting vulnerability based on the third response data.

[0087] The scheme of the embodiment refers to whether the cross-site scripting vulnerability can be successfully triggered after the test of the test case this time, and if not, the second response data obtained is reanalyzed to obtain a second state feature of the vulnerability trigger point corresponding to the cross-site scripting vulnerability, and the second state feature is input into the target model to obtain a second test case based on the target model. The second test case is sent to the candidate page again to inject the test case into the candidate page to obtain third response data. The third response data is analyzed to determine whether the cross-site scripting vulnerability is triggered, and if so, the cross-site scripting vulnerability is directly positioned based on the third response data, and if not, the above steps are repeatedly executed until the response data obtained can be used for positioning of the cross-site scripting vulnerability, or the number of repetitions reaches a preset limit value, and then the test is stopped.

[0088] Specifically, the system obtains the injection point information of the target website, including:

[0089] S12: Scanning the target website by using a black box scanner to obtain injection point information;

[0090] wherein, the injection point information is different corresponding to different types of cross-site scripting vulnerabilities, when the cross-site scripting vulnerability is a reflective cross-site scripting vulnerability, the injection point information includes a request address of the candidate page, a request mode and a request parameter corresponding to the injection point, when the cross-site scripting vulnerability is a stored cross-site scripting vulnerability, the injection point information includes a request address of the candidate page, a request mode, a request parameter corresponding to the injection point and a candidate request address triggering the stored cross-site scripting vulnerability.

[0091] The initial test case is constructed, and the initial test case is sent to the candidate page based on the access path to obtain corresponding first response data, including:

[0092] S13: A random string is constructed as an initial test case, and the test case is used for positioning a vulnerability trigger point of a cross-site scripting vulnerability in a candidate page;

[0093] S14: The initial test case is sent to the candidate page based on the access path to obtain a corresponding response page;

[0094] wherein, when the type of the cross-site scripting vulnerability is reflective, a response page fed back by the target website is directly obtained;

[0095] when the type of the cross-site scripting vulnerability is stored, a candidate request address triggering the stored cross-site scripting vulnerability in the corresponding injection point information is accessed to obtain the response page.

[0096] In application, the system can generate a feature string as an initial test case, and construct an access request according to injection point related information combined with the initial test case, and send the access request containing the initial test case to a Web application server, so as to apply the initial test case to a candidate page based on the server to obtain a corresponding response page. Wherein, the function of the feature string is to position a vulnerability trigger point in a possible vulnerability trigger page, and to obtain environmental information of the cross-site scripting vulnerability trigger point by observing the context environment near the string.

[0097] Further, the first response data is analyzed to obtain a first state feature of the vulnerability trigger point, including:

[0098] S15: The first response data is analyzed to determine an output context environment of the initial test case in the page, a test repetition degree and a test result of this test, the output context environment represents an environment in which the corresponding test case is in when output, the test repetition degree includes a repetition degree of a test action and a reuse situation of a test case, the test action corresponds to an element in the test case, and the test result represents whether the cross-site scripting vulnerability is successfully triggered;

[0099] S16: determining a test case feature of the initial test case based on the first response data and the initial test case analysis, the test case feature including elements retained in the current response data and elements filtered out;

[0100] S17: determining feature information of the vulnerability trigger point based on the output context environment, the test case feature and the test result;

[0101] S18: determining a first state feature corresponding to the vulnerability trigger point based on the feature information.

[0102] Specifically, in order to characterize the environment in the test case generation process of cross-site scripting vulnerability (XSS vulnerability), facilitate the system to observe the environment, and thus provide a basis for the decision of the target model, the embodiment is realized by the method of defining the corresponding state space according to the characteristics of XSS vulnerability. For example, the embodiment is to model the state as a feature vector (f1, f2, …, f n ), where each element represents a different state feature. The state features are divided into four categories. The first category is to characterize the output context environment of the test case. The second category is the feature information of the test case itself, that is, the test case feature. The third category is the repetition degree in the test process. The fourth category is the test result. Only one item in the test result represents whether the test case successfully triggers the XSS vulnerability. For specific information, please refer to the following table:

[0103]

[0104] The output context environment refers to the abstract position of the test case in the specific language received by the interpreter, that is, the environment in which the test case is output. The feature information of the test case itself (i.e., the test case feature) is to characterize which key elements can be displayed on the vulnerability trigger page for the current test case, and which special elements in the test case will not be filtered. Part or all elements in the self-feature information correspond to a test action. For example, it is found in the test process that multiple test cases with special symbol “<” cannot make “<” appear in the vulnerability trigger page. It is proved that the Web application has a high probability of filtering “<”, so it is more desirable for the target model to take the action of making the symbol “<” not exist in the subsequent test case. The repetition degree in the test process mainly includes whether the previous action is the same as the current action, and the repetition of the current test case before. These two features are used for subsequent reward calculation as negative incentives for the same action or repeated test cases, to avoid the target model taking the same action or using repeated test cases in a round.

[0105] Based on the above, the system can determine the feature information of the vulnerability trigger point based on the output context environment, test case characteristics and test results, and determine the first state feature of the corresponding vulnerability trigger point based on the feature information.

[0106] In an embodiment, the target model is a reinforcement learning model, and the reinforcement learning algorithm used is a general A2C (Advantage Actor-Critic) algorithm. The target model has a reward function and an action space, the action space includes a plurality of different rules for generating new test cases, and the target model is used to generate test cases more targeted to the trigger points of cross-site scripting vulnerabilities through state features and corresponding rewards.

[0107] The method further comprises:

[0108] S19: Calculate the reward value of the initial test case based on the first state feature, the reward value being used to evaluate the effectiveness of the action of the initial test case in the state represented by the first state feature;

[0109] The processing of the first state feature by the target model to obtain the first test case comprises:

[0110] The first state feature and the reward value are input into the target model, so that the target model processes the first state feature and the reward value to obtain the first test case.

[0111] The action space in the embodiment includes a basic test case generation rule and a test case mutation rule. The basic test case generation rule is used to detect false positives of the judgment condition of whether the current test case successfully triggers a vulnerability, and the test case mutation rule is used to make the test case bypass the cleaning function of the website and make the specified part of the test case content in a context environment that can be successfully executed.

[0112] Specifically, the generation rule of the basic test case is set for the false alarm problem of the judgment condition of whether the current test case is successfully triggered, and the embodiment eliminates the false alarm by dynamically detecting whether the malicious code of the injected test case is executed. Specifically, a JavaScript function xss(ID) is defined in each web page, and the function adds the ID to an array that can be recognized by the scanner. In the process of parsing the response, it is analyzed whether the corresponding ID value appears in the specific array of the page, that is, it is judged whether the malicious code is successfully executed. Wherein ID is an 8-bit integer randomly generated each time the test case is generated, and the mutation process does not modify the ID value in the test case. Therefore, it can be known that the embodiment uses xss(ID) instead of the commonly used alert() function, and in addition, a custom attribute xss-attribute is used to uniformly represent the tag attribute. If a tag with the xss-attribute attribute can be detected, it also proves that the malicious code is executed, that is, the xss-attribute of the text should be parsed as the attribute of the HTML tag.

[0113] The design of the mutation rule of the test case mainly aims at two aspects. On the one hand, the clean function that may be used in the web application is designed to have a corresponding mutation rule so that the test case can bypass the related clean function. On the other hand, the context environment of the test case at the vulnerability trigger point is considered, and a corresponding mutation rule is designed to make the specific part of the test case in the context environment that can be successfully executed, for example, to make the function xss() in the JavaScript code environment that can be successfully executed, or to make the tag attribute xss-attribute in the tag environment that can be successfully parsed.

[0114] Further, in the process of analyzing the response data, the system will calculate the reward of the action taken for the current state, which is used to evaluate whether the current action a t is an effective action. Since the current action a t directly affects the generation of the next test case, and further affects the next state feature s t+1 , the calculation of the reward r t is realized by evaluating the new state s t+1 .

[0115] The reward calculation function used in the embodiment is shown in the following table. If a cross-site scripting vulnerability is found at the current time step, then r t is the value of the maximum time step MAX_STEP minus the current time step, which is beneficial to the agent to find the test case that can trigger the cross-site scripting vulnerability as soon as possible. The maximum time step MAX_STEP is a hyperparameter, s t+1

[38] and s t+1

[39] are the state features f defined in the list corresponding to the upper state parameters.38 and f 39 a value that is a negative incentive for the target model to take the same action as the model under test, for avoiding the target model repeatedly taking the same action.

[0116]

[0117] The inputting the first state feature and the reward value into the target model, so that the target model processes the first state feature and the reward value, to obtain the first test case, includes:

[0118] S20: inputting the first state feature and the reward value into the target model, so that the target model determines a target action through analysis of the first state feature and the reward value, and executes the target action, and further obtains the first test case based on an execution result.

[0119] In order to better illustrate the scheme of the embodiment, the following is described in combination with a specific application example:

[0120] ImpressCMS is an open source content management system based on PHP / MySQL, and users can modify the code according to their own needs, and further customize the website into an enterprise website, a personal blog, a community forum, etc. Taking the open source content management system as a detection target, as shown in Figure 3 , the specific detection process includes:

[0121] a. Using a black box scanner to extract injection point information. The black box scanner takes "http: / / ipcs.com" as an initial URL to scan the ImpressCMS website, and obtains injection point related information, one of which is shown in Figure 4

[0122] b. Continue to select a path from the access path of the vulnerability trigger point in the injection point related information, as shown in Figure 4

[0123] c. Obtain feature information of the vulnerability trigger point, and obtain state features representing the vulnerability trigger point. The context information of the vulnerability trigger point is shown in Figure 5 , wherein "mdciurgk" is a randomly generated feature value for locating the specific position of the vulnerability trigger point in the page;

[0124] d. The target model decides the corresponding action according to the state feature. The state feature vector obtained above is shown as s0 in Figure 6 , and the action a0 decided by the target model according to the state is Action6;​​

[0125] e executes the corresponding action based on the target model to obtain a new test case, sends the new test case to the vulnerability injection point according to the injection point related information, and observes the vulnerability trigger point again. Specifically, the target model executes action Action6 to obtain a new test case javascript:xss(24549614), uses this test case to test, observes the vulnerability trigger point, and obtains a new state s1, whose feature vector is as follows Figure 6 As shown in s1, the corresponding context is as follows Figure 7 As shown in (a) in .

[0126] Repeat steps d and e until the cross-site scripting vulnerability is successfully triggered or a certain number of repetitions is reached. The target model determines the action a1 based on state s1 as Action1, and a new test case is obtained. <script>xss(24549614)< / script> , use this test case to test, observe the vulnerability trigger point to get the new state s2; the target model decides action a2 based on state s2 as Action23, and get a new test case"> <script>xss(24549614)< / script> , use this test case to test, observe the vulnerability trigger point to get the new state s3, at this time the last item of state s3 is 1, indicating that the XSS vulnerability is successfully triggered, then end the test of the injection point and report the vulnerability.

[0127] like Figure 8 As shown, another embodiment of the present invention also provides a cross-site scripting vulnerability detection device 100, including:

[0128] An acquisition module is used to obtain injection point information of a target website, wherein the injection point information includes at least a request address, a request method, and request parameters corresponding to the injection point of a candidate page with a cross-site scripting vulnerability;

[0129] A first determining module, configured to determine an access path of the candidate page according to the injection point information;

[0130] A construction module, configured to construct an initial test case, and send the initial test case to a candidate page based on the access path to obtain corresponding first response data;

[0131] A first analysis module is configured to analyze the response data to obtain state characteristics of corresponding vulnerability trigger points, wherein the state characteristics are used to describe environment information where the vulnerability trigger points are located, and the environment information includes context information of the vulnerability trigger points;

[0132] A first processing module, configured to process the state feature using a target model to obtain a first test case;

[0133] The first sending module is configured to send the first test case to a candidate page according to the access path, and obtain corresponding second response data;

[0134] The second determining module is configured to analyze the second response data, determine whether the cross-site scripting vulnerability is triggered, and if so, locate the cross-site scripting vulnerability based on the second response data.

[0135] In some embodiments, the apparatus further comprises:

[0136] The second analyzing module is configured to, when the cross-site scripting vulnerability is not triggered, analyze the second response data, and obtain second state features corresponding to the vulnerability trigger point;

[0137] The second processing module is configured to process the second state features by using the target model, and obtain a second test case;

[0138] The second sending module is configured to send the second test case to the candidate page according to the access path, and obtain corresponding third response data;

[0139] The third determining module is configured to analyze the third response data, determine whether the cross-site scripting vulnerability is triggered, and if so, locate the cross-site scripting vulnerability based on the third response data.

[0140] In some embodiments, the obtaining of the injection point information of the target website comprises:

[0141] Scanning the target website by using a black box scanner to obtain the injection point information;

[0142] The injection point information is different for different types of cross-site scripting vulnerabilities. When the cross-site scripting vulnerability is a reflective cross-site scripting vulnerability, the injection point information comprises a request address, a request mode and a request parameter corresponding to an injection point of a candidate page. When the cross-site scripting vulnerability is a storage-type cross-site scripting vulnerability, the injection point information comprises a request address, a request mode, a request parameter corresponding to an injection point and a candidate request address for triggering the storage-type cross-site scripting vulnerability of a candidate page.

[0143] In some embodiments, the constructing of the initial test case and the sending of the initial test case to the candidate page based on the access path to obtain corresponding first response data comprise:

[0144] A random string is constructed as an initial test case, and the test case is used for locating a vulnerability trigger point of a cross-site scripting vulnerability in a candidate page;

[0145] The initial test case is sent to the candidate page based on the access path, and a corresponding response page is obtained;

[0146] wherein, when the type of the cross-site scripting vulnerability is the reflective type, a response page fed back by the target website is directly obtained;

[0147] When the type of the cross-site scripting vulnerability is the storage type, a candidate request address triggering the storage type cross-site scripting vulnerability in the corresponding injection point information is accessed to obtain the response page.

[0148] In some embodiments, the analysis of the first response data obtains a first state feature of the corresponding vulnerability trigger point, including:

[0149] The first response data is analyzed to determine the output context environment of the initial test case in the page, the test repetition degree, and the test result of this test, the output context environment representing the environment in which the corresponding test case is placed when output, the test repetition degree including the repetition degree of test actions and the reuse situation of test cases, the test actions corresponding to elements in the test case, and the test result representing whether the cross-site scripting vulnerability is successfully triggered;

[0150] Based on the first response data and the initial test case analysis, the test case features of the initial test case are determined, including the elements retained in the current response data and the elements filtered out of the test case;

[0151] Based on the output context environment, the test case features, and the test result, the feature information of the vulnerability trigger point is determined;

[0152] Based on the feature information, the first state feature corresponding to the vulnerability trigger point is determined.

[0153] In some embodiments, the target model is a reinforcement learning model, the target model has a reward function and an action space, the action space contains a plurality of different rules for generating new test cases, and the target model is used to generate test cases more targeted to the trigger point of the cross-site scripting vulnerability through state features and corresponding rewards;

[0154] The method further includes:

[0155] Based on the first state feature, the reward value of the initial test case is calculated and determined, the reward value being used to evaluate the effectiveness of the actions of the initial test case in the state represented by the first state feature;

[0156] The first test case is obtained by processing the first state feature using the target model:

[0157] The first state feature and the reward value are input into the target model, so that the target model processes the first state feature and the reward value to obtain the first test case.

[0158] In some embodiments, the action space comprises a generation rule of a basic test case and a variation rule of the test case, the generation rule of the basic test case is used for detecting false positives of a judgment condition whether a current test case successfully triggers a vulnerability, and the variation rule of the test case is used for enabling the test case to bypass a cleaning function of a website and enabling a part of content of the test case to be in a context environment capable of being successfully executed.

[0159] In some embodiments, the inputting the first state feature and the reward value into the target model, so that the target model processes the first state feature and the reward value, to obtain the first test case, comprises:

[0160] The first state feature and the reward value are inputted into the target model, so that the target model determines a target action through analysis of the first state feature and the reward value, and executes the target action, and then obtains the first test case based on an execution result.

[0161] Another embodiment of the present application further provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements steps in the cross-site scripting vulnerability detection method according to any one of the above embodiments when executing the computer program.

[0162] Another embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program implements steps in the cross-site scripting vulnerability detection method according to any one of the above embodiments when being executed by a processor.

[0163] It should be noted that the computer storage media of the present application can be computer-readable signal media or computer-readable storage media or any combination of the two. The computer-readable media can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, computer-readable storage media can be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present application, computer-readable signal media can include a computer-readable program code in a baseband or having a carrier wave that propagates through transmission or space. Such a computer-readable program code can take many forms, including but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the foregoing. Computer-readable signal media can also be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable medium carrying the program code can be transmitted by any suitable medium, including but not limited to, wireless, optical, cable, RF, or the like, or any suitable combination of the foregoing.

[0164] Those skilled in the art should understand that the above discussion of any of the embodiments is merely exemplary and is not intended to be limiting of the scope of the application. The features of the various embodiments presented above can be combined in any number of ways to provide further embodiments. Steps can be omitted, modified, or combined in any number of ways to provide further embodiments. The scope of the application is defined by the appended claims and equivalents thereto.

[0165] One or more embodiments of the present application are intended to cover all alternatives, modifications, and variations of the present application falling within the scope of the broadest possible interpretation of the claims. Accordingly, any and all departures from the above-described steps, modifications, omissions, and additions to the described steps are to be considered as falling within the scope of the application.

Claims

1. A method for detecting a cross-site scripting vulnerability, characterized in that: include: Obtaining injection point information of the target website, wherein the injection point information includes at least the request address, request method, and request parameters corresponding to the injection point of the candidate page with a cross-site scripting vulnerability; Determining an access path of the candidate page based on the injection point information; Constructing an initial test case, and sending the initial test case to the candidate page based on the access path to obtain corresponding first response data; Analyzing the first response data to obtain a first state feature of a vulnerability trigger point corresponding to a cross-site scripting vulnerability, wherein the first state feature is used to describe environment information where the vulnerability trigger point is located, and the environment information includes context information of the vulnerability trigger point; Processing the first state feature using a target model to obtain a first test case; Sending the first test case to a candidate page based on the access path to obtain corresponding second response data; The second response data is analyzed to determine whether the cross-site scripting vulnerability is triggered, and if so, the cross-site scripting vulnerability is located based on the second response data.

2. The cross-site scripting vulnerability detection method according to claim 1, characterized in that: The method further comprises: If the cross-site scripting vulnerability is not triggered, analyzing the second response data to obtain a second state feature corresponding to the vulnerability triggering point; Processing the second state feature using the target model to obtain a second test case; Sending the second test case to the candidate page based on the access path to obtain corresponding third response data; The third response data is analyzed to determine whether the cross-site scripting vulnerability is triggered, and if so, the cross-site scripting vulnerability is located based on the third response data.

3. The cross-site scripting vulnerability detection method according to claim 1, characterized in that: The step of obtaining the injection point information of the target website includes: Scan the target website using a black box scanner to obtain injection point information; Among them, the injection point information is different for different types of cross-site scripting vulnerabilities. When the cross-site scripting vulnerability is a reflective cross-site scripting vulnerability, the injection point information includes the request address of the candidate page, the request method, and the request parameters corresponding to the injection point. When the cross-site scripting vulnerability is a stored cross-site scripting vulnerability, the injection point information includes the request address of the candidate page, the request method, the request parameters corresponding to the injection point, and the candidate request address that triggers the stored cross-site scripting vulnerability.

4. The cross-site scripting vulnerability detection method according to claim 1, characterized in that: The constructing of the initial test case and sending the initial test case to the candidate page based on the access path to obtain corresponding first response data includes: Construct a random string as the initial test case, which is used to locate the trigger point of the cross-site scripting vulnerability in the candidate page; Sending the initial test case to a candidate page based on the access path to obtain a corresponding response page; Wherein, when the type of the cross-site scripting vulnerability is a reflection type, directly obtaining the response page fed back by the target website; When the type of the cross-site scripting vulnerability is a storage type, access is performed based on a candidate request address that triggers the storage type cross-site scripting vulnerability in the corresponding injection point information to obtain the response page.

5. The cross-site scripting vulnerability detection method according to claim 1, characterized in that: The analyzing the first response data to obtain a first state feature corresponding to a vulnerability trigger point includes: Analyzing the first response data to determine an output context, test repetition, and a test result of the initial test case in the page, wherein the output context represents an environment in which the corresponding test case is output; the test repetition includes repetition of test actions and reuse of test cases; the test actions correspond to elements in the test case; and the test result represents whether a cross-site scripting vulnerability is successfully triggered; Determining test case characteristics of the initial test case based on the first response data and the initial test case analysis, the test case characteristics including elements retained and elements filtered out of the test case in the current response data; Determine characteristic information of the vulnerability trigger point based on the output context, test case characteristics, and test results; A first state feature corresponding to the vulnerability trigger point is determined based on the feature information.

6. The cross-site scripting vulnerability detection method according to claim 5, characterized in that: The target model is a reinforcement learning model having a reward function and an action space. The action space includes multiple different rules for generating new test cases. The target model is used to generate test cases that are more targeted at trigger points of cross-site scripting vulnerabilities through state features and corresponding rewards. The method further comprises: Determining a reward value for the initial test case based on the first state feature, wherein the reward value is used to evaluate the effectiveness of an action of the initial test case under the state represented by the first state feature; The step of processing the first state feature using the target model to obtain a first test case includes: The first state feature and the reward value are input into the target model, so that the target model processes the first state feature and the reward value to obtain the first test case.

7. The cross-site scripting vulnerability detection method according to claim 6, characterized in that: The action space includes basic test case generation rules and test case mutation rules. The basic test case generation rules are used to detect false positives in the judgment conditions of whether the current test case successfully triggers a vulnerability. The test case mutation rules are used to enable the test case to bypass the website's cleaning function and place the formulated part of the test case in a context where it can be successfully executed.

8. The cross-site scripting vulnerability detection method according to claim 6, characterized in that: Inputting the first state feature and the reward value into the target model so that the target model processes the first state feature and the reward value to obtain the first test case includes: The first state feature and reward value are input into the target model, so that the target model determines the target action by analyzing the first state feature and the reward value, and executes the target action, thereby obtaining the first test case based on the execution result.

9. A cross-site scripting vulnerability detection device, characterized in that: include: An acquisition module is used to obtain injection point information of a target website, wherein the injection point information includes at least a request address, a request method, and request parameters corresponding to the injection point of a candidate page with a cross-site scripting vulnerability; A first determining module, configured to determine an access path of the candidate page according to the injection point information; A construction module, configured to construct an initial test case, and send the initial test case to a candidate page based on the access path to obtain corresponding first response data; A first analysis module is configured to analyze the response data to obtain state characteristics of corresponding vulnerability trigger points, wherein the state characteristics are used to describe environment information where the vulnerability trigger points are located, and the environment information includes context information of the vulnerability trigger points; A first processing module, configured to process the state feature using a target model to obtain a first test case; A first sending module, configured to send the first test case to a candidate page according to the access path, and obtain corresponding second response data; The second determination module is configured to analyze the second response data to determine whether the cross-site scripting vulnerability is triggered, and if so, locate the cross-site scripting vulnerability based on the second response data.

10. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps of the cross-site scripting vulnerability detection method according to any one of claims 1 to 8 are implemented.

Images