A black box web vulnerability scanning entry collection method and device

Abstract

The application discloses a black box Web vulnerability scanning entry collection method and device, and relates to the technical field of network security. The method comprises the following steps: identifying all the interactive elements in a Web page by traversing a DOM tree; obtaining events bound to each interactive element; performing simulation operation on the events bound to each interactive element; judging whether a new Web page generated in response to the simulation operation reaches a stable state; if yes, traversing an updated DOM sub-tree, locating newly added interactive elements in the current Web page, and performing deduplication processing on the newly added interactive elements; repeatedly performing the above steps on the new Web page until a maximum recursion depth is reached or the Web page no longer generates new interactive elements. The application improves the authenticity and comprehensiveness of Web application request collection, thereby improving the detection rate of black box Web vulnerabilities.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a black-box Web vulnerability scanning entry collection method and device. BACKGROUND

[0002] Black-box Web vulnerability scanning is usually divided into two main parts: the collection of scanning entries and the deformation probe attack on the collected requests, and the collection of scanning entries is a crucial step. The usual scanning entry collection methods mainly include: collecting links and forms in pages through crawler technology, or collecting user requests through proxies or traffic analysis. Traditional crawler technology usually relies on regular expressions to extract links and forms in pages, and more advanced technical solutions will try to trigger events in pages, simulate user interaction to enhance collection effect.

[0003] However, the event triggering and interaction simulation scheme in the prior art has the following defects:

[0004] (1) Blindness. The traditional scheme usually sets a timeout, traverses all registered events or DOM nodes for triggering, and lacks systematic interaction logic.

[0005] (2) Logic branch omission. In some scenarios, the front-end page needs to request data from the back-end after user operation and display new content, which may trigger interaction again. The traditional scheme is prone to omit these logic branches due to the inability to determine whether the element needs multiple interactions.

[0006] (3) Difficulty in balancing efficiency and quality. Due to the use of fixed timeout, there may be cases where the element interaction has ended but is still waiting, or the element interaction effect has not been realized but the waiting has been ended early, resulting in either slow scanning or poor scanning quality.

[0007] (4) Challenge of single-page applications. Modern front-end technologies (such as React, Vue, etc.) make single-page applications mainstream, and the traditional scheme is difficult to systematically analyze large-scale single-page applications, resulting in insufficient coverage of logic branches. SUMMARY

[0008] In view of the above defects or deficiencies in the prior art, the present application provides a black-box Web vulnerability scanning entry collection method and device, which can effectively solve the technical problems existing in the background art.

[0009] The application provides a black box Web vulnerability scanning entry collection method, comprising: a scanning entry identification step: all interactive elements in a Web page are identified by traversing a DOM tree; an event acquisition step: events bound to each interactive element are acquired; an interactive operation step: events bound to each interactive element are simulated; an element positioning and deduplication step: whether a new Web page generated in response to the simulation operation reaches a stable state is judged, if yes, a DOM subtree updated is traversed, newly added interactive elements in the current Web page are positioned, and the newly added interactive elements are subjected to deduplication processing; and a recursive analysis step: the scanning entry identification step, the event acquisition step, the interactive operation step and the element positioning and deduplication step are repeatedly executed for the new Web page until a maximum recursion depth is reached or the Web page no longer generates new interactive elements.

[0010] Another aspect of the application also provides a black box Web vulnerability scanning entry collection device, comprising: a scanning entry identification module for identifying all interactive elements in a Web page by traversing a DOM tree; an event acquisition module for acquiring events bound to each interactive element; an interactive operation module for simulating events bound to each interactive element; an element positioning and deduplication module for judging whether a new Web page generated in response to the simulation operation reaches a stable state, if yes, traversing an updated DOM subtree, positioning newly added interactive elements in the current Web page, and subjecting the newly added interactive elements to deduplication processing; and a recursive analysis module for repeatedly executing the scanning entry identification module, the event acquisition module, the interactive operation module and the element positioning and deduplication module for the new Web page until a maximum recursion depth is reached or the Web page no longer generates new interactive elements.

[0011] The black box Web vulnerability scanning entry collection method and device provided by the application balance scanning efficiency and effect through a page stable state judgment method and a multi-factor element deduplication method, improve the authenticity and comprehensiveness of Web application request collection, and thus improve the detection rate of black box Web vulnerabilities. BRIEF DESCRIPTION OF DRAWINGS

[0012] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the attached drawings:

[0013] Figure 1 is a flowchart of a black box Web vulnerability scanning entry collection method provided by an embodiment of the application Figure 1 ;

[0014] Figure 2 is a flowchart of a black-box Web vulnerability scanning entry collection method provided by an embodiment of the present application Figure 2 ;

[0015] Figure 3 is a structural diagram of a black-box Web vulnerability scanning entry collection device provided by an embodiment of the present application

[0016] Figure 4 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0017] To make the objectives, technical solutions, and superiorities of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some, but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts are within the scope of the present application.

[0018] The terms used in the embodiments of the present application are only for the purpose of describing particular embodiments and are not intended to limit the present application. The singular forms "a," "an," and "the" used in the embodiments of the present application are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0019] It should be understood that although the terms first, second, third, etc. can be used in the embodiments of the present application to describe obtaining modules, these obtaining modules should not be limited to these terms. These terms are only used to distinguish the obtaining modules from each other.

[0020] Depending on the context, the word "if" as used herein can be interpreted to mean "when" or "while" or "in response to determining" or "in response to detecting." Similarly, the phrase "if it is determined" or "if [a stated condition or event] is detected" can be interpreted to mean "upon being determined" or "in response to determining" or "upon detecting [the stated condition or event]" or "in response to detecting [the stated condition or event]."

[0021] It should be noted that the "upper," "lower," "left," "right," and other directional terms described in the embodiments of the present application are described from the perspective of the angle shown in the drawings, and should not be understood as limiting the embodiments of the present application. In addition, in the context, it should also be understood that when referring to an element being formed "on" or "under" another element, it can be directly formed "on" or "under" another element, or indirectly formed "on" or "under" another element through an intermediate element.

[0022] One embodiment of the present application provides a black box web vulnerability scanning entry collection method, which systematically covers the logical branches of a web application and comprehensively collects scanning entry information through the technical concepts of interactive element analysis, automatic interaction simulation, page steady state determination, recursive analysis and the like.

[0023] Referring to Figure 1 、 2 The black box web vulnerability scanning entry collection method of the present embodiment specifically comprises the following steps:

[0024] Step S101, scanning entry identification step: all interactive elements in the web page are identified by traversing the DOM tree.

[0025] Specifically, the elements in the web page are analyzed to identify the interactive elements. Specifically, all interactive elements in the page, such as buttons, links, input boxes, etc., are identified by traversing the DOM tree.

[0026] Step S102, event acquisition step: acquire the events bound to each interactive element.

[0027] Specifically, the events bound to each element are acquired by methods such as getEventListeners, such as click, mouseover, input, etc. Preferably, regular expression matching is used to detect whether the element contains dangerous operations, such as "delete", "logout" and the like, and actions configured to avoid processing are used to avoid these dangerous operations.

[0028] Step S103, interactive operation step: simulate the operation of the events bound to each interactive element.

[0029] Specifically, the event simulation operation includes but is not limited to: (1) simulate the hover, click and the like of the mouse through the MouseEvent API. (2) simulate the keyboard input through the KeyboardEvent API. (3) fill in the content of the Input element, according to the type of the form field, such as email, phone, date, etc., automatically fill in the appropriate value, and combine the click operation of the form submission button to simulate the form submission.

[0030] Step S104, element positioning and deduplication step: determine whether the new web page generated in response to the simulation operation reaches a steady state, if so, traverse the updated DOM subtree, locate the newly added interactive elements in the current web page, and perform deduplication processing on the newly added interactive elements.

[0031] Specifically, this step is used to detect the effect of the interactive operation, including:

[0032] 1. Wait for the new Web page to reach a stable state

[0033] Two conditions need to be met for the Web page to be stable, one is no longer request, two is no longer change dom structure, specific through the following way to judge:

[0034] (1) Monitoring requests

[0035] Wait for all new http requests of the page to be sent. The embodiment monitors the number of http requests of the Web page, mainly through monitoring the global page request counter. If there is a new http request in the page, wait for the request to end, which means that the global page request counter is zero, otherwise if there is no new http request in the page, it means that the request is sent.

[0036] Monitor the following three situations of the Web page http request:

[0037] I. Monitor whether there is a request sent through XML HttpRequest API:

[0038] Hook intercepts the XML HttpRequest API, when open is called, the request counter is added by 1 and the readystatechange event is listened to, when the readystatechange event is generated and readyState is 4, the request counter is reduced by 1. When the counter is cleared, it means that there is no request sent through XML HttpRequest API.

[0039] II. Monitor whether a request is sent through fetch:

[0040] Hook intercepts the fetch API, when fetch is called, the request counter is added by 1, when the finally callback of fetch is executed, the request counter is reduced by 1. When the counter is cleared, it means that there is no request sent through fetch API.

[0041] III. Monitor whether a script node of the DOM tree is added:

[0042] When the MutationObserver API captures a new script node, the request counter is added by 1 and the load event is listened to, when the load event is generated, the request counter is reduced by 1. When the counter is cleared, it means that there is no new script node of the DOM tree.

[0043] When there is no request sent by the XML HttpRequest API, no request sent by the fetch, and no script node of the newly added DOM tree, it indicates that there is no newly added http request in the current Web page.

[0044] (2) Monitor the DOM changes

[0045] DOM is the abbreviation of Document Object Model. The embodiment monitors the DOM changes of the page through the MutationObserver API provided by the browser, and determines that the page reaches a stable state when the DOM stops updating for a period of time. The period of time can usually be 1 frame to 2 frames, which is about 17 milliseconds to 33 milliseconds according to 60 frames per second of a page. In this process, since the browser can generate a large number of DOM update events, the embodiment preferably uses the debounce technology to debounce the DOM update events, reducing the communication overhead between the browser and the control program.

[0046] If the count value of the global page request counter is zero (i.e., there is no newly added http request) and the DOM of the current page stops updating, it is determined that the updated Web page reaches a stable state.

[0047] 2, Find new elements

[0048] After the Web page reaches a stable state, the updated DOM subtree is traversed to locate the newly added interactive elements in the current Web page, and the newly added interactive elements are de-duplicated.

[0049] Since the element selector of the modern front end can change frequently, it is necessary to combine multiple ways to de-duplicate. The embodiment uses multiple element positioning algorithms, such as CSS selector, XPath, DOM Object, and content hash, and combines a generalization strategy to ensure the uniqueness of the discovered new elements, eliminate some elements with low interaction significance, and avoid repeated interactions. In addition, through the generalization strategy de-duplication, some inefficient processing flows of complex components can be jumped out on the basis of ensuring the coverage of the logical branch, such as jumping out of the repeated click operation on the date element in the date selector component. Since it is a general simulation operation logic, it also avoids the adaptation work of writing rules for various components, improving the generality.

[0050] Specifically, the de-duplication processing of the embodiment can use the following methods:

[0051] (1) Perform event simulation operation on elements with the same properties in the element selector (such as CSS selector) only once.

[0052] (2) When the element selector changes, trigger the operation only once for the same DOM object, and avoid triggering the DOM object multiple times.

[0053] (3) Hash the content of the interactive element to ensure that the interactive element with the same content is not processed repeatedly.

[0054] (4) Replace the identifiable content (e.g., numbers, IPs, UUIDs, etc.) with the same attribute in the interactive element with a uniform identifier, and perform the event simulation operation only once for the uniform identifier.

[0055] (5) Use a global deduplicator to determine whether similar interactive elements on different web pages or in different tasks are the same, and do not process the same interactive elements repeatedly.

[0056] After completing the deduplication processing of the interactive elements on the web page, it can be determined whether there are new interactive elements in the updated web page.

[0057] Step S105, recursive analysis step: repeat the scanning entry identification step, the event acquisition step, the interactive operation step, and the element positioning and deduplication step for the new web page until the maximum recursion depth is reached or the web page no longer produces new interactive elements.

[0058] Repeat the above steps S101 to S104 for the new web page to perform deep interaction of the page logic. If the web page produces new interactive elements and the maximum recursion depth has not been reached, the analysis continues. Specifically, if an interactive operation causes the web page to change and produces a new interactive element that did not exist before, the page logic depth corresponding to the new element increases by 1. When there are no new interactive elements on the page, or the page logic depth reaches the configured threshold limit (i.e., the maximum recursion depth), the interactive operation process stops. This step avoids the possibility of infinite recursion, allowing the process to reach a terminal state.

[0059] For example, when a button on a web page is clicked, a new page is opened, and new hyperlink entries, buttons, selectors, etc. appear on the new page. Normally, the page will not be opened indefinitely, but in some special cases, some folders can be opened indefinitely, and the interactive process cannot end. The recursive analysis method of this embodiment can ensure that the test process ends gradually.

[0060] Further, if the interactive element being interacted in the current web page disappears, the state before the interactive element disappears is returned through backtracking of the interaction process. For example, a button X needs to be clicked A button and then a button B to appear, when the button B disappears, we first try to click the back button of the browser, if the button B still cannot appear, it can be considered that the web developer has not implemented the corresponding backtracking logic. At this time, the state before the button B disappears is returned through backtracking of the interaction process proposed in the embodiment. For another example, there are two buttons of login and registration on the page, the login form is displayed by default, and the login form is replaced by the registration form when the registration button is clicked. When the registration button is clicked, the login form disappears. At this time, if we want to analyze the login operation, the login form needs to reappear through backtracking of the interaction process proposed in the embodiment.

[0061] The backtracking of the interaction process of the embodiment refers to recording the whole path and process of the interaction, and then backtracking to the state before the interactive element disappears, so that the interactive element of the previous operation reappears, and then the interaction operation test is continued.

[0062] Steps S101-S105 are complete recursive analysis of each interactive element in the initial web page. According to the process, scanning analysis is performed on all interactive elements in the initial web page, that is, the collection of all scanning entrances can be completed.

[0063] In order to more clearly understand the technical solutions of the present application, the following provides part of the scene examples of the black box web vulnerability scanning entrance collection method of the present application.

[0064] Example 1: Recursive analysis of single-page application (SPA)

[0065] Assumed scenario: an enterprise internal management system is developed by using React, and contains multiple function modules such as user management, permission management, system configuration, etc. The traditional crawler can only obtain a small number of links of the home page due to the inability to effectively process the dynamic loading characteristics of the SPA application, the reasons are as follows: (1) the function entrance is dynamically loaded by clicking, and there is no fixed URL; (2) the page state depends on the user interaction sequence; (3) temporary UI components such as pop-up windows and drawers need to be triggered by specific operations; (4) the page is not refreshed after form submission but is updated locally.

[0066] The implementation process of the present application is as follows:

[0067] Firstly, in the initial analysis stage, the system identifies the clickable items of the left menu bar, analyzes the binding events and confirms that the items are all registered for the click event, and adds the menu items to the queue to be processed;

[0068] Then, in the interaction and state determination phase, simulate clicking the first menu item, monitor the new API request initiation, wait for the request to complete and the DOM update to stop, and confirm that the page enters a stable state;

[0069] Next, in the recursive processing phase, analyze the newly loaded content page, find the edit and delete buttons in the data table, identify the page number buttons of the paginator, and add these new elements to the processing queue. Process the elements in the queue one by one.

[0070] Finally, in the state management phase, record the page state before each interaction. When the interaction element disappears and cannot continue to interact, for example, a mistaken trigger logout, backtrack according to the previously recorded page state to achieve logical rollback. Further, use a global de-duplicator to avoid repeated analysis of the same function.

[0071] Through the above steps, each functional branch of the SPA application can be systematically explored, significantly improving the entry coverage.

[0072] Example 2: Form automatic filling and submission

[0073] Assume scenario: A certain e-commerce website's product publishing function contains multiple step-by-step forms, each with field validation, and some fields require dynamic API to obtain options. Traditional solutions often fail to correctly fill in the form. The reasons are: (1) The form field types are diverse, requiring appropriate values to be filled in; (2) There are inter-field relationships; (3) Front-end validation is required before submission; (4) The form is submitted in steps, and the state needs to be maintained.

[0074] The implementation process of the invention is as follows:

[0075] First, intelligent field recognition. Analyze the name, type, and other attributes of the form fields, and understand the field semantics based on the label text to prepare appropriate test data for different types of fields.

[0076] Then, dynamic option processing. Monitor the API requests triggered by form field changes, wait for the option data to be loaded, and select the appropriate option value.

[0077] Next, validation feedback processing. Monitor form validation events, analyze validation failure prompts, and adjust the filling strategy until validation is passed.

[0078] Finally, step-by-step form processing. Record the state of each step of the form to ensure that all required fields are filled in and the submission is completed in the correct order.

[0079] The above scheme can intelligently handle complex forms and significantly improve the success rate of form processing.

[0080] Example 3 Explorable list exploration of infinite depth

[0081] Assumed scenario: a file management system uses a tree structure to display file directories, supporting infinite-level expansion. Traditional crawlers are prone to infinite recursion or missing deep nodes, because: (1) the directory level is unlimited; (2) expanding nodes dynamically loads data; (3) the same level may have nodes with the same name; (4) expanding too many nodes may cause performance problems.

[0082] The implementation process of the present application is as follows:

[0083] First, depth management is performed. Set the maximum recursion depth threshold, record the level information of the current node, and back up in time when the threshold is exceeded.

[0084] Then, node recognition is performed. Combine path information to reduce node weight, identify duplicate directory structures, and avoid falling into a loop of expansion.

[0085] Next, load state processing is performed. Monitor the request triggered by the expansion operation, wait for the child node list to be loaded, and confirm that the expansion animation is complete.

[0086] Finally, resource optimization is performed. Timely retract the processed branches, periodically clean up the page cache, and control the number of nodes being expanded at the same time.

[0087] The above scheme can effectively explore deep tree structures while avoiding resource exhaustion problems.

[0088] Referring to Figure 3 Another embodiment of the present application also provides a black box Web vulnerability scanning entry collection device 200, which comprises a scanning entry identification module 201, an event acquisition module 202, an interactive operation module 203, an element positioning and weight reduction module 204, and a recursive analysis module 205. The black box Web vulnerability scanning entry collection device 200 can execute the black box Web vulnerability scanning entry collection method in the method embodiment.

[0089] The black box Web vulnerability scanning entry collection device 200 of the present embodiment comprises:

[0090] The scanning entry identification module 201 is used to identify all interactive elements in the Web page by traversing the DOM tree;

[0091] The event acquisition module 202 is used to acquire the events bound to each interactive element;

[0092] The interactive operation module 203 is used to simulate the operation of the events bound to each interactive element;

[0093] The element positioning and deduplication module 204 is configured to determine whether the new web page generated in response to the simulation operation reaches a stable state, and if so, traverse the updated DOM sub-tree, locate the newly added interactive element in the current web page, and perform deduplication processing on the newly added interactive element.

[0094] The recursive analysis module 205 is configured to repeatedly execute the scan entry identification module, the event acquisition module, the interactive operation module, and the element positioning and deduplication module for the new web page until a maximum recursion depth is reached or no new interactive element is generated in the web page.

[0095] Further, the recursive analysis module 205 is further configured to, if the interactive element being interacted in the current web page disappears, return to a state before the interactive element disappears through backtracking of the interactive operation process.

[0096] Further, the element positioning and deduplication module 204 is further configured to monitor the count value of a global page request counter of the browser client and the DOM changes of the current web page, and if the count value of the global page request counter is zero and the DOM of the current web page stops updating, determine that the updated web page reaches a stable state.

[0097] Further, the element positioning and deduplication module 204 is further configured to perform an event simulation operation on elements with the same attributes in an element selector only once, perform a triggering operation on the same DOM object only once when the element selector changes, perform a hash calculation on the content of the interactive element to ensure that the same interactive element is not processed repeatedly, replace the identifiable content of the interactive element with a uniform identifier, perform an event simulation operation on the uniform identifier only once, and determine whether similar interactive elements in different web pages or different tasks are the same, and do not perform repeated processing on the same interactive element.

[0098] Further, the recursive analysis module 205 is further configured to, if a new interactive element that has not appeared before is generated in the current web page, increase the page logic depth value by 1, continue to perform recursive analysis on the new interactive element if the page logic depth value does not reach a maximum recursion depth threshold, and stop performing recursive analysis when there is no new interactive element that has not appeared before in the web page or the page logic depth value reaches the maximum recursion depth threshold.

[0099] It should be noted that the black box web vulnerability scan entry collection device 200 provided in the embodiment corresponds to the technical solutions for executing the method embodiments, and the implementation principles and technical effects are similar to those of the method, which will not be described here.

[0100] Figure 4 This is a schematic diagram of an electronic device 300 provided in another embodiment of the present invention. This electronic device is used to implement the black-box Web vulnerability scanning entry point collection method in the method embodiment. The electronic device 300 in the embodiments of the present invention may include, but is not limited to, devices such as PCs, smartphones, tablets, PDAs, servers, etc. Figure 4 The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0101] like Figure 4 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described herein, based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing device 301, ROM 302, and RAM 303 are interconnected via a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0102] Typically, the following devices can be connected to I / O interface 304: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0103] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A black box web vulnerability scanning entry collection method, characterized in that, The method comprises the following steps: a scanning entry identification step of identifying all the interactive elements in the web page by traversing the DOM tree; an event acquisition step of acquiring the events bound to each interactive element; an interactive operation step of performing simulated operation on the events bound to each interactive element; an element positioning and redundancy reduction step of monitoring the counting value of a global page request counter of the browser client and the DOM change of the current web page, judging that the updated web page reaches a stable state if the counting value of the global page request counter is zero and the DOM of the current web page stops updating, traversing the updated DOM sub-tree, positioning the newly added interactive elements in the current web page, performing event simulation operation on the elements with the same attributes in the element selector only once, performing trigger operation on the same DOM object only once when the element selector changes, performing hash calculation on the content of the interactive elements to ensure that the interactive elements with the same content will not be repeatedly processed, replacing the identifiable content with the same attributes in the interactive elements with a uniform identifier, performing event simulation operation on the uniform identifier only once, judging whether the similar interactive elements on different web pages or in different tasks are the same, and not performing repeated processing on the same interactive elements; a recursive analysis step of repeatedly performing the scanning entry identification step, the event acquisition step, the interactive operation step and the element positioning and redundancy reduction step for the new web page until the maximum recursion depth is reached or the web page no longer produces new interactive elements; if the interactive elements being interacted in the current web page disappear, recording the full path and process of the interactive operation, and then backtracking to the state before the interactive elements disappear; if the current web page produces new interactive elements that have not appeared before, increasing the page logic depth value by 1; if the page logic depth value does not reach the maximum recursion depth threshold, continuing to perform recursive analysis on the new interactive elements; when there is no new interactive element that has not appeared before on the web page, or the page logic depth value reaches the maximum recursion depth threshold, stopping the recursive analysis.

2. A black box web vulnerability scanner entry collection apparatus characterized by, The method comprises the following steps: a scanning entry identification module for identifying all the interactive elements in the web page by traversing the DOM tree; an event acquisition module for acquiring the events bound to each interactive element; an interactive operation module for performing simulated operation on the events bound to each interactive element; The element positioning and weight reduction module is configured to monitor a count value of a global page request counter of a browser client and a DOM change of a current web page. If the count value of the global page request counter is zero and the DOM of the current web page stops updating, it is determined that the updated web page reaches a stable state. The updated DOM sub-tree is traversed to locate newly added interactive elements in the current web page. An event simulation operation is performed only once on elements with the same attribute in an element selector. When the element selector changes, a triggering operation is performed only once on the same DOM object. The content of the interactive elements is hashed to ensure that interactive elements with the same content are not repeatedly processed. Identifiable content with the same attribute in the interactive elements is replaced with a uniform identifier. An event simulation operation is performed only once on the uniform identifier. It is determined whether similar interactive elements on different web pages or in different tasks are the same. The same interactive elements are not repeatedly processed. The recursive analysis module is configured to repeatedly execute the scan entry identification module, the event acquisition module, the interactive operation module and the element positioning and weight reduction module for a new web page until a maximum recursive depth is reached or no new interactive element is generated in the web page. If an interactive element being interactively operated in the current web page disappears, all paths and processes of the interactive operation are recorded, and then the state before the disappearance of the interactive element is traced back. If a new interactive element that has not appeared before is generated in the current web page, a page logic depth value is increased by 1. If the page logic depth value does not reach a maximum recursive depth threshold, recursive analysis is continuously performed on the new interactive element. When there is no new interactive element that has not appeared before on the web page, or the page logic depth value reaches the maximum recursive depth threshold, the recursive analysis is stopped.

Images