XSS attack defense method, system and device based on page reconstruction technology and medium
By deploying an HTTP proxy to simulate and statically render HTML pages, the method effectively prevents XSS attacks by eliminating JS script vulnerabilities, addressing the limitations of existing defense methods against DOM-based XSS.
Patent Information
- Application Number
- CN202411470437.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-21
- Publication Date
- 2025-01-03
AI Technical Summary
Existing defense methods are ineffective against DOM-based XSS attacks, as they cannot intercept these attacks since they do not send attack signatures to the web server and are executed on the browser side.
Deploy an HTTP proxy component between the web server and browser to simulate the HTML page, execute it as a virtual page, and redraw the result as a pure static HTTP page, using a virtual web engine and websocket for event synchronization.
Prevents XSS attacks by removing JS scripts with vulnerabilities, effectively defending against storage, reflection, and DOM-based XSS attacks by rendering pages statically.
Smart Images
Figure CN119254521A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of cross-site scripting attack defense, and in particular to an XSS attack defense method, system, device and medium based on page reconstruction technology. Background Art
[0002] The existing defense measures mainly include: 1. Interception based on attack features, commonly seen in firewalls or WAFs, uses request parameters to match specific XSS script feature libraries to determine whether it is an XSS attack and block it; 2. XSS interception based on syntax and semantics, commonly seen in WAF, determines whether it is an XSS attack and blocks it by checking whether the request parameters conform to JS syntax and form attack semantics; 3. Code optimization and front-end and back-end code optimization, permission control to reduce XSS vulnerabilities; Interception technology based on attack features is common in traditional firewalls and WAFs. Since the JS language is highly dynamic, it is impossible to fully list possible attack scripts through traditional regular expression matching, and its ability to detect XSS attacks is relatively limited.
[0003] Interception technology based on syntax and semantics is common in the next generation of WAF. Compared with attack feature detection technology, syntax and semantics can more accurately detect various JS variants. HTTP requests are often sent using various encoding technologies, such as urlencode, base64, etc. Interception technology based on syntax and semantics cannot effectively handle encoded attacks.
[0004] It should be noted that the above two types of interception technologies cannot deal with DOM-based XSS attacks. This is because DOM-based XSS attacks do not send attack signatures to the web server, and the attack is executed directly on the browser side.
[0005] Code optimization and the use of newer front-end and back-end frameworks can reduce XSS vulnerabilities, but cannot completely eliminate such attacks. Summary of the invention
[0006] In view of the problem that existing defense methods cannot intercept DOM-based XSS attacks, the present invention proposes an XSS attack defense method, system, device and medium based on page reconstruction technology; a proxy is deployed between the web server and the browser to simulate the HTML page returned by the web server, and the execution result is redrawn as a pure static HTTP page, which is sent to the proxy through websocket to achieve event synchronization between the virtual page in the proxy and the user's browser page, thereby avoiding any possible XSS attacks.
[0007] The specific implementation contents of the present invention are as follows: A XSS attack defense method based on page reconstruction technology deploys an HTTP proxy component on the network link between the web server and the browser, specifically including: Forward the HTTP request obtained from the browser to the HTTP proxy component, and forward the HTTP request to the web server through the scheduling controller; According to the HTTP response obtained from the web server, the virtual web engine is called to execute the HTML page and JS page obtained from the HTTP proxy component, and the execution result is rendered as a virtual page; Monitor and record the change data of the virtual page, and send the change data to the browser via websocket; Redraw the execution results into pure static HTTP pages to defend against XSS attacks.
[0008] In order to better implement the present invention, further, the monitoring and recording of the change data of the virtual page specifically includes: Monitor and record the change data of the virtual page. If the current virtual page is a new page, record the complete data; if the current virtual page is a changed page, record the incremental data, and call the scheduling controller to send the incremental data to the browser via the HTTP proxy component in the form of websocket.
[0009] In order to better implement the present invention, further, the execution result is redrawn into a pure static HTTP page, specifically including: Reorganize the new page into a pure static HTTP page; the pure static page does not include the JS script of the original page; Get incremental data from the changed page, generate an HTTP response, and call the dispatch controller to send it to the browser via the HTTP proxy component in the form of websocket.
[0010] In order to better implement the present invention, further, the XSS attack defense method based on page reconstruction technology also includes: Call the JS script to capture the hardware change message obtained from the browser and send it to the HTTP proxy component via websocket; Calling the scheduling controller to forward the hardware change message to the virtual web engine to execute the hardware change message; Monitor and record the change data of the virtual page, and send it to the browser via websocket to complete the synchronization between the virtual browser and the user's browser.
[0011] In order to better implement the present invention, further, the hardware change message includes a keyboard change message, a keyboard change message, and a window change message.
[0012] Based on the above-mentioned XSS attack defense method based on page reconstruction technology, in order to better realize the present invention, further, an XSS attack defense system based on page reconstruction technology is proposed, which is used for the above-mentioned XSS attack defense method based on page reconstruction technology; including HTTP proxy component, virtual web engine, virtual page monitoring module, and scheduling controller; The HTTP proxy component is used to receive HTTP requests from the browser and send them to the web server; The virtual web engine is used to render the HTML page and JS script obtained from the web server into a virtual page locally and execute the hardware change message; The virtual page monitoring module is deployed in the virtual web engine and is used to monitor and record virtual page changes and intercept HTTP requests generated by virtual pages; The scheduling controller is used to schedule the virtual web engine, create a corresponding virtual page for each HTTP request, distribute hardware change messages to the corresponding virtual pages, and forward the virtual page to the generated HTTP request to the HTTP proxy component, which is finally sent to the web server by the proxy component.
[0013] In order to better implement the present invention, further, the HTTP proxy component includes an HTTP proxy component server and an HTTP proxy component client; The HTTP proxy component server is used to receive HTTP requests from the browser and also receive hardware change messages from the browser; The HTTP proxy component client is used to send HTTP requests to the web server and receive HTTP responses from the web server.
[0014] Based on the above-mentioned XSS attack defense method based on page reconstruction technology, in order to better realize the present invention, further, an electronic device is proposed, including a memory and a processor; a computer program is stored on the memory; when the computer program is executed on the processor, the above-mentioned XSS attack defense method based on page reconstruction technology is implemented.
[0015] Based on the above-mentioned XSS attack defense method based on page reconstruction technology, in order to better realize the present invention, further, a computer-readable storage medium is proposed, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned XSS attack defense method based on page reconstruction technology is implemented.
[0016] The present invention has the following beneficial effects: The present invention uses a built-in virtual web engine to execute the HTML page returned by the server and renders the page as a static page. The JS script with possible vulnerabilities returned by the web server is completely removed from the page. Storage-type, reflection-type and DOM-type XSS attacks all rely on the execution of specific JS scripts. In the scenario of the present invention, the attack will not take effect, thereby preventing any possible XSS attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Figure 1 A schematic block diagram of the overall structure of the XSS attack defense system based on page reconstruction technology provided by the present invention. DETAILED DESCRIPTION
[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.
[0019] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0020] The professional terms and explanations involved in this embodiment are as follows: Cross-Site Scripting is a security vulnerability that usually occurs in web applications. It allows attackers to inject malicious scripts into web pages, which will be executed when other users visit the web pages. There are three main types of XSS attacks: stored XSS, reflected XSS, and DOM-Based XSS.
[0021] Stored XSS: Malicious scripts are permanently stored on the target server, such as in a database, log, or other data store. When other users request pages containing these malicious scripts, the scripts will be executed. Common examples include forums, message boards, comment areas, etc.
[0022] Reflected XSS: The attacker carries a malicious script in the form of request parameters, etc. The server writes the parameters into the HTML page and returns it directly, and the script is executed in the browser. This attack usually requires the user to click a malicious link, and the script will be executed immediately in the user's browser.
[0023] DOM-based XSS: This type of XSS vulnerability occurs on the client side, where the attacker modifies the DOM structure of the web page so that the browser executes malicious code when parsing the script. Unlike other types of XSS, this attack does not involve data responded by the server.
[0024] Embodiment 1: This embodiment proposes an XSS attack defense method based on page reconstruction technology, which deploys an HTTP proxy component on the network link between the web server and the browser, specifically including: The HTTP request obtained from the browser is forwarded to the HTTP proxy component, and the HTTP request is forwarded to the web server through the scheduling controller.
[0025] According to the HTTP response obtained from the web server, the virtual web engine is called to execute the HTML page and JS page obtained from the HTTP proxy component, and the execution result is rendered as a virtual page.
[0026] Monitor and record the change data of the virtual page, and send the change data to the browser via websocket.
[0027] Redraw the execution results into pure static HTTP pages to defend against XSS attacks.
[0028] Furthermore, the monitoring and recording of the change data of the virtual page specifically includes: Monitor and record the change data of the virtual page. If the current virtual page is a new page, record the complete data; if the current virtual page is a changed page, record the incremental data, and call the scheduling controller to send the incremental data to the browser via the HTTP proxy component in the form of websocket. In order to better implement the present invention, further, the execution result is redrawn into a pure static HTTP page, specifically including: Reorganize the new page into a pure static HTTP page; the pure static page does not include the JS script of the original page; Get incremental data from the changed page, generate an HTTP response, and call the dispatch controller to send it to the browser via the HTTP proxy component in the form of websocket.
[0029] Furthermore, the XSS attack defense method based on page reconstruction technology also includes: Call the JS script to capture the hardware change message obtained from the browser and send it to the HTTP proxy component via websocket; Calling the scheduling controller to forward the hardware change message to the virtual web engine to execute the hardware change message; Monitor and record the change data of the virtual page, and send it to the browser via websocket to complete the synchronization between the virtual browser and the user's browser.
[0030] Furthermore, the hardware change message includes a keyboard change message, a keyboard change message, and a window change message.
[0031] Working principle: This embodiment is deployed in the form of a proxy on the network link between the browser and the web server. The present invention implements a virtual page on the proxy, the data of the virtual page comes from the HTTP response returned by the web server, the HTML page and JS script therein are simulated and executed on the proxy, the execution result is rendered as a static page and sent to the browser, and at the same time, a JS script is embedded in the above page to capture keyboard and mouse events and window change events, and such events are sent to the proxy through websocket to achieve event synchronization between the virtual page in the proxy and the user's browser page; the HTML page returned by the server is executed through the built-in virtual web engine, and the page is rendered as a static page, and the JS script returned by the web server that may have vulnerabilities is completely removed from the page; storage type, reflection type and DOM type XSS attacks all need to rely on the execution of specific JS scripts, and the attack will not take effect in the scenario of this embodiment, effectively defending against XSS attacks in any situation.
[0032] Embodiment 2: This embodiment is described in detail in the form of steps based on the above-mentioned embodiment 1, and specifically includes the following steps.
[0033] Step S1: Obtain an HTTP request initiated from a browser, send the HTTP proxy request to an HTTP proxy component server, call a scheduling controller to send the HTTP request to an HTTP proxy component client, and forward it from the HTTP proxy component client to a web server.
[0034] Step S2: The scheduling controller calls the virtual web engine to execute the HTML page and JS page from the proxy component, and renders the execution result as a virtual page.
[0035] Step S3: calling the virtual page monitoring module to monitor and record changes in virtual pages, recording complete data for new pages, and only recording incremental data for page changes and notifying the scheduling controller; The dispatch controller reorganizes the new page recorded in the previous step into a purely static page, which does not contain any JS scripts of the original page. For incremental data, the dispatch controller pushes the data to the browser via websocket through the proxy component.
[0036] Step S4: the scheduling controller returns the above data as an HTTP response to the browser through the HTTP proxy component server; The static page processed by the browser rendering obtains the same display effect as the original page. At the same time, the browser receives incremental data through websocket and redraws the page.
[0037] The XSS attack defense method based on page reconstruction technology also includes: Step S5: The user's mouse, keyboard and window change messages are captured by the JS script and sent to the HTTP proxy component server in the form of websocket; The scheduling controller is called to obtain the above-mentioned change messages and forward them to the corresponding virtual web engine. The virtual web engine executes these change messages to make the user operations consistent with the user operations on the browser. The resulting page changes are captured again by the virtual page monitoring module and fed back to the browser according to step S3 and its subsequent steps, thereby achieving complete synchronization between the virtual browser and the user browser.
[0038] HTTP requests generated by the virtual browser, such as form submissions and page requests, will be captured by the monitoring module and forwarded to the proxy component by the scheduling controller, and finally sent to the web server to obtain a new page.
[0039] Working principle: This embodiment provides a method for solving the XSS defense problem. The principle is to deploy a proxy between the web server and the browser. The proxy simulates the HTML page returned by the web server and redraws the execution result into a pure static HTTP page to avoid any possible XSS attacks.
[0040] This embodiment can be deployed independently as a proxy server, or as a firewall or a part of a WAF, i.e. a web application firewall, between a browser and a web server to intercept HTTP requests and responses, convert HTML dynamic pages into pure static pages, and defend against any possible XSS attacks.
[0041] This embodiment is deployed in the form of a proxy on the network link between the browser and the web server; a virtual page is implemented on the proxy, and the data of the virtual page comes from the HTTP response returned by the web server. The HTML page and JS script therein are simulated and executed on the proxy, and the execution result is rendered as a static page and sent to the browser. At the same time, a JS script is embedded in the above page to capture keyboard and mouse events and window change events, and such events are sent to the proxy through websocket to achieve event synchronization between the virtual page in the proxy and the user's browser page; the HTML page returned by the server is executed through the built-in virtual web engine, and the page is rendered as a static page, and the JS script returned by the web server that may have vulnerabilities is completely removed from the page. Storage-type, reflection-type and DOM-type XSS attacks all rely on the execution of specific JS scripts, and the attack will not be effective in the scenario of this embodiment.
[0042] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1, and thus will not be described in detail.
[0043] Embodiment 3: This embodiment is based on any one of the above embodiments 1 to 2. Figure 1 As shown, an XSS attack defense system based on page reconstruction technology is proposed, which is used for the above-mentioned XSS attack defense method based on page reconstruction technology; it includes an HTTP proxy component, a virtual web engine, a virtual page monitoring module, and a scheduling controller; The HTTP proxy component is used to receive HTTP requests from the browser and send them to the web server; The virtual web engine is used to render the HTML page and JS script obtained from the web server into a virtual page locally and execute the hardware change message; The virtual page monitoring module is deployed in the virtual web engine and is used to monitor and record virtual page changes and intercept HTTP requests generated by virtual pages; The scheduling controller is used to schedule the virtual web engine, create a corresponding virtual page for each HTTP request, distribute hardware change messages to the corresponding virtual pages, and forward the virtual page to the generated HTTP request to the HTTP proxy component, which is finally sent to the web server by the proxy component.
[0044] The HTTP proxy component includes an HTTP proxy component server and an HTTP proxy component client; The HTTP proxy component server is used to receive HTTP requests from the browser and also receive hardware change messages from the browser; The HTTP proxy component client is used to send HTTP requests to the web server and receive HTTP responses from the web server.
[0045] This embodiment also proposes an electronic device, including a memory and a processor; a computer program is stored on the memory; when the computer program is executed on the processor, the above-mentioned XSS attack defense method based on page reconstruction technology is implemented.
[0046] This embodiment also proposes a computer-readable storage medium, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned XSS attack defense method based on page reconstruction technology is implemented.
[0047] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1-2, so they will not be repeated here.
[0048] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.
Claims
1. A XSS attack defense method based on page reconstruction technology, characterized in that: Deploy HTTP proxy components on the network link between the web server and the browser, including: Forward the HTTP request obtained from the browser to the HTTP proxy component, and forward the HTTP request to the web server through the scheduling controller; According to the HTTP response obtained from the web server, the virtual web engine is called to execute the HTML page and JS page obtained from the HTTP proxy component, and the execution result is rendered as a virtual page; Monitor and record the change data of the virtual page, and send the change data to the browser via websocket; Redraw the execution results into pure static HTTP pages to defend against XSS attacks.
2. According to the XSS attack defense method based on page reconstruction technology of claim 1, it is characterized in that: The monitoring and recording of the change data of the virtual page specifically includes: Monitor and record the change data of the virtual page. If the current virtual page is a new page, record the complete data; if the current virtual page is a changed page, record the incremental data, and call the scheduling controller to send the incremental data to the browser via the HTTP proxy component in the form of websocket.
3. According to the XSS attack defense method based on page reconstruction technology of claim 2, it is characterized in that: The redrawing of the execution result into a purely static HTTP page specifically includes: Reorganize the new page into a pure static HTTP page; the pure static page does not include the JS script of the original page; Get incremental data from the changed page, generate an HTTP response, and call the dispatch controller to send it to the browser via websocket through the HTTP proxy component.
4. According to the XSS attack defense method based on page reconstruction technology of claim 1, it is characterized in that: The XSS attack defense method based on page reconstruction technology also includes: Call the JS script to capture the hardware change message obtained from the browser and send it to the HTTP proxy component via websocket; Calling the scheduling controller to forward the hardware change message to the virtual web engine to execute the hardware change message; Monitor and record the change data of the virtual page, and send it to the browser via websocket to complete the synchronization between the virtual browser and the user's browser.
5. According to claim 4, a XSS attack defense method based on page reconstruction technology is characterized in that: The hardware change message includes a keyboard change message, a keyboard change message, and a window change message.
6. An XSS attack defense system based on page reconstruction technology, used to execute the XSS attack defense method based on page reconstruction technology as claimed in claim 1; characterized in that: Includes HTTP proxy component, virtual web engine, virtual page monitoring module, and scheduling controller; The HTTP proxy component is used to receive HTTP requests from the browser and send them to the web server; The virtual web engine is used to render the HTML page and JS script obtained from the web server into a virtual page locally and execute the hardware change message; The virtual page monitoring module is deployed in the virtual web engine and is used to monitor and record virtual page changes and intercept HTTP requests generated by virtual pages; The scheduling controller is used to schedule the virtual web engine, create a corresponding virtual page for each HTTP request, distribute hardware change messages to the corresponding virtual pages, and forward the virtual page to the generated HTTP request to the HTTP proxy component, which is finally sent to the web server by the HTTP proxy component.
7. The XSS attack defense system based on page reconstruction technology according to claim 6 is characterized in that: The HTTP proxy component includes an HTTP proxy component server and an HTTP proxy component client; The HTTP proxy component server is used to receive HTTP requests from the browser and also receive hardware change messages from the browser; The HTTP proxy component client is used to send HTTP requests to the web server and receive HTTP responses from the web server.
8. An electronic device, characterized in that: It comprises a memory and a processor; a computer program is stored in the memory; when the computer program is executed on the processor, the XSS attack defense method based on page reconstruction technology as described in any one of claims 1 to 5 is implemented.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 7, the XSS attack defense method based on page reconstruction technology as described in any one of claims 1-5 is implemented.