Black box Web vulnerability scanning entry collection method and device

Abstract

The invention discloses a black box Web vulnerability scanning entry collection method and device, and relates to the technical field of network security. The method comprises the following steps of: identifying all interactive elements in a Web page by traversing a DOM (Document Object Model) tree; acquiring an event bound with each interactive element; performing simulation operation on an event bound with each interactive element; judging whether a new Web page generated in response to the simulation operation reaches a stable state or not, if yes, traversing the updated DOM subtree, positioning newly added interactive elements in the current Web page, and performing weight reduction processing on the newly added interactive elements; and repeatedly executing the steps for the new Web page until the maximum recursion depth is reached or the Web page does not generate new interactive elements any more. According to the method, the authenticity and comprehensiveness of Web application request collection are improved, so that the detection rate of black box Web vulnerabilities is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a black box Web vulnerability scanning entry collection method and device. Background Art

[0002] Black-box web vulnerability scanning is usually divided into two main parts: collecting scan entries and performing deformation detection attacks on the collected requests. The collection of scan entries is a crucial step. The usual scanning entry collection methods mainly include: collecting links and forms in the page through crawler technology, or collecting user requests through proxy or traffic analysis. Traditional crawler technology usually relies on regular expressions to extract links and forms in the page. More advanced technical solutions will try to trigger events in the page and simulate user interactions to enhance the collection effect.

[0003] However, the event triggering and interaction simulation solutions in the prior art have the following defects: (1) Blindness. Traditional solutions usually set a timeout and traverse all registered events or DOM nodes for triggering, lacking systematic interaction logic.

[0004] (2) Missing logical branches. In some scenarios, the front-end page needs to request data from the backend and display new content after the user operates. This new content may trigger interaction again. Traditional solutions are prone to missing these logical branches because they cannot determine whether an element requires multiple interactions.

[0005] (3) It is difficult to balance efficiency and quality. Due to the use of a fixed timeout, there may be a situation where the element interaction has ended but the waiting is still in progress, or the waiting ends early before the effect of the element interaction is reflected, resulting in either slow scanning or poor scanning quality.

[0006] (4) Challenges of single-page applications. Modern front-end technologies (such as React, Vue, etc.) have made single-page applications mainstream. Traditional solutions are difficult to systematically analyze large-scale single-page applications, resulting in insufficient coverage of logical branches. Summary of the invention

[0007] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a black box Web vulnerability scanning entry collection method and device, which can effectively solve the technical problems existing in the background technology.

[0008] The present invention provides a black box Web vulnerability scanning entry collection method, comprising: a scanning entry identification step: identifying all interactive elements in a Web page by traversing a DOM tree; an event acquisition step: acquiring an event bound to each interactive element; an interactive operation step: performing a simulated operation on the event bound to each interactive element; an element positioning and weight reduction step: judging whether a new Web page generated in response to the simulated operation has reached a stable state, and if so, traversing an updated DOM subtree, locating newly added interactive elements in the current Web page, and performing weight reduction processing on the newly added interactive elements; a recursive analysis step: repeatedly executing the scanning entry identification step, the event acquisition step, the interactive operation step, and the element positioning and weight reduction step for a new Web page until a maximum recursive depth is reached or the Web page no longer generates new interactive elements.

[0009] On the other hand, the present invention also provides a black box Web vulnerability scanning entry collection device, including: a scanning entry identification module, used to identify all interactive elements in a Web page by traversing the DOM tree; an event acquisition module, used to obtain events bound to each interactive element; an interactive operation module, used to simulate operations on events bound to each interactive element; an element positioning and weight reduction module, used to determine whether a new Web page generated in response to the simulated operation has reached a stable state, and if so, traverse the updated DOM subtree, locate the newly added interactive elements in the current Web page, and perform weight reduction processing on the newly added interactive elements; a recursive analysis module, used to repeatedly execute the scanning entry identification module, the event acquisition module, the interactive operation module and the element positioning and weight reduction module for a new Web page until the maximum recursive depth is reached or the Web page no longer generates new interactive elements.

[0010] The present invention provides a black-box Web vulnerability scanning entry collection method and device, which, by fitting the interactive process in a real Web scenario, proposes concepts such as "logic depth within the page", systematically covers the logical branches of Web applications, balances scanning efficiency and effect through a page steady-state judgment method and a multi-factor element weight reduction method, improves the authenticity and comprehensiveness of Web application request collection, and thus improves the detection rate of black-box Web vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 This is a flowchart of a black box Web vulnerability scanning entry collection method provided by an embodiment of the present application. Figure 1 ; Figure 2This is a flowchart of a black box Web vulnerability scanning entry collection method provided by an embodiment of the present application. Figure 2 ; Figure 3 It is a structural diagram of a black box Web vulnerability scanning entry collection device provided by an embodiment of the present application; Figure 4 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0012] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0013] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings.

[0014] It should be understood that although the terms first, second, third, etc. may be used to describe the acquisition modules in the embodiments of the present invention, the acquisition modules should not be limited to these terms. These terms are only used to distinguish the acquisition modules from each other.

[0015] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0016] It should be noted that the directional words such as "upper", "lower", "left", and "right" described in the embodiments of the present invention are described at the angles shown in the drawings and should not be understood as limiting the embodiments of the present invention. In addition, in the context, it should also be understood that when it is mentioned that an element is formed "on" or "under" another element, it can not only be formed directly "on" or "under" another element, but also be formed "on" or "under" another element indirectly through an intermediate element.

[0017] An embodiment of the present invention provides a black box Web vulnerability scanning entry collection method, the technical concept of which is to systematically cover the logical branches of Web applications and comprehensively collect scanning entry information through interactive element analysis, automated interaction simulation, page steady state determination, recursive analysis and other technologies.

[0018] See also Figure 1 , 2 The black box web vulnerability scanning entry collection method of this embodiment specifically includes the following steps: Step S101, scanning entry identification step: identifying all interactive elements in the web page by traversing the DOM tree.

[0019] Specifically, analyze the elements in the web page and identify the interactive elements. Specifically, by traversing the DOM tree, identify all the interactive elements in the page, such as buttons, links, input boxes, etc.

[0020] Step S102, event acquisition step: acquiring the event bound to each interactive element.

[0021] Specifically, getEventListeners and other methods are used to obtain events bound to each element, such as click, mouseover, input, etc. Preferably, regular expression matching is used to detect whether the element contains dangerous operations, such as "delete", "logout" and other dangerous operations, and these dangerous operations are avoided by configuring and adding evasion processing actions.

[0022] Step S103, interactive operation step: simulate the operation on the event bound to each interactive element.

[0023] Specifically, event simulation operations include but are not limited to: (1) simulating mouse hover, click, and other operations through the MouseEvent API. (2) simulating keyboard input through the KeyboardEvent API. (3) Filling in the content of elements such as Input, automatically filling in appropriate values ​​based on the type of form field, such as email, phone, date, etc., and simulating form submission by clicking the form submit button.

[0024] Step S104, element location and weight reduction step: determine whether the new Web page generated in response to the simulation operation has reached a stable state. If so, traverse the updated DOM subtree, locate the newly added interactive elements in the current Web page, and perform weight reduction processing on the newly added interactive elements.

[0025] Specifically, this step is used to detect the effect of the interactive operation, including: 1. Wait for the new web page to reach a stable state The stability of a web page requires two conditions to be met at the same time: one is that no more requests are sent, and the other is that the DOM structure no longer changes. The specific judgment is as follows: (1) Monitoring Request Wait for all new http requests of the page to be sent. This embodiment monitors the number of http requests of the web page, mainly by monitoring the global page request counter. If there is a new http request on the page, wait for the request to end, which means that the global page request counter is reset to zero. Otherwise, if there is no new http request on the page, it indicates that the request has been sent.

[0026] Simultaneously monitor the following three types of http requests for web pages: I. Monitor whether there are requests sent through the XML HttpRequest API: Hook the XML HttpRequest API, add 1 to the request counter when open is called and listen to the readystatechange event. When the readystatechange event is generated and the readyState is 4, the request counter is reduced by 1. When the counter is cleared to zero, it indicates that there is no request sent through the XML HttpRequest API.

[0027] II. Monitor whether the request is sent through fetch: Hook the fetch API, and when fetch is called, the request counter is incremented by 1, and when the finally callback of fetch is executed, the request counter is decremented by 1. When the counter is cleared to 0, it indicates that there is no request sent through the fetch API.

[0028] III. Monitor whether a new script node is added to the DOM tree: When the MutationObserver API captures a newly added script node, the request counter is incremented by 1 and the load event is listened. When the load event occurs, the request counter is decremented by 1. When the counter is cleared to zero, it indicates that there is no newly added script node in the DOM tree.

[0029] When there is no request sent by the XML HttpRequest API, no request sent by fetch, and no newly added script node in the DOM tree, it indicates that there is no newly added http request in the current web page.

[0030] (2) Monitoring DOM changes DOM is the abbreviation of Document Object Model. This embodiment monitors the DOM changes of the page through the MutationObserver API provided by the browser, and determines that the page has reached a stable state when the DOM stops updating for a period of time. A period of time can usually be 1 to 2 frames in length, which is approximately 17 milliseconds to 33 milliseconds based on a page updating 60 frames per second. In this process, since the browser may generate a large number of DOM update events, this embodiment preferably uses debounce technology to debounce the DOM update events to reduce the communication overhead between the browser and the control program.

[0031] If the count value of the global page request counter returns to zero (ie, there is no new http request) and the DOM of the current page stops updating, it is determined that the currently updated Web page has reached a stable state.

[0032] 2. Discover new elements After the web page reaches a stable state, the updated DOM subtree is traversed to locate the newly added interactive elements in the current web page, and the newly added interactive elements are reduced in weight.

[0033] Since the element selectors of modern front-ends may change frequently, it is necessary to combine multiple methods to reduce the weight. This embodiment uses multiple element positioning algorithms, such as CSS selectors, XPath, DOM Object, content hash, combined with a generalization strategy, to ensure the uniqueness of the newly discovered elements, eliminate certain elements with low interactive significance, and avoid repeated interactions. In addition, by reducing the weight through the generalization strategy, it is possible to jump out of the inefficient processing flow of some complex components while ensuring the coverage of logical branches, for example, jumping out of the repeated click operation on the date element in the date selector component. Because it is a universal simulation operation logic, it also avoids the adaptation work of various components by writing rules, thereby improving versatility.

[0034] Specifically, the weight reduction process in this embodiment may adopt the following method: (1) Only one event simulation operation is performed on elements with the same attributes in the element selector (for example, CSS selector).

[0035] (2) When the element selector changes, only one trigger operation is performed on the same DOM object to avoid the DOM object being triggered multiple times.

[0036] (3) Perform hash calculation on the content of interactive elements to ensure that interactive elements with the same content are not processed repeatedly.

[0037] (4) Replace the identifiable content with the same attributes (e.g., numbers, IP addresses, UUIDs, etc.) in the interactive elements with a unified identifier, and perform event simulation operations only once on the unified identifier; (5) Use a global duplicate reducer to determine whether similar interactive elements on different web pages or in different tasks are the same, and do not repeat the same interactive elements.

[0038] After completing the weight reduction process for the interactive elements on the Web page, it can be determined whether there are newly added interactive elements in the currently updated Web page.

[0039] Step S105, recursive analysis step: repeat the scanning entry identification step, the event acquisition step, the interactive operation step and the element positioning and weight reduction step for a new Web page until the maximum recursive depth is reached or the Web page no longer generates new interactive elements.

[0040] Repeat the above steps S101 to S104 for the new web page to deeply interact with the page logic. If the web page generates new interactive elements and the maximum recursive depth has not been reached, continue the analysis. Specifically, if an interactive operation causes the web page to change and generates new interactive elements that did not exist before, the page logic depth corresponding to the new element increases by 1. When there are no new interactive elements on the page, or the page logic depth reaches the configured threshold limit (i.e., the maximum recursive depth), the interactive operation process is stopped. In this way, this step avoids the possibility of infinite recursion and allows the process to reach a final state.

[0041] For example, when a button on a web page is clicked, a new page will be opened, and new hyperlink entries, buttons, selectors and other elements will appear on the new page. Usually, pages will not be opened infinitely, but in some special cases, some folders can be opened infinitely and the interactive process cannot be ended. The recursive analysis method of this embodiment can ensure that the test process is gradually ended.

[0042] Furthermore, if the interactive element that is being interactively operated in the current web page disappears, the interactive operation process is backtracked to return to the state before the interactive element disappears. For example: a button X needs to click button A and then button B to appear. When button B disappears, we first try to click the back button of the browser. If button B still cannot appear, it can be considered that the web developer has not implemented the corresponding fallback logic. At this time, it is necessary to backtrack the interactive operation process proposed in this embodiment to return to the state before button B disappears. For another example: there are two buttons, login and register, on the page. The login form is displayed by default. Clicking the register button will replace the login form with the registration form. When the register button is clicked, the login form disappears. At this time, if we want to analyze the login operation, we need to backtrack the interactive operation process proposed in this embodiment to make the login form reappear.

[0043] The backtracking of the interactive operation process in this embodiment refers to recording the entire path and process of the interactive operation, and then backtracking to the state before the interactive element disappears, so that the interactive element previously operated reappears, and then the interactive operation test continues.

[0044] Steps S101-S105 are a complete recursive analysis of each interactive element in the initial Web page. By scanning and analyzing all interactive elements in the initial Web page according to this process, the collection of all scan entries can be completed.

[0045] In order to more clearly understand the technical solution of the present invention, some scenario-based examples of the black-box Web vulnerability scanning entry collection method of the present invention are provided below.

[0046] Example 1: Recursive analysis of a single-page application (SPA) Assumption: An enterprise internal management system is developed using React, which includes multiple functional modules such as user management, permission management, and system configuration. Traditional crawlers cannot effectively handle the dynamic loading characteristics of SPA applications and can only obtain a small number of links on the homepage. The reasons are: (1) Function entrances are dynamically loaded by clicking and there is no fixed URL; (2) Page status depends on the order of user interactions; (3) Temporary UI components such as pop-ups and drawers require specific operations to trigger; (4) After the form is submitted, the page is not refreshed but partially updated.

[0047] The implementation process of the present invention is as follows: First, in the initial analysis phase, the system identifies the clickable items in the left menu bar, analyzes the binding events and confirms that these items have registered click events, and adds these menu items to the queue to be processed; Then, in the interaction and state determination phase, simulate clicking the first menu item. When monitoring a new API request is initiated, wait for the request to complete and DOM updates to stop, and confirm that the page has entered a stable state. Next, in the recursive processing phase, the newly loaded content page is analyzed, the edit and delete buttons in the data table are found, the page number buttons of the pager are identified, these new elements are added to the queue to be processed, and the elements in the queue are processed one by one; Finally, in the state management stage, the page state before each interaction is recorded. When the interactive element disappears and the interaction can no longer continue, such as an erroneous triggering of logout, the previously recorded page state is backtracked to achieve logical rollback. The global weight reducer is further used to avoid repeated analysis of the same function.

[0048] Through the above steps, we can systematically explore the various functional branches of the SPA application and significantly improve the entry coverage.

[0049] Example 2: Automatic form filling and submission Assume that the product publishing function of an e-commerce website includes multiple step-by-step forms. Each form has field validation, and the options of some fields need to be obtained dynamically through the API. Traditional solutions often fail because they cannot correctly fill in the form. The reasons are: (1) The form field types are diverse and need to be filled with appropriate values; (2) There is a linkage relationship between fields; (3) Front-end verification is required before submission; (4) The form is submitted step by step and the status needs to be maintained.

[0050] The implementation process of the present invention is as follows: First, perform intelligent field recognition, analyze the name, type and other attributes of the form field, understand the field semantics in combination with the label text, and prepare appropriate test data for different types of fields.

[0051] Then, perform dynamic option processing, monitor the API requests triggered by form field changes, wait for option data to load, and select the appropriate option value.

[0052] Next, perform verification feedback processing. Monitor form verification events, analyze verification failure prompts, and adjust the filling strategy until verification passes.

[0053] Finally, perform the step-by-step form processing. Record the form status at each step, ensure that all required fields are filled in, and complete the submission in the correct order of operations.

[0054] The above solution can intelligently process complex forms and greatly improve the success rate of form processing.

[0055] Example 3: Expandable list exploration with unlimited depth Hypothetical scenario: A file management system uses a tree structure to display file directories and supports unlimited level expansion. Traditional crawlers are prone to infinite recursion or missing deep nodes because: (1) there is no limit on the directory level; (2) expanding a node will dynamically load data; (3) nodes with the same name may appear at the same level; (4) expanding too many nodes may cause performance problems.

[0056] The implementation process of the present invention is as follows: First, perform depth management. Set the maximum recursive depth threshold, record the level information of the current node, and roll back in time when the threshold is exceeded.

[0057] Then, node identification is performed. Node weight reduction is performed based on path information, and repeated directory structures are identified to avoid loop expansion.

[0058] Next, the loading state is processed. Monitor the request triggered by the expansion operation, wait for the sub-node list to be loaded, and confirm that the expansion animation is finished.

[0059] Finally, perform resource optimization, close processed branches in time, clean up page cache regularly, and control the number of nodes expanded at the same time.

[0060] The above scheme can effectively explore deep tree structures while avoiding the problem of resource exhaustion.

[0061] See also Figure 3 Another embodiment of the present invention further provides a black box web vulnerability scanning entry collection device 200, comprising a scanning entry identification module 201, an event acquisition module 202, an interactive operation module 203, an element positioning and weight reduction module 204 and a recursive analysis module 205. The black box web vulnerability scanning entry collection device 200 can execute the black box web vulnerability scanning entry collection method in the method embodiment.

[0062] The black box Web vulnerability scanning entry collection device 200 of this embodiment includes: A scanning entry identification module 201 is used to identify all interactive elements in a web page by traversing the DOM tree; An event acquisition module 202 is used to acquire the event bound to each interactive element; Interaction operation module 203, used to simulate the event bound to each interactive element; The element location and weight reduction module 204 is used to determine whether the new web page generated in response to the simulation operation has reached a stable state, and if so, traverse the updated DOM subtree, locate the newly added interactive elements in the current web page, and perform weight reduction processing on the newly added interactive elements; The recursive analysis module 205 is used to repeatedly execute the scanning entry identification module, the event acquisition module, the interactive operation module and the element positioning and weight reduction module for a new Web page until the maximum recursive depth is reached or the Web page no longer generates new interactive elements.

[0063] Furthermore, the recursive analysis module 205 is also used for: if the interactive element being interactively operated in the current Web page disappears, returning to the state before the interactive element disappears by backtracking the interactive operation process.

[0064] Furthermore, the element positioning and weight reduction module 204 is also used to: monitor the count value of the global page request counter of the browser client and the DOM changes of the current Web page. If the count value of the global page request counter returns to zero and the DOM of the current Web page stops updating, it is determined that the updated Web page has reached a stable state.

[0065] Furthermore, the element positioning and weight reduction module 204 is also used to: perform only one event simulation operation on elements with the same attributes in the element selector; when the element selector changes, perform only one trigger operation on the same DOM object; perform hash calculation on the content of the interactive elements to ensure that the interactive elements with the same content will not be processed repeatedly; replace the identifiable content with the same attributes in the interactive elements with a unified identifier, and perform only one event simulation operation on the unified identifier; and determine whether similar interactive elements on different Web pages or in different tasks are the same, and do not process the same interactive elements repeatedly.

[0066] Furthermore, the recursive analysis module 205 is also used to: if the current Web page generates a new interactive element that has not appeared before, then increase the page logic depth value by 1; if the page logic depth value does not reach the maximum recursive depth threshold, then continue to perform recursive analysis on the new interactive element; when there is no new interactive element that has not appeared before on the Web page, or the page logic depth value reaches the maximum recursive depth threshold, then stop performing recursive analysis.

[0067] It should be noted that the black box Web vulnerability scanning entry collection device 200 provided in this embodiment corresponds to a technical solution that can be used to execute each method embodiment. Its implementation principle and technical effect are similar to the method and will not be repeated here.

[0068] Figure 4 This is a schematic diagram of the structure of an electronic device 300 provided in another embodiment of the present invention, and the electronic device is used to implement the black box Web vulnerability scanning entry collection method in the method embodiment. The electronic device 300 in the embodiment of the present invention may include but is not limited to a PC, a smart phone, a tablet computer, a PDA, a server, etc. Figure 4 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0069] like Figure 4 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303 to implement the method of the embodiment of the present invention. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0070] Typically, the following devices may be connected to the I / O interface 304: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0071] The above description is only a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A black box Web vulnerability scanning entry collection method, characterized in that: The steps include: Scanning entry identification step: Identify all interactive elements on the web page by traversing the DOM tree; Event acquisition step: Get the events bound to each interactive element; Interaction operation steps: simulate the events bound to each interactive element; Element location and weight reduction step: determining whether the new web page generated in response to the simulation operation has reached a stable state, and if so, traversing the updated DOM subtree, locating the newly added interactive elements in the current web page, and performing weight reduction processing on the newly added interactive elements; Recursive analysis step: Repeat the scanning entry identification step, the event acquisition step, the interactive operation step, and the element positioning and weight reduction step for a new Web page until the maximum recursive depth is reached or the Web page no longer generates new interactive elements.

2. According to claim 1, a black box Web vulnerability scanning entry collection method is characterized in that: The recursive analysis step also includes: If the interactive element being interactively operated in the current Web page disappears, the interactive operation process is backtracked to return to the state before the interactive element disappears.

3. According to the black box Web vulnerability scanning entry collection method of claim 1, it is characterized in that: The step of determining whether the new Web page generated in response to the simulation operation has reached a stable state comprises: Monitor the count value of the global page request counter of the browser client and the DOM change of the current Web page. If the count value of the global page request counter returns to zero and the DOM of the current Web page stops updating, it is determined that the updated Web page has reached a stable state.

4. A black box Web vulnerability scanning entry collection method according to claim 1, characterized in that: The step of reducing the weight of the newly added interactive elements includes: Only one event simulation operation is performed on elements with the same attributes in the element selector; When the element selector changes, only one trigger operation is performed on the same DOM object; Hash the content of interactive elements to ensure that interactive elements with the same content are not processed repeatedly; Replacing identifiable content of the same attribute in the interactive element with a unified identifier, and performing an event simulation operation only once on the unified identifier; as well as, Determine whether similar interactive elements on different web pages or in different tasks are the same, and do not repeat the same interactive elements.

5. A black box Web vulnerability scanning entry collection method according to claim 1, characterized in that: The recursive analysis step also includes: If the current web page generates a new interactive element that has not appeared before, the page logic depth value is increased by 1; if the page logic depth value does not reach the maximum recursive depth threshold, the recursive analysis continues to be performed on the new interactive element; when there is no new interactive element that has not appeared before on the web page, or the page logic depth value reaches the maximum recursive depth threshold, the recursive analysis is stopped.

6. A black box web vulnerability scanning entry collection device, characterized in that: include: The scanning entry recognition module is used to identify all interactive elements on a web page by traversing the DOM tree; Event acquisition module, used to obtain the events bound to each interactive element; The interactive operation module is used to simulate the events bound to each interactive element; An element location and weight reduction module is used to determine whether the new web page generated in response to the simulation operation has reached a stable state, and if so, traverse the updated DOM subtree, locate the newly added interactive elements in the current web page, and perform weight reduction processing on the newly added interactive elements; The recursive analysis module is used to repeatedly execute the scanning entry identification module, the event acquisition module, the interactive operation module and the element positioning and weight reduction module for a new Web page until the maximum recursive depth is reached or the Web page no longer generates new interactive elements.

7. A black box Web vulnerability scanning entry collection device according to claim 6, characterized in that: The recursive analysis module is also used for: If the interactive element being interactively operated in the current Web page disappears, the interactive operation process is backtracked to return to the state before the interactive element disappears.

8. A black box Web vulnerability scanning entry collection device according to claim 6, characterized in that: The element positioning and weight reduction module is also used for: Monitor the count value of the global page request counter of the browser client and the DOM change of the current Web page. If the count value of the global page request counter returns to zero and the DOM of the current Web page stops updating, it is determined that the updated Web page has reached a stable state.

9. A black box Web vulnerability scanning entry collection device according to claim 6, characterized in that: The element positioning and weight reduction module is also used for: Only one event simulation operation is performed on elements with the same attributes in the element selector; When the element selector changes, only one trigger operation is performed on the same DOM object; Hash the content of interactive elements to ensure that interactive elements with the same content are not processed repeatedly; Replacing identifiable content of the same attribute in the interactive element with a unified identifier, and performing an event simulation operation only once on the unified identifier; as well as, Determine whether similar interactive elements on different web pages or in different tasks are the same, and do not repeat the same interactive elements.

10. A black box Web vulnerability scanning entry collection device according to claim 6, characterized in that: The recursive analysis module is also used for: If the current web page generates a new interactive element that has not appeared before, the page logic depth value is increased by 1; if the page logic depth value does not reach the maximum recursive depth threshold, the recursive analysis continues to be performed on the new interactive element; when there is no new interactive element that has not appeared before on the web page, or the page logic depth value reaches the maximum recursive depth threshold, the recursive analysis is stopped.

Images