Automatic XSS vulnerability attack system oriented to network target range

Abstract

The invention relates to a network range-oriented XSS vulnerability automatic attack system, which comprises an injection point information acquisition layer used for mining potential injection points of Web applications in a network range, analyzing the types of the injection points, context information and output display positions corresponding to input data, and outputting detailed information of the injection points; the attack vector generation layer is used for defining a reinforcement learning environment based on detailed information of an injection point, selecting an initial attack vector of a corresponding type from the initial attack vector list, selecting an optimal variation strategy according to a current environment state to perform variation on the initial attack vector, constructing an attack request and initiating an attack; the attack verification layer is used for analyzing a response page corresponding to the attack request, judging whether the attack is successful or not and feeding back an award to the attack vector generation layer; and the vulnerability information display layer is used for visually displaying the XSS vulnerability test result of the Web application. And the efficiency and the accuracy of XSS vulnerability testing in the network target range are effectively improved.

Description

An automated XSS vulnerability attack system for network testing ranges Technical Field

[0001] This application relates to the fields of network security and vulnerability testing technology, and in particular to an automated XSS vulnerability attack system for network test ranges. Background Technology

[0002] With the increasingly severe cyberattack situation, cyber ranges have become an important technical means to safeguard national cybersecurity. Through virtualization technology, they simulate real business architectures, providing enterprises and security testing organizations with a simulated environment for web application security testing, helping to identify and mitigate security risks as early as possible. In the construction of cyber ranges, automated attack technology is one of the core supporting technologies. It enables automated vulnerability discovery, alleviating the limitations of traditional manual penetration testing that "heavily relies on the experience and knowledge of testers," while avoiding the "explosive traffic" problem caused by brute-force scanning with conventional scanners. This is crucial for the large-scale and efficient operation of cyber ranges.

[0003] Currently, traditional XSS attack tools have significant drawbacks: the attack process is blind, attempting brute-force attacks by injecting predefined fixed attack vectors, hoping that a particular vector will succeed by chance. This strategy not only generates a large number of invalid requests but can even trigger a "request storm," making it unsuitable for network testing environments that require "low-traffic interference and high testing efficiency." At the same time, traditional tools struggle to accurately identify the injection point context information of web applications, leading to a mismatch between attack vectors and injection points, resulting in low vulnerability coverage and a high false positive rate.

[0004] Therefore, there is an urgent need to design an automated attack system for XSS vulnerabilities that can accurately identify injection points, dynamically generate attack vectors, and efficiently verify attack results, in order to meet the needs of daily attack and defense drills and penetration testing in network ranges. Summary of the Invention

[0005] Based on this, it is necessary to provide an automated XSS vulnerability attack system for network test ranges to address the above-mentioned technical problems. The core of this system is to achieve automated testing of XSS vulnerabilities through a four-layer interactive architecture (injection point information collection layer, attack vector generation layer, attack verification layer, and vulnerability information display layer), thereby solving the problems of strong blindness, low efficiency, and high false positive rate of traditional tools.

[0006] Firstly, this application provides an automated XSS vulnerability attack system for network test ranges, comprising an injection point information acquisition layer, an attack vector generation layer, an attack verification layer, and a vulnerability information display layer that interact sequentially. Specifically: the injection point information acquisition layer is used to discover potential injection points in web applications within the network test range, analyze the type of the injection point, context information, and the output display position corresponding to the input data, and output detailed injection point information; the attack vector generation layer is used to define a reinforcement learning environment based on the detailed injection point information, select an initial attack vector of the corresponding type from an initial attack vector list, select the optimal mutation strategy to mutate the initial attack vector according to the current environment state, construct an attack request, and launch an attack; the attack verification layer is used to analyze the response page corresponding to the attack request, determine whether the attack was successful, and provide a reward to the attack vector generation layer; the vulnerability information display layer is used to visualize the XSS vulnerability test results of the web application, the test results including the vulnerability type and exploitable attack vectors.

[0007] Optionally, in one embodiment of this application, the injection point information acquisition layer includes an injection point identification submodule and an injection point analysis submodule, wherein: the injection point identification submodule explores the Web application through a reinforcement learning agent, extracts the set of actions that the agent can execute in the current state, inputs the action set into the reinforcement learning model to obtain the optimal action, converts the string-form action object corresponding to the optimal action into a Selenium object for localization, identifies the type of the optimal action and executes it, and records all pages containing injection points; the action types include click operations and input operations, and when executing input operations, an online data generator is used to generate input data of the corresponding type, wherein the online data generator is a pattern-based open-source test data generator; the injection point analysis submodule receives a set of page URLs containing injection points, constructs a unique probe vector for each injection point of each page, and sends probe data packets to the target page.

[0008] Optionally, in one embodiment of this application, the injection point analysis submodule determines whether the response page contains a probe vector corresponding to the injection point: if it does, the injection point is determined to be a reflected injection point, and the injection point context information and the response page URL are stored in the injection point details; if it does not, the response page is tracked through taint marking; if the response page is successfully tracked, the injection point is determined to be a stored injection point, and the injection point context information and the response page URL are stored in the injection point details; if the response page is not tracked, the injection point is determined to be without vulnerability.

[0009] Optionally, in one embodiment of this application, the reinforcement learning environment defined by the attack vector generation layer includes a state space, an action space, a reward function, and a maximum variation length; the attack vector generation layer also includes an experience cache pool for storing experience data after each attack, the experience data including the current state, the executed mutation policy, the feedback reward, the new state, and the attack result; the attack vector generation layer samples a preset number of experience data from the experience cache pool, updates the parameters of the Actor network and the Critic target network, and synchronizes the parameters of the Critic target network to the Critic main network every preset step, the Critic main network being used to decide the optimal mutation policy.

[0010] Optionally, in one embodiment of this application, the attack vector generation layer determines during the attack process: if the attack vector successfully triggers an XSS vulnerability, then the testing of the current injection point is stopped and the test result is output; if the mutation count reaches the maximum mutation length but the vulnerability is not triggered, then it is determined that the current injection point does not have a vulnerability and the test is stopped; if the maximum mutation length is not reached and the vulnerability is not triggered, then the environment state is updated and the optimal mutation strategy is selected to continue the attack.

[0011] Optionally, in one embodiment of this application, the attack verification layer sets the attack code of all attack vectors as pop-up functions; the attack verification layer listens for pop-up events on the response page through Webdriver. If a pop-up event is detected, the attack is considered successful, and the reward is the difference between the maximum variable asynchronous length and the current variable asynchronous length; if no pop-up event is detected, the DOM syntax tree structure of the response page is extracted and traversed. If a pop-up function is found in the DOM syntax tree, the attack is considered successful, and the reward is the difference between the maximum variable asynchronous length and the current variable asynchronous length; if no pop-up function is found, the reward is calculated based on the edit distance between the attack vector in the response page and the original attack vector, and the attack is considered unsuccessful.

[0012] Optionally, in one embodiment of this application, the visualization content of the vulnerability information display layer further includes injection point parameters, number of attack attempts, and attack test task information; the attack test task information includes task name, target address, task status, number of vulnerabilities, and creation time; the vulnerability information display layer supports the creation of new attack test tasks and can specify the execution frequency of attack test tasks.

[0013] Compared with existing technologies, the advantages of this invention are as follows: First, high degree of automation: It achieves full automation from "injection point discovery → attack vector generation → attack verification → result display" without human intervention, reducing reliance on the experience of testers; Second, high testing efficiency: By dynamically generating attack vectors through reinforcement learning, it reduces invalid requests from traditional tools, avoids "request storms," ​​and adapts to the traffic control requirements of network test ranges; Third, high accuracy: It selects matching attack vectors based on the injection point context, and combines "pop-up monitoring + DOM tree traversal" for dual verification, improving vulnerability identification rate (high sensitivity) and controlling false positives (high specificity); Fourth, wide applicability: It supports custom testing frequencies to meet the needs of daily attack and defense drills and regular penetration testing in network test ranges, and the visual interface facilitates vulnerability management and analysis.

[0014] In summary, this system can effectively improve the efficiency and accuracy of XSS vulnerability testing in network ranges, providing strong support for network security protection. Attached Figure Description

[0015] Figure 1 is a schematic diagram of the architecture of an automated XSS vulnerability attack system for network test ranges in one embodiment; Figure 2 is a schematic diagram of the workflow of the injection point information collection layer in one embodiment; Figure 3 is a schematic diagram of the workflow of the attack vector generation layer in one embodiment; Figure 4 is a schematic diagram of the workflow of the attack verification layer in one embodiment; Figure 5 is a schematic diagram of the injection point exploration task creation page in one embodiment; Figure 6 is a schematic diagram of the injection point information page in one embodiment; Figure 7 is a schematic diagram of the attack vector management page in one embodiment; Figure 8 is a schematic diagram of the attack test task creation page in one embodiment; Figure 9 is a schematic diagram of the attack test task list page in one embodiment; Figure 10 is a schematic diagram of the attack test result details page in one embodiment; Figure 11 is a test environment topology diagram in one embodiment; Figure 12 is a schematic diagram of the test results in one embodiment; Figure 13 is a schematic diagram of the average Youden index comparison in one embodiment. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0017] In one embodiment, an automated XSS vulnerability attack system for network test ranges is provided. The core of this system is to achieve automated testing of XSS vulnerabilities through a four-layer sequential interactive architecture (injection point information collection layer, attack vector generation layer, attack verification layer, and vulnerability information display layer), which solves the problems of strong blindness, low efficiency, and high false positive rate of traditional tools. As shown in Figure 1, the core functions and interaction relationships of each layer are as follows: Injection Point Information Acquisition Layer: As the system's "data input layer," it is responsible for mining potential injection points in web applications within the network testbed, analyzing the injection point type (reflective / stored), contextual information (such as parameter type, page structure), and the output display position corresponding to the input data, ultimately outputting structured "injection point details" to provide basic data for subsequent attack vector generation; Attack Vector Generation Layer: As the system's "core decision layer," it defines the reinforcement learning environment based on the injection point details, selects an initial attack vector matching the injection point type from the initial attack vector list, and then selects the optimal mutation strategy to dynamically mutate the initial attack vector based on the current environment state (such as the feedback result of the previous attack), constructing an attack request and launching an attack on the web application; Attack Verification Layer: As the system's "feedback layer," it analyzes the response page corresponding to the attack request, determines whether the attack was successful, and feeds back a quantified "reward" to the attack vector generation layer, providing a basis for strategy optimization of the reinforcement learning model; Vulnerability Information Display Layer: As the system's "result output layer," it displays the vulnerability information of the web application. The application's XSS vulnerability test results are visualized, including vulnerability type, exploitable attack vectors, injection point parameters, number of attack attempts, and attack test task information, making it easy for testers to intuitively obtain vulnerability details.

[0018] In one embodiment of this application, the injection point information acquisition layer includes an injection point identification submodule and an injection point analysis submodule. The workflow is shown in Figure 2, and the specific implementation is as follows: The injection point identification submodule simulates human exploration logic through a reinforcement learning agent to achieve automated mining of injection points in Web applications. The steps are as follows: Step 1: Action object conversion—When the agent reaches a certain page state, it extracts the set of executable actions in that state (each action is a unique string identifier composed of label name, attributes, and other information), inputs the action set into a reinforcement learning model (such as a Q-Learning model), and the model outputs the "optimal action" in the current state; Since the system uses the Selenium automation tool to implement page interaction, the string form of the "optimal action" needs to be converted into a Selenium object to support the Selenium Driver. Step 1: Locating the operation (corresponding function getExecuteObject); Step 2: Action type recognition – Determine the type of the optimal action: If it is a "click operation", directly call the click function to execute; if it is an "input operation" (such as a text box, password box, email input box), use the online data generator Mocker to generate realistic input data (Mocker is a pattern-based open-source test data generator that integrates tools such as FakerJS and RandExpJS, and supports custom parameters to generate multiple types of data), and then call the write function to execute the input (corresponding function executeAction); Step 3: State iteration and recording – After the action is executed, the agent enters a new state, repeats the above steps, and records all page URLs containing data injection points to form a "collection of page URLs containing injection points".

[0019] The injection point analysis submodule, based on a "collection of page URLs containing injection points," analyzes the type and output location of injection points through "probe vector testing." The steps are as follows: Step 1: Construct probe vectors—For each page containing an injection point, construct a unique random string as a "probe vector" for each injection point parameter (corresponding function getRandString); Step 2: Send probe data packets—Send a request carrying the probe vector to the target page (corresponding function request), and analyze the response page; Step 3: Injection point type determination: If the response page contains the probe vector corresponding to the injection point, the injection point is determined to be a reflected injection point, and the injection point context information (such as parameter name, page path) and the response page URL are stored in "injection point details"; If the response page does not contain a probe vector, the stainTracking function is called to track the flow of injection point data through "taint marking." If the corresponding response page is successfully tracked, the injection point is determined to be a stored injection point, and the relevant information is stored in "injection point details"; If no response page is tracked, the injection point is determined to be without vulnerability, and is excluded from the scope of subsequent attacks.

[0020] In one embodiment of this application, the attack vector generation layer is the core of the system. It dynamically generates and optimizes attack vectors based on reinforcement learning. The workflow is shown in Figure 3, and the specific implementation is as follows: First, the reinforcement learning environment is defined: the environmental parameters supporting the attack decision are defined, including: State space: describing the current attack environment state, such as the injection point context, the response result of the previous attack (attack success / failure, attack vector filtering status); Action space: defining the set of mutation strategies for attack vectors (such as label mutation, attribute mutation, case obfuscation, etc.); Reward function: used to quantify the feedback of the attack result (provided by the attack verification layer); Maximum mutation length: setting the maximum number of mutations that an attack vector can try, balancing testing efficiency and attack coverage.

[0021] Next, the initial attack vector is selected: based on the "injection point type" (such as normal HTML tag injection or JavaScript injection) in the injection point details, an initial attack vector of the matching type is randomly selected from the preset "initial attack vector list" (corresponding function selectPayload) to avoid invalid attempts caused by incompatibility between the vector and the injection point.

[0022] Next, attack iteration and model optimization: Step 1: Strategy selection – Based on the current environment state, call the getAction function to select the optimal mutation strategy, mutate the initial attack vector, and construct an attack request; Step 2: Attack execution and experience storage – Send an attack request to the target page (corresponding to the step function), and store the experience data of "state – action – reward – new state – attack result" into the "experience cache pool" (corresponding to the addBuffer function; the parameters of the experience cache pool are defined by the replayBuffer function, including the cache pool size and the number of samples sampled each time); Step 3: Model update – Randomly sample a preset number of samples from the experience cache pool (e.g., ... m pieces of empirical data are used to update the parameters of the Actor network (responsible for policy generation) and the Critic target network (responsible for value evaluation) by calling the learn function; at preset steps, the parameters of the Critic target network are synchronized to the Critic main network (the main network is responsible for real-time decision-making) to ensure model convergence; Step 4: Attack stopping condition: if the attack vector successfully triggers the XSS vulnerability, stop the test on the current injection point and output "attack successful + valid attack vector"; if the number of mutations reaches the maximum mutation time and the vulnerability is not triggered, it is determined that there is no exploitable vulnerability at the current injection point and the test is stopped; if the above conditions are not met, update the environment state and repeat steps 1-3.

[0023] In one embodiment of this application, the attack verification layer is responsible for the accurate judgment of the attack result and the reward feedback. The workflow is shown in Figure 4. The specific implementation is as follows: Unified attack code setting: In order to simplify the verification logic, the attack code of all attack vectors is uniformly set as "pop-up function" (such as alert(1), alert(document.cookie)). The success of the attack is determined by "whether the pop-up is triggered" or "whether the pop-up function exists".

[0024] The attack result judgment steps include: Step 1: Pop-up event listening – listen for pop-up events on the response page using Webdriver (corresponding function listen): if a pop-up is detected, the attack is directly judged as "successful"; Step 2: DOM tree traversal verification – if no pop-up is detected (possibly because the attack code requires event triggering rather than immediate execution), call the domParse function to extract the DOM syntax tree structure of the response page and traverse the DOM tree to find the pop-up function: if the pop-up function is found, the attack is judged as "successful" (indicating that the attack code has been injected into the page structure and can be triggered for execution); if not found, the attack is judged as "failed"; Step 3: Reward calculation – call the caluReward function to calculate the reward: when the attack is successful, the reward = maximum variable asynchronous length - current variable asynchronous length (encourages early success and reduces invalid attempts); when the attack fails, the reward is calculated based on the "edit distance" (degree of difference) between the attack vector extracted from the response page and the original attack vector (the smaller the edit distance, the higher the reward, guiding the model to optimize the mutation strategy).

[0025] Feedback mechanism: The "attack result" and "reward" are fed back to the attack vector generation layer for policy updates in the reinforcement learning model.

[0026] In one embodiment of this application, the vulnerability information display layer uses the Vue framework to develop the front-end interface, and Python is used for the back-end to implement data interaction. The core functions are "test result visualization" and "test task management". The interface is shown in Figures 5, 6, 7, 8, 9, and 10. The specific implementation is as follows: Visualization content: The displayed test results include: Basic vulnerability information: vulnerability type (such as Class II, Class IV, etc.), target address (URL of the page where the vulnerability is located), injection point parameters (such as keyword), and exploitable attack vectors; Attack process information: number of attack attempts, attack test task information (task name, target address, task status, number of vulnerabilities, creation time); Task management function: Supports the creation of new attack test tasks (specifying the target address, number of threads, test frequency - such as once, daily, weekly, to meet the needs of regular drills in the target range), and when a new attack test task is created, the "injection point exploration task" is automatically triggered. The attack test is started only after the injection point exploration is completed, as shown in Figure 8.

[0027] User Interface: Testers can view detailed information about individual vulnerabilities (such as attack vectors) through the "Vulnerability Information Report"—the attack test result details page shown in Figure 10. <scscriptript>alERt(1)< / scscriptript> (Attack attempts 4 times). You can also view the execution status of all tasks through the "Task List" - the attack test task list page shown in Figure 9, which supports search, pagination and other operations.

[0028] In one embodiment of this application, to verify the effectiveness of the system, a test environment was built based on a network test range. The environment topology is shown in Figure 11, and the specific configuration is shown in Table 1 below: Table 1

[0029] Perform the following operations on the three target ranges respectively: launch the "Injection Point Exploration Task" of XSSExplore to discover injection points in the web applications of each target range; based on the detailed injection point information, launch the "Attack Test Task" to dynamically generate attack vectors and launch attacks; the attack verification layer judges the attack results in real time, and the vulnerability information display layer records the test results; perform the same test process on the three traditional tools to ensure that the test conditions are consistent.

[0030] The Youden Index, recommended by the OWASP Benchmark project, is used as the core evaluation metric to comprehensively measure the tool's "vulnerability identification capability" and "false positive control capability." The calculation formula is as follows:

[0031]

[0032]

[0033] Among them, TP indicates that the tool correctly identifies real vulnerabilities; FN indicates that it cannot identify real vulnerabilities; TN indicates that it correctly ignores false alarms; FP indicates that it cannot ignore false alarms; Sensitivity indicates the tool's ability to correctly identify vulnerabilities; Specificity is used to measure the tool's false positive rate, and its sum with FPR (False Positive Rate) is 1.

[0034] The test results are shown in Table 2, Figure 12, and Figure 13. As can be seen from the figures, for the three target ranges Webseclab, XSS-labs, and WAVSEP, the designed XSSExplore performs better than traditional brute-force scanners, with Youden indices of 0.8, 0.6, and 0.77 respectively, and an average Youden indices of 0.72, exceeding other tools by 0.4. The main reasons are: accurate injection point discovery: exploring web applications through reinforcement learning agents and combining probe vector testing to analyze injection point context, improving vulnerability coverage; dynamic attack vector generation: adjusting mutation strategies based on attack feedback, avoiding the blindness of fixed vectors, and improving attack success rate; and accurate attack verification: reducing false positives (100% specificity) through dual verification of "pop-up listening + DOM tree traversal".

[0035] Table 2

[0036] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0038] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0039] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0040] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An automated XSS vulnerability attack system for network testing ranges, characterized in that, The system comprises an injection point information acquisition layer, an attack vector generation layer, an attack verification layer, and a vulnerability information display layer, which interact sequentially. Specifically: the injection point information acquisition layer is used to discover potential injection points in web applications within a network testbed, analyze the type of injection point, context information, and the output display position corresponding to the input data, and output detailed injection point information; the attack vector generation layer is used to define a reinforcement learning environment based on the detailed injection point information, select an initial attack vector of the corresponding type from the initial attack vector list, select the optimal mutation strategy to mutate the initial attack vector according to the current environment state, construct an attack request, and launch an attack; the attack verification layer is used to analyze the response page corresponding to the attack request, determine whether the attack was successful, and provide a reward to the attack vector generation layer; the vulnerability information display layer is used to visualize the XSS vulnerability test results of the web application, including the vulnerability type and exploitable attack vectors.

2. The automated XSS vulnerability attack system for network test ranges according to claim 1, characterized in that, The injection point information acquisition layer includes an injection point identification submodule and an injection point analysis submodule. Specifically: the injection point identification submodule explores web applications using a reinforcement learning agent, extracts the set of actions the agent can execute in its current state, inputs the action set into a reinforcement learning model to obtain the optimal action, converts the string-based action object corresponding to the optimal action into a Selenium object for localization, identifies the type of the optimal action and executes it, and records all pages containing injection points. The action types include click operations and input operations. When executing input operations, an online data generator is used to generate input data of the corresponding type. The online data generator is a pattern-based open-source test data generator. The injection point analysis submodule receives a set of page URLs containing injection points, constructs a unique probe vector for each injection point on each page, and sends probe data packets to the target page.

3. The automated XSS vulnerability attack system for network test ranges according to claim 2, characterized in that, The injection point analysis submodule determines whether the response page contains the probe vector corresponding to the injection point: if it does, the injection point is determined to be a reflection injection point, and the injection point context information and the response page URL are stored in the injection point details. If not included, the response page is traced through taint marking. If the response page is successfully traced, the injection point is determined to be a stored injection point, and the injection point context information and the response page URL are stored in the injection point details. If no response page is found, it is determined that the injection point does not have a vulnerability.

4. The automated XSS vulnerability attack system for network test ranges according to claim 1, characterized in that, The reinforcement learning environment defined by the attack vector generation layer includes a state space, an action space, a reward function, and a maximum variation length. The attack vector generation layer also includes an experience cache pool for storing experience data after each attack. This experience data includes the current state, the executed mutation policy, the reward, the new state, and the attack result. The attack vector generation layer samples a preset amount of experience data from the experience cache pool, updates the parameters of the Actor network and the Critic target network, and synchronizes the parameters of the Critic target network to the Critic main network every preset step. The Critic main network is used to decide the optimal mutation policy.

5. The automated XSS vulnerability attack system for network test ranges according to claim 4, characterized in that, During the attack process, the attack vector generation layer determines: if the attack vector successfully triggers an XSS vulnerability, then stops testing the current injection point and outputs the test results; If the maximum mutation length is reached but the vulnerability is not triggered, the current injection point is determined to be vulnerability-free and the test is stopped; if the maximum mutation length is not reached and the vulnerability is not triggered, the environment state is updated and the optimal mutation strategy is selected for the attack.

6. The automated XSS vulnerability attack system for network test ranges according to claim 1, characterized in that, The attack verification layer sets the attack code of all attack vectors as pop-up functions; the attack verification layer listens for pop-up events on the response page through Webdriver. If a pop-up event is detected, the attack is considered successful, and the reward is the difference between the maximum variable asynchronous length and the current variable asynchronous length. If no pop-up event is detected, the DOM syntax tree structure of the response page is extracted and traversed. If the pop-up function is found in the DOM syntax tree, the attack is considered successful, and the reward is the difference between the maximum variable asynchronous length and the current variable asynchronous length. If no pop-up function is found, the reward is calculated based on the edit distance between the attack vector in the response page and the original attack vector, and the attack is deemed to have failed.

7. The automated XSS vulnerability attack system for network test ranges according to claim 1, characterized in that, The visualization content of the vulnerability information display layer also includes injection point parameters, number of attack attempts, and attack test task information; the attack test task information includes task name, target address, task status, number of vulnerabilities, and creation time; the vulnerability information display layer supports the creation of new attack test tasks and allows specification of the execution frequency of attack test tasks.

Images