WO2015067114A1 - 基于文档对象模型的跨站脚本攻击漏洞检测方法、装置、终端及介质 - Google Patents

基于文档对象模型的跨站脚本攻击漏洞检测方法、装置、终端及介质 Download PDF

Info

Publication number
WO2015067114A1
WO2015067114A1 PCT/CN2014/088283 CN2014088283W WO2015067114A1 WO 2015067114 A1 WO2015067114 A1 WO 2015067114A1 CN 2014088283 W CN2014088283 W CN 2014088283W WO 2015067114 A1 WO2015067114 A1 WO 2015067114A1
Authority
WO
WIPO (PCT)
Prior art keywords
parameter value
object model
document object
webpage
value pair
Prior art date
Application number
PCT/CN2014/088283
Other languages
English (en)
French (fr)
Inventor
翁家才
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to US15/034,363 priority Critical patent/US9754113B2/en
Publication of WO2015067114A1 publication Critical patent/WO2015067114A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2119—Authenticating web pages, e.g. with suspicious links

Definitions

  • the present invention relates to the field of network technologies, and in particular, to a Document Object Model (DOM)-based Cross Site Script (XSS) vulnerability detection method and apparatus, and a terminal.
  • DOM Document Object Model
  • XSS Cross Site Script
  • the XSS vulnerability is the most common vulnerability in the Internet today. It can be triggered by various browsers such as IE, Chrome, FireFox, etc., and the damage is very huge.
  • XSS is a malicious attacker who adds malicious code to a web page and entice a user to access it.
  • malicious code is executed on the user's machine, causing the malicious attacker to steal user information, or at the user.
  • the machine is attacked by a horse and remotely gains control of the user's machine.
  • Ordinary reflective XSS has obvious echo features in the return page source code, which is relatively easy to detect.
  • DOM XSS occurs when the browser executes JavaScript (JS) code and changes the page DOM tree. The malicious code is not echoed back to the page source.
  • JS JavaScript
  • an embodiment of the present invention provides a method, device, and terminal for detecting a cross-site scripting vulnerability based on a document object model.
  • a method for detecting a cross-site scripting vulnerability based on a document object model includes:
  • the feature script is a malicious code that contains malicious characters and can be uniquely identified in a document object model tree of the webpage;
  • a document object model based cross-site scripting vulnerability detection apparatus comprising:
  • An obtaining module configured to obtain a set of parameter value pairs in an original web address of the webpage, where the parameter value pair includes at least one parameter value pair in the set;
  • a replacement module configured to replace a parameter value in the parameter value pair with a feature script to form a test URL of the webpage;
  • the feature script is a malicious character and can be uniquely identified in a document object model tree of the webpage Malicious code;
  • the obtaining module is further configured to obtain a page content corresponding to the test URL;
  • a conversion module configured to convert the page content into a document object model tree
  • a detecting module configured to detect, according to the document object model tree and the feature script, whether the cross-site scripting vulnerability exists in the parameter value pair.
  • a terminal wherein the terminal object is provided with a cross-site scripting vulnerability detecting apparatus based on a document object model as described above.
  • Still another aspect provides a non-transitory computer readable storage medium having stored thereon computer executable instructions for executing the above-described document object model based cross-site scripting vulnerability when running the executable instructions in a computer Detection method.
  • the DOM XSS vulnerability can be effectively discovered, which greatly improves the vulnerability discovery capability and detection efficiency.
  • FIG. 1 is a flowchart of a DOM XSS vulnerability detection method according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a DOM XSS vulnerability detection method according to another embodiment of the present invention.
  • FIG. 3 is a diagram showing an example of detection results of a DOM XSS vulnerability detection scheme according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a DOM XSS vulnerability detecting apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a DOM XSS vulnerability detecting apparatus according to another embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a DOM XSS vulnerability detection method according to an embodiment of the present invention.
  • the Document Object Model (DOM)-based Cross Site Script (XSS) vulnerability detection method in this embodiment is simply referred to as the DOM XSS vulnerability detection method.
  • the DOM XSS vulnerability detection method in this embodiment may include the following steps.
  • the parameter value pair set of the embodiment includes at least one parameter value pair.
  • the webpage is a webpage that may have an XSS, and may be, for example, a Common Gateway Interface (CGI) with parameters, or a static page without parameters.
  • CGI Common Gateway Interface
  • the user can control the input place in the webpage corresponding to the webpage as a parameter value pair in the webpage, that is, a target point to be detected.
  • the parameter value pairs can be a.html#XXX and a.html? XXX.
  • the feature script of this embodiment is malicious code that contains malicious characters and can be uniquely identified in the DOM tree of the web page.
  • the feature script can also be referred to as a JS feature script.
  • the malicious characters may be malicious characters obtained according to the existing XSS vulnerability detection scheme, such as characters ⁇ , characters>, characters ", characters", characters ', characters', and characters/etc.
  • the above parameter pair XXX represents a parameter value that needs to be replaced with a feature script.
  • each feature script needs sequential independent detection. Obviously, the more feature scripts, the stronger the vulnerability discovery capability, but the slower the overall detection efficiency, the strict control of the number of feature scripts while ensuring sufficient discovery capability to ensure detection efficiency.
  • a feature script is taken as an example to describe the technical solution of the present invention. For each feature script, a similar scheme may be used for detection, and details are not described herein again.
  • a parameter script may be substituted for the parameter value for each parameter value pair in the set of parameter value pairs to form a test URL for the web page.
  • the scripts are tested one by one to ensure the efficiency of the test.
  • the feature script of the embodiment of the present invention may be preset according to experience.
  • the page content corresponding to the test URL can be obtained from the web server of the test URL.
  • the page content in this embodiment refers to all the information included in the webpage corresponding to the web address, and may include text, pictures, and the like.
  • the content of the page corresponding to the test URL refers to all the information included in the webpage corresponding to the test URL.
  • the DOM tree is a tree representation of the data and structure on the page in the page content
  • the page Content is the representation of data and structure in the DOM tree.
  • the DOM tree and page content are two representations of data and structure. According to the corresponding relationship between the two, they can be converted to each other. For example, in the specific conversion, all the tag nodes in the source code of the webpage content may be displayed according to the parent-child relationship between the nodes, and the DOM tree structure of the content of the page is obtained.
  • the execution body of the DOM XSS vulnerability detection method in this embodiment is a DOM XSS vulnerability detection device, which may be specifically obtained through software integration, for example, may be a software integration tool.
  • the inserted feature script can be found only in the converted DOM tree, and the DOM XSS vulnerability can be effectively discovered without triggering the execution of the feature script, thereby greatly improving the vulnerability discovery.
  • Ability and efficiency of detection by using the above solution, the inserted feature script can be found only in the converted DOM tree, and the DOM XSS vulnerability can be effectively discovered without triggering the execution of the feature script, thereby greatly improving the vulnerability discovery.
  • Ability and efficiency of detection can be used in the converted DOM tree.
  • the step 104 “detecting whether the parameter value pair has an XSS vulnerability according to the DOM tree and the feature script” may include: determining whether a feature script is included in the DOM tree, When included, it is determined that the parameter value pair has an XSS vulnerability; when not included, it is determined that the parameter value pair does not have an XSS vulnerability.
  • the step 102 “acquiring the page content corresponding to the test website” includes: requesting, by the website server of the test website, the page content corresponding to the test website; and receiving the website of the test website. The page content of the server response.
  • the method may further include the step of: receiving the original webpage input by the user through the human interface module.
  • URL a human machine interface module can be set on the DOM XSS vulnerability detecting device, and the human interface module is configured to receive the original web address of the webpage input by the user.
  • the method may further include: when the feature script is not included in the document object model tree, triggering a button in the execution webpage, and in response to the button being triggered, updating the location Determining, according to the updated document object model tree and the feature script, whether the parameter value pair has a cross-site scripting vulnerability, until all buttons in the webpage are triggered and no vulnerability is detected. There is no vulnerability in this page, otherwise there will be a vulnerability in the page if there is a vulnerability in the page after a button is triggered. This can be triggered for some of the more complex DOM XSS vulnerabilities, such as partial DOM XSS vulnerabilities that need to be clicked on a button on the returned page.
  • the solution of the present invention can still be solved, and the DOM XSS vulnerability detection range of the technical solution of the present invention is further expanded.
  • the technical solution of the foregoing embodiment only needs to find the inserted feature script in the converted DOM tree, and the feature script can be triggered to execute to effectively discover the DOM XSS vulnerability, thereby greatly improving the vulnerability discovery capability and the detection efficiency.
  • the technical solution of the above embodiment can also detect, further expand the detection range of the DOM XSS vulnerability, and improve the vulnerability discovery capability.
  • the technical solution of the above embodiment can not only detect the DOM XSS vulnerability, but also effectively detect the common anti- The XSS vulnerability is very applicable.
  • FIG. 2 is a flowchart of a DOM XSS vulnerability detection method according to another embodiment of the present invention.
  • the DOM XSS vulnerability detection method of this embodiment is based on the technical solutions of the embodiment shown in FIG. 1 and its optional embodiments, and the technical solution of the present invention is introduced in more detail.
  • the DOM XSS vulnerability detection method in this embodiment may specifically include the following steps:
  • the DOM XSS vulnerability detecting device receives the original web address of the webpage input by the user through the human interface module; performing step 201;
  • the human interface module of this embodiment may be a touch screen or a keyboard or the like.
  • the original URL of the webpage can be input through its touch screen.
  • the DOM XSS vulnerability detection device has a keyboard
  • the original URL of the web page can be entered via the keyboard.
  • DOM XSS vulnerability detection device parses the original URL of the webpage, and obtains a set of parameter value pairs in the original webpage of the webpage; step 202;
  • the DOM XSS vulnerability detection device analyzes the original URL of the webpage, extracts all pairs of parameter values included therein, and extracts all pairs of parameter values to form a set of parameter value pairs.
  • the DOM XSS vulnerability detecting device determines whether there is a pair of parameter values to be detected; when yes, step 203 is performed; otherwise, when not present, the DOM XSS vulnerability detection ends;
  • the DOM XSS vulnerability detection device can specifically determine whether the set of parameter values is an empty set. When the set is empty, there is no pair of parameter values to be detected, and the DOM XSS vulnerability detection ends. When the parameter value pair is a non-empty set, step 203 can be performed at this time to continue the detection.
  • DOM XSS vulnerability detection device determines the current parameter value pair to be detected; performing step 204;
  • the test may be performed one by one according to the order of each parameter value in the original URL of the web page.
  • First test When trying, obtain the first parameter value pair in the original URL of the webpage, and then select one by one according to the order of each parameter value pair. When it does not exist, the parameter value pair in the original URL of the web page is tested for each parameter value pair in the set, and the corresponding DOM XSS vulnerability detection ends.
  • DOM XSS vulnerability detection device uses a feature script to replace the parameter value, forming a test URL of the web page; performing step 205;
  • the feature script is a malicious code that contains a malicious character and can be uniquely identified in the DOM tree of the webpage.
  • the feature script can also be referred to as a JS feature script. For details, refer to the description of the related embodiments, and details are not described herein.
  • the DOM XSS vulnerability detection device requests the website content corresponding to the test URL from the website server of the test website; and step 206 is performed;
  • the DOM XSS vulnerability detection device Since the page content of the URL is stored in the server of the website, when the DOM XSS vulnerability detection device wants to obtain the content of the page, it needs to request the content of the page corresponding to the test URL from the website server of the test URL.
  • the DOM XSS vulnerability detection device receives the page content of the web server response of the test website; performing step 207;
  • the web server of the test URL When the web server of the test URL receives a request from the DOM XSS vulnerability detection device, it returns a page content response to the DOM XSS vulnerability detection device. Corresponding to the content of the page received by the DOM XSS vulnerability detection device on the DOM XSS vulnerability detection device side.
  • DOM XSS vulnerability detection device converts the page content into a DOM tree; step 208;
  • the DOM XSS vulnerability detection device After receiving the content of the page, the DOM XSS vulnerability detection device converts the data and structure on the page in the page content into a corresponding DOM tree. For example, in the specific conversion, all the tag nodes in the source code of the webpage content may be displayed according to the parent-child relationship between the nodes, and the DOM tree structure of the content of the page is obtained.
  • the DOM XSS vulnerability detecting device determines whether a feature script is included in the DOM tree. When included, step 209 is performed; otherwise step 210 is performed;
  • the DOM XSS vulnerability detection device detects all the information of the DOM tree and determines whether the feature script is included in the DOM tree.
  • the DOM XSS vulnerability detecting apparatus determines that the parameter value pair has an XSS vulnerability; and step 202 is performed;
  • the DOM XSS vulnerability detection device detects all the information of the DOM tree and determines that the feature script is included in the DOM tree, it is determined that the parameter value pair has an XSS vulnerability.
  • the DOM XSS vulnerability detecting apparatus determines that the parameter value pair does not have an XSS vulnerability; and performs step 202.
  • the DOM XSS vulnerability detection device detects all the information of the DOM tree and determines that the feature script is not included in the DOM tree, it is determined that the parameter value pair does not have an XSS vulnerability. At this point, the next parameter value pair can be detected in a similar manner as described above.
  • a feature script is still taken as an example for description.
  • multiple feature scripts may be preset, and each parameter value pair is detected by using multiple feature scripts.
  • each parameter value pair is detected by using multiple feature scripts.
  • step 208 "DOM XSS vulnerability detection device determines that the DOM tree does not include feature scripts" Then, before step 210, the DOM XSS vulnerability detection device triggers the execution of the button in the webpage, and then returns to steps 205-208. If the button is triggered, the DOM XSS vulnerability detection device also determines that the feature script is still not included in the DOM tree. The XSS vulnerability detection device triggers the next button in the execution webpage until all the buttons are triggered, and the feature script is not included in the DOM tree. 210.
  • the DOM XSS vulnerability detection device determines that the parameter value pair does not have an XSS vulnerability.
  • the technical solution of the embodiment only needs to find the inserted feature script in the converted DOM tree, and the feature script can be triggered to execute to effectively discover the DOM XSS vulnerability, thereby greatly improving the vulnerability discovery capability and the detection efficiency.
  • the technical solution of the above embodiment can also detect, further expand the detection range of the DOM XSS vulnerability, and improve the vulnerability discovery capability.
  • the technical solution of the above embodiment can not only detect the DOM XSS vulnerability, but also effectively detect the common reflective XSS vulnerability, and the applicability is very strong.
  • FIG. 3 is a diagram showing an example of detection results of a DOM XSS vulnerability detection scheme according to an embodiment of the present invention. As shown in FIG.
  • FIG. 4 is a schematic structural diagram of a DOM XSS vulnerability detecting apparatus according to an embodiment of the present invention.
  • the DOM XSS vulnerability detection apparatus of this embodiment may specifically include an acquisition module 10, a replacement module 11, a conversion module 12, and a detection module 13.
  • the obtaining module 10 is configured to obtain a set of parameter value pairs in the original webpage of the webpage, and the parameter value pair set includes at least one parameter value pair; the replacing module 11 is connected to the obtaining module 10, and the replacing module 11 is used to acquire the acquiring module 10.
  • the parameter value pairs the parameter value pairs in the set, and the feature script replaces the parameter values to form a test URL of the webpage;
  • the feature script is a malicious code that contains malicious characters and can be uniquely identified in the DOM tree of the webpage;
  • the obtaining module 10 is also used for Get replacement
  • the module 11 replaces the page content corresponding to the obtained test URL;
  • the conversion module 12 is connected to the acquisition module 10, and the conversion module 12 is configured to convert the page content acquired by the acquisition module 10 into a DOM tree;
  • the detection module 13 is connected to the conversion module 12, and detects The module 13 is configured to detect, according to the DOM tree and the feature script converted by the conversion module 12, whether the parameter value pair has an XSS vulnerability.
  • the feature script can be pre-set.
  • the DOM XSS vulnerability detection device of the present embodiment is the same as the implementation mechanism of the foregoing method embodiment by using the above-mentioned module to implement the DOM XSS vulnerability.
  • the DOM XSS vulnerability detection device of the present embodiment is the same as the implementation mechanism of the foregoing method embodiment by using the above-mentioned module to implement the DOM XSS vulnerability.
  • the DOM XSS vulnerability detecting apparatus of this embodiment can find the inserted feature script only in the converted DOM tree by using the above module, and can effectively discover the DOM XSS vulnerability by triggering the execution of the feature script, thereby greatly improving the vulnerability discovery.
  • FIG. 5 is a schematic structural diagram of a DOM XSS vulnerability detecting apparatus according to another embodiment of the present invention. As shown in FIG. 5, the embodiment further includes the following optional technical solutions on the basis of the foregoing embodiment shown in FIG.
  • the detecting module 13 in the DOM XSS vulnerability detecting apparatus of the embodiment is specifically configured to determine whether a feature script is included in the DOM tree, and when included, determining that the parameter value pair has an XSS vulnerability; when not included , determining that the parameter value pair does not have an XSS vulnerability.
  • the obtaining module 10 in the DOM XSS vulnerability detecting apparatus of the embodiment is specifically configured to request the website server 20 of the test website to request the page content corresponding to the test website; and receive the website server 20 of the test website. The content of the page in response.
  • the website server 20 interacting with the acquisition module 10 is also shown.
  • the website server is a server of a website, and the website server 20 stores the page content of all the web pages under the website, and is in other When a device or module requests a page content from it, it responds to the requested device or module with the requested page content.
  • the website server 20 receives the request for obtaining the page content corresponding to the test URL sent by the module 10, the page content corresponding to the test URL is obtained, and the acquisition module is obtained. 10: Send a response to send the page content corresponding to the test URL to the obtaining module 10.
  • the DOM XSS vulnerability detecting apparatus of this embodiment may further include a receiving module 14.
  • the receiving module 14 is configured to receive an original web address of a webpage input by a user through a human interface module.
  • the corresponding obtaining module 10 is connected to the receiving module 14 , and the obtaining module 10 is configured to obtain a set of parameter value pairs in the original web address of the webpage received by the receiving module 14 .
  • the DOM XSS vulnerability detecting apparatus of this embodiment may further include an engine triggering module 15, which is an alternate auxiliary module of the embodiment of the present invention.
  • an engine triggering module 15 For some DOM XSS vulnerabilities, a button needs to be clicked to trigger. At this time, the DOM XSS vulnerability of the feature script cannot be found in the DOM tree generated by the initial return page, and the detection module 13 detects that the document object model tree does not include the feature script.
  • the engine triggering module 15 triggers the execution of the button in the webpage, so that the DOM XSS vulnerability is triggered.
  • the acquiring module 10 acquires the page content corresponding to the test URL that has been triggered by the engine triggering module 15.
  • the acquisition module 10 is therefore also connected to the engine trigger module 15.
  • the obtaining module 10 obtains the page content corresponding to the obtained test URL replaced by the replacement module 11;
  • the conversion module 12 converts the page content obtained by the obtaining module 10 into a DOM tree; and the DOM converted by the detecting module 13 according to the conversion module 12
  • the tree and feature scripts detect if there is an XSS vulnerability in the parameter value pair. If the button is triggered, the detecting module 13 further determines that the feature script is still not included in the DOM tree. At this time, the engine triggering module 15 triggers the execution of the next button in the webpage until all the buttons are triggered, and the detecting module 13 detects the DOM tree.
  • the technical solution of the embodiment of the present invention can also detect and further improve the vulnerability discovery capability for some more complex DOM XSS vulnerabilities.
  • the DOM XSS vulnerability detecting apparatus of this embodiment implements DOM by adopting the above module
  • the detection of the XSS vulnerability is the same as that of the foregoing method embodiment.
  • the DOM XSS vulnerability detecting apparatus of this embodiment only needs to find the inserted feature script in the converted DOM tree by using the above module, and can effectively discover the DOM XSS vulnerability by triggering the execution of the feature script, thereby greatly improving the vulnerability discovery capability. And detection efficiency.
  • the technical solution of the above embodiment can also detect, further expand the detection range of the DOM XSS vulnerability, and improve the vulnerability discovery capability.
  • the technical solution of the above embodiment can not only detect the DOM XSS vulnerability, but also effectively detect the common reflective XSS vulnerability, and the applicability is very strong.
  • the DOM XSS vulnerability detecting apparatus of this embodiment may be specifically disposed on the browser client side and used as an engine device of the browser. It can also be set in a terminal to perform its functions separately.
  • FIG. 6 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal can be used to implement the DOM XSS vulnerability detection method provided in the foregoing embodiment.
  • the terminal device 800 can include a communication unit 110, a memory 120 including one or more computer readable storage media, an input unit 130, a display unit 140, a sensor 150, an audio circuit 160, a WiFi (wireless fidelity) module 170.
  • a processor 180 having one or more processing cores, and a power supply 190 and the like are included. It will be understood by those skilled in the art that the terminal device structure shown in FIG. 6 does not constitute a limitation of the terminal device, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements. among them:
  • the communication unit 110 can be used for transmitting and receiving information and receiving and transmitting signals during a call.
  • the communication unit 110 can be an RF (Radio Frequency) circuit, a router, a modem, or the like.
  • RF circuits as communication units include, but are not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, and a LNA (Low Noise Amplifier, low). Noise amplifier), duplexer, etc.
  • SIM Subscriber Identity Module
  • the communication unit 110 can also communicate with the network and other devices through wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.
  • the memory 120 can be used to store software programs and modules, and the processor 180 executes various functional applications and data processing by running software programs and modules stored in the memory 120.
  • the memory 120 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to The data created by the use of the terminal device 800 (such as audio data, phone book, etc.) and the like.
  • memory 120 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, memory 120 may also include a memory controller to provide access to memory 120 by processor 180 and input unit 130.
  • the input unit 130 can be configured to receive input numeric or character information and to generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls.
  • input unit 130 can include touch-sensitive surface 131 as well as other input devices 132.
  • Touch-sensitive surface 131 also referred to as a touch display or trackpad, can collect touch operations on or near the user (such as a user using a finger, stylus, etc., on any suitable object or accessory on touch-sensitive surface 131 or The operation near the touch-sensitive surface 131), and driving the corresponding connection according to a preset program Set.
  • the touch-sensitive surface 131 can include two portions of a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 180 is provided and can receive commands from the processor 180 and execute them.
  • the touch-sensitive surface 131 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 130 can also include other input devices 132.
  • other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 140 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the terminal device 800, which can be composed of graphics, text, icons, video, and any combination thereof.
  • the display unit 140 may include a display panel 141.
  • the display panel 141 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like.
  • the touch-sensitive surface 131 may cover the display panel 141, and when the touch-sensitive surface 131 detects a touch operation thereon or nearby, it is transmitted to the processor 180 to determine the type of the touch event, and then the processor 180 according to the touch event The type provides a corresponding visual output on display panel 141.
  • touch-sensitive surface 131 and display panel 141 are implemented as two separate components to implement input and input functions, in some embodiments, touch-sensitive surface 131 can be integrated with display panel 141 for input. And output function.
  • Terminal device 800 may also include at least one type of sensor 150, such as a light sensor, motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 141 according to the brightness of the ambient light, and the proximity sensor may close the display panel 141 when the terminal device 800 moves to the ear. And / or backlight.
  • the gravity acceleration sensor can detect in all directions (a Generally, it is the size of the three-axis acceleration. When it is still, it can detect the magnitude and direction of gravity. It can be used to identify the gesture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer attitude calibration), vibration recognition related functions (such as step counting).
  • Others such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, which are also configurable by the terminal device 800, will not be described herein.
  • the audio circuit 160, the speaker 161, and the microphone 162 can provide an audio interface between the user and the terminal device 800.
  • the audio circuit 160 can transmit the converted electrical data of the received audio data to the speaker 161 for conversion to the sound signal output by the speaker 161; on the other hand, the microphone 162 converts the collected sound signal into an electrical signal by the audio circuit 160. After receiving, it is converted into audio data, and then processed by the audio data output processor 180, transmitted to the terminal device such as another terminal device via the RF circuit 110, or outputted to the memory 120 for further processing.
  • the audio circuit 160 may also include an earbud jack to provide communication of the peripheral earphones with the terminal device 800.
  • the terminal device may be configured with a wireless communication unit 170, which may be a WiFi module.
  • WiFi is a short-range wireless transmission technology
  • the terminal device 800 can help a user to send and receive emails, browse web pages, and access streaming media through the wireless communication unit 170, which provides wireless broadband Internet access for users.
  • FIG. 6 shows the wireless communication unit 170, it can be understood that it does not belong to the essential configuration of the terminal device 800, and may be omitted as needed within the scope of not changing the essence of the invention.
  • the processor 180 is the control center of the terminal device 800, which connects various portions of the entire handset using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 120, and recalling data stored in the memory 120.
  • the various functions and processing data of the terminal device 800 are executed to perform overall monitoring of the mobile phone.
  • the processor 180 may include one or more processing cores; preferably, the processor 180 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications. It can be understood that the above modulation and demodulation processor It may also not be integrated into the processor 180.
  • the terminal device 800 further includes a power source 190 (such as a battery) for supplying power to the various components.
  • a power source 190 such as a battery
  • the power source can be logically connected to the processor 180 through the power management system to manage functions such as charging, discharging, and power management through the power management system.
  • Power supply 190 may also include any one or more of a DC or AC power source, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.
  • the terminal device 800 may further include a camera, a Bluetooth module, and the like, and details are not described herein again.
  • the display unit of the terminal device is a touch screen display
  • the terminal device further includes a memory, and one or more programs, wherein one or more programs are stored in the memory and configured to be one or one
  • the above processor executing the one or more programs includes instructions for: acquiring a set of parameter value pairs in an original web address of the web page, the parameter value pair including at least one parameter value pair in the set; replacing the feature script with a feature script
  • the parameter value in the pair of parameter values forms a test URL of the webpage;
  • the feature script is a malicious code that contains a malicious character and can be uniquely identified in a document object model tree of the webpage; and the test URL is obtained Corresponding page content; converting the page content into a profile object model tree; detecting, according to the document object model tree and the feature script, whether there is a cross-site scripting vulnerability.
  • the memory is further configured to: store whether the feature script is included in the document object model tree, and when included, determine that the parameter value pair has a cross-site scripting vulnerability; when not included, Determine that there is no cross-site scripting vulnerability in the parameter value pair.
  • the memory is further configured to: store, by the website server of the test website, the page content corresponding to the test website; and receive the page content of the website server response of the test website.
  • the memory is further configured to store an instruction to receive an original web address of the webpage input by the user through the human interface module.
  • the memory is further configured to: when the feature script is not included in the document object model tree, trigger a button in the webpage; acquire a page content corresponding to the test URL; The page content is converted into a document object model tree; and the parameter value pair is detected according to the document object model tree and the feature script to detect whether there is a cross-site scripting vulnerability.
  • the DOM XSS vulnerability detection device only exemplifies the division of each functional module when the DOM XSS vulnerability detection service is triggered.
  • the foregoing functions may be allocated differently according to requirements.
  • the functional module is completed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.
  • the DOM XSS vulnerability detection device provided by the foregoing embodiment is the same as the DOM XSS vulnerability detection method embodiment, and the specific implementation process is described in detail in the method embodiment, and details are not described herein again.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Information Transfer Between Computers (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本发明公开了一种基于文档对象模型的跨站脚本攻击漏洞检测方法及装置、终端。所述方法包括：获取网页的原始网址中的参数值对集合，参数值对集合中包括至少一个参数值对；采用特征脚本替换所述参数对的参数值形成网页的测试网址，特征脚本为包含有恶意字符且能在网页的文档对象模型树中唯一标识的恶意代码；获取测试网址对应的页面内容；将页面内容转化为文档对象模型树；根据文档对象模型树和特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。本发明通过采用上述方案，只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。

Description

基于文档对象模型的跨站脚本攻击漏洞检测方法、装置、终端及介质
本申请要求于2013年11月8日提交中国专利局、申请号为201310554402.1、发明名称为“基于文档对象模型的跨站脚本攻击漏洞检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络技术领域，特别涉及一种基于文档对象模型(Document Object Model，DOM)的跨站脚本攻击(Cross Site Script，XSS)漏洞检测方法及装置、终端。
背景技术
XSS漏洞是当今互联网最为普遍的漏洞，可以在IE，Chrome，FireFox等各个浏览器触发，危害十分巨大。
通常情况下，XSS是恶意攻击者通过在网页中加入恶意代码并诱使用户访问，当访问者浏览网页时恶意代码会在用户机器上执行，从而导致恶意攻击者盗取用户信息，或者在用户机器上进行挂马攻击并远程获得用户机器的控制权。普通反射型XSS在返回页面源码中具有明显的回显特征，比较容易检测。与普通反射型XSS不同的是，DOM XSS是在浏览器执行JavaScript(简称JS)代码并改变页面DOM树时发生的，恶意代码并不在返回页面源码中回显。
现有的DOM XSS漏洞检测方案，要触发执行所***的特征JS脚本 才能发现XSS漏洞，且只有在***的特征JS脚本与动态网页内容的上下文语法完全吻合时才有可能触发执行特征JS脚本，这就导致需要尝试足够多类型的特征JS脚本，而且每次尝试执行JS脚本都需花费大量时间，这大大降低了漏洞发现能力与检测效率。
发明内容
有鉴于此，本发明实施例提供了一种基于文档对象模型的跨站脚本攻击漏洞检测方法及装置、终端。
一方面，提供了一种基于文档对象模型的跨站脚本攻击漏洞检测方法，所述方法包括：
获取网页的原始网址中的参数值对集合，所述参数值对集合中包括至少一个参数值对；
采用特征脚本替换所述参数值对中的参数值，形成所述网页的测试网址；所述特征脚本为包含有恶意字符且能在所述网页的文档对象模型树中唯一标识的恶意代码；
获取所述测试网址对应的页面内容；
将所述页面内容转化为文档对象模型树；
根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
另一方面，提供了一种基于文档对象模型的跨站脚本攻击漏洞检测装置，所述装置包括：
获取模块，用于获取网页的原始网址中的参数值对集合，所述参数值对集合中包括至少一个参数值对；
替换模块，用于采用特征脚本替换所述参数值对中的参数值，形成所述网页的测试网址；所述特征脚本为包含有恶意字符且能在所述网页的文档对象模型树中唯一标识的恶意代码；
所述获取模块，还用于获取所述测试网址对应的页面内容；
转化模块，用于将所述页面内容转化为文档对象模型树；
检测模块，用于根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
再一方面，还提供了一种终端，所述终端上设置有如上所述的基于文档对象模型的跨站脚本攻击漏洞检测装置。
再另一方面，还提供一种非瞬时性的计算机可读存储介质，其上存储有计算机可执行指令，当计算机中运行这些可执行指令时，执行上述基于文档对象模型的跨站脚本攻击漏洞检测方法。
本发明实施例提供的基于文档对象模型的跨站脚本攻击漏洞检测方法及装置、终端，通过采用上述方案，只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一实施例提供的DOM XSS漏洞检测方法的流程图。
图2为本发明另一实施例提供的DOM XSS漏洞检测方法的流程图。
图3为本发明实施例的DOM XSS漏洞检测方案的检测结果实例图。
图4为本发明一实施例提供的DOM XSS漏洞检测装置的结构示意图。
图5为本发明另一实施例提供的DOM XSS漏洞检测装置的结构示意图。
图6是本发明实施例提供的一种终端结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
图1为本发明一实施例提供的DOM XSS漏洞检测方法的流程图。本实施例的基于文档对象模型(Document Object Model，DOM)的跨站脚本攻击(Cross Site Script，XSS)漏洞检测方法简称为DOM XSS漏洞检测方法。如图1所示，本实施例的DOM XSS漏洞检测方法，可以包括如下步骤。
100、获取网页的原始网址中的参数值对集合。
本实施例的参数值对集合中包括至少一个参数值对。
本实施例中网页是可能存在XSS的网页，例如可以是带参数的通用网关接口(Common Gateway Interface；CGI)，也可以是无参数的静态页面。所述网页对应的网址中用户能够控制输入地方可以视为该网址中的一个参数值对，也就是需要检测的目标点。比如对于静态页面a.html，其参数值对可以是a.html#XXX和a.html？XXX。对于动态页面a.php？b＝1&c＝2，参数值对可以是b＝XXX和c＝XXX。
101、采用特征脚本替换替换所述参数值对中的参数值，形成网页的测试网址。
本实施例的特征脚本为包含有恶意字符且能在网页的DOM树中唯一标识的恶意代码，该特征脚本也可以称为JS特征脚本。其中恶意字符可以为根据现有的XSS漏洞检测方案得来的恶意字符，例如可以为字符<、字符>、字符“、字符”、字符‘、字符’以及字符/等等。
例如，上述参数对中字串XXX表示需要用特征脚本替换的参数值。如<img src＝x onerror＝alert(/dom-xss/)/>是一个尝试在网页DOM树中***标签的特征脚本。需要说明的是特征脚本可以有若干个，每个特征脚本需要顺序独立的检测。显然，特征脚本越多，漏洞发现能力越强，但整体检测效率越慢，在保证足够发现能力的同时严格控制特征脚本的数目以保证检测效率。本实施例中以一个特征脚本为例来描述本发明的技术方案，对于每一个特征脚本可以采用类似的方案进行检测，在此不再一一举例赘述。
在某些示例性实现中，可以对参数值对集合中的每个参数值对，采用特征脚本替换参数值，形成网页的测试网址。可以按照每个参数值对在网页的原始网址中的先后顺序，一一进行测试，以保证可以对每个参数值对进行测试，而且对每个参数值对进行测试时，可以采用多个特征脚本一一进行测试，以保证测试的效率。本发明实施例的特征脚本可以为根据经验预先设置的。
102、获取测试网址对应的页面内容。
例如可以从测试网址的网站服务器中获取该测试网址对应的页面内容。
本实施例中的页面内容是指网址对应的网页中所包括的所有信息，可以包括文字、图片等等资源。该测试网址对应的页面内容即是指该测试网址对应的网页中所包括的所有信息。
103、将页面内容转化为DOM树。
DOM树是页面内容中页面上数据和结构的一个树形的表示，而页面 内容是DOM树中的数据和结构的表现方式，DOM树和页面内容是数据和结构的两种表现方式，根据两者的对应关系，可以进行互相转换。例如具体转换时，可以将网页内容的源代码中的所有标签节点按照各节点之间的父子关系，将各标签节点展示出来，即得到了该页面内容的DOM树结构。
104、根据DOM树和特征脚本检测所述参数值对是否存在XSS漏洞。
例如当以<img src＝x onerror＝alert(/dom-xss/)/>为一个尝试在网页DOM树中***标签的特征脚本时，可以向测试网址的网站服务器请求参数值对为a.php？b＝<img src＝x onerror＝alert(/dom-xss/)/>&c＝2的页面内容，并将页面内容转化为DOM树，从而根据DOM树和特征脚本“<img src＝xonerror＝alert(/dom-xss/)/>”检测每一个参数值对是否存在XSS漏洞。
本实施例的DOM XSS漏洞检测方法的执行主体为DOM XSS漏洞检测装置，该装置具体可以为通过软件集成得到，例如可以为一个软件集成的工具。
本实施例的DOM XSS漏洞检测方法，通过采用上述方案，只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。
进一步可选地，在上述实施例的技术方案的基础上，其中步骤104“根据DOM树和特征脚本检测所述参数值对是否存在XSS漏洞”，可以包括：判断DOM树中是否包括特征脚本，当包括时，确定所述参数值对存在XSS漏洞；当不包括时，确定所述参数值对不存在XSS漏洞。
例如当根据DOM树中和特征脚本“<img src＝xonerror＝alert(/dom-xss/)/>”检测参数b中是否存在XSS漏洞，即为检测DOM树中是否存在特征脚本“<img src＝x onerror＝alert(/dom-xss/)/>”，当存在时，确定参数b中存在XSS漏洞，否则当不存在时，确定参数b中不存在XSS漏洞。
可选地，在上述实施例的技术方案的基础上，其中步骤102“获取测试网址对应的页面内容“，包括：向测试网址的网站服务器请求测试网址对应的页面内容；并接收测试网址的网站服务器响应的页面内容。
可选地，在上述实施例的技术方案的基础上，其中步骤100“获取网页的原始网址中的参数值对集合”之前，还可以包括步骤：接收用户通过人机接口模块输入的网页的原始网址。例如在DOM XSS漏洞检测装置上可以设置有人机接口模块，该人机接口模块用于接收用户输入的网页的原始网址。
可选地，在上述实施例的技术方案的基础上，还可以包括如下步骤：当文档对象模型树中不包括特征脚本时，触发执行网页中的按钮，响应于所述按钮被触发，更新所述文档对象模型树并根据所述更新的文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞，直到网页中所有的按钮都被触发且未检测到漏洞才能确定该网页不存在漏洞，否则只要有一个按钮被触发后网页存在漏洞，该网页都存在漏洞。这样对于一些更复杂的DOM XSS漏洞，比如部分DOM XSS漏洞需要在返回的页面上点击某个按钮后才能触发。采用本发明的方案仍然可以解决，进一步扩大了本发明技术方案的DOM XSS漏洞检测范围。
上述实施例的所有可选技术方案，可以采用可以结合的方式任意组合形成本发明的可选技术方案，在此不再一一举例。
上述实施例的技术方案，只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。此外对于如需要在返回页面点击按钮后才能触发的更复杂的DOM XSS漏洞，上述实施例的技术方案也能检测到，进一步扩大了DOM XSS漏洞的检测范围，提高了漏洞发现能力。而且上述实施例的技术方案不仅能检测DOM XSS漏洞，也可以有效检测普通反 射型XSS漏洞，适用性非常强。
图2为本发明另一实施例提供的DOM XSS漏洞检测方法的流程图。本实施例的基于DOM XSS漏洞检测方法在上述图1所示实施例及其可选实施例的技术方案的基础上，更加详细地介绍本发明的技术方案。如图2所示，本实施例的基于DOM XSS漏洞检测方法，具体可以包括如下步骤：
200、DOM XSS漏洞检测装置接收用户通过人机接口模块输入的网页的原始网址；执行步骤201；
本实施例的人机接口模块可以为触摸屏或者键盘等等。例如DOMXSS漏洞检测装置带有触摸屏的时候，可以通过其触摸屏输入网页的原始网址。当DOM XSS漏洞检测装置带有键盘时，可以通过键盘输入网页的原始网址。
201、DOM XSS漏洞检测装置对网页的原始网址进行解析，获取网页的原始网址中的参数值对集合；执行步骤202；
具体地，DOM XSS漏洞检测装置对网页的原始网址进行分析，取出其中包括的所有参数值对，取出的所有参数值对构成参数值对集合。
202、DOM XSS漏洞检测装置确定是否存在要检测的参数值对；当存在时，执行步骤203；否则当不存在时，DOM XSS漏洞检测结束；
例如，DOM XSS漏洞检测装置具体可以判断参数值对集合是否是空集合，当时空集合时，即不存在要检测的参数值对，此时DOM XSS漏洞检测结束。而当该参数值对集合为非空集合时，此时可以执行步骤203，继续检测。
203、DOM XSS漏洞检测装置确定当前要检测的参数值对；执行步骤204；
为了保证对参数值对集合中的每个参数值对都进行测试，可以按照每个参数值对在网页的原始网址中的先后顺序，一一进行测试。第一次测 试时，获取网页的原始网址中第一个参数值对，后续按照各个参数值对的先后顺序，一一选取。当不存在时，即为网页的原始网址中参数值对集合中的每个参数值对都测试完毕，此时对应DOM XSS漏洞检测结束。
204、DOM XSS漏洞检测装置采用特征脚本替换参数值，形成网页的测试网址；执行步骤205；
特征脚本为包含有恶意字符且能在网页的DOM树中唯一标识的恶意代码，该特征脚本也可以称为JS特征脚本，详细可以参考上述相关实施例的记载，在此不再赘述。
205、DOM XSS漏洞检测装置向测试网址的网站服务器请求测试网址对应的页面内容；执行步骤206；
由于网址的页面内容存储在网站的服务器中，因此，DOM XSS漏洞检测装置想要获取页面内容时，需要向测试网址的网站服务器请求测试网址对应的页面内容。
206、DOM XSS漏洞检测装置接收测试网址的网站服务器响应的页面内容；执行步骤207；
当测试网址的网站服务器接收到DOM XSS漏洞检测装置的请求之后，会向DOM XSS漏洞检测装置返回页面内容响应。对应在DOM XSS漏洞检测装置侧，在DOM XSS漏洞检测装置接收响应的页面内容。
207、DOM XSS漏洞检测装置将页面内容转化为DOM树；执行步骤208；
DOM XSS漏洞检测装置接收到页面内容之后，将页面内容中页面上数据和结构转化成对应的DOM树。例如具体转换时，可以将网页内容的源代码中的所有标签节点按照各节点之间的父子关系，将各标签节点展示出来，即得到了该页面内容的DOM树结构。
208、DOM XSS漏洞检测装置判断DOM树中是否包括特征脚本， 当包括时，执行步骤209；否则执行步骤210；
DOM XSS漏洞检测装置对DOM树的所有信息进行检测，判断DOM树中有没有包括特征脚本。
209、DOM XSS漏洞检测装置确定所述参数值对存在XSS漏洞；执行步骤202；
当DOM XSS漏洞检测装置对DOM树的所有信息进行检测，确定DOM树中包括特征脚本，则确定所述参数值对存在XSS漏洞。
210、DOM XSS漏洞检测装置确定所述参数值对不存在XSS漏洞；执行步骤202。
当DOM XSS漏洞检测装置对DOM树的所有信息进行检测，确定DOM树中不包括特征脚本，则确定所述参数值对不存在XSS漏洞。此时可以按照上述类似的方式对下一个参数值对进行检测。
本实施例中仍以一个特征脚本为例来进行说明，实际应用中可以预先设置多个特征脚本，采用多个特征脚本对每个参数值对进行检测。当多个特征脚本的检测结果中只要有一个特征脚本的检测中该参数值对存在XSS漏洞，则确定该参数值对存在XSS漏洞。当多个特征脚本的检测结果中每一个特征脚本的检测中该参数值对不存在XSS漏洞，则确定该参数值对不存在XSS漏洞。
而且对于一些更复杂的DOM XSS漏洞，比如部分DOM XSS漏洞需要在返回的页面上点击某个按钮后才能触发，还可以在步骤208中“DOM XSS漏洞检测装置判断DOM树中不包括特征脚本”之后，步骤210之前，DOM XSS漏洞检测装置触发执行网页中的按钮，然后返回步骤205-208，若触发该按钮之后，DOM XSS漏洞检测装置还判断DOM树中仍不包括特征脚本，此时DOM XSS漏洞检测装置触发执行网页中的下一个按钮，直到所有的按钮都被触发，DOM树中均不包括特征脚本，此时才执行步骤 210，DOM XSS漏洞检测装置确定所述参数值对不存在XSS漏洞。通过采用该方案，这样对于一些更复杂的DOM XSS漏洞，本发明实施例的技术方案也能够检测到，进一步提高了漏洞发现能力。
本实施例的技术方案，只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。此外对于如需要在返回页面点击按钮后才能触发的更复杂的DOM XSS漏洞，上述实施例的技术方案也能检测到，进一步扩大了DOM XSS漏洞的检测范围，提高了漏洞发现能力。而且上述实施例的技术方案不仅能检测DOM XSS漏洞，也可以有效检测普通反射型XSS漏洞，适用性非常强。
在实际测试过程中，采用本发明实施例的技术方案累计扫描数万个站点，已累计发现数千个页面存在DOM XSS漏洞，且误报率为零。因此，需要别说明的是，本发明实施例的DOM XSS漏洞检测方案可以检测任意站点及网页。例如图3为本发明实施例的DOM XSS漏洞检测方案的检测结果实例图。如图3所示，是以本发明实施例的DOM XSS漏洞检测方案检测发现某个页面存在DOM XSS漏洞的例子，其中<iframe/onload＝alert(/xss/)></iframe>即为本实施例的一个特征脚本。
图4为本发明一实施例提供的DOM XSS漏洞检测装置的结构示意图。如图4所示，本实施例的DOM XSS漏洞检测装置具体可以包括获取模块10、替换模块11、转化模块12和检测模块13。
其中获取模块10用于获取网页的原始网址中的参数值对集合，参数值对集合中包括至少一个参数值对；替换模块11与获取模块10连接，替换模块11用于对获取模块10获取的参数值对集合中的参数值对，采用特征脚本替换参数值，形成网页的测试网址；特征脚本为包含有恶意字符且能在网页的DOM树中唯一标识的恶意代码；获取模块10还用于获取替换 模块11替换的得到的测试网址对应的页面内容；转化模块12与获取模块10连接，转换模块12用于将获取模块10获取的页面内容转化为DOM树；检测模块13与转化模块12连接，检测模块13用于根据转化模块12转化得到的DOM树和特征脚本检测所述参数值对是否存在XSS漏洞。该特征脚本可以为预先设置的。
本实施例的DOM XSS漏洞检测装置，通过采用上述模块实现DOM XSS漏洞的检测与上述相关方法实施例的实现机制相同，详细可以参考上述实施例的记载，在此不再赘述。
本实施例的DOM XSS漏洞检测装置，通过采用上述模块，只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。
图5为本发明另一实施例提供的DOM XSS漏洞检测装置的结构示意图。如图5所示，本实施例在上述图4所示实施例的基础上，进一步包括如下可选技术方案。
如图5所示，本实施例的DOM XSS漏洞检测装置中的检测模块13具体用于判断DOM树中是否包括特征脚本，当包括时，确定所述参数值对存在XSS漏洞；当不包括时，确定所述参数值对不存在XSS漏洞。
可选地，如图5所示，本实施例的DOM XSS漏洞检测装置中的获取模块10具体用于向测试网址的网站服务器20请求测试网址对应的页面内容；并接收测试网址的网站服务器20响应的页面内容。如图6所示，图中还示出了与获取模块10交互的网站服务器20，网站服务器为某网站的服务器，该网站服务器20中存储有该网站下的所有网页的页面内容，并在其他设备或者模块向其请求某页面内容时，向请求的设备或者模块响应请求的页面内容。当该网站服务器20接收到获取模块10发送的测试网址对应的页面内容的请求时，获取该测试网址对应的页面内容，并向该获取模块 10发送响应，以将该测试网址对应的页面内容发送给该获取模块10。
可选地，如图5所示，本实施例的DOM XSS漏洞检测装置还可以包括接收模块14。该接收模块14用于接收用户通过人机接口模块输入的网页的原始网址。此时对应的获取模块10与接收模块14连接，获取模块10用于获取接收模块14接收的网页的原始网址中的参数值对集合。
可选地，如图5所示，本实施例的DOM XSS漏洞检测装置还可以包括引擎触发模块15，该引擎触发模块15为本发明实施例的一个备用的辅助模块。对于一些DOM XSS漏洞需要点击某个按钮才能触发，此时在由初始返回页面生成的DOM树中找不到特征脚本的DOM XSS漏洞，在检测模块13检测确定文档对象模型树中不包括特征脚本时，此时引擎触发模块15触发执行网页中的按钮，这样才将DOM XSS漏洞触发，此时再由获取模块10获取已经由该引擎触发模块15触发了按钮后的测试网址对应的页面内容。因此获取模块10还与引擎触发模块15连接。后续继续上述操作，获取模块10获取替换模块11替换的得到的测试网址对应的页面内容；转换模块12将获取模块10获取的页面内容转化为DOM树；检测模块13根据转化模块12转化得到的DOM树和特征脚本检测所述参数值对是否存在XSS漏洞。若触发该按钮之后，检测模块13还判断DOM树中仍不包括特征脚本，此时引擎触发模块15触发执行网页中的下一个按钮，直到所有的按钮都被触发，检测模块13检测DOM树中均不包括特征脚本，此时才确定所述参数值对不存在XSS漏洞。通过采用该方案，对于一些更复杂的DOM XSS漏洞，本发明实施例的技术方案也能够检测到，进一步提高了漏洞发现能力。
本实施例的上述所有可选技术方案，可以采用可以结合的方式任意组合形成本发明的可选技术方案，在此不再一一举例。
本实施例的DOM XSS漏洞检测装置，通过采用上述模块实现DOM  XSS漏洞的检测与上述相关方法实施例的实现机制相同，详细可以参考上述实施例的记载，在此不再赘述。
本实施例的DOM XSS漏洞检测装置，通过采用上述模块只需在转化的DOM树中寻找***的特征脚本，而不需要让特征脚本触发执行就能有效发现DOM XSS漏洞，大大提高了漏洞发现能力及检测效率。此外对于如需要在返回页面点击按钮后才能触发的更复杂的DOM XSS漏洞，上述实施例的技术方案也能检测到，进一步扩大了DOM XSS漏洞的检测范围，提高了漏洞发现能力。而且上述实施例的技术方案不仅能检测DOM XSS漏洞，也可以有效检测普通反射型XSS漏洞，适用性非常强。
本实施例的DOM XSS漏洞检测装置具体可以设置在浏览器客户端侧，作为浏览器的一个引擎装置来使用。还可以设置在一个终端中，单独执行其功能。
图6是本发明实施例提供的一种终端结构示意图。参见图6，该终端可以用于实施上述实施例中提供的DOM XSS漏洞检测方法。
终端设备800可以包括通信单元110、包括有一个或一个以上计算机可读存储介质的存储器120、输入单元130、显示单元140、传感器150、音频电路160、WiFi(wireless fidelity，无线保真)模块170、包括有一个或者一个以上处理核心的处理器180、以及电源190等部件。本领域技术人员可以理解，图6中示出的终端设备结构并不构成对终端设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。其中：
通信单元110可用于收发信息或通话过程中，信号的接收和发送，该通信单元110可以为RF(Radio Frequency，射频)电路、路由器、调制解调器、等网络通信设备。特别地，当通信单元110为RF电路时，将基站的下行信息接收后，交由一个或者一个以上处理器180处理；另外，将涉 及上行的数据发送给基站。通常，作为通信单元的RF电路包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、用户身份模块(SIM)卡、收发信机、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等。此外，通信单元110还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于GSM(Global System of Mobile communication，全球移动通讯***)、GPRS(General Packet Radio Service，通用分组无线服务)、CDMA(Code Division Multiple Access，码分多址)、WCDMA(Wideband Code Division Multiple Access，宽带码分多址)、LTE(Long Term Evolution，长期演进)、电子邮件、SMS(Short Messaging Service，短消息服务)等。存储器120可用于存储软件程序以及模块，处理器180通过运行存储在存储器120的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器120可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作***、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据终端设备800的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器120可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。相应地，存储器120还可以包括存储器控制器，以提供处理器180和输入单元130对存储器120的访问。
输入单元130可用于接收输入的数字或字符信息，以及产生与用户设置以及功能控制有关的键盘、鼠标、操作杆、光学或者轨迹球信号输入。具体地，输入单元130可包括触敏表面131以及其他输入设备132。触敏表面131，也称为触摸显示屏或者触控板，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触敏表面131上或在触敏表面131附近的操作)，并根据预先设定的程式驱动相应的连接装 置。可选的，触敏表面131可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器180，并能接收处理器180发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触敏表面131。除了触敏表面131，输入单元130还可以包括其他输入设备132。具体地，其他输入设备132可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元140可用于显示由用户输入的信息或提供给用户的信息以及终端设备800的各种图形用户接口，这些图形用户接口可以由图形、文本、图标、视频和其任意组合来构成。显示单元140可包括显示面板141，可选的，可以采用LCD(Liquid Crystal Display，液晶显示器)、OLED(Organic Light-Emitting Diode，有机发光二极管)等形式来配置显示面板141。进一步的，触敏表面131可覆盖显示面板141，当触敏表面131检测到在其上或附近的触摸操作后，传送给处理器180以确定触摸事件的类型，随后处理器180根据触摸事件的类型在显示面板141上提供相应的视觉输出。虽然在图6中，触敏表面131与显示面板141是作为两个独立的部件来实现输入和输入功能，但是在某些实施例中，可以将触敏表面131与显示面板141集成而实现输入和输出功能。
终端设备800还可包括至少一种传感器150，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板141的亮度，接近传感器可在终端设备800移动到耳边时，关闭显示面板141和/或背光。作为运动传感器的一种，重力加速度传感器可检测各个方向上(一 般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于终端设备800还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路160、扬声器161，传声器162可提供用户与终端设备800之间的音频接口。音频电路160可将接收到的音频数据转换后的电信号，传输到扬声器161，由扬声器161转换为声音信号输出；另一方面，传声器162将收集的声音信号转换为电信号，由音频电路160接收后转换为音频数据，再将音频数据输出处理器180处理后，经RF电路110以发送给比如另一终端设备，或者将音频数据输出至存储器120以便进一步处理。音频电路160还可能包括耳塞插孔，以提供外设耳机与终端设备800的通信。
为了实现无线通信，该终端设备上可以配置有无线通信单元170，该无线通信单元170可以为WiFi模块。WiFi属于短距离无线传输技术，终端设备800通过无线通信单元170可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图6示出了无线通信单元170，但是可以理解的是，其并不属于终端设备800的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
处理器180是终端设备800的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器120内的软件程序和/或模块，以及调用存储在存储器120内的数据，执行终端设备800的各种功能和处理数据，从而对手机进行整体监控。可选的，处理器180可包括一个或多个处理核心；优选的，处理器180可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作***、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器 也可以不集成到处理器180中。
终端设备800还包括给各个部件供电的电源190(比如电池)，优选的，电源可以通过电源管理***与处理器180逻辑相连，从而通过电源管理***实现管理充电、放电、以及功耗管理等功能。电源190还可以包括一个或一个以上的直流或交流电源、再充电***、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。
尽管未示出，终端设备800还可以包括摄像头、蓝牙模块等，在此不再赘述。具体在本实施例中，终端设备的显示单元是触摸屏显示器，终端设备还包括有存储器，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行所述一个或者一个以上程序包含用于进行以下操作的指令：获取网页的原始网址中的参数值对集合，所述参数值对集合中包括至少一个参数值对；采用特征脚本替换所述参数值对中的参数值，形成所述网页的测试网址；所述特征脚本为包含有恶意字符且能在所述网页的文档对象模型树中唯一标识的恶意代码；获取所述测试网址对应的页面内容；将所述页面内容转化为丈档对象模型树；根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
可选地，该存储器还用于存储以下指令：判断所述文档对象模型树中是否包括所述特征脚本，当包括时，确定所述参数值对存在跨站脚本攻击漏洞；当不包括时，确定所述参数值对不存在跨站脚本攻击漏洞。
可选地，该存储器还用于存储以下指令：向所述测试网址的网站服务器请求所述测试网址对应的页面内容；并接收所述测试网址的网站服务器响应的所述页面内容。
可选地，该存储器还用于存储以下指令：接收用户通过人机接口模块输入的所述网页的原始网址。
可选地，该存储器还用于存储以下指令：当所述文档对象模型树中不包括所述特征脚本时，触发所述网页中的按钮；获取所述测试网址对应的页面内容；将所述页面内容转化为文档对象模型树；根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
需要说明的是：上述实施例提供的DOM XSS漏洞检测装置在触发DOM XSS漏洞检测业务时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的DOM XSS漏洞检测装置与DOM XSS漏洞检测方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (12)

  1. 一种基于文档对象模型的跨站脚本攻击漏洞检测方法，所述方法包括：
    获取网页的原始网址中的参数值对集合，所述参数值对集合中包括至少一个参数值对；
    采用特征脚本替换所述参数值对中的参数值，形成所述网页的测试网址，所述特征脚本为包含有恶意字符且能在所述网页的文档对象模型树中唯一标识的恶意代码；
    获取所述测试网址对应的页面内容；
    将所述页面内容转化为文档对象模型树；
    根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
  2. 根据权利要求1所述的方法，根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞，包括：
    判断所述文档对象模型树中是否包括所述特征脚本，当包括时，确定所述参数值对存在跨站脚本攻击漏洞；当不包括时，确定所述参数值对不存在跨站脚本攻击漏洞。
  3. 根据权利要求1所述的方法，获取所述测试网址对应的页面内容，包括：
    向所述测试网址的网站服务器请求所述测试网址对应的页面内容；
    接收所述测试网址的网站服务器响应的所述页面内容。
  4. 根据权利要求1-3任一所述的方法，还包括：
    接收用户通过人机接口模块输入的所述网页的所述原始网址。
  5. 根据权利要求2所述的方法，所述方法还包括：
    当所述文档对象模型树中不包括所述特征脚本时，触发所述网页中的按钮；
    响应于所述按钮被触发，更新所述文档对象模型树；
    根据所述更新的文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
  6. 一种基于文档对象模型的跨站脚本攻击漏洞检测装置，所述装置包括：
    获取模块，用于获取网页的原始网址中的参数值对集合，所述参数值对集合中包括至少一个参数值对；
    替换模块，用于采用特征脚本替换所述参数值对中的参数值，形成所述网页的测试网址，所述特征脚本为包含有恶意字符且能在所述网页的文档对象模型树中唯一标识的恶意代码；
    所述获取模块，还用于获取所述测试网址对应的页面内容；
    转化模块，用于将所述页面内容转化为文档对象模型树；
    检测模块，用于根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
  7. 根据权利要求6所述的装置，所述检测模块，还用于判断所述文档对象模型树中是否包括所述特征脚本，当包括时，确定所述参数值对存在跨站脚本攻击漏洞；当不包括时，确定所述参数值对不存在跨站脚本攻击 漏洞。
  8. 根据权利要求6所述的装置，所述获取模块还用于向所述测试网址的网站服务器请求所述测试网址对应的页面内容；并接收所述测试网址的网站服务器响应的所述页面内容。
  9. 根据权利要求6-8任一所述的装置，所述装置还包括：
    接收模块，用于接收用户通过人机接口模块输入的所述网页的原始网址。
  10. 根据权利要求6-8任一所述的装置，所述装置还包括：
    引擎触发模块，用于当所述文档对象模型树中不包括所述特征脚本时，触发所述网页中的按钮；以及
    更新模块，用于响应于所述按钮被触发，更新所述文档对象模型树。
  11. 一种终端，所述终端上设置有如上权利要求6-10任一所述的基于文档对象模型的跨站脚本攻击漏洞检测装置。
  12. 一种非瞬时性的计算机可读存储介质，其上存储有计算机可执行指令，当计算机中运行这些可执行指令时，执行如下步骤：
    获取网页的原始网址中的参数值对集合，所述参数值对集合中包括至少一个参数值对；
    采用特征脚本替换所述参数值对中的参数值，形成所述网页的测试网址，所述特征脚本为包含有恶意字符且能在所述网页的文档对象模型树中唯一标识的恶意代码；
    获取所述测试网址对应的页面内容；
    将所述页面内容转化为文档对象模型树；
    根据所述文档对象模型树和所述特征脚本检测所述参数值对是否存在跨站脚本攻击漏洞。
PCT/CN2014/088283 2013-11-08 2014-10-10 基于文档对象模型的跨站脚本攻击漏洞检测方法、装置、终端及介质 WO2015067114A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/034,363 US9754113B2 (en) 2013-11-08 2014-10-10 Method, apparatus, terminal and media for detecting document object model-based cross-site scripting attack vulnerability

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310554402.1 2013-11-08
CN201310554402.1A CN104636664B (zh) 2013-11-08 2013-11-08 基于文档对象模型的跨站脚本攻击漏洞检测方法及装置

Publications (1)

Publication Number Publication Date
WO2015067114A1 true WO2015067114A1 (zh) 2015-05-14

Family

ID=53040883

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/088283 WO2015067114A1 (zh) 2013-11-08 2014-10-10 基于文档对象模型的跨站脚本攻击漏洞检测方法、装置、终端及介质

Country Status (3)

Country Link
US (1) US9754113B2 (zh)
CN (1) CN104636664B (zh)
WO (1) WO2015067114A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105279215A (zh) * 2014-06-10 2016-01-27 中兴通讯股份有限公司 资源的下载方法及装置
CN107454041B (zh) * 2016-05-31 2020-06-02 阿里巴巴集团控股有限公司 防止服务器被攻击的方法及装置
CN108073828B (zh) * 2016-11-16 2022-02-18 阿里巴巴集团控股有限公司 一种网页防篡改方法、装置及***
CN108881101B (zh) * 2017-05-08 2021-06-15 腾讯科技（深圳）有限公司 一种基于文档对象模型的跨站脚本漏洞防御方法、装置以及客户端
CN109768945A (zh) * 2017-11-09 2019-05-17 国网青海省电力公司电力科学研究院 一种任意文件下载漏洞的检测装置及发现方法
CN107832622B (zh) * 2017-12-08 2019-03-12 平安科技（深圳）有限公司 漏洞检测方法、装置、计算机设备及存储介质
CN108616526A (zh) * 2018-04-16 2018-10-02 贵州大学 一种检测Web页面中的XSS漏洞的检测方法
CN110874475A (zh) * 2018-08-30 2020-03-10 重庆小雨点小额贷款有限公司 漏洞挖掘方法、漏洞挖掘平台及计算机可读存储介质
CN109450844B (zh) * 2018-09-18 2022-05-10 华为云计算技术有限公司 触发漏洞检测的方法及装置
CN109657469B (zh) * 2018-12-07 2023-02-24 腾讯科技（深圳）有限公司 一种脚本检测方法及装置
CN114153729A (zh) * 2021-11-30 2022-03-08 北京达佳互联信息技术有限公司 网页测试方法、装置、电子设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101883024A (zh) * 2010-06-23 2010-11-10 南京大学 一种跨站点伪造请求的动态检测方法
CN101902470A (zh) * 2010-07-14 2010-12-01 南京大学 一种基于表单特征的Web安全漏洞动态检测方法
CN102609649A (zh) * 2012-02-06 2012-07-25 北京百度网讯科技有限公司 一种自动采集恶意软件的方法和装置
CN102663296A (zh) * 2012-03-31 2012-09-12 杭州安恒信息技术有限公司 面向网页JavaScript恶意代码的智能检测方法

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2007183838A (ja) * 2006-01-06 2007-07-19 Fujitsu Ltd クエリーパラメーター出力ページ発見プログラム、クエリーパラメーター出力ページ発見方法およびクエリーパラメーター出力ページ発見装置
US8656495B2 (en) * 2006-11-17 2014-02-18 Hewlett-Packard Development Company, L.P. Web application assessment based on intelligent generation of attack strings
US8949990B1 (en) * 2007-12-21 2015-02-03 Trend Micro Inc. Script-based XSS vulnerability detection
KR101001132B1 (ko) * 2008-02-22 2010-12-15 엔에이치엔비즈니스플랫폼 주식회사 웹 어플리케이션의 취약성 판단 방법 및 시스템
US8800040B1 (en) * 2008-12-31 2014-08-05 Symantec Corporation Methods and systems for prioritizing the monitoring of malicious uniform resource locators for new malware variants
CN101964025B (zh) * 2009-07-23 2016-02-03 北京神州绿盟信息安全科技股份有限公司 Xss检测方法和设备
EP2513800B1 (en) * 2009-12-15 2021-08-04 Synopsys, Inc. Methods and systems of detecting and analyzing correlated operations in a common storage
CN102592089B (zh) * 2011-12-29 2015-04-08 北京神州绿盟信息安全科技股份有限公司 网页重定向跳转漏洞检测方法及装置
CN103095681B (zh) * 2012-12-03 2016-08-03 微梦创科网络科技（中国）有限公司 一种检测漏洞的方法及装置
US8943589B2 (en) * 2012-12-04 2015-01-27 International Business Machines Corporation Application testing system and method
US9195570B2 (en) * 2013-09-27 2015-11-24 International Business Machines Corporation Progressive black-box testing of computer software applications
US9390269B2 (en) * 2013-09-30 2016-07-12 Globalfoundries Inc. Security testing using semantic modeling

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101883024A (zh) * 2010-06-23 2010-11-10 南京大学 一种跨站点伪造请求的动态检测方法
CN101902470A (zh) * 2010-07-14 2010-12-01 南京大学 一种基于表单特征的Web安全漏洞动态检测方法
CN102609649A (zh) * 2012-02-06 2012-07-25 北京百度网讯科技有限公司 一种自动采集恶意软件的方法和装置
CN102663296A (zh) * 2012-03-31 2012-09-12 杭州安恒信息技术有限公司 面向网页JavaScript恶意代码的智能检测方法

Also Published As

Publication number Publication date
US9754113B2 (en) 2017-09-05
CN104636664B (zh) 2018-04-27
US20160267278A1 (en) 2016-09-15
CN104636664A (zh) 2015-05-20

Similar Documents

Publication Publication Date Title
WO2015067114A1 (zh) 基于文档对象模型的跨站脚本攻击漏洞检测方法、装置、终端及介质
CN108989266B (zh) 一种防止网页劫持的处理方法和客户端以及服务器
CN103617165B (zh) 一种加载图片的方法、装置及终端
CN107040609B (zh) 一种网络请求处理方法和装置
WO2015090248A1 (zh) 服务器的过载保护方法及装置
CN110716850B (zh) 页面测试方法、装置、***及存储介质
US10095666B2 (en) Method and terminal for adding quick link
WO2018077041A1 (zh) 应用运行的方法及装置
WO2014206143A1 (zh) 未读消息数目显示方法、装置和设备
WO2017084452A1 (zh) 图形界面中标签页的处理方法和装置
CN109088844B (zh) 信息拦截方法、终端、服务器及***
US10956653B2 (en) Method and apparatus for displaying page and a computer storage medium
WO2018006841A1 (zh) 二维码信息传输方法、装置以及设备
WO2013185565A1 (zh) 移动终端浏览器弱光源下浏览网页的方法及装置
WO2014173167A1 (en) Method, apparatus and system for filtering data of web page
WO2014194688A1 (en) Webpage processing method and terminal device
WO2014206138A1 (zh) 一种更新网页数据的方法、装置和终端设备
WO2017219293A1 (zh) 一种获取网页内容的方法及装置
WO2015067142A1 (zh) 网页显示方法及装置
WO2015003636A1 (zh) 一种页面元素的拦截方法和装置
US9582584B2 (en) Method, apparatus and system for filtering data of web page
WO2018137528A1 (zh) 资源访问方法及装置
CN112749074B (zh) 一种测试用例推荐方法以及装置
WO2015062234A1 (zh) 移动终端资源处理方法、装置和设备
CN110445746B (zh) cookie获取方法、装置及存储设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14859875

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15034363

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 07.10.2016)

122 Ep: pct application non-entry in european phase

Ref document number: 14859875

Country of ref document: EP

Kind code of ref document: A1