Stored-XSS漏洞检测的研究与设计  

STUDY AND DESIGN OF Stored-XSS VULNERABILITY DETECTION

作　　者：李冰[1,2] 赵逢禹[2] 

机构地区：[1]上海理工大学光电信息与计算机工程学院,上海200093 [2]上海计算机软件技术开发中心上海市计算机软件评测重点实验室,上海201112

出　　处：《计算机应用与软件》2013年第3期17-21,共5页Computer Applications and Software

基　　金：国家自然科学基金委员会与中国民航空局联合资助项目(60979011)

摘　　要：跨站脚本XSS(Cross Site Scripting)漏洞已经成为了大多数网站共同面对的Web安全问题,对XSS漏洞的有效预防检测有利于提高Web安全。分析XSS漏洞的攻击原理,指出现有动态分析方法在检测存储型XSS漏洞方面的不足,提出一种有效的存储型漏洞动态检测方法。设计并实现了Stored-XSS漏洞动态检测模型,并在实际的场景下对该模型进行了测试评估,实验证明提出的方法能对存储型XSS漏洞进行有效检测。Cross-site scripting（XSS） vulnerability has become the Web security problem for most websites,effective prevention and detection of XSS vulnerability favour the improvement in Web security.In the paper,we analyse the attacking principle of XSS vulnerability,and point out the inadequacy of existing dynamic analysis methods in detecting stored-XSS vulnerability.An effective dynamic detection method for stored-XSS vulnerability is proposed,moreover we also design and implement a dynamic detection model for the stored-XSS vulnerability,as well as carry out testing and evaluation on this model in practical scenario.Experiments prove that the method proposed in the paper can detect stored-XSS vulnerability effectively.

关 键 词：XSS漏洞 WEB安全 存储型XSS漏洞 动态检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]