针对基于编码的跨站脚本攻击分析及防范方法  

Analysis and Prevention for Cross-site Scripting Attacks Based on Encoding

作　　者：张伟[1] 吴灏[1] 邹郢路[1] 

机构地区：[1]解放军信息工程大学信息工程学院,郑州450002

出　　处：《小型微型计算机系统》2013年第7期1615-1619,共5页Journal of Chinese Computer Systems

基　　金：国家"八六三"高技术研究发展计划项目(2008AA01Z420)资助;郑州市科技创新团队项目(10CXTD150)资助

摘　　要：随着Web应用的快速发展,跨站脚本攻击事件迅猛增加,其攻击技术也在不断更新变化,出现一些特殊的高级攻击方法,其中基于编码的跨站脚本攻击就是其中之一.本文针对二进制和N元字母表两种常见的基于编码的跨站脚本攻击进行了深入分析,在已有客户端跨站脚本攻击检测技术的基础上,给出了一种动态访问控制的防范方法,弥补了现有针对此类攻击的防范方案缺乏实用性的不足,并通过实验验证了此方法的有效性和实用性.With the development of Web application,cross-site scripting attacks have been rapidly increasing,and the technique of those attacks is constantly updating.There has been some special advanced attacks such as the ones based on encoding.In this paper w e analyze tw o kinds of those attacks respectively based on the binary and N-ray alphabets encoding,then presents a dynamically access control method to prevent them by means of the existing detection and prevention technology of cross-site scripting attack,making up the existing approach being lack of the practicality,and the experimental results verify the feasibility and practicality of our protection mechanism.

关 键 词：跨站脚本攻击 WEB应用程序 跨域访问 N元字母表编码 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]