跨站脚本攻击(XSS)的形成与利用研究  

Cross Site Scripting(XSS) Attack Research of Formation and Utilization

作　　者：龚小刚[1] 王红凯[1] 夏威[1] 吴科庆 

机构地区：[1]国网浙江省电力公司信息通信分公司,浙江杭州310007

出　　处：《信息安全与技术》2015年第3期52-55,共4页

摘　　要：跨站脚本攻击(XSS)是目前网上最流行的WEB攻击方式之一,也是危害最大的Web攻击方式之一。由于Javascript的普及应用,跨站脚本攻击的利用场景也在逐渐扩展,造成的危害会随着黑客对其的理解加深而越来越大。与其他类型的漏洞相比,互联网上的各类扫描器对于XSS的识别都具有较高的准确性,而XSS平台的普及也为XSS的深度利用制造了条件,越来越多的人正在掌握XSS攻击的各类用法。在可预见的未来,对于XSS的认知是网站开发人员必不可少的知识,本文就当下XSS漏洞所能利用的手法与利用的场景进行分析,希望能对开发人员在相关业务场景代码编写过程中有所警示,也希望安全人员更多的了解XSS攻击存在的场景和被利用的手段,以促进互联网安全生态圈的发展。Cross site scripting (XSS) is one of the most popuIar WEB At acking methods at present, and aIso one of the most risky web at acks. Because of the popuIarization of JavaScript, the scene of the cross site scripting at ack is aIso graduaI y expanded.And it’s more and more harmfuI with the hacker’s deepening understanding. Compared with other vuInerabiIities, aI the scanners have a high accuracy for the recognition of the XSS, PopuIarize of XSS pIatform which is for XSS depth using manufacturing conditions, make more and more peopIe become masters of XSS at ack. In the foreseeabIe future, XSS wiI be essentiaI knowIedge for website deveIopers.This paper anaIysis how XSS vuInerabiIities couId be used at present,which may be heIpfuI to deveIopers who are going to write some process with the reIevant business scene code, aIso make more security engineeers know it, to promote the deveIopment of Internet security ecoIogicaI circIe.

关 键 词：信息安全 WEB安全 XSS 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]