基于模拟用户的Ajax Web自动化测试模型  

Ajax Web automatic testing model based on simulation of users

作　　者：王丽娜[1] 李怀[1] 赵磊[1] 

机构地区：[1]武汉大学计算机学院,湖北武汉430072

出　　处：《华中科技大学学报（自然科学版）》2016年第3期1-5,共5页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(61303213;61373169;61472448);国家高技术研究发展计划资助项目(2015AA016004)

摘　　要：针对一般爬虫不能获取动态页面,导致源码获取障碍,从而无法对Web应用进行自动化渗透测试分析这一问题,提出了一种基于模拟用户的Ajax Web自动化测试模型,通过模拟用户触发JavaScript事件后利用JavaScript引擎解析该事件,从而获取相应的动态页面,然后利用Fuzzing测试检测相应的Web安全漏洞.以结构化查询语言注入攻击和跨站脚本攻击为例,通过实验发现:所提出的测试模型能有效发现采用Ajax技术的Web应用中存在的Web安全问题.Generally the crawler can not get dynamic pages,leading to the obstacles of getting source code to automated penetration testing analysis for Web applications.In order to solve this problem,a Ajax Web automatic testing model was proposed based on the simulation of the users,and JavaScript engine was used to parse the event by triggering JavaScript event through simulation of the users.Then the corresponding dynamic pages was obtained,and the Fuzzing test was used to detect the corresponding Web security vulnerabilities.In the case of structured query language（SQL）injection and cross site scripting（CSS）vulnerability,discovered by experiment,it can be found that this Ajax Web automatic testing model based on the JS engine can efficiently find the Web security problems in Web application using Ajax technology.

关 键 词：WEB安全 模拟用户 跨站脚本攻击 结构化查询语言注入攻击 AJAX JQUERY 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]