针对HTTPS的Web前端劫持及防御研究  

Research on the Web Front-end Hijacking and Defense against HTTPS

作　　者：赵国锋[1] 陈勇[1] 王新恒[1] 

机构地区：[1]重庆邮电大学通信学院,重庆400065

出　　处：《信息网络安全》2016年第3期15-20,共6页Netinfo Security

基　　金：国家自然科学基金青年基金[61402065];江苏省未来网络前瞻项目[BY2013095-5-7;BY2013095-2-3]

摘　　要：文章针对HTTPS协议通信流程,详细分析了基于伪造证书与中间人会话劫持的基本方法及原理,指出了常用劫持方法通过后端来操控原始数据流量时的缺陷,并重点提出了一种基于前端XSS脚本注入的更高效的HTTPS会话劫持方法,实现了表单提交、动态元素、脚本弹窗、框架页面的劫持。最后详细阐述了Web前端劫持方法的实现原理与流程,并搭建原型系统进行验证,进一步分析给出了HTTPS通信的安全隐患,提出了可行的防范措施。This paper discusses the HTTPS protocol communication process,analyzes the basic principles and methods in detail based on forged certificates and man in the middle session hijacking.Then it points out that conventional hijacking method through the backend to manipulate the original data flow and defects,and puts forward a front-end scripting XSS based on injection of more efficient and more perfect HTTPS session hijacking method,which can realize the hijacking of the form submission,dynamic elements,the script window,and the page frame.Finally it expounds the priciple and process the Web front-end hijacking,builds a prototype system to validate,and makes a further analysis of the HTTPS communication security risks.According to the present situation,it also puts forward feasible preventive measures.

关 键 词：HTTPS 会话劫持 XSS 前端劫持 动态元素 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]