基于改进模糊测试的Web应用漏洞挖掘方法  

Web Application Vulnerabilities Mining Method Based on Improved Fuzzing

作　　者：达小文 王晓程[1] 陈志浩[1] 

机构地区：[1]中国航天科工集团第二研究院706所,北京100854

出　　处：《计算机与现代化》2016年第8期100-104,共5页Computer and Modernization

摘　　要：为解决Web模糊测试挖掘漏洞速度较慢、发现漏洞数较少的问题,提出一种改进的Web模糊测试向量生成方法。在通用的Web应用模糊测试结构(Web Fuzzing)基础上,分析现有测试向量生成方法,引入遗传算法来改进Web模糊测试向量生成方法。基于该方法实现XSS模糊测试工具,使用该工具对2个Web应用系统进行测试,将结果与现有模糊测试工具测试结果对比,验证了使用该方法挖掘Web漏洞速度快,发现漏洞数更多,提高了漏洞挖掘效率。To solve the problems that slower speed and fewer number of vulnerabilities found of Web fuzzing for mining vulnerabilities,a method to improve the generation of vectors of Web fuzzing is proposed. On the basis of the structure of commonly-used fuzzing for Web application（ Web fuzzing） and the analyses of the current methods of testing vectors generation,the genetic algorithm to improve testing vector generation of Web fuzzing is applied. Based on this method,a XSS fuzzing tool is implemented.The testing results of multiple Web applications with XSS fuzzing tool and that with current fuzzing tool are compared,which indicates that the efficiency of mining vulnerability is increased with the method.

关 键 词：WEB安全 Web漏洞 模糊测试 遗传算法 测试向量 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]