基于Fuzzing技术提升XSS漏洞防御水平的研究  

Design on enhancement of XSS vulnerability detection capabilities based on fuzzing technology

作　　者：许莹莹[1] 梁华庆[1] 刘伟[2] 王雪凤[2] 

机构地区：[1]中国石油大学(北京)地球物理与信息工程学院,北京102249 [2]塔里木油田公司开发事业部,新疆库尔勒841000

出　　处：《电子设计工程》2017年第5期33-36,41,共5页Electronic Design Engineering

摘　　要：面对高交互性、高复杂性的网络操作过程,有效提升对XSS漏洞的检测、防御能力有利于提高Web安全。本文提出了一种主动提升对XSS漏洞的检测与防御能力的方法,该方法通过网络爬虫爬取Web交互页面,结合XSS漏洞的特征,基于Fuzzing技术主动挖掘潜在漏洞,利用渗透工具模拟攻击并捕获网络攻击流量,提取攻击特征,最终结合Snort防御告警主动提升Web安全。实验测试表明,该方法可有效检测XSS漏洞,结合对Snort规则库的补充升级,能够有效提升对XSS漏洞的防御能力。Surrounding with all kinds of network operation processes of high interaction and high complexity, the effective prevention and detection of Cross-site scripting （XSS） vulnerability favour the improvement in Web security. The paper describes a method of using Crawler＇s technology to download the content of Interactive page, dig vulnerability with Fuzzing technology, and then to capture network attacks, extract features from the attacks, and at last enhancing the ability of Snort to prevention and detection of XSS vulnerability. We also verify the method with actual experienment, finally the result of the experiment verifies that the method using certain snort and it＇s effective to improve the detection capabilities. fuzzing test inputs can upgrade the rules of

关 键 词：FUZZING技术 XSS漏洞 渗透攻击 特征提取 

分 类 号：TN91[电子电信—通信与信息系统]