基于渗透测试的HTML5漏洞检测技术的探讨  

Discussion on HTML5 Vulnerability Detection Technology Based on Penetration Test

作　　者：田晓玲[1] 杨晓凯 TIAN Xiaoling;YANG Xiaokai(School of Information Engineering,Beijing Polytechnic College,Beijing 100042,China;Beijing Opay-Inc. ,Beijing 100010,China)

机构地区：[1]北京工业职业技术学院信息工程学院,北京100042 [2]北京欧非科技有限公司,北京100010

出　　处：《北京工业职业技术学院学报》2022年第3期17-20,69,共5页Journal of Beijing Polytechnic College

摘　　要：各类APP的广泛使用给人们的工作和生活带来方便的同时也面临着各种安全考验,对此类应用的安全测试也越来越重要,从渗透测试的基本概念和基本流程入手,探讨渗透测试在HTML5网站中的应用,以某行业HTML5网站进行渗透测试为例,讲述渗透测试的过程,从加密算法和越权漏洞入手,阐述保证HTML5安全性的重要性,总结常见的几个漏洞的测试方法和修复建议,以期帮助学习者和渗透测试人员有针对性地进行渗透测试。The wide use of various APPs brings convenience to people's work and life,but also faces various security tests.Security testing for such applications is becoming more and more important.Starting with the basic concept and basic process of penetration testing,this paper discusses the application of penetration testing in HTML5 websites.Taking an industry HTML5 website as an example,this paper describes the process of penetration testing.Starting with encryption algorithms and ultra vires vulnerabilities,this paper expounds the importance of ensuring the security of HTML5,summarizes the testing methods and repair suggestions of several common vulnerabilities,in order to help learners and penetration testers conduct targeted penetration testing.

关 键 词：渗透测试 HTML5 AES 越权漏洞 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]