Research And Implementation Of Key Technologies For Stored Cross-site Scripting Vulnerabilities

With the rapid development of Internet technology,Web applications play an increasingly important role in people's lives.However,the skills of Web developers are mixed,which creates hidden security risks for Web applications.Among these security risks,cross-site scripting(XSS)vulnerabilities are a very harmful Web application vulnerability.Since 2004,XSS has consistently ranked among the top ten application security risks announced by OWASP.Compared with the reflective XSS that embeds the XSS code into the URL,the stored XSS that needs to inject the XSS code into the server database in advance is more harmful and affects the time.Therefore,for the stored XSS vulnerability,it is practical to conduct research.At present,research on the stored XSS vulnerability detection is not sufficient.Common research methods include white box test and black box test.The white box test relies heavily on the application source code.It requires the tester to fully understand the source code and complete the audit work on the code.The implementation of this detection method generally depends on the programming language and has poor portability.For the black box test,the tester does not need to understand the application source code,but only needs to stand on the user's point of view to test.It usually relies on the crawler algorithm to obtain Webpage information and finds possible injection points in many Webpages.However,when using the crawler algorithm,it tends to focus only on improving the crawler speed and neglects the anti-reptile rules of some Websites,thus causing the failure of crawlers.At the same time,the completeness and effectiveness of the attack vector is also related to the efficiency of vulnerability detection.The commonly used method is fuzzy test technology.Fuzzy test technology often wants the target Website to send a large number of randomly generated meaningless data,and then judge whether there is a loophole based on the response result.These randomly generated data often have no clear meaning and directivity,and there is a large blindness.In view of the basic idea of genetic algorithm,the operation mode and implementation specification depend on the specific use,high parallelism,and high global optimal solution solving ability.This paper uses genetic algorithm to deform the existing attack vector and generate it.Adapt to the attack vector of the Website under test.In order to detect vulnerabilities efficiently,attack vectors are classified by decision tree algorithm.In summary,this article has thoroughly studied the relevant content of stored XSS vulnerability detection.The main research contents are as follows:(1)A method for finding stored XSS vulnerability injection points based on Web crawler technology is proposed.This method uses the breadth-first search strategy to crawl the Website,analyzes the obtained Web pages,and uses the page containing the Form as the injection point page.The page,and by submitting "speepers" to determine the display page of each injection point and the output location,thereby reducing the need to avoid full-site scanning and improve speed when detecting vulnerabilities.(2)An attack vector generation and optimization method based on genetic algorithm and decision tree algorithm is proposed.After the attack vector analysis,the attack vector is formally described and processed as an attack vector that is convenient for the genetic algorithm to process.In the genetic algorithm,the improved one-hot coding is proposed as the genetic coding method.The crossover and mutation operators are designed for the coding method.Then classify attack vectors and finally the attack vector can be adapted to the Website to be detected.(3)A method for dynamically determining whether a Website vulnerability exists.After the simulation attack is implemented using selenium,the response results are analyzed.In order to improve the detection speed,the label of the display page and the content output is extracted according to the injection point information analyzed by the crawling stage,and when the string matching algorithm is used,the output position is directly positioned to avoid matching of the entire Webpage.(4)According to the above mentioned method,a system for storage type XSS vulnerability detection is designed and implemented.The whole system is implemented in Python language,which is easy to transplant and easy to use.No matter what operating system,just install the python environment and related modules,you can run the command to detect,the final detection result and the URL of the crawled Webpage.Both will be saved in the local document.A test scheme is designed for the above-mentioned stored XSS vulnerability detection system,and a comparative experiment is carried out to verify the effectiveness and practicability of the system.