论文部分内容阅读
XSS(Cross Site Scripting)漏洞经常存在于web页面中,它的攻击方式是通过在web页面中插入代码html语句、js语句等来达到攻击效果。如果服务器端没有对其进行过滤,当用户浏览该网页时,插入的代码就会在浏览器中执行,以达到攻击目的。文章介绍了XSS漏洞的分类和检测方法,对反射型XSS漏洞、存储型XSS漏洞和基于基于DOM的XSS漏洞进行了详述,提出了黑盒测试和白盒测试等XSS漏洞检测方法等内容。
XSS (Cross Site Scripting) vulnerabilities often exist in the web page, its attack is through the web page insert code html statements, js statements to achieve the attack effect. If the server does not filter it, when the user browses the web page, the inserted code is executed in the browser for the purpose of the attack. This paper introduces the classification and testing methods of XSS vulnerabilities, and details the reflective XSS vulnerabilities, storage XSS vulnerabilities and DOM based XSS vulnerabilities, and puts forward such methods as black box testing and white box testing XSS vulnerability detection methods.