共查询到19条相似文献,搜索用时 125 毫秒
1.
黄细标 《信息技术与信息化》2024,(3):140-143
针对现有的跨站脚本检测技术尚未对漏洞注入点进行充分研究,且漏洞检测率相对较低的问题,为了提升检测效果,提出一种基于分布式系统的跨站脚本动态检测方法。通过综合考虑字符串长度、字符类型等因素对攻击向量进行了分类与变形,根据输入点、输出点类型自动生成攻击向量与合法向量。采用基于PhantomJS的网络爬虫对网站进行更为全面的漏洞注入点分析,并使用Gearman来实现分布式任务调度,提高检测效率。采用PHP语言设计并实现了分布式自动化跨站脚本检测系统,进一步通过实验和其他相关工具对比分析,表明所提方法能够有效挖掘出Web应用中的跨站脚本漏洞。 相似文献
2.
随着互联网的快速发展,越来越多的Web应用漏洞不断涌现,这对互联网安全造成了很大的威胁。其中,跨站脚本漏洞在Web漏洞中尤为常见,根据这一漏洞,跨站脚本攻击得以实现。这种攻击可以将恶意代码植入特定的网页,从而破坏系统的安全性。跨站脚本攻击具有匿名性、易操作、难以检测等特点,是当前互联网上比较常见的攻击手段之一。文章基于Web的环境探讨跨站脚本攻击问题,研究跨站脚本攻击的攻击原理,根据不同的类别分析漏洞成因,研究这类攻击的危害和影响,根据攻击特点提出相应的预防措施。 相似文献
3.
4.
5.
随着Web应用在互联网中的迅速发展,出现了大量的Web安全漏洞,其中最为突出的是跨站脚本(XSS)漏洞攻击.为了对Web应用中的XSS漏洞进行有效的检测和防御,通过分析XSS漏洞的特征及原理,总结出产生该漏洞攻击的几大主要原因,结合目前常用漏洞检测方法提出几种XSS漏洞攻击的防御方法,可有效识别和防范XSS漏洞攻击,对Web应用具有较高的实用性. 相似文献
6.
钱伟俊 《信息安全与通信保密》2014,(8):115-117
文中详细阐述了攻击者利用跨站伪造请求(CSRF)的方法来远程对网络设备开展攻击渗透的具体方法与步骤,阐明通过用户浏览器提交相关命令的操作过程,相关漏洞攻击的例子可有利于建立安全研究和安全审计的概念。 相似文献
7.
姜建华 《电子产品维修与制作》2009,(7):99-99
您的网站安全吗?您的网站容易遭受跨站脚本攻击吗?
跨站脚本攻击是代码注入的一种特例。在这种攻击中,恶意用户将HTML或其他的客户端脚本嵌入到您的Web站点中,让该攻击看似来自您的网站,用户将对此深信不疑,因此让攻击者可以绕过客户端的许多安全措施,从用户那里获取敏感信息,或传输恶意程序。 相似文献
8.
9.
10.
11.
针对Web网站突出的安全问题,详细分析了当前对Web网站安全威胁最严重的3种网络攻击:SQL注入、跨站和跨站请求伪造的实现原理和常用攻击方法,并结合研究和实践提出了具体的防范算法:采用过滤用户提交Web请求中的非法字符串代码实现了SQL注入及跨站的防范算法,具体代码使用了JSP中的Servlet过滤器实现;采用伪随机数对用户端身份进行持续认证的方式实现了跨站请求伪造算法, 相似文献
12.
由于网站服务的应用广泛性,跨站攻击已经上升为互联网中数量最多的攻击手段,对跨站代码的过滤已经成为各个网站的重中之重。网站要对跨站进行过滤就要充分了解跨站产生的机理,并且要理解数据代码在Web应用程序中的解析过程。这两点只是基本的要素,要想尽可能完全地过滤跨站代码,就要进一步针对各种语言解析模块之间的关系,研究和分析在各种模块互相嵌套下跨站的复杂性才行,这样根据各种情况才能得到降低跨站威胁的有效措施。 相似文献
13.
OAuth2.0 protocol has been widely adopted to simplify user login to third-party applications,at the same time,existing risk of leaking user privacy data,what even worse,causing user accounts to be hijacked.An account hijacking attack model around authorization code was built by analyzing the vulnerabilities of the OAuth2.0 protocol.A vulnerable API identification method based on differential traffic analysis and an account hijacking verification method based on authorized authentication traffic monitoring was proposed.An account hijacking attack threat detection framework OScan for OAuth2.0 authorization API was designed and implemented.Through a large-scale detection of the 3 853 authorization APIs deployed on the Alexa top 10 000 websites,360 vulnerable APIs were discovered.The further verification showed that 80 websites were found to have threat of account hijacking attack.Compared with similar tools,OScan has significant advantages in covering the number of identity provider,the number of detected relying party,as well as the integrity of risk detection. 相似文献
14.
15.
16.
The text-oriented automated crowdturfing attack has a series of features such as low attack cost and strong concealment.This kind of attack can automatically generate a large number of fake reviews,with harmful effect on the healthy development of the user review community.In recent years,researchers have found that text-oriented crowdturfing attacks for the English review community,but there was few research work on automated crowdsourcing attacks in the Chinese review community.A Chinese character embedding LSTM model was proposed to automatically generate Chinese reviews with the aim of antomated crowdturfing attacks,which model trained by a combination with Chinese character embedding network,LSTM network and softmax dense network,and a temperature parameter T was designed to construct the attack model.In the experiment,more than 50 000 real user reviews were crawled from Taobao's online review platform to verify the effectiveness of the attack method.Experimental results show that the generated fake reviews can effectively fool linguistics-based classification detection approach and texts plagiarism detection approach.Besides,the massive manually evaluation experiments also demonstrate that the generated reviews with the proposed attack approach perform well in reality and diversity. 相似文献
17.
DDoS attack extensively existed have been mortal threats for the software-defined networking (SDN) controllers and there is no any security mechanism which can prevent them yet.Combining SDN and network function virtualization (NFV),a novel preventing mechanism against DDoS attacks on SDN controller called upfront detection middlebox (UDM) was proposed.The upfront detection middlebox was deployed between SDN switch interfaces and user hosts distributed,and DDoS attack packets were detected and denied.An NFV-based method of implementing the upfront middlebox was put forward,which made the UDM mechanism be economical and effective.A prototype system based on this mechanism was implemented and lots experiments were tested.The experimental results show that the UDM mechanism based on NFV can real-time and effectively detect and prevent against DDoS attacks on SDN controllers. 相似文献
18.