Discovery and research of network security vulnerabilities based on Web application

Xiao-shuang ZHANG; Yi-ling XU; Yuan LIU

doi:10.11959/j.issn.2096-109x.2016.00065

您当前的位置：

首页 >

文章列表页 >

Discovery and research of network security vulnerabilities based on Web application

academic paper | 更新时间：2024-06-03

- Discovery and research of network security vulnerabilities based on Web application
- Chinese Journal of Network and Information Security Vol. 2, Issue 6, Pages: 58-65(2016)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00065
  CLC： TP309
- Online First：2016-06，
  
  Published：15 June 2016
- 稿件说明：
移动端阅览
Xiao-shuang ZHANG, Yi-ling XU, Yuan LIU. Discovery and research of network security vulnerabilities based on Web application[J]. Chinese Journal of Network and Information Security, 2016, 2(6): 58-65.
DOI：

Xiao-shuang ZHANG, Yi-ling XU, Yuan LIU. Discovery and research of network security vulnerabilities based on Web application[J]. Chinese Journal of Network and Information Security, 2016, 2(6): 58-65. DOI： 10.11959/j.issn.2096-109x.2016.00065.

摘要

Web安全漏洞可分为2类，即基于Web平台和基于Web自身应用的安全漏洞。通过分析Web应用网络安全漏洞的攻击原理和攻击过程，研究了包括反射型、存储型和文档对象模型（DOM

document object model）的跨站脚本（XSS

cross site scripting）漏洞和结构化查询语言（SQL

structured query language）注入漏洞，以及会话认证管理漏洞，提出了基于3种不同漏洞的相应的防范措施。

Abstract

Web security vulnerabilities can be divided into two categories

including security vulnerabilities Web platform and Web their own application.By analyzing the attack principle and process of Web application network security vulnerabilities

XSS vulnerability including type of the reflective

stored

and DOM

SQL injection vulner-ability and session authentication management vulnerability were studied.The corresponding preventive measures of the three kinds of vulnerabilities were put forward.

关键词

Keywords

references

PARVEZ M , ZAVARSKY P , KHOURY N . Analysis of effective-ness of black-box web application scanners in detection of stored SQL injection and stored XSS vulnerabilities [C ] // The 10th Interna-tional Conference for Internet Technology and Secured Transac-tions (ICITST),IEEE .c 2015 : 186 - 191 .

SHAR L K , TAN H B K . Auditing the XSS defence features im-plemented in Web application programs [J ] . Software,IET , 2012 , 6 ( 4 ): 377 - 390 .

SADEGHIAN A , ZAMANI M ' MANAF A A . A taxonomy of SQL injection detection and prevention techniques [C ] // 2013 Interna-tional Conference on Informatics and Creative Multimedia (ICICM),IEEE .c 2013 : 53 - 56 .

SATHYANARAYAN S , QI D , LIANG Z , et al . SQLR:gram-mar-guided validation of SQL injection sanitizers [C ] // 2014 19th International Conference on Engineering of Complex Computer Systems (ICECCS),IEEE .c 2014 : 154 - 157 .

YOON E J , YOO K Y . A new authentication scheme for session initiation protocol [C ] // International Conference on Complex,Intel-ligent and Software Intensive Systems,IEEE .c 2009 : 549 - 554 .

吴晓恒 . 跨站脚本攻击的防御技术研究 [D ] . 上海 : 上海交通大学 , 2011 .

WU X H . Defense technology research of cross site scripting attack [D ] . Shanghai : Shanghai Jiaotong Universtiy , 2011 .

Views

643

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research and implementation of fuzzing testing based on HTTP proxy

Related Author

Xin SUN

Yi-yang YAO

Xin-dai LU

Xue-jiao LIU

Yong-han WU

Related Institution

No data

⁰