基于HTTP代理的模糊测试技术研究

孙歆; 姚一杨; 卢新岱; 刘雪娇; 吴永涵

doi:10.11959/j.issn.2096-109x.2016.00022

您当前的位置：

首页 >

文章列表页 >

基于HTTP代理的模糊测试技术研究

学术论文 | 更新时间：2024-06-03

- 基于HTTP代理的模糊测试技术研究
- Research and implementation of fuzzing testing based on HTTP proxy
- 网络与信息安全学报 2016年2卷第2期页码：75-86
- 作者机构：
- 作者简介：
  
  [ "孙歆（1981-），男，浙江杭州人，国网浙江省电力公司高级工程师，主要研究方向为Web安全。" ]
  [ "姚一杨（1984-），男，浙江杭州人，国网浙江省电力公司工程师，主要研究方向为网络安全。" ]
  [ "卢新岱（1988-），男，浙江奉化人，国网浙江省电力公司工程师，主要研究方向为信息安全。" ]
  [ "刘雪娇（1984-），女，河南安阳人，杭州师范大学讲师，主要研究方向为网络安全评估、应用安全。" ]
  [ "吴永涵（1996-），男，浙江温州人，杭州师范大学本科生，主要研究方向为信息安全。" ]
- 基金信息：
  
  国网浙江省电力公司科技基金资助项目;Science and Technology Program of State Grid Zhejiang Electric Power Company(5211XT14009G);国家自然科学基金资助项目;The National Natural Science Foundation of China(61502134);浙江省重点科技创新团队基金资助项目;Zhejiang Provincial Science and Technology Innovation Program(2013TD03)
- DOI：10.11959/j.issn.2096-109x.2016.00022
  中图分类号： TP391
- 网络首发：2016-02，
  
  纸质出版：2016-02-15
- 稿件说明：
移动端阅览
孙歆, 姚一杨, 卢新岱, 等. 基于HTTP代理的模糊测试技术研究[J]. 网络与信息安全学报, 2016,2(2):75-86.

Xin SUN, Yi-yang YAO, Xin-dai LU, et al. Research and implementation of fuzzing testing based on HTTP proxy[J]. Chinese Journal of Network and Information Security, 2016, 2(2): 75-86.
孙歆, 姚一杨, 卢新岱, 等. 基于HTTP代理的模糊测试技术研究[J]. 网络与信息安全学报, 2016,2(2):75-86. DOI： 10.11959/j.issn.2096-109x.2016.00022.

Xin SUN, Yi-yang YAO, Xin-dai LU, et al. Research and implementation of fuzzing testing based on HTTP proxy[J]. Chinese Journal of Network and Information Security, 2016, 2(2): 75-86. DOI： 10.11959/j.issn.2096-109x.2016.00022.

摘要

常用的Web应用测试工具普遍存在着测试功能欠优化、可配置程度较低、测试结果不够智能等问题，无法较好地辅助测试。进行了基于HTTP代理的模糊测试技术研究，设计了相应的测试工具。该工具应用模糊测试理论，异步监听实现了HTTP代理与服务器、浏览器间的高性能通信；采用基于伪码的可配置测试用例生成策略，灵活进行自动化测试；通过解析网络数据分组，为用户提供全面的测试分析结果。实验结果表明，该工具支持主流 Web 应用漏洞检测、测试策略配置，可检测出目录遍历、SQL 注入、跨站脚本等漏洞。

Abstract

Most of the security testing tools lack of optimization of testing

configured strategy and intelligent analysis of testing results.These problems lead to the status that these tools can’t be used in Web application testing well.A fuzzing testing method towards Web application security based on HTTP proxy was proposed.The high-performance communication between HTTP proxy server and browser through the mechanism of asynchronous monitoring was realized.Configured strategy of testing cases based on pseudo code could help to do flexible and automatic tests.By using multi-dimensional ways to parse the packet

intelligent analysis of testing results was achieved.Experiments show that the tool supports mainstream Web application vulnerabilities detection and configured strategy of testing.It can detect the vulnerabilities such as directory traversal

SQL injection

cross-site scripting.

关键词

Keywords

references

崔光耀 . 启明星辰IPS突破Web防御僵局 [J ] . 信息安全与通信保密 2008 ( 6 ): 33 .

CUI G Y . Venus IPS breakthrough Web defense deadlock [J ] . In-formation Security and Communications Privacy , 2008 ( 6 ): 33 .

HUANG Y W , HUANG S K , LIN T P , et al . Web application security assessment by fault injection and behavior monitor-ing[C]//The 12th International World Wide Web Conference . New York , c 2003 : 148 - 159 .

MILLER B . Project:operating system utility program reliabil-ity-the fuzz generator [EB/OL ] . http://pages.cs.wisc.edu/～bart/fuzz/fuzz.html http://pages.cs.wisc.edu/～bart/fuzz/fuzz.html .

OEHLERT P . Violating assumptions with fuzzing [J ] . IEEE Security and Privacy , 2005 , 3 ( 2 ): 58 - 62 .

SUTTON M , GREENE A , AMINI P . Fuzzing:brute force vulner-ability discovery [M ] . 2007 .

吴志勇 , 王红川 , 孙乐昌 , 等 . Fuzzing技术综述 [J ] . 计算机应用研究 , 2007 , 27 ( 3 ): 829 - 832 .

WU Z Y , WANG H C , SUN L C , et al . Survey on fuzzing [J ] . Ap-plication Research of Computers , 2007 , 27 ( 3 ): 829 - 832 .

MILLER B P , FREDRIKSEN L , SO B . An empirical study of the reliability of UNIX utilities [J ] . Communications of the ACM , 1990 , 33 ( 12 ): 32 - 44 .

LIN J C , CHEN J M . An automated mechanism for secure input handing [J ] . Journal of Computers , 2009 , 4 ( 9 ): 837 - 844 .

ERIKSSON B I , DAHL O E , BÜLLER R , et al . A new oral direct thrombin inhibitor,dabigatran etexilate,compared with enoxaparin for prevention of thromboembolic events following total hip or knee replacement:the BISTROⅡ randomized trial [J ] . Journal of Thrombosis and Haemostasis , 2005 , 3 ( 1 ): 103 - 111 .

SPI Dynamics . Web application security assessment [R ] . 2003 .

于莉莉 , 杜蒙杉 , 张平 , 等 . Web 安全性测试技术综述 [J ] . 计算机应用研究 2012 , 29 ( 29 ): 4000 - 4002 .

YU L L , DU M S , ZHANG P , et al . Survey on Web security testing technologies [J ] . Application Research of Computers , 2012 , 29 ( 29 ): 4000 - 4002 .

HAMMERSLAND R , SNEKKENES E . Fuzz testing of Web ap-plications [EB/OL ] . Journal of Computer and System Sciences , http://rune.hammersland.net/tekst/fuzzing-article.pdf http://rune.hammersland.net/tekst/fuzzing-article.pdf .

GRAAF M D . Intelligent fuzzing of Web applications [D ] . Amster-dam:University of Amsterdam , 2009 .

STOECKEL D M , STELZER E A , DICK L K . Evaluation of two spike-and-recovery controls for assessment of extraction efficiency in microbial source tracking studies [J ] . Water Research , 2009 , 43 ( 19 ): 4820 - 4827 .

都娟 . 基于模糊测试方法的 Web 应用安全性测试技术的研究及其工具实现 [D ] . 上海:华东师范大学 , 2011 .

DU J . Web application security testing technique based on fuzzing and implementation of the tool [D ] . Shanghai:East China Normal University , 2011 .

刘为 . 基于模糊测试的XSS漏洞检测系统研究与实现 [D ] . 长沙:湖南大学 , 2010 .

LIU W . Research on and implementation of XSS vulnerability mining based on fuzzing technology [D ] . Changsha:Hunan Univer-sity , 2010 .

Damn vulnerable Web application [EB/OL ] . http://www.dvwa.co.uk/ http://www.dvwa.co.uk/ .

Fuzzing:brute force vulnerability discovery [EB/OL ] . http://www.fuzzing.org/ http://www.fuzzing.org/ .

Web security [EB/OL ] . https://portswigger.net/burp/ https://portswigger.net/burp/ .

浏览量

615

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于分布散度的自适应模糊测试优化方法

进化内核模糊测试研究综述

基于攻击图的网络安全度量研究综述

基于Web应用的网络安全漏洞发现与研究