| 摘要: |
| 黑盒漏洞扫描器是用于Web应用漏洞检测的重要辅助工具, 能够在Web应用正式上线前有效识别潜在的安全威胁, 从而提升Web应用的整体安全性. 当前大多数黑盒扫描器主要通过模拟用户操作和正则匹配来收集攻击面. 然而, 模拟用户操作容易被输入验证机制拦截, 且难以处理复杂的事件操作, 而正则匹配方法无法有效处理动态内容. 这导致扫描器难以有效处理JavaScript代码中的隐藏攻击面和动态生成的攻击面, 使其在部分Web应用中漏洞检测效果不佳. 为解决上述问题, 提出一种基于JavaScript代码分析的漏洞扫描器增强框架JSEScan. 该框架结合静态与动态代码分析技术, 绕过表单验证和事件触发的限制, 通过提取JavaScript代码中攻击面的特征, 实现JavaScript代码中攻击面的挖掘, 并且攻击面将被同步至多种扫描器, 从而增强其漏洞检测能力. 实验结果表明, JSEScan能将单个扫描器的代码覆盖量提高81.02%–242.15%, 并且相比于多扫描器同时工作的情况, 额外发现239个安全漏洞, 具备更强的攻击面收集能力和漏洞检测能力. |
| 关键词: Web安全 黑盒扫描器 JavaScript 漏洞检测 攻击面挖掘 |
| DOI：10.13328/j.cnki.jos.007476 |
| 分类号:TP311 |
| 基金项目:国家自然科学基金(62372236, 62402223); 国家资助博士后研究人员计划(GZB20240982); 江苏省青蓝工程; 江苏省卓越博士后计划 |
|
| Vulnerability Scanner Enhancement Framework Based on JavaScript Code Analysis |
|
KUANG Bo-Yu1, ZHU Yan1, YANG Shan-Quan2, SU Mang1,2, ZHOU Yong-Bin1, FU An-Min1,2
|
|
1.School of Cyber Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China;2.School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China
|
| Abstract: |
| The black-box vulnerability scanner is an essential tool for Web application vulnerability detection, capable of identifying potential security threats effectively before a Web application is launched, thus enhancing the overall security of the application. However, most current black-box scanners primarily collect the attack surface through user operation simulation and regular expression matching. The simulation of user operations is vulnerable to interception by input validation mechanisms and struggles with handling complex event operations, while regular expression matching is ineffective in processing dynamic content. As a result, the scanner cannot effectively address hidden attack surfaces within JavaScript code or dynamically generated attack surfaces, leading to suboptimal vulnerability detection in some Web applications. To resolve these issues, this study proposes a JavaScript Exposure Scanner (JSEScan), a vulnerability scanner enhancement framework based on JavaScript code analysis. The framework integrates static and dynamic code analysis techniques, bypassing form validation and event-triggering restrictions. By extracting attack surface features from JavaScript code, JSEScan identifies attack surfaces and synchronizes them across multiple scanners, enhancing their vulnerability detection capabilities. The experimental results demonstrate that JSEScan increases coverage by 81.02% to 242.15% compared to using a single scanner and uncovers an additional 239 security vulnerabilities when compared to multiple scanners working concurrently, showing superior attack surface collection and vulnerability detection capabilities. |
| Key words: Web security black-box scanner JavaScript vulnerability detection attack surface mining |
