Cross site request forgery vulnerability detection method and device

Abstract

The invention discloses a cross site request forgery vulnerability detection method and device. The method comprises the following steps: acquiring a webpage entrance to be detected, and generating a unique feature corresponding to the webpage entrance, wherein the feature comprises webpage entrance description information; taking the generated feature as the parameter content of the webpage entrance to be detected, including the generated feature in a webpage request, and submitting the webpage request to a target website; and crawling a webpage of the target website, looking up whether or not the feature is included on the webpage or not, and if so, determining a webpage entrance on which cross site request forgery vulnerability exists according to the webpage entrance description information included in the feature. Through adoption of the scheme of the invention, the accuracy of cross site request forgery vulnerability detection can be increased.

Description

Technical field [0001] The present invention relates to webpage safety detection technology, in particular to a method and device for detecting cross-site forged request vulnerabilities. Background technique [0002] Cross-site request forgery (CSRF, Cross Site Request Forgery) attack, mainly refers to the attacker can implant malicious code or link in the webpage, when the victim's browser visits the malicious code or clicks on the malicious link, the attacker uses the victim The legal identity verification carried by the browser (usually stored in the browser cookie) initiates a malicious operation request to the target site. When the web page of the target site does not verify the validity of the request source, the malicious operation request will be successfully executed. It is believed that the webpage of the target site has a CSRF vulnerability. [0003] A typical example of a CSRF attack is when a user logs on to a webpage of a bank website, and the legal identity verific...

AI Technical Summary

Problems solved by technology

[0007] Even if the url address contains keywords similar to the token parameter, since the current target website does not verify the legitimacy of the token, for example, the token parameter pre-negotiated between the browser and the target website is "token=123456", and the attacker added in the url The token parameter is "token=111111", and the detection device detects that "token" is included in the url, and it is determined that there is no CSRF vulnerability, which leads to false negatives, and some cases of CSRF vulnerabilities are missed

[0008] In summary, the existing CSRF vulnerability detection scheme has a large number of false positives and missed negatives, resulting in high false positive rate and low accuracy rate

Images