Method for recognizing CSRF token elements in web pages

Abstract

The invention discloses a method for recognizing CSRF token elements in web pages. The method comprises the following steps: establishing a first conversation of HTTP; examining whether a page source code has <form> labels or not by acquiring a targeted page source code; searching whether form elements of which input types are hidden exist in the <form> labels of the web page source code of the first conversation; establishing a second conversation of HTTP; examining whether a page source code has <form> labels or not by acquiring a targeted page source code; searching whether form elements of which input types are hidden exist in the <form> labels of the web page source code of the second conversation; successively comparing the values of the form elements of which the input types are hidden in the forms of the first conversation and the second conversation; calculating the proportion of Levenstein distance of the values of the suspected CSRF token form elements; judging whether the parameters are CSRF token or not. The CSRF token elements are dynamically recognized on the basis of an algorithm, the recognition rate of the CSRF token elements is increased, and missing report is greatly reduced.

Description

Technical field [0001] The invention relates to the field of CSRF identification, in particular to a method for identifying CSRF token elements in a webpage. Background technique [0002] The CSRF attack is successful because the attacker can forge the user’s request. All user authentication information in the request is stored in the Cookie, so the attacker can directly use the user’s own Cookie without knowing the authentication information. To pass the security verification. It can be seen that the key to resisting CSRF attacks is to include information that cannot be forged by the attacker in the request, and the information does not exist in the Cookie. [0003] The system developer can add a randomly generated token in the form of a parameter in the HTTP request, and establish an interceptor on the server side to verify the token. If there is no token in the request or the content of the token is incorrect, it may be a CSRF attack. Deny the request. This method of embeddin...

AI Technical Summary

Problems solved by technology

Specifically, CSRF attacks can be understood in this way: the attacker has stolen your identity and sent a malicious request in your name. This request is completely legal to the server, but it has completed an operation expected by the attacker.

Images