• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Data Intelligence and Security >An Analysis of Effectiveness of Black-Box Web Application Scanners in Detection of Stored SQL Injection and Stored XSS Vulnerabilities
【24h】

An Analysis of Effectiveness of Black-Box Web Application Scanners in Detection of Stored SQL Injection and Stored XSS Vulnerabilities

机译：黑盒Web应用程序扫描仪在检测到存储SQL注入和存储XSS漏洞中的有效性分析

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Black-box web application scanners are used to detect vulnerabilities in the web application without any knowledge of the source code. Recent research had shown their poor performance in detecting stored Cross-Site Scripting (XSS) and stored SQL Injection (SQLI). The detection efficiency of four black-box scanners on two testbeds, Wackopicko and Custom testbed Scanit (obtained from [5]), have been analyzed in this paper. The analysis showed that the scanners need to be improved for better detection of multi-step stored XSS and stored SQLI. This study involves the interaction between the selected scanners and the web application to measure their efficiency of inserting proper attack vectors in appropriate fields. The results of this research paper indicate that there is not much difference in terms of performance between open-source and commercial black-box scanners used in this research. However, it may depend on the policies and trust issues of the companies using them according to their needs. Some of the possible recommendations are provided to improve the detection rate of stored SQLI and stored XSS vulnerabilities in this paper. The study concludes that the state-of-the-art of automated black-box web application scanners in 2020 needs to be improved to detect stored XSS and stored SQLI more effectively.
机译：黑匣子Web应用程序扫描仪用于检测Web应用程序中的漏洞，而无需任何知识源代码。最近的研究表明它们在检测存储的跨站点脚本（XSS）和存储的SQL注入（SQLI）方面的性能不佳。在本文中分析了两个测试台，Wackopicko和自定义测试用扫描仪（从[5]）上的四个黑匣子扫描仪的检测效率。分析表明，需要改进扫描仪以便更好地检测多步存储XS和存储的SQLI。本研究涉及所选扫描仪与Web应用程序之间的交互，以测量它们在适当领域中插入适当的攻击向量的效率。本研究论文的结果表明，在本研究中使用的开源和商业黑匣子扫描仪之间的性能方面没有太大差异。但是，它可能取决于公司的政策和信任问题，根据他们的需求使用它们。提供了一些可能的建议，以提高存储SQLI的检测率并在本文中存储了XSS漏洞。该研究的结论是，需要改进2020年自动黑匣子Web应用程序扫描仪的最新，以检测存储的XSS并更有效地存储SQLI。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号