XSS detection method and device

1. A cross-site scripting (XSS) detection method for detecting XSS vulnerabilities in a web page, comprising steps of:

determining a set of parameter-value pairs that can be accepted by the web page;

and for each parameter-value pair in the set:

constructing a parameter-value pair in which a dedicated script is inserted;

assembling a URL corresponding to the web page based on the parameter-value pair in which the dedicated script has been inserted, wherein the URL is assembled by modifying a sequence of the parameter-value pair in which the dedicated script has been inserted by adding the dedicated script at an end of the URL and by adding a closing tag of a hypertext markup language element or a specific character before the dedicated script;

wherein in assembling the URL corresponding to the web page, a plurality of URLs are assembled by changing the sequence of the parameter-value pairs and by inserting other special codes in the URL;

acquiring dynamic web page content corresponding to the assembled URL;

simulating the execution of the dynamic web page content, wherein the steps of acquiring the dynamic web page content and simulating the execution of the dynamic web page content are performed respectively for each one of the plurality of URLs, and

determining when the dedicated script is executed, that the processing of the parameter-value pair in the web page contains XSS vulnerabilities.

2. The XSS detection method according to claim 1 , wherein in simulating the execution of the dynamic web page content, a script parsing engine is used to execute scripts in the web page content and the script parsing engine is constructed to determine whether XSS vulnerabilities exist depending on whether the dedicated script is triggered.

3. The XSS detection method according to claim 1 , wherein the dedicated script is an alert function.

4. The XSS detection method according to claim 1 , further comprising:

recording whether a parameter in the set of parameter-value pairs contains XSS vulnerabilities.

5. A cross-site scripting (XSS) detection device for detecting XSS vulnerabilities in a web page, comprising hardware and:

a web page parameter-value pair set determining unit configured to determine a set of parameter-value pairs that can be accepted by the web page;

a testing URL assembler configured to assemble a testing URL for each parameter-value pair in the set of parameter-value pairs, wherein a dedicated script is inserted in the value of the parameter-value pair during the assembly of the testing URL and, wherein the testing URL is assembled by modifying a sequence of the parameter-value pair in which the dedicated script has been inserted by adding the dedicated script at an end of the testing URL and by adding a closing tag of a hypertext markup language element or a specific character before the dedicated script; wherein the testing URL assembler is configured to assemble a plurality of testing URLs by changing the sequence of the parameter-value pair and by inserting other special codes in the URL when assembling the testing URL;

a communicator configured to send each testing URL to a web server and receive dynamic web page content returned from the web server in order to detect XSS vulnerabilities for each testing URL; and

a simulator configured to simulate the execution of the dynamic web page content and determine the existence of XSS vulnerabilities in the parameter-value pair when the dedicated script has been executed.

6. The XSS detection device according to claim 5 , further comprising:

a script parsing engine, with which the simulator executes the script when simulating the execution of the web page content, wherein the script parsing engine determines whether XSS vulnerabilities exist in the parameter-value pair depending on whether the dedicated script has been triggered.

7. The XSS detection device according to claim 5 , wherein the dedicated script is an alert function.

8. The XSS detection device according to claim 5 , further comprising a recorder configured to record whether a parameter in the set of parameter-value pairs contains XSS vulnerabilities.

9. A non-volatile computer readable medium including instructions that, when executed by a microprocessor, cause the following steps to be performed:

determining a set of parameter-value pairs that can be accepted by a web page; and for each parameter-value pair in the set:

constructing a parameter-value pair in which a dedicated script is inserted;

assembling a URL corresponding to the web page based on the parameter-value pair in which the dedicated script has been inserted, wherein the URL is assembled by modifying a sequence of the parameter-value pair in which the dedicated script has been inserted by adding the dedicated script at an end of the URL and by adding a closing tag of a hypertext markup language element or a specific character before the dedicated script;

wherein in assembling the URL corresponding to the web page, a plurality of URLs are assembled by changing the sequence of the parameter-value pairs and by inserting other special codes in the URL;

acquiring dynamic web page content corresponding to the assembled URL;

simulating the execution of the acquired dynamic web page content, wherein the steps of acquiring the dynamic web page content and simulating the execution of the dynamic web page content are performed respectively for each one of the plurality of URLs, and

when the dedicated script is executed, it is determined that the processing of the parameter-value pair in the web page contains cross-site scripting (XSS) vulnerabilities.