A reflective XSS vulnerability detection method based on fuzzing test

Aiming at the problems of low efficiency,high false negative rate and high false positive rate in the current cross site scripting (XSS) vulnerability detection technology for web applications,this paper proposes a reflective XSS vulnerability detection method based on fuzzing test.First,Web crawler technology was used to crawl and analyze the web links of the specified depth of the whole site.so as to extract the potential user injection points;Secondly,fuzzy test cases was constructed according to the grammatical form of attack payload.and an initial weights was set for each element.obtain the output point type according to the injected probe vector.the corresponding attack grammatical form was selected to construct more potential attack payloads,and it was mutated to form a mutated attack payload as the request parameter;Then,the website response was analyzed and the weights of elements was adjusted to generate a more efficient attack payload.Finally,this method was compared with two mainstream XSS vulnerability detection tools,AWvsand W3AF.The experimental results show that the number of potential user injection points that can be found by the proposed system increases by 11. 5%, the false positive rate of vulnerability decreased to 0.38%,and the false negative rate was lower than 2.31%;At the same time,the number of requests was reduced and the detection time was saved.