关键词: Web安全, 跨站脚本, 攻击向量, 漏洞利用, 漏洞检测方法

Abstract: XSS(cross-site scripting) is a type of computer security vulnerability typically found in Web applications. Attackers usually inject malicious scripts into Web pages viewed by other users, and expect the script to be executed. Because of the high flexibility of HTML encoding schemes offering the attacker many possibilities for circumventing input filters, XSS attacks are difficult to detect and prevent. In order to make effective prevention for XSS vulnerabilities, firstly we carefully analyzed and compared the characteristics and principles of Reflected XSS, Stored XSS and DOM-based XSS, then combed the large number of XSS attack vectors with different shapes, and illustrated the common use of XSS vulnerabilities, such as stealing, session hijacking and phishing. Finally, we sorted out the basic means of defense XSS, and summarized the main methods of automatic XSS vulnerability detection including static analysis, dynamic analysis and machine learning.

Key words: Web security, XSS(cross-site scripting), attack vectors, exploit, vulnerability detection methods