Method, apparatus, terminal and media for detecting document object model-based cross-site scripting attack vulnerability

An apparatus for detecting a document object model based cross-site scripting comprising a processor and a memory having processor-executable instructions stored therein, and the instructions when executed by the processor, configure the processor to:

• obtain a set of parameter-value pairs from an original web address of a web page, wherein the set of parameter-value pairs comprises at least one parameter-value pair;
• replace a parameter value in a parameter-value pair with feature code, to form a test web address for the web page, wherein the feature code comprises malicious code that comprises a malicious character and is uniquely identified in a document object model tree of the web page;
• obtain page content corresponding to the test web address, wherein the processor is further configured to:
• request a web server of the test web address for page content corresponding to the test web address;
• and receive the page content responded by the web server of the test web address;
• convert the page content into the document object model tree;
• and detect whether a cross-site scripting vulnerability exists in the parameter value pair, based on the document object model tree and the feature code,
• wherein the processor is further configured to:
• determine whether the document object model tree comprises the feature code;
• determine that a cross-site scripting vulnerability exists in the parameter-value pair if the document object model tree comprises the feature code;
• determine that no cross-site scripting vulnerability exists in the parameter-value pair if the document object model tree does not comprise the feature code;
• and in a case that the document object model tree does not comprise the feature code:
• triggering execution of a button on the web page;
• updating the document object model tree;
• and
• detecting whether a cross-site scripting vulnerability exists in the parameter-value pair based on the updated document object model tree and the feature code.

A non-transitory computer readable storage medium, storing computer executable instructions such that the following steps are performed when the executable instructions are executed on a computer:

• obtaining a set of parameter-value pairs from an original web address of a web page, wherein the set of parameter-value pairs comprises at least one parameter-value pair;
• replacing a parameter value in a parameter-value pair with feature code, to form a test web address for the web page, wherein the feature code comprises malicious code that comprises a malicious character and is uniquely identified in a document object model tree of the web page;
• obtaining page content corresponding to the test web address by:
• requesting a web server of the test web address for page content corresponding to the test web address;
• and
• receiving the page content responded by the web server of the test web address;
• converting the page content into the document object model tree;
• and detecting whether a cross-site scripting vulnerability exists in the parameter-value pair, based on the document object model tree and the feature code by:
• determining whether the document object model tree comprises the feature code;
• determining that a cross-site scripting vulnerability exists in the parameter-value pair if the document object model tree comprises the feature code;
• determining that no cross-site scripting vulnerability exists in the parameter-value pair if the document object model tree does not comprise the feature code;
• and in a case that the document object model tree does not comprise the feature code:
• triggering execution of a button on the web page;
• updating the document object model tree;
• and
• detecting whether a cross-site scripting vulnerability exists in the parameter-value pair based on the updated document object model tree and the feature code.