WO2020253351A1 - 一种点击劫持漏洞检测方法、装置及计算机设备 - Google Patents

一种点击劫持漏洞检测方法、装置及计算机设备 Download PDF

Info

Publication number
WO2020253351A1
WO2020253351A1 PCT/CN2020/085723 CN2020085723W WO2020253351A1 WO 2020253351 A1 WO2020253351 A1 WO 2020253351A1 CN 2020085723 W CN2020085723 W CN 2020085723W WO 2020253351 A1 WO2020253351 A1 WO 2020253351A1
Authority
WO
WIPO (PCT)
Prior art keywords
page
response message
detected
http response
click operation
Prior art date
Application number
PCT/CN2020/085723
Other languages
English (en)
French (fr)
Inventor
张何钫
Original Assignee
深圳前海微众银行股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海微众银行股份有限公司 filed Critical 深圳前海微众银行股份有限公司
Publication of WO2020253351A1 publication Critical patent/WO2020253351A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the technical field of financial technology (Fintech) and the technical field of information security, in particular to a method, device and computer equipment for detecting clickjacking vulnerabilities.
  • the common method for detecting click-hijacking vulnerabilities is manual testing. By manually clicking on any position of the webpage, testing whether it will click on some functional buttons of the iframe page to determine whether a page has click-hijacking vulnerabilities.
  • the manual test mode it is difficult to distinguish whether the click is on some functional buttons of the iframe page or the page to be tested. Therefore, the detection of clickjacking vulnerabilities in the prior art is prone to false negatives or false positives, resulting in low detection accuracy.
  • This application provides a method, device and computer equipment for detecting clickjacking vulnerabilities, which are used to solve the problem of under-reporting or misreporting when detecting clickjacking vulnerabilities in the prior art, resulting in low detection accuracy.
  • this embodiment of the application provides a method for detecting clickjacking vulnerabilities: obtaining the uniform resource locator URL of the page to be detected, and determining whether to perform a simulated click operation on the page to be detected according to the URL; If the page to be detected performs a simulated click operation, a hypertext transfer protocol HTTP response message returned based on the simulated click operation is obtained; it is determined whether there is a click on the page to be detected according to at least one result in the HTTP response message Hijacking vulnerability; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains an inline box for prohibiting loading of the page to be detected The default anti-hijacking code for the iframe page.
  • the uniform resource locator URL of the page to be detected first obtain the uniform resource locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL, and if it is determined to perform a simulated click operation on the page to be detected, obtain HTTP Respond to the message, and determine whether there is a clickjacking vulnerability according to at least one result in the HTTP response message, so that a part of the underreporting of the clickjacking vulnerability can be reduced according to the URL.
  • the page to be detected has a clickjacking vulnerability
  • at least one result of a simulated click operation on the page to be detected is used to determine whether the page to be detected has a clickjacking vulnerability
  • the content security policy (CSP) page embeds
  • a set of attributes can characterize whether the page to be detected can be nested by an iframe page, so in combination with the preset anti-hijacking code used to prohibit the page to be detected from loading the iframe page in the inline box, it can fully consider whether the page to be detected has clickjacking vulnerabilities. Thereby, the accuracy of detecting clickjacking vulnerabilities can be improved.
  • the HTTP response message includes an HTTP resource part, and it is determined whether the HTTP response message contains the preset anti-hijacking code in the following manner: the HTTP resource part is combined with a preset regular expression Perform regular matching with the formula, and determine whether the HTTP response message contains the preset anti-hijacking code according to the result of the regular matching.
  • the regular expression since the regular expression has strong logic and flexibility, it is determined whether the HTTP response message contains the preset defense based on the result of regular matching between the HTTP resource part and the preset regular expression.
  • the hijacking code can accurately check whether the preset anti-hijacking code is included.
  • obtaining a hypertext transfer protocol HTTP response message returned based on the simulated click operation includes: if the simulated click operation The corresponding HTTP request is a request for changing the background data of the page to be detected, and the HTTP request contains login status information, then the HTTP response message returned based on the simulated click operation is obtained.
  • the HTTP request is a request to change the background data of the page to be detected, and the HTTP request contains login status information, the HTTP request has the condition of a hijacking vulnerability, so it is only obtained in this case HTTP response message.
  • the determining whether to perform a simulated click operation on the page to be detected according to the URL includes: determining whether the URL is in a preset URL whitelist, and if not, responding to the waiting The detection page performs a simulated click operation.
  • a part of URLs are filtered out in advance through a preset URL whitelist, which can prevent false positives to a certain extent and improve the detection accuracy of clickjacking vulnerabilities.
  • the at least one result further includes: whether the HTTP response message includes page nesting header information.
  • this application provides a clickjacking vulnerability detection device, including:
  • the obtaining module is configured to obtain the uniform resource locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL;
  • a processing module configured to, if it is determined to perform a simulated click operation on the page to be detected, obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation; according to at least one result in the HTTP response message It is determined whether the page to be detected has a clickjacking vulnerability; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains a prohibition
  • the page to be detected loads the preset anti-hijacking code of the inline frame iframe page.
  • the HTTP response message includes an HTTP resource part
  • the processing module determines whether the HTTP response message contains the preset anti-hijacking code in the following manner: Combining the HTTP resource part with The preset regular expression performs regular matching, and it is determined whether the HTTP response message contains the preset anti-hijacking code according to the result of the regular matching.
  • the processing module is specifically configured to: if the HTTP request corresponding to the simulated click operation is a request to change the background data of the page to be detected, and the HTTP request contains login status information, Then, the HTTP response message returned based on the simulated click operation is obtained.
  • the processing module is specifically configured to determine whether the URL is in a preset URL whitelist, and if not, perform a simulated click operation on the page to be detected.
  • the at least one result further includes: whether the HTTP response message includes page nesting header information.
  • the present application provides a computer device including a program or instruction, and when the program or instruction is executed, it is used to execute the above-mentioned method of the first aspect and each implementation manner of the first aspect.
  • the present application provides a storage medium including a program or instruction, and when the program or instruction is executed, it is used to execute the method of the first aspect and the implementation manners of the first aspect.
  • FIG. 1 is a schematic diagram of the process flow of a clickjacking vulnerability detection method provided by an embodiment of the application
  • FIG. 2 is a schematic diagram of the specific steps of a method for detecting clickjacking vulnerabilities according to an embodiment of the application
  • FIG. 3 is a schematic structural diagram of a clickjacking vulnerability detection device provided by an embodiment of the application.
  • Figure 4 is a schematic structural diagram of a computer device provided by an embodiment of the application.
  • FIG. 1 is a schematic diagram of the process flow of a method for detecting clickjacking vulnerabilities provided by an embodiment of the present application. As shown in Figure 1, the method includes:
  • Step 101 Obtain the uniform resource locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the uniform resource locator URL.
  • the embodiment of this application does not limit the browser of the page to be detected.
  • the browser of the page to be detected may be a headless browser (Headless Browser), which is a web browser without a Graphical User Interface (GUI), which can usually be controlled by programming or a command line interface.
  • Headless Browser can specifically be Chrome Headless, and Chrome Headless can be used for automated usability testing or browser interaction testing.
  • the embodiment of the present application can call Chrome Headless to perform operations such as simulated clicking.
  • Step 102 If it is determined to perform a simulated click operation on the page to be detected, obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation.
  • Step 103 Determine whether the page to be detected has a clickjacking vulnerability according to at least one result in the Hypertext Transfer Protocol HTTP response message.
  • a specific implementation manner of determining whether to perform a simulated click operation on the page to be detected according to the URL may be:
  • the preset URL whitelist includes URL1, URL2, and URL3. If the uniform resource locator of the page A to be detected is URL4, since URL4 is not in the preset URL whitelist, a simulated click operation can be performed on the page A to be detected.
  • a part of URLs can be filtered out in advance by preset URL whitelist, which can prevent false positives to a certain extent and improve the detection accuracy of clickjacking vulnerabilities.
  • an optional implementation manner for obtaining a hypertext transfer protocol HTTP response message returned based on the simulated click operation is as follows:
  • the HTTP request corresponding to the simulated click operation is a request to change the background data of the page to be detected, and the HTTP request contains login status information
  • the HTTP response message returned based on the simulated click operation is obtained .
  • the HTTP request is a request to change the background data of the page to be detected, specifically: used to change the background of the page to be detected Data request.
  • the HTTP request when the HTTP request is a request to change the background data of the page to be detected, only if the HTTP request contains login status information, the HTTP request may have the condition of the hijacking vulnerability. Obtaining the HTTP response message only under the circumstances can avoid unnecessary operation steps and improve the accuracy of detection.
  • the at least one result includes: whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains a method for prohibiting all Describes the preset anti-hijacking code for loading the iframe page of the inline box on the page to be detected.
  • the embodiment of this application does not limit the specific form of the preset anti-hijacking code.
  • the following content exemplarily lists the preset anti-hijacking code of a clickjacking vulnerability detection method provided by the embodiment of the present application:
  • the first step is to set the cascading style sheets (CSS) style with display as None for the main part of the page to be detected.
  • CSS cascading style sheets
  • display is a parameter that can define CSS styles. By assigning different values to display, different CSS styles can be set.
  • display is set to None, the main part of the page to be detected will not be hidden on the page to be detected in the browser, and will not be controlled by clicking.
  • hide the style tag of the main body The code will take effect first, and style is an attribute of the page to be detected.
  • the second step when the browser renders to the last js code part, the js code in the script tag takes effect, and check whether the page is nested.
  • js is a literal scripting language of JavaScript.
  • the third step if top and self are equal, indicating that the page is not nested, remove the CSS style that was originally set to the main part of display as None.
  • top is a variable provided by the browser, representing the outermost window object, and self is the current window object.
  • the fourth step if top and self are not equal, assign self.location to top.location, so that the js code will jump the page of the outermost window to the page of the page to be detected to prevent being nested.
  • top.location represents the location of the outermost window object
  • self.location represents the location of the current window object
  • the HTTP response message when the HTTP response message includes an HTTP resource part, it can be determined whether the HTTP response message contains a preset anti-hijacking code in the following manner: Regularize the HTTP resource part with a preset regular expression Match, determine whether the HTTP response message contains a preset anti-hijacking code according to the result of regular matching.
  • the regular expression since the regular expression has strong logic and flexibility, it can be determined whether the HTTP response message contains the preset anti-hijacking code through the regular matching result of the HTTP resource part and the preset regular expression. Accurately check whether it contains a preset anti-hijacking code.
  • the HTTP response message includes an HTTP header, it can be determined by string matching whether it contains the page nesting attribute of the content security policy CSP.
  • CSP frame-ancestors'none', which means that it cannot be nested
  • CSP frame-ancestors'self'*.somesite.com', which means that it is nested by *.somesite.com; among them, *.somesite.com is used to indicate the domain name protocol port of the nested site and other information .
  • the foregoing at least one result may further include: whether the HTTP response message includes page nesting header information.
  • This method can expand another result of detecting clickjacking vulnerabilities. Since the page nesting header information can characterize the page nesting attribute of the page to be detected, when at least one result also includes page nesting header information, it can be further Improve the detection accuracy of clickjacking vulnerabilities, so that it can also determine whether the page contains nested header information through string matching.
  • the page nesting header information may be the X-Frame-Options header.
  • ALLOW-FROM uri When the value of X-Frame-Options is ALLOW-FROM uri, it indicates pages that can be nested.
  • the uniform resource locator URL of the page to be detected is first obtained, and according to the URL, it is determined whether to perform a simulated click operation on the page to be detected. If it is determined to perform a simulated click operation on the page to be detected, then Obtain the HTTP response message, and determine whether there is a clickjacking vulnerability according to at least one result in the HTTP response message, so that a part of the underreporting of the clickjacking vulnerability can be reduced according to the URL.
  • FIG. 2 is a schematic diagram of the specific steps of the method.
  • Step 201 Obtain the uniform resource locator URL of the page to be detected.
  • Step 202 Determine whether the uniform resource locator URL of the page to be detected is in the preset whitelist.
  • step 210 If yes, go to step 210; otherwise, go to step 203.
  • Step 203 Perform a simulated click operation to trigger a hypertext transfer protocol HTTP request.
  • Chrome Headless JavaScript can be called to simulate a click operation.
  • Step 204 Determine whether the Hypertext Transfer Protocol HTTP request satisfies the preset condition, if the preset condition is met, step 205 is executed; if the preset condition is not met, step 210 is executed.
  • the hypertext transfer protocol HTTP request meets the preset condition, which means: the HTTP request is a request to update the background data of the page to be checked, and the HTTP request includes login status information .
  • the hypertext transfer protocol HTTP request does not meet the preset condition, which means that the HTTP request is not a request to update the background data of the page to be checked, or an HTTP request Does not include login information.
  • Step 205 Obtain a hypertext transfer protocol HTTP response message.
  • the HTTP response message is a response message that responds to the HTTP request of the page to be detected.
  • step 205 After step 205 is performed, at least one of steps 206 to 208 may be performed.
  • Step 206 Determine whether the response message contains page nesting header information.
  • Step 207 Determine whether the response message contains the page nesting attribute of the content security policy CSP.
  • Step 208 Determine whether the response message contains a preset anti-hijacking code.
  • steps 206 to 208 can be executed at the same time, and the steps between step 206 and step 208 are not affected.
  • step 210 If the determination result of one or more steps in at least one step executed in step 206 to step 208 is yes, then execute step 210; if the determination result of each step in at least one step executed in step 206 to step 208 is Otherwise, go to step 209.
  • Step 209 Determine that the page to be detected has a clickjacking vulnerability.
  • Step 210 It is determined that the page to be detected has no clickjacking vulnerability.
  • the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, Or, whether the HTTP response message contains a preset anti-hijacking code for prohibiting the page to be detected from loading the inline frame iframe page.
  • the clickjacking vulnerability detection method in this application has a higher accuracy rate and can greatly reduce the false alarm rate.
  • the above-mentioned false alarms of these false alarms can also be improved by setting up black and white lists to reduce the manual review time of security personnel.
  • Figure 3 is a schematic structural diagram of a clickjacking vulnerability detection device provided by an embodiment of the application. As shown in Figure 3, the device includes:
  • the obtaining module 301 is configured to obtain the uniform resource locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL;
  • the processing module 302 is configured to, if it is determined to perform a simulated click operation on the page to be detected, obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation; according to at least one of the HTTP response messages The result determines whether the page to be detected has a clickjacking vulnerability; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains Prevent the page to be detected from loading the preset anti-hijack code of the inline frame iframe page.
  • the HTTP response message includes an HTTP resource part
  • the processing module 302 is specifically configured to:
  • processing module 302 is specifically configured to:
  • the HTTP request corresponding to the simulated click operation is a request to change the background data of the page to be detected, and the HTTP request contains login status information
  • the HTTP response message returned based on the simulated click operation is obtained .
  • processing module 302 is specifically configured to:
  • the at least one result further includes:
  • HTTP response message includes page nesting header information.
  • the embodiment of the present invention also provides a computer device. As shown in FIG. 4, it includes at least one processor 401 and a memory 402 connected to the at least one processor.
  • the embodiment of the present invention does not limit the processing.
  • the connection between the processor 401 and the memory 402 in FIG. 4 is taken as an example.
  • the bus can be divided into address bus, data bus, control bus, etc.
  • the memory 402 stores instructions that can be executed by at least one processor 401, and at least one processor 401 can execute the steps included in the aforementioned clickjacking vulnerability detection method by executing the instructions stored in the memory 402.
  • the processor 401 is the control center of the computer equipment, which can use various interfaces and lines to connect various parts of the computer equipment, and prevent maliciousness by running or executing instructions stored in the memory 402 and calling data stored in the memory 402. attack.
  • the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor.
  • the application processor mainly processes an operating system, a user interface, and an application program.
  • the adjustment processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 401.
  • the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented on separate chips.
  • the processor 401 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention.
  • the general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed and completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the memory 402 as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules.
  • the memory 402 may include at least one type of storage medium, for example, it may include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk , CD, etc.
  • the memory 402 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the memory 402 in the embodiment of the present invention may also be a circuit or any other device capable of realizing a storage function for storing program instructions and/or data.
  • the embodiment of the present application provides a storage medium including a program or instruction, and when the program or instruction is executed, it is used to execute the clickjacking vulnerability detection method provided by the present application and the method of each embodiment.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种点击劫持漏洞检测方法、装置及计算机设备，涉及金融科技（Fintech）领域，用以解决现有技术检测点击劫持漏洞的准确率低的问题。方法包括：获取待检测页面的统一资源定位符URL，若根据URL确定对待检测页面执行模拟点击操作，则获取基于模拟点击操作返回的超文本传输协议HTTP响应报文；根据HTTP响应报文中的至少一项结果确定待检测页面是否存在点击劫持漏洞；至少一项结果包括HTTP响应报文是否含有内容安全策略的页面嵌套属性，或是否含有用于禁止待检测页面加载内联框页面的预设防劫持代码。通过使用HTTP响应报文中的至少一项结果确定是否存在点击劫持漏洞，能够准确检测出网页中的点击劫持漏洞。

Description

一种点击劫持漏洞检测方法、装置及计算机设备
相关申请的交叉引用
本申请要求在2019年06月21日提交中国专利局、申请号为201910540302.0、申请名称为“一种点击劫持漏洞检测方法、装置及计算机设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及金融科技(Fintech)技术领域和信息安全技术领域，尤其涉及一种点击劫持漏洞检测方法、装置及计算机设备。
背景技术
随着计算机技术的发展，越来越多的技术(例如大数据技术、分布式技术、区块链(Blockchain)技术、人工智能技术等)应用在金融领域，传统金融业正在逐步向金融科技(Fintech)转变。目前，金融科技领域中，信息安全至关重要，点击劫持是一种视觉上的欺骗手段，攻击者可以使用一个透明的、不可见的内联框(即iframe)，覆盖在一个网页上，然后诱使用户在该网页上进行操作，通过调整iframe页面的位置，可以诱使用户恰好点击在iframe页面的一些功能性按钮上执行一些操作。可知，某些网页上是会存在点击挟持漏洞的，因此，需要将网页上的这些点击挟持漏洞检测出来。
目前检测点击挟持漏洞的常用方式为人工测试方式，通过人工点击网页的任意位置，测试是否会点击在iframe页面的一些功能性按钮上，来确定一个页面是否存在点击挟持漏洞。然而，人工测试方式下，很难辨别是点击在iframe页面的一些功能性按钮上还是点击在待检测页面上。因此，现有技术中检测点击劫持漏洞时很容易出现漏报或误报，导致检测的准确率较低。
发明内容
本申请提供一种点击劫持漏洞检测方法、装置及计算机设备，用以解决现有技术中检测点击劫持漏洞时很容易出现漏报或误报，导致检测准确率较低的问题。
第一方面，本申请实施例提供一种点击劫持漏洞检测方法：获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作；若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文；根据所述HTTP响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞；所述至少一项结果包括所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
上述方法中，首先获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作，若确定对所述待检测页面执行模拟点击操作，则获取HTTP响应报文，并根据所述HTTP响应报文中的至少一项结果确定是否存在点击劫持漏洞，从而能够根据URL减少对点击劫持漏洞进行检测时的一部分漏报。另外，对待检测页面进行点击劫持漏洞时，通过对待检测页面执行模拟点击操作的至少一项结果，确定述待检测页面是否存在点击劫持漏洞，而内容安全策略(Content Security Policy，CSP)的页面嵌套属性，能够表征待检测页面能否被iframe页面嵌套，如此再结合用于禁止待检测页面加载内联框iframe页面的预设防劫持代码，能够全面考虑待检测页面是否存在点击劫持漏洞，从而可以提升检测点击劫持漏洞的准确率。
一种可选实施方式中，所述HTTP响应报文包括HTTP资源部分，按照以下方式确定所述HTTP响应报文是否含有所述预设防劫持代码：将所述HTTP资源部分与预设正则表达式进行正则匹配，根据正则匹配的结果确定所述HTTP响应报文是否含有所述预设防劫持代码。
上述方法中，由于正则表达式具有较强的逻辑性和灵活性，因此通过对HTTP资源部分与预设正则表达式进行正则匹配的结果，确定所述HTTP响应报文是否含有所述预设防劫持代码，可以准确检验出是否含有所述预设防劫持代码。
一种可选实施方式中，所述若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文，包括：若所述模拟点击操作对应的HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息，则获取基于所述模拟点击操作返回的所述HTTP响应报文。
上述方法中，由于HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息时，该HTTP请求才有出现劫持漏洞的条件，因此这种情况下才获取HTTP响应报文。
一种可选实施方式中，所述根据所述URL确定是否对所述待检测页面执行模拟点击操作，包括：确定所述URL是否在预设URL白名单中，若否，则对所述待检测页面执行模拟点击操作。
上述方法中，通过预设URL白名单，提前过滤掉一部分URL，从而能够在一定程度上防止误报，提升点击劫持漏洞的检测准确率。
一种可选实施方式中，所述至少一项结果还包括：所述HTTP响应报文是否包括页面嵌套头部信息。
上述方法中，能够扩展检测点击劫持漏洞的另一种结果，其中，页面嵌套头部信息能够表征待检测页面的页面嵌套属性，从而可以进一步提升点击劫持漏洞的检测准确率。
第二方面，本申请提供一种点击劫持漏洞检测装置，包括：
获取模块，用于获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作；
处理模块，用于若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文；根据所述HTTP 响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞；所述至少一项结果包括所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
一种可选实施方式中，所述HTTP响应报文包括HTTP资源部分，所述处理模块按照以下方式确定所述HTTP响应报文是否含有所述预设防劫持代码：将所述HTTP资源部分与预设正则表达式进行正则匹配，根据正则匹配的结果确定所述HTTP响应报文是否含有所述预设防劫持代码。
一种可选实施方式中，所述处理模块具体用于：若所述模拟点击操作对应的HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息，则获取基于所述模拟点击操作返回的所述HTTP响应报文。
一种可选实施方式中，所述处理模块具体用于：确定所述URL是否在预设URL白名单中，若否，则对所述待检测页面执行模拟点击操作。
一种可选实施方式中，所述至少一项结果还包括：所述HTTP响应报文是否包括页面嵌套头部信息。
上述第二方面及第二方面各个实施例的有益效果，可以参考上述第一方面及第一方面各个实施方式的有益效果，这里不再赘述。
第三方面，本申请提供一种计算机设备，包括程序或指令，当所述程序或指令被执行时，用以执行上述第一方面及第一方面各个实施方式的方法。
第四方面，本申请提供一种存储介质，包括程序或指令，当所述程序或指令被执行时，用以执行上述第一方面及第一方面各个实施方式的方法。
附图说明
图1为本申请实施例提供的一种点击劫持漏洞检测方法的步骤流程示意图；
图2为本申请实施例提供的一种点击劫持漏洞检测方法的具体步骤流程 示意图；
图3为本申请实施例提供的一种点击劫持漏洞检测装置的结构示意图；
图4为本申请实施例提供的一种计算机设备的结构示意图。
具体实施方式
为了更好的理解上述技术方案，下面将结合说明书附图及具体的实施方式对上述技术方案进行详细的说明，应当理解本申请实施例以及实施例中的具体特征是对本申请技术方案的详细的说明，而不是对本申请技术方案的限定，在不冲突的情况下，本申请实施例以及实施例中的技术特征可以相互结合。
金融科技(Fintech)领域中，信息安全的重要性不言而喻。在金融交易过程中，一些网页上是会存在点击挟持漏洞的，因此需要将这些点击挟持漏洞检测出来。目前检测点击挟持漏洞的常用方式为人工测试方式，通过人工点击网页的任意位置，测试是否点击在iframe页面的一些功能性按钮上，来确定一个页面是否存在点击挟持漏洞。然而，人工测试方式下，很难辨别是点击在iframe页面的一些功能性按钮上还是点击在待检测页面上，因此该种方式很容易出现漏报或误报，导致检测点击挟持漏洞的准确率较低。
为此，本申请实施例提供一种点击劫持漏洞检测方法，图1为本申请实施例提供的一种点击劫持漏洞检测方法的步骤流程示意图。如图1所示，该方法包括：
步骤101：获取待检测页面的统一资源定位符URL，并根据所述统一资源定位符URL确定是否对所述待检测页面执行模拟点击操作。
需要说明的是，本申请实施例对待检测页面的浏览器不做限定。例如，待检测页面的浏览器可以为无界面浏览器(Headless Browser),Headless Browser是没有图形用户界面(Graphical User Interface，GUI)的网页浏览器，通常可以通过编程或命令行界面来控制。Headless Browser具体可以为Chrome Headless，Chrome Headless可以用于自动化可用性测试或测试浏览器交互。 基于此，本申请实施例可以调用Chrome Headless执行模拟点击等操作。
步骤102：若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文。
步骤103：根据所述超文本传输协议HTTP响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞。
示例性地，在上述步骤101中，根据所述URL确定是否对所述待检测页面执行模拟点击操作的具体实施方式可以为：
确定所述URL是否在预设URL白名单中，若否，则对所述待检测页面执行模拟点击操作。
举例来说，预设URL白名单中包括URL1、URL2和URL3。若待检测页面A的统一资源定位符为URL4，则由于URL4不在预设URL白名单中，因此可以对待检测页面A执行模拟点击操作。
上述方法中，通过预设URL白名单，能够提前过滤掉一部分URL，从而能够在一定程度上防止误报，提升点击劫持漏洞的检测准确率。
示例性地，在上述步骤102中，若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文的一种可选实施方式如下：
若所述模拟点击操作对应的HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息，则获取基于所述模拟点击操作返回的所述HTTP响应报文。
需要说明的是，待检测页面的一些相关配置信息可以作为后台数据存储在后台服务器中，HTTP请求为更改所述待检测页面的后台数据的请求，具体是指：用于更改待检测页面的后台数据的请求。
上述方法中，当HTTP请求为更改所述待检测页面的后台数据的请求时，只有所述HTTP请求中含有登陆态信息，该HTTP请求才可能会出现劫持漏洞的条件，因此通过限定在这种情况下才获取HTTP响应报文，能够避免不必要的操作步骤，提高检测的准确性。
示例性地，在上述步骤103中，所述至少一项结果包括：所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
本申请实施例不限定预设防劫持代码的具体形式。例如，以下内容示例性列出本申请实施例提供的一种点击劫持漏洞检测方法的预设防劫持代码：
Figure PCTCN2020085723-appb-000001
上述代码在运行时可以执行以下步骤：
第一步、将待检测页面显示的主体部分设置display为None的层叠样式表(cascading style sheets，CSS)样式。
需要说明的是，display为一个可定义CSS样式的参数，通过对display赋不同的值，可以设置不同的CSS样式。当display设置为None时，可以使待检测页面显示的主体部分不会隐藏在浏览器的待检测页面上，不会被点击控制，按浏览器对代码的渲染顺序，隐藏主体的样式style标签内的代码会首先生效，style为待检测页面的一个属性。
第二步、当浏览器渲染到最后的js代码部分时，script标签内的js代码生效，检查页面是否被嵌套。
需要说明的是，js是JavaScript一种直译式脚本语言。
第三步、如果top和self相等时，说明页面没有被嵌套，则移除原来设置到主体部分的display为None的CSS样式。
其中，top是浏览器提供的变量，表示最外层窗口对象，self是当前窗口对象。
第四步、如果top和self不相等时，则将self.location赋值给top.location，使得js代码将最外层窗口的页面跳转到待检测页面的页面，防止被嵌套。
其中，top.location表示最外层窗口对象的位置，self.location表示当前窗口对象的位置。
示例性地，本申请实施例中，当HTTP响应报文包括HTTP资源部分时，可以按照以下方式确定HTTP响应报文是否含有预设防劫持代码：将HTTP资源部分与预设正则表达式进行正则匹配，根据正则匹配的结果确定HTTP响应报文是否含有预设防劫持代码。
上述方法中，由于正则表达式具有较强的逻辑性和灵活性，因此通过对HTTP资源部分与预设正则表达式进行正则匹配的结果，确定HTTP响应报文是否含有预设防劫持代码，可以准确检验出是否含有预设防劫持代码。
示例性地，若HTTP响应报文包括HTTP头部，则可以通过字符串匹配来确定是否含有内容安全策略CSP的页面嵌套属性。
需要说明的是，CSP的页面嵌套属性取不同值时，可以代表不同的属性。例如：
(1)CSP:frame-ancestors'none'，表示不能被嵌套；
(2)CSP:frame-ancestors'self'，表示只能被本站点嵌套；
(3)CSP:frame-ancestors'self'*.somesite.com'，表示被*.somesite.com站点嵌套；其中，*.somesite.com用于指示被嵌套的站点的域名协议端口等信息。
示例性地，上述至少一项结果还可以包括：HTTP响应报文是否包括页面嵌套头部信息。该种方式能够扩展检测点击劫持漏洞的另一种结果，由于页面嵌套头部信息能够表征待检测页面的页面嵌套属性，从而至少一项结果还 包括页面嵌套头部信息时，能够进一步提升点击劫持漏洞的检测准确率，使得还可以通过字符串匹配确定是否含有页面嵌套头部信息。举例来说，页面嵌套头部信息可以为X-Frame-Options头部。
具体地，X-Frame-Options取不同值时，有以下结果：
当X-Frame-Options取值为DENY时，表示不允许被嵌套；
当X-Frame-Options取值为SAMEORIGIN时，表示可以被同源站点嵌套；
当X-Frame-Options取值为ALLOW-FROM uri时，表示可以被嵌套的页面。
由于X-Frame-Options这个页面嵌套头部信息目前还不被一些浏览器支持，因此一些情况下还需要结合CSP的页面嵌套属性来确定点击劫持漏洞。
本申请实施例中，首先获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作，若确定对所述待检测页面执行模拟点击操作，则获取HTTP响应报文，并根据所述HTTP响应报文中的至少一项结果确定是否存在点击劫持漏洞，从而能够根据所述URL减少点击劫持漏洞的一部分漏报。另外，对所述待检测页面进行点击劫持漏洞时，通过对所述待检测页面执行模拟点击操作的至少一项结果确定所述待检测页面是否存在点击劫持漏洞，而CSP的页面嵌套属性，能够表征待检测页面能否被iframe页面嵌套，另外再结合用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码，从而能够全面考虑待检测页面是否存在点击劫持漏洞，提升检测点击劫持漏洞的准确率。
下面结合图2，详细介绍本申请实施例提供的一种点击劫持漏洞检测方法，图2为该方法的具体步骤流程示意图。
步骤201：获取待检测页面的统一资源定位符URL。
步骤202：确定待检测页面的统一资源定位符URL是否在预设白名单中。
若是，则执行步骤210；否则，执行步骤203。
步骤203：进行模拟点击操作，触发超文本传输协议HTTP请求。
举例来说，可以调用Chrome Headless的JavaScript进行模拟点击操作。
步骤204：确定超文本传输协议HTTP请求是否满足预设条件，若满足预设条件，则执行步骤205；若不满足预设条件，则执行步骤210。
本申请实施例中，在一种可选地实施方式中，超文本传输协议HTTP请求满足预设条件，是指：HTTP请求为更新待检测页面的后台数据的请求，且HTTP请求包括登录态信息。
本申请实施例中，在另一种可选地实施方式中，超文本传输协议HTTP请求不满足预设条件，是指：HTTP请求不为更新待检测页面的后台数据的请求，或者，HTTP请求不包括登录态信息。
步骤205：获取超文本传输协议HTTP响应报文。
其中，HTTP响应报文为响应待检测页面的HTTP请求的响应报文。
步骤205执行之后，可以执行步骤206～步骤208中至少一个步骤。
步骤206：确定响应报文是否包含页面嵌套头部信息。
步骤207：确定响应报文是否包含内容安全策略CSP的页面嵌套属性。
步骤208：确定响应报文是否包含预设防劫持代码。
需要说明的是，可以同时执行步骤206～步骤208中至少一个步骤，步骤206～步骤208之间不受影响。
若步骤206～步骤208中执行的至少一个步骤中存在一个或多个步骤的确定结果为是，则执行步骤210；若步骤206～步骤208中执行的至少一个步骤中每个步骤的确定结果为否，则执行步骤209。
步骤209：确定待检测页面有点击劫持漏洞。
步骤210：确定待检测页面无点击劫持漏洞。
根据所述HTTP响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞；所述至少一项结果包括所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
分别使用现有技术和本申请中的点击劫持漏洞检测方法对200个域名的主页进行测试，测试结果如表1所示：
检测总量 检出个数 漏报个数 误报个数
现有技术 200 115 12 33
本申请 200 91 7 4
表1
可以发现，相比于现有技术来说，本申请中的点击劫持漏洞检测方法的准确率较高，能够极大地降低误报率。其中，上述对这些漏报误报情况还可以通过设置黑白名单的方式进行改进，以减少安全人员的人工审核时间。
图3为本申请实施例提供的一种点击劫持漏洞检测装置的结构示意图，如图3所示，该装置包括：
获取模块301，用于获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作；
处理模块302，用于若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文；根据所述HTTP响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞；所述至少一项结果包括所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
一种可选实施方式中，所述HTTP响应报文包括HTTP资源部分；
所述处理模块302具体用于：
按照以下方式确定所述HTTP响应报文是否含有所述预设防劫持代码：将所述HTTP资源部分与预设正则表达式进行正则匹配，根据正则匹配的结果确定所述HTTP响应报文是否含有所述预设防劫持代码。
一种可选实施方式中，所述处理模块302具体用于：
若所述模拟点击操作对应的HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息，则获取基于所述模拟点击操作返回的所述HTTP响应报文。
一种可选实施方式中，所述处理模块302具体用于：
确定所述URL是否在预设URL白名单中，若否，则对所述待检测页面执行模拟点击操作。
一种可选实施方式中，所述至少一项结果还包括：
所述HTTP响应报文是否包括页面嵌套头部信息。
上述装置各个实施方式的有益效果，可以参考本申请提供的一种点击劫持漏洞检测方法的有益效果，这里不再赘述。
基于相同的技术构思，本发明实施例还提供了一种计算机设备，如图4所示，包括至少一个处理器401，以及与至少一个处理器连接的存储器402，本发明实施例中不限定处理器401与存储器402之间的具体连接介质，图4中处理器401和存储器402之间通过总线连接为例。总线可以分为地址总线、数据总线、控制总线等。
在本发明实施例中，存储器402存储有可被至少一个处理器401执行的指令，至少一个处理器401通过执行存储器402存储的指令，可以执行前述的点击劫持漏洞检测方法中所包括的步骤。
其中，处理器401是计算机设备的控制中心，可以利用各种接口和线路连接计算机设备的各个部分，通过运行或执行存储在存储器402内的指令以及调用存储在存储器402内的数据，从而预防恶意攻击。可选的，处理器401可包括一个或多个处理单元，处理器401可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器401中。在一些实施例中，处理器401和存储器402可以在同一芯片上实现，在一些实施例中，它们也可以在独立的芯片上分别实现。
处理器401可以是通用处理器，例如中央处理器(CPU)、数字信号处理器、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本发明实施例中公开的各方法、步骤及逻辑框图。 通用处理器可以是微处理器或者任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
存储器402作为一种非易失性计算机可读存储介质，可用于存储非易失性软件程序、非易失性计算机可执行程序以及模块。存储器402可以包括至少一种类型的存储介质，例如可以包括闪存、硬盘、多媒体卡、卡型存储器、随机访问存储器(Random Access Memory，RAM)、静态随机访问存储器(Static Random Access Memory，SRAM)、可编程只读存储器(Programmable Read Only Memory，PROM)、只读存储器(Read Only Memory，ROM)、带电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、磁性存储器、磁盘、光盘等等。存储器402是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本发明实施例中的存储器402还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
本申请实施例提供一种存储介质，包括程序或指令，当所述程序或指令被执行时，用以执行本申请提供的一种点击劫持漏洞检测方法以及各个实施例的方法。
最后应说明的是：本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入 式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (12)

  1. 一种点击劫持漏洞检测方法，其特征在于，包括：
    获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作；
    若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文；
    根据所述HTTP响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞；所述至少一项结果包括所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
  2. 如权利要求1所述的方法，其特征在于，所述HTTP响应报文包括HTTP资源部分，按照以下方式确定所述HTTP响应报文是否含有所述预设防劫持代码：
    将所述HTTP资源部分与预设正则表达式进行正则匹配，根据正则匹配的结果确定所述HTTP响应报文是否含有所述预设防劫持代码。
  3. 如权利要求1所述的方法，其特征在于，所述若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文，包括：
    若所述模拟点击操作对应的HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息，则获取基于所述模拟点击操作返回的所述HTTP响应报文。
  4. 如权利要求1所述的方法，其特征在于，所述根据所述URL确定是否对所述待检测页面执行模拟点击操作，包括：
    确定所述URL是否在预设URL白名单中，若否，则对所述待检测页面执行模拟点击操作。
  5. 如权利要求1-4任一所述的方法，其特征在于，所述至少一项结果还 包括：所述HTTP响应报文是否包括页面嵌套头部信息。
  6. 一种点击劫持漏洞检测装置，其特征在于，包括：
    获取模块，用于获取待检测页面的统一资源定位符URL，并根据所述URL确定是否对所述待检测页面执行模拟点击操作；
    处理模块，用于若确定对所述待检测页面执行模拟点击操作，则获取基于所述模拟点击操作返回的超文本传输协议HTTP响应报文；根据所述HTTP响应报文中的至少一项结果确定所述待检测页面是否存在点击劫持漏洞；所述至少一项结果包括所述HTTP响应报文是否含有内容安全策略CSP的页面嵌套属性，或，所述HTTP响应报文是否含有用于禁止所述待检测页面加载内联框iframe页面的预设防劫持代码。
  7. 如权利要求6所述的装置，其特征在于，所述HTTP响应报文包括HTTP资源部分，所述处理模块具体用于：
    按照以下方式确定所述HTTP响应报文是否含有所述预设防劫持代码：
    将所述HTTP资源部分与预设正则表达式进行正则匹配，根据正则匹配的结果确定所述HTTP响应报文是否含有所述预设防劫持代码。
  8. 如权利要求6所述的装置，其特征在于，所述处理模块具体用于：
    若所述模拟点击操作对应的HTTP请求为更改所述待检测页面的后台数据的请求，且所述HTTP请求中含有登陆态信息，则获取基于所述模拟点击操作返回的所述HTTP响应报文。
  9. 如权利要求6所述的装置，其特征在于，所述处理模块具体用于：
    确定所述URL是否在预设URL白名单中，若否，则对所述待检测页面执行模拟点击操作。
  10. 如权利要求6-9任一所述的装置，其特征在于，所述至少一项结果还包括：所述HTTP响应报文是否包括页面嵌套头部信息。
  11. 一种计算机设备，其特征在于，包括程序或指令，当所述程序或指令被执行时，如权利要求1至5中任意一项所述的方法被执行。
  12. 一种存储介质，其特征在于，包括程序或指令，当所述程序或指令 被执行时，如权利要求1至5中任意一项所述的方法被执行。
PCT/CN2020/085723 2019-06-21 2020-04-20 一种点击劫持漏洞检测方法、装置及计算机设备 WO2020253351A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910540302.0A CN110278207B (zh) 2019-06-21 2019-06-21 一种点击劫持漏洞检测方法、装置及计算机设备
CN201910540302.0 2019-06-21

Publications (1)

Publication Number Publication Date
WO2020253351A1 true WO2020253351A1 (zh) 2020-12-24

Family

ID=67961260

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/085723 WO2020253351A1 (zh) 2019-06-21 2020-04-20 一种点击劫持漏洞检测方法、装置及计算机设备

Country Status (2)

Country Link
CN (1) CN110278207B (zh)
WO (1) WO2020253351A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884730A (zh) * 2022-05-07 2022-08-09 深信服科技股份有限公司 一种请求检测方法、装置、设备及可读存储介质
CN116644250A (zh) * 2023-07-27 2023-08-25 太平金融科技服务（上海）有限公司 页面检测方法、装置、计算机设备和存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110278207B (zh) * 2019-06-21 2023-04-07 深圳前海微众银行股份有限公司 一种点击劫持漏洞检测方法、装置及计算机设备
CN111130993B (zh) * 2019-11-22 2022-03-29 北京知道创宇信息技术股份有限公司 一种信息提取的方法及装置、可读存储介质
CN113158187B (zh) * 2021-03-26 2022-12-23 杭州数梦工场科技有限公司 检测点击劫持的方法及装置、电子设备
CN113162937A (zh) * 2021-04-25 2021-07-23 中国工商银行股份有限公司 应用安全自动化检测方法、系统、电子设备及存储介质
CN115695050B (zh) * 2022-12-31 2023-04-07 北京仁科互动网络技术有限公司 点击劫持攻击的防范方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8856869B1 (en) * 2009-06-22 2014-10-07 NexWavSec Software Inc. Enforcement of same origin policy for sensitive data
US9015844B1 (en) * 2012-06-25 2015-04-21 Symantec Corporation Techniques for web application vulnerability scanning
CN104767747A (zh) * 2015-03-30 2015-07-08 微梦创科网络科技（中国）有限公司 点击劫持安全检测方法和装置
CN107968769A (zh) * 2016-10-19 2018-04-27 中兴通讯股份有限公司 网页安全检测方法及装置
CN110278207A (zh) * 2019-06-21 2019-09-24 深圳前海微众银行股份有限公司 一种点击劫持漏洞检测方法、装置及计算机设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104486140B (zh) * 2014-11-28 2017-12-19 华北电力大学 一种检测网页被劫持的装置及其检测方法
CN105245518B (zh) * 2015-09-30 2018-07-24 小米科技有限责任公司 网址劫持的检测方法及装置
CN107819639B (zh) * 2016-09-14 2021-12-24 西门子公司 一种测试方法和装置
CN109672658B (zh) * 2018-09-25 2022-01-21 平安科技（深圳）有限公司 Json劫持漏洞的检测方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8856869B1 (en) * 2009-06-22 2014-10-07 NexWavSec Software Inc. Enforcement of same origin policy for sensitive data
US9015844B1 (en) * 2012-06-25 2015-04-21 Symantec Corporation Techniques for web application vulnerability scanning
CN104767747A (zh) * 2015-03-30 2015-07-08 微梦创科网络科技（中国）有限公司 点击劫持安全检测方法和装置
CN107968769A (zh) * 2016-10-19 2018-04-27 中兴通讯股份有限公司 网页安全检测方法及装置
CN110278207A (zh) * 2019-06-21 2019-09-24 深圳前海微众银行股份有限公司 一种点击劫持漏洞检测方法、装置及计算机设备

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884730A (zh) * 2022-05-07 2022-08-09 深信服科技股份有限公司 一种请求检测方法、装置、设备及可读存储介质
CN114884730B (zh) * 2022-05-07 2023-12-29 深信服科技股份有限公司 一种请求检测方法、装置、设备及可读存储介质
CN116644250A (zh) * 2023-07-27 2023-08-25 太平金融科技服务（上海）有限公司 页面检测方法、装置、计算机设备和存储介质
CN116644250B (zh) * 2023-07-27 2023-10-20 太平金融科技服务（上海）有限公司 页面检测方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
CN110278207B (zh) 2023-04-07
CN110278207A (zh) 2019-09-24

Similar Documents

Publication Publication Date Title
WO2020253351A1 (zh) 一种点击劫持漏洞检测方法、装置及计算机设备
US10484424B2 (en) Method and system for security protection of account information
US9860270B2 (en) System and method for determining web pages modified with malicious code
CN107204960B (zh) 网页识别方法及装置、服务器
US7111246B2 (en) User interface accorded to tiered object-related trust decisions
CN108566399B (zh) 钓鱼网站识别方法及系统
EP3065367A1 (en) System and method for automated phishing detection rule evolution
JP6827116B2 (ja) ウェブページのクラスタリング方法及び装置
US20140237603A1 (en) Rule matching in the presence of languages with no types or as an adjunct to current analyses for security vulnerability analysis
CN105959324A (zh) 基于正则匹配的网络攻击检测方法及装置
KR20060123024A (ko) 계층화된 객체-관련 신뢰 수준 판정
CN111737692B (zh) 应用程序的风险检测方法及装置、设备、存储介质
CN106033450B (zh) 一种广告拦截的方法、装置和浏览器
US20200226291A1 (en) Systems and methods for detecting and remedying theft of data
US20190362142A1 (en) Electronic form identification using spatial information
WO2021098242A1 (zh) 页面处理方法、装置、电子设备和计算机可读介质
EP3703329A1 (en) Webpage request identification
US20210409445A1 (en) Machine learning-based sensitive resource collection agent detection
CN108646988B (zh) 文档打印方法和系统
WO2018068366A1 (zh) 预防xss攻击的方法
US20190179879A1 (en) Webpage rendering using a remotely generated layout node tree
JP2012088803A (ja) 悪性ウェブコード判別システム、悪性ウェブコード判別方法および悪性ウェブコード判別用プログラム
CN110532784A (zh) 一种暗链检测方法、装置、设备及计算机可读存储介质
CN106682044B (zh) 数据处理的方法及装置
CN111125704B (zh) 一种网页挂马识别方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20825794

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20825794

Country of ref document: EP

Kind code of ref document: A1