摘要
为了丰富Web应用漏洞测试所需要的测试数据集,提出一种新的模糊测试用例生成方法,弥补了现有Web应用漏洞测试技术及工具采用固定测试用例、无法动态生成与扩展的问题。提出一种基于模板的动态组合生成测试用例的方法,对典型测试用例进行归类,生成不同的模板库,再通过模板库规则和随机变化动态生成大量测试用例,从而极大地丰富测试用例的变化,提高Web应用漏洞检测率,使Web应用模糊测试成为可能。实验结果表明,使用该方法生成测试用例的漏洞测试工具较同类工具发现了更多的Web应用漏洞。实验证明本方法有效可行。
This paper proposed a new approach of generating fuzzing testing vectors, which could expand testing dataset vastly and made up for deficiencies that testing vectors were fixed and non-extendable in existing methods and tools in Web applications vulnerabilities detecting. The new approach created templates via classifying existing testing vectors and combined those templates with constraint and random variation to generate vast various vectors dynamically. These various vectors improved Web applications vulnerabilities detection rate and made the Web applications fuzzing testing possible. The experimental results show that the vulnerability testing tool, which uses testing vectors generated by the new method, finds more Web applications vulnerabilities than comparable testing tools. The experiment proves the validity of the method.
出处
《计算机应用研究》
CSCD
北大核心
2015年第10期3004-3008,3040,共6页
Application Research of Computers
基金
国家"973"计划资助项目(2013CB329605)
关键词
测试用例
Web应用漏洞
模板
组合
漏洞检测率
testing vectors
Web applications vulnerabilities
templates
combination
vulnerabilities detection rate
