基于网页静态分析的Web应用系统弱口令检测方法.pdfVIP

湖 南 电 力 第 36卷第5 期 HUNAN ELECTRIC POWER 2016年 10月 doi:10. 3969/j. issn. 1008-0198. 2016. 05. 012 基于网页静态分析的W eb 应用 系统弱口令检测方法 田峥，薛海伟，田建伟，漆文辉 (国网湖南省电力公司电力科学研究院，湖南长沙410007) 摘 要 ：针对现有基于动态截取方式的Web 应用账号弱口令检测方法操作繁琐、自动 化程度较低，无法满足信息安全监督工作的需要。本文提出一种基于网页静态分析的 Web应用系统弱口令检测方法，通过对登录页面的表单进行识别与分析，实现对登录 关键信息的自动提取。基于此方法，实现了一个可对Web 应用账号进行自动化弱口令 检测的系统原型，并支持常见数字和字母组合的验证码识别。系统自动化程度较高，具 有较好的实用性和应用前景。 关键词：Web应用系统；弱口令；动态截取；静态分析；验证码识别 中图分类号：TP393.08 文献标志码：B 文章编号：1008-0198(2016)05-0047-04 Weak password detection of Web application system based on webpage static analysis TIAN Zheng, XUE Haiwei, TIAN Jianwei, QI Wenhui ( State Grid Hunan Electric Power Corporation Research Institute , Changsha 410007, China) Abstract : The existing weak password detection method based on dynamic intercept is o low complexity and low degree of automation, which can not meet the needs o information security supervision. In this paper, a weak password detection method based on the static analysis o webpage is proposed, which automatically extracts the key information o login process by identifying and analyzing the form o the login page. Based on this method, a system prototype which can automatically detect the weak password for Web application and supports captcha recognize o common digital and letter combinations is realized. The system has a high degree o automation, and has good practicability and application prospect. Key words ： Web application； weak password； dynamic intercept; static analysis; captcha recognize 近年来，随着互联网技术的发