赵国锋^*， 陈勇， 王新恒

（  重庆邮电大学 通信学院 未来网络研究中心；  ）

摘要： 本文论述了HTTPS协议通信流程，详细分析了基于伪造证书与中间人会话劫持的基本方法及原理，指出了常用劫持方法通过后端来操控最原始数据流量及其缺陷，并重点提出了一种基于前端XSS脚本注入的更高效、更完善的HTTPS会话劫持方法，实现了表单提交、动态元素、脚本弹窗、框架页面的劫持。最后，本文详细阐述了其Web前端劫持实现原理与流程，并搭建原型系统进行验证，进一步分析出了 HTTPS 通信的安全隐患，根据现状对此提出了可行的防范措施。
关键词： HTTPS；中间人；XSS；前端劫持；动态元素

Zhao Guofeng^*， Chen Yong， Wang XinHen

（  College of Communication, Chongqing university of Posts and Telecommunications；  ）

Abstract： This paper discusses the HTTPS protocol communication process is analyzed in detail based on forged certificates and man in the middle session hijacking the basic principles and methods, it is pointed out that conventional hijacking method through the backend to manipulate the original data flow and defects, and put forward a front-end scripting XSS based on injection of more efficient, more perfect HTTPS session hijacking method, has realized the form submission, dynamic elements, the window script, the hijacking of the page frame. At last, this paper describes the principle and process of the Web front end hijacking, build a prototype system to verify the security risk, and further analyze the HTTPS communications security risks, and to provide the feasible preventive measures.

Tag：

点此返回栏目查看更多>>>参考论文