WEB安全测试分类及防范测试方法1Web应用程序布署环境测试.......................................................................................................21.1HTTP请求引发漏洞的测试................................................................................................21.2操作系统目录安全性及Web应用程序布署环境目录遍历问题测试............................22应用程序测试...............................................................................................................................32.1SQL注入漏洞测试.............................................................................................................32.1.1SQL注入漏洞攻击实现原理...................................................................................32.1.2SQL注入漏洞防范措施...........................................................................................42.1.3SQL注入漏洞检测方法...........................................................................................52.2表单漏洞测试....................................................................................................................62.2.1表单漏洞实现原理..................................................................................................62.2.2表单漏洞防范措施..................................................................................................62.2.3表单漏洞检测方法..................................................................................................62.3Cookie欺骗漏洞测试.........................................................................................................82.3.1Cookie欺骗实现原理..............................................................................................82.3.2Cookie欺骗防范措施..............................................................................................82.3.3Cookie欺骗监测方法..............................................................................................92.4用户身份验证测试............................................................................................................92.4.1用户身份验证漏洞防范措施..................................................................................92.4.2用户身份验证检测方法..........................................................................................92.5文件操作漏洞测试............................................................................................................92.5.1文件操作漏洞实现原理..........................................................................................92.5.2文件操作漏洞防范措施........................................................................................102.5.3文件操作漏洞检测方法........................................................................................102.6Session测试.....................................................................................................................112.6.1客户端对服务器端的欺骗攻击............................................................................112.6.2直接对服务器端的欺骗攻击................................................................................112.6.3Session漏洞检测方法...........................................................................................122.7跨网站脚本(XSS)漏洞测试.......................................................