Abstract:

This paper discusses the HTTPS protocol communication process, analyzes the basic principles and methods in detail based on forged certificates and man in the middle session hijacking. Then it points out that conventional hijacking method through the backend to manipulate the original data flow and defects, and puts forward a front-end scripting XSS based on injection of more efficient and more perfect HTTPS session hijacking method, which can realize the hijacking of the form submission, dynamic elements, the script window, and the page frame. Finally it expounds the priciple and process the Web front-end hijacking, builds a prototype system to validate, and makes a further analysis of the HTTPS communication security risks. According to the present situation, it also puts forward feasible preventive measures.

Key words: HTTPS, session hijacking, XSS, front-end hijacking, dynamic element