Shepherd：实现自动化和大规模登录安全研究
Shepherd: Enabling Automatic and Large-Scale Login Security Studies
摘要：
越来越多的互联网部分隐藏在登录字段后面。这对任何基于扫描互联网的研究构成了障碍。此外，认证过程本身可能是一个弱点。为了大规模研究身份验证的弱点，需要自动登录功能。在这项工作中，我们介绍牧羊人，扫描框架自动登录网站。Shepherd框架使我们能够对网站的登录后方面进行大规模扫描。Shepherd扫描网站的登录字段，尝试提交凭据并评估登录是否成功。我们说明谢泼德的能力，通过扫描会话劫持的易感性。在这项研究中，我们使用了一组未经验证的网站凭据，其中一些将是无效的。使用这个集合，Shepherd能够完全自动登录并验证它确实登录了6，273个未知站点，占测试集的12.4%。我们发现，从我们的（有偏见的）测试集，2,579个网站，即，41.4%的人容易受到简单的会话劫持攻击。
英文摘要：
More and more parts of the internet are hidden behind a login field. This poses a barrier to any study predicated on scanning the internet. Moreover, the authentication process itself may be a weak point. To study authentication weaknesses at scale, automated login capabilities are needed. In this work we introduce Shepherd, a scanning framework to automatically log in on websites. The Shepherd framework enables us to perform large-scale scans of post-login aspects of websites. Shepherd scans a website for login fields, attempts to submit credentials and evaluates whether login was successful. We illustrate Shepherd's capabilities by means of a scan for session hijacking susceptibility. In this study, we use a set of unverified website credentials, some of which will be invalid. Using this set, Shepherd is able to fully automatically log in and verify that it is indeed logged in on 6,273 unknown sites, or 12.4% of the test set. We found that from our (biased) test set, 2,579 sites, i.e., 41.4%, are vulnerable to simple session hijacking attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
