Page loophole detection device and page loophole detection method

Abstract

The invention relates to a page loophole detection device which comprises an abstract syntax tree management module, a symbol table module and a stain backtracking module. The abstract syntax tree management module is used for detecting an abstract syntax tree of a detected program source code, the symbol table module is used for managing symbol table information of the detected program source code, the stain backtracking module is used for reading the abstract syntax tree from the abstract syntax management module, traversing the abstract syntax tree to acquire a set of all pre-configured triggering nodes and backtracking all correlated variables of each triggering node according to the symbol table information, and if correlated variables can be input and changed by an attacker in a controllable manner, existence of loopholes at the triggering nodes is judged, and loophole information is output. By the page loophole detection device, loophole coverage rate can be increased, and false alarm rate can be lowered. In addition, the invention provides a page loophole detection method.

Description

technical field [0001] The present invention relates to web page security technology, in particular to a page loophole detection device and a detection method, in particular to a PHP page loophole detection device and a detection method. Background technique [0002] At present, the method for detecting vulnerabilities in various active pages such as PHP pages is mainly black-box scanning. By constructing a large number of deformed use cases, visit the PHP page, and then judge the content of the returned page. If there is specific data in the returned page, it is considered that the PHP page cannot handle the input correctly, and there is a loophole. [0003] The black box scanning method has the following disadvantages: [0004] First, its effect depends on the method of constructing use cases. If there are too few use cases, the source code path of the covered PHP page is not enough, and there will be a large number of false positives. If the use case construction is no...

AI Technical Summary

Problems solved by technology

[0004] First, its effect depends on the way of constructing use cases. If there are too few use cases, the source code path of the covered PHP page is not enough, and there will be a lot of false positives

If the use case structure is not comprehensive, the coverage path is still insufficient, and a large number of false positives

[0005] Second, the use case may require a specific pattern. For example, the PHP page starting with the "http" string will continue to be processed. Otherwise, all use cases will be discarded, and the inner logic cannot be entered, and the test effect cannot be achieved. There are still a lot of false positives.

[0006] Third, black box scanning relies on the returned page to judge the test results. If the PHP page is not returned, it will miss the report

[0007] Fourth, black-box scanning relies on the correct deployment of PHP pages. It can only test PHP pages that have been fully deployed and can be accessed normally. When the source code of an undeployed PHP page is given alone, black-box scanning cannot work

[0009] The disadvantage of the characteristic string matching method is that there are too many false positives, because if the input of the dangerous function is fixed and cannot be controlled by the attacker, the use of the dangerous function will not cause a loophole

Images