Website security detection system and method based on full flow

Abstract

The invention discloses a website security detection system and method based on full flow, which can more comprehensively cover the security test of a fast iterative WEB project, can discover newly added vulnerabilities of the system in time and can improve the security of a WEB system. The technical scheme is as follows: according to the system and the method provided by the invention, the problem of insufficient security detection vulnerability coverage rate frequently encountered by an Internet company in a WEB development process is taken as a starting point, safety scanning is carried outby combining active scanning and passive scanning latitudes, and active flow and passive flow of a website are covered, so that newly-added vulnerabilities of the system are discovered in time, and the safety of the WEB system is improved.

Description

technical field [0001] The invention relates to the field of information security, in particular to a website security detection system and method based on full traffic. Background technique [0002] Existing WEB vulnerability scanning systems are mainly divided into two categories, one is active scanning and the other is passive scanning. [0003] The main workflow of the active scanning system is: add scanning task -> start scanning -> generate scanning report. The main principle is as follows: first, crawl the seed URL through the WEB crawler, obtain the new URL in the newly crawled page, and then crawl layer by layer, finally, obtain all the URLs of the website, after deduplication Save all URLs, and finally, initiate an active vulnerability scan against the processed URLs. The disadvantage of the active scanning system is that the acquired URLs are incomplete, and the URLs that require interaction to be triggered are difficult for WEB crawlers to crawl. In addit...

AI Technical Summary

Problems solved by technology

The disadvantage of the active scanning system is that the acquired URLs are incomplete, and the URLs that require interaction to be triggered are difficult for WEB crawlers to crawl. In addition, WEB crawlers cannot obtain island pages, test pages, and POST requests for special operations.

The disadvantage of the passive scanning system is that the passively accepted traffic also cannot cover all URLs, and only URLs of passive traffic can be captured

[0009] 3) It is difficult to fully synchronize the new functions of software development to the security testing department, resulting in information asymmetry, easy security testing is not targeted, and the efficiency is low;

[0010] 4) The security status of the test environment is easy to be negligent and becomes the entry point for hacker attacks

[0011] In summary, the existing WEB vulnerability scanning system can no longer meet the needs of Internet companies' software development security testing. At present, the industry urgently needs a new security testing system and method developed to address the pain points of security testing in Internet companies.

Images