A system and method for website security detection based on full flow

Abstract

The invention discloses a website security detection system and method based on full flow, which can more comprehensively cover the security test of rapidly iterative WEB projects, discover newly added loopholes in the system in time, and improve the security of the WEB system. Its technical solution is: the system and method of the present invention take the problem of insufficient coverage of security detection vulnerabilities often encountered by Internet companies in the WEB development process as a starting point, and conduct security scanning by combining the two latitudes of active scanning and passive scanning, Cover the active traffic and passive traffic of the website, so as to discover new loopholes in the system in time and improve the security of the WEB system.

Description

technical field [0001] The invention relates to the field of information security, in particular to a website security detection system and method based on full traffic. Background technique [0002] Existing WEB vulnerability scanning systems are mainly divided into two categories, one is active scanning and the other is passive scanning. [0003] The main workflow of the active scanning system is: add scanning task -> start scanning -> generate scanning report. The main principle is as follows: first, crawl the seed URL through the WEB crawler, obtain the new URL in the newly crawled page, and then crawl layer by layer, finally, obtain all the URLs of the website, after deduplication Save all URLs, and finally, initiate an active vulnerability scan against the processed URLs. The disadvantage of the active scanning system is that the acquired URLs are incomplete, and the URLs that require interaction to be triggered are difficult for WEB crawlers to crawl. In addit...

AI Technical Summary

Problems solved by technology

The disadvantage of the active scanning system is that the acquired URLs are incomplete, and the URLs that require interaction to be triggered are difficult for WEB crawlers to crawl. In addition, WEB crawlers cannot obtain island pages, test pages, and POST requests for special operations.

The disadvantage of the passive scanning system is that the passively accepted traffic also cannot cover all URLs, and only URLs of passive traffic can be captured

[0009] 3) It is difficult to fully synchronize the new functions of software development to the security testing department, resulting in information asymmetry, easy security testing is not targeted, and the efficiency is low;

[0010] 4) The security status of the test environment is easy to be negligent and becomes the entry point for hacker attacks

[0011] In summary, the existing WEB vulnerability scanning system can no longer meet the needs of Internet companies' software development security testing. At present, the industry urgently needs a new security testing system and method developed to address the pain points of security testing in Internet companies.

Images