A vulnerability scanning system and method for java web services

Abstract

The invention provides a vulnerability scanning system and method for java web services, and relates to the technical field of vulnerability scanning. The scanning system comprises an asset collection module, a fingerprint identification module, a framework vulnerability scanning module and a basic vulnerability scanning module. The scanning method implemented based on the scanning system performs URL removal processing on non-target assets and invalid links in URL processing, thereby improving the scanning rate. In the asset collection module, input parameters are collected and sorted in a common search box login box. Before directory scanning, subdirectories of collected URL assets are processed, thereby improving the discovery rate of the directory scanning module. The subsequent SQL injection module performs identification and bypass processing on WAF. The method simply integrates a vulnerability library of common java development template vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability scanning, and in particular to a vulnerability scanning system and method for Java web services. Background Art

[0002] With the rapid development of the Internet, the Internet has become a meeting point that connects everyone's information. People are increasingly accustomed to completing various business functions on the Internet. Many financial companies, government agencies, and private enterprises interact and process their business through various web systems, providing people with more convenient and efficient services. At the same time, the network security situation is becoming more and more severe, with frequent cyber attacks and a large number of user privacy leaks, which have a great impact on enterprises and individuals. It is becoming more and more important to do a good job in network security protection.

[0003] To do a good job of network security protection, enterprises generally need to understand their own exposed assets and conduct penetration tests and vulnerability scans on the enterprise's violent assets. For security vulnerabilities, enterprises need to arrange developers to repair them and then verify the vulnerabilities. The financial and human resources costs are huge, which is a heavy burden for small and medium-sized enterprises. Vulnerability scanners can effectively reduce the pressure on small and medium-sized enterprises. Vulnerability scanners are simple to operate, fast, and time-saving, which can help security personnel complete system security assessments faster and more efficiently.

[0004] Among the currently known technologies, the scanner does not specifically differentiate and scan different Java frameworks, the scanning is not flexible enough, and the scanning rate is slow. The processing of URL assets is relatively complicated, and some static files and invalid links do not need to be detected for vulnerabilities. The overall scanning is relatively simple and not flexible enough. The directory scanning only scans the subdirectories of the input site, but the target assets may exist in multiple directories. The framework recognition is not sophisticated enough, and there is no complete vulnerability library for common Java development template vulnerabilities. Summary of the invention

[0005] The purpose of the present invention is to provide a vulnerability scanning system and method for java web services, so as to solve the above-mentioned problems existing in the prior art.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] A vulnerability scanning system for java web services comprises an asset collection module, a fingerprint recognition module, a framework vulnerability scanning module and a basic vulnerability scanning module. The asset collection module collects the URL information and the sub-directory information of the site according to the input target site. The fingerprint recognition module performs fingerprint recognition on the java framework and determines the current framework type by searching several common locations. The framework vulnerability scanning module is used to enter the framework to perform vulnerability scanning after the fingerprint scanning module determines the framework type, and collect common java framework vulnerabilities. The basic vulnerability scanning module comprises a directory scanning submodule, an XSS vulnerability scanning submodule and an SQL injection vulnerability scanning submodule. The target scanning submodule is used to scan the sub-directories of the target asset URL. The XSS vulnerability scanning submodule is used to scan all URLs obtained by a crawler to see if there are xss vulnerabilities. The SQL injection vulnerability scanning submodule is used to determine whether a database command maliciously constructed by a user enters a database for execution in the SQL injection module.

[0008] Preferably, the asset collection module adopts a breadth-first crawler strategy to crawl URLs of the entire site, prioritizes links with high importance and relevance, uses Python's BeautifulSoup module to obtain all a tags with href attributes, extracts the href attributes in the a tags, removes duplicate links, removes non-target assets if extracted, and brings the asset root directory if it does not start with http, adds the processed links to an unvisited list, and adds the crawled links to a visited list; takes out the URLs in the unvisited list and crawls them again according to the crawler steps, and puts the crawler results into a file after the crawler is completed for the convenience of subsequent fingerprint recognition module, framework vulnerability scanning module, and basic vulnerability scanning module to call.

[0009] Preferably, the fingerprint recognition module determines the current frame type by searching several common locations, including HTTP header, server, X-Powered-By and cookies of the http response header, specifically including the following steps:

[0010] First, get the HTTP header information in the response package, and then confirm whether there are HTTP headers such as Server, X-Jenkins, X-Powered-By, and Powered by. If so, directly get the corresponding Java framework information.

[0011] Preferably, the SQL injection vulnerability scanning submodule performs vulnerability judgment by distinguishing between the test statements injected by the SQL injection module and the response packets of different test statements, specifically including:

[0012] B1, first perform WAF judgment, try to use the URL containing special characters to access the injected website (attacked website), determine whether WAF exists, if so, determine whether WAF can be bypassed, if so, modify the test statement, try to bypass the payload and then enter step B2; if not, directly enter step B2;

[0013] B2, the test SQL injection module includes error injection, Boolean blind injection and delayed blind injection. The error injection and joint query statements in the common SQL injection are used for testing. Different test responses are compared to determine whether there is a vulnerability. If there is a vulnerability, the test result is directly output, and then the Boolean blind injection and delayed blind injection are tested; otherwise, the Boolean blind injection and delayed blind injection are directly tested.

[0014] Preferably, the use of a URL containing special characters to access and determine whether a WAF exists specifically includes: using a URL containing special characters to access and a response of 403, 500 or a response containing keywords such as banned and fiercewall appears;

[0015] Step B2 includes: using error injection, Boolean blind injection and delayed blind injection as SQL basic tests, wherein the error injection uses enumerated passwords to inject in a brute force test manner to obtain the correct password; when the page cannot echo the query information, you can consider using delayed blind injection. The delayed blind injection attacker constructs a delayed statement. When the database executes the statement, if the judgment condition is met, the execution time is short. If the judgment condition is not met, it will cause a long execution time. The attacker can judge whether the test statement is correct by the length of the response time, thereby obtaining the database information; Boolean blind injection is mainly used in situations where there is no echo, and is generally used for query. Boolean blind injection judges the database information by responding to the returned true or false. Before using Boolean blind injection, it is necessary to first determine whether the data is character type or numeric type, and then construct a Boolean statement to judge the page echo, which is used to query whether the database has the information. If so, the information details are returned, and if not, there will be a corresponding error.

[0016] The present invention discloses a vulnerability scanning method for java web services, comprising the following steps:

[0017] S1, input the target asset to be scanned into the asset collection module, and use the breadth-first crawler algorithm to crawl the full site URL of the target asset;

[0018] S2, extracting the URL data input points that meet the crawler requirements and saving them together with their directory nodes into a unified folder as the crawler results;

[0019] S3, using the fingerprint recognition module to identify the web framework in the crawler results, and identifying the framework type by looking up the HTTP header, the server, X-Powered-By and cookies of the http response header; for different framework types, different vulnerability scanning modules are selected to perform the vulnerability scanning process; after using the fingerprint recognition module to determine the web framework type, the directory scanning submodule is used to find the service interface that a website can provide, and the link provided by this service interface is used to further scan the website directory. The subsequent vulnerability detection function needs to be further scanned based on the website directory, and a request is made through the link displayed on the website. If the status code is 200 (file exists), 302 (resources in this directory are temporarily moved), 401 (authentication is required to access this file), 403 (the request is valid, but the server refuses to respond), it means that there are files in the directory. After determining the accessible directory of the website, call the XSS and SQL injection vulnerability scanning modules to test whether this website has known vulnerabilities;

[0020] S4, based on the scanning results from S1 to S3, forms a vulnerability scanning result report.

[0021] Preferably, step S2 specifically includes:

[0022] S21, use Python's BeautifulSoup module to obtain all a tags with href attributes, extract the href attributes in the a tags, remove duplicate links, if the extracted non-target assets are removed, then bring the asset root directory if it does not start with http, add the processed links to the unvisited list, and add the links that have been crawled to the visited list; S22, take out the URLs in the unvisited list and crawl again according to the crawling steps. After the crawling is completed, put the crawling results into a file for the convenience of calling the subsequent fingerprint recognition module, framework vulnerability scanning module and basic vulnerability scanning module.

[0023] Preferably, in step S3, a fingerprint recognition module is used to identify the web framework in the crawler result, and the framework type is identified by searching the HTTP header, the server, X-Powered-By and cookies of the http response header. Specifically, the following steps are performed: obtaining the HTTP header information in the response packet, and then confirming whether there are HTTP headers such as Server, X-Jenkins, X-Powered-By and Powered by in the response packet. If there are, then obtaining the Java framework information in the response packet, and identifying the special Struts2 framework:

[0024] First, you can pass the actionErrors parameter. If the response packet is abnormal, it can be determined that the target is built on Struts2. There are mainly the following abnormal situations:

[0025] (1) Response packet status code 400, 500 or 302;

[0026] (2) The parameters passed by actionErrors are echoed on the page;

[0027] (3) The content structure of the page has changed significantly;

[0028] Secondly, you can judge whether / struts / webconsole.html exists. If the response package is normal, it can be determined that it is the struts framework.

[0029] Finally, through the keyword and checkbox_keyword parameters, if keyword=11 is passed, the page will be displayed normally or 11 will be echoed to the page, while passing _checkbox_keyword=111 will echo an error, so the website can be determined to be a struts framework;

[0030] For WebLogic framework identification, you can identify the WebLogic framework through the following default path:

[0031] (1) / console / login / LoginForm.jsp

[0032] (2) / wls-wsat / CoordinatorPortType

[0033] (3) / _async / AsyncResponseService

[0034] (4) / ws_utc / config.do.

[0035] Preferably, in step S3, for different framework types, different vulnerability scanning modules are selected to perform vulnerability scanning, and the process specifically includes: to be determined as struct2 and weblogic frameworks, a framework vulnerability scanning module is used to collect struct2 and weblogic framework vulnerabilities, and a struct2 vulnerability detection method is analyzed. Struct2 vulnerabilities are mainly transmitted through POST or GET methods, and then it is determined whether the return package command is executed. If the command result is executed, it is determined that the vulnerability exists; by executing the command {str1+str2}, if the response package contains the result of str1+str2, then the vulnerability exists; for other framework types, no framework vulnerability scanning is performed.

[0036] The beneficial effects of the present invention are:

[0037] The present invention provides a vulnerability scanning system and method for javaweb services. In URL processing, the method removes non-target assets and invalid links from the URL to improve the scanning rate; in the asset collection module, input parameters are collected and sorted in the common search box login box; before directory scanning, the sub-directories of the collected URL assets are processed to improve the discovery rate of the directory scanning module; and the SQL injection module subsequently identifies and bypasses WAF. The method simply integrates a vulnerability library of common java development template vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a structural diagram of the vulnerability scanning system for Java web services provided in Example 1;

[0039] Figure 2 This is a schematic diagram of the SQL injection module workflow provided in Example 1. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation methods described herein are only used to explain the present invention and are not used to limit the present invention.

[0041] Example 1

[0042] This embodiment provides a vulnerability scanning system for Java web services. Figure 1 As shown, it includes an asset collection module, a fingerprint recognition module, a framework vulnerability scanning module and a basic vulnerability scanning module. The asset collection module collects the site URL information and site sub-directory information according to the input target site. The fingerprint recognition module performs fingerprint recognition on the java framework and determines the current framework type by searching several common locations. The framework vulnerability scanning module is used to enter the framework for vulnerability scanning after the fingerprint scanning module determines the framework type, and collect common java framework vulnerabilities; the basic vulnerability scanning module includes a directory scanning submodule, an XSS vulnerability scanning submodule and an SQL injection vulnerability scanning submodule. The target scanning submodule is used to scan the sub-directories of the target asset URL; the XSS vulnerability scanning submodule is used to scan all URLs obtained by the crawler for xss vulnerabilities; the SQL injection vulnerability scanning submodule is used to determine whether the SQL injection module has a database command maliciously constructed by the user entering the database for execution.

[0043] The asset collection module in this embodiment adopts a breadth-first crawler strategy to crawl URLs of the entire site, giving priority to crawling links with high importance and relevance, and uses Python's BeautifulSoup module to obtain all a tags with href attributes, extract the href attributes in the a tags, remove duplicate links, and remove non-target assets if extracted. If the extracted assets do not start with http, bring the asset root directory. The processed links are added to the unvisited list, and the links that have been crawled are added to the visited list; take out the URLs in the unvisited list and crawl them again according to the crawler steps. After the crawling is completed, put the crawling results into a file for the convenience of subsequent fingerprint recognition module, framework vulnerability scanning module and basic vulnerability scanning module to call.

[0044] The fingerprint recognition module in this embodiment determines the current frame type by searching several common locations, including HTTP header, server, X-Powered-By and cookies of the http response header, specifically including the following steps:

[0045] First, get the HTTP header information in the response package, and then confirm whether there are HTTP headers such as Server, X-Jenkins, X-Powered-By, and Powered by. If so, directly get the corresponding Java framework information.

[0046] The SQL injection vulnerability scanning submodule in this embodiment performs vulnerability judgment by distinguishing between the test statements injected by the SQL injection module and the response packets of different test statements, specifically including:

[0047] B1, first perform WAF judgment, try to use the URL containing special characters to access the injected website (attacked website), and determine whether there is WAF. If it can be bypassed, modify the test statement, try to bypass the payload and then enter step B2; if it cannot be bypassed, directly enter step B2;

[0048] B2, the test SQL injection module includes error injection, Boolean blind injection and delayed blind injection. The error injection and joint query statements in the common SQL injection are used for testing. Different test responses are compared to determine whether there is a vulnerability. If there is a vulnerability, the test result is directly output, and then the Boolean blind injection and delayed blind injection are tested; otherwise, the Boolean blind injection and delayed blind injection are directly tested.

[0049] In this embodiment, the method of using a URL containing special characters to access and determining whether a WAF exists specifically includes: using a URL containing special characters to access and a response of 403, 500 or a response containing keywords such as banned or fiercewall appears;

[0050] Step B2 includes: using error injection, Boolean blind injection and delayed blind injection as SQL basic tests, wherein the error injection, enumeration passwords are injected in a brute force test manner to obtain the correct password, delayed blind injection, when the page cannot echo the query information, you can consider using delayed blind injection, delayed blind injection attacker constructs a delay statement, when the database executes the statement if the judgment condition is met, the execution time is short, if the judgment condition is not met, it will cause a long execution time, the attacker can judge whether the test statement is correct by the length of the response time, thereby obtaining the database information; Boolean blind injection is mainly used in the case of no echo, generally used for query, Boolean blind injection judges the database information by the true or false returned by the response. Before using Boolean blind injection, it is necessary to first determine whether the data is character type or numeric type, and then construct a Boolean statement to judge the page echo, which is used to query whether the database has the information, if so, the information details are returned, if not, there will be a corresponding error.

[0051] Example 2

[0052] This embodiment provides a vulnerability scanning method for Java web services, which is implemented based on the vulnerability scanning system for Java web services recorded in Embodiment 1 and includes the following steps:

[0053] S1, input the target asset to be scanned into the asset collection module, and use the breadth-first crawler algorithm to crawl the full site URL of the target asset;

[0054] S2, extracting the URL data input points that meet the crawler requirements and saving them together with their directory nodes into a unified folder;

[0055] S3, uses the fingerprint recognition module to identify the web framework in the crawler results, and identifies the framework type by looking for the HTTP header, the server, X-Powered-By and cookies of the http response header; for different framework types, different vulnerability scanning modules are selected to perform the vulnerability scanning process; at the same time, the directory scanning module can find the service interface that a website can provide for expansion, and the subsequent vulnerability detection function needs to be further scanned based on the website directory to test whether this website has known vulnerabilities;

[0056] S4, based on the scanning results from S1 to S3, forms a vulnerability scanning result report.

[0057] Step S2 specifically includes:

[0058] S21, use Python's BeautifulSoup module to obtain all a tags with href attributes, extract the href attributes in the a tags, remove duplicate links, remove non-target assets if extracted, and bring the asset root directory if it does not start with http. Add the processed links to the unvisited list, and add the links that have been crawled to the visited list;

[0059] S22, take out the URLs in the unvisited list and crawl again according to the crawling steps. After the crawling is completed, put the crawling results into a file to facilitate the subsequent fingerprint recognition module, framework vulnerability scanning module and basic vulnerability scanning module to call.

[0060] In step S3, the fingerprint recognition module is used to identify the web framework in the crawler results, and the framework type is identified by searching the HTTP header, the server, X-Powered-By and cookies of the http response header, specifically:

[0061] For the more special Struts2 framework identification:

[0062] First, you can pass the actionErrors parameter. If the response packet is abnormal, it can be determined that the target is built on Struts2. The response packet has the following exceptions:

[0063] (1) Response packet status code 400, 500 or 302;

[0064] (2) The parameters passed by actionErrors are echoed on the page;

[0065] (3) The content structure of the page has changed significantly;

[0066] Secondly, you can judge by whether / struts / webconsole.html exists. If the response package is normal, it can be determined that it is the struts framework.

[0067] Finally, through the keyword and checkbox_keyword parameters, if keyword=11 is passed, the page will be displayed normally or 11 will be echoed on the page, and if checkbox_keyword=111 is passed, an error will be echoed, then the website can be determined to be a struts framework.

[0068] For WebLogic framework identification, you can identify the WebLogic framework through the following default path:

[0069] (1) / console / login / LoginForm.jsp

[0070] (2) / wls-wsat / CoordinatorPortType

[0071] (3) / _async / AsyncResponseService

[0072] (4) / ws_utc / config.do

[0073] To be determined are struct2 and weblogic frameworks. Use framework vulnerability scanning module to collect struct2 and weblogic framework vulnerabilities and analyze struct2 vulnerability detection methods. Struct2 vulnerabilities mainly pass commands through POST or GET, and then determine whether the return package command is executed. If the command result is executed, then it is determined that the vulnerability exists. By executing the command {str1+str2}, if the response package contains the result of str1+str2, then the vulnerability exists.

[0074] For other framework types, the basic vulnerability scanning module is used, including the XSS scanning submodule and the SQL injection vulnerability scanning submodule. The XSS scanning submodule extracts the input points of all URLs obtained from the crawler results, replaces the input points with xss test statements, and checks whether the response package contains the xss test statements constructed in the request package. If there are xss test statements, it can be verified that the URL has an xss vulnerability.

[0075] The SQL injection vulnerability scanning submodule in this embodiment is based on the difference between the SQL injection test statements and the response packets of different test statements, specifically including:

[0076] B1, first perform WAF judgment, try to use the URL containing special characters to access the injected website (attacked website), determine whether WAF exists, if so, determine whether WAF can be bypassed, if so, modify the test statement, try to bypass the payload and then enter step B2; if not, directly enter step B2;

[0077] B2, the test SQL injection module includes error injection, Boolean blind injection and delayed blind injection. The error injection and joint query statements in the common SQL injection are used for testing. Different test responses are compared to determine whether there is a vulnerability. If there is a vulnerability, the test result is directly output, and then the Boolean blind injection and delayed blind injection are tested; otherwise, the Boolean blind injection and delayed blind injection are directly tested.

[0078] In step B1 of this embodiment, the method for determining whether a WAF exists by using a URL containing special characters to access the URL includes: using a URL containing special characters to access the URL, and a response of 403, 500 or a response containing keywords such as banned or fiercewall appears;

[0079] Step B2 includes: using error injection, Boolean blind injection and delayed blind injection as SQL basic tests, wherein the error injection uses enumerated passwords to inject in a brute force test manner to obtain the correct password; when the page cannot echo the query information, you can consider using delayed blind injection. The delayed blind injection attacker constructs a delayed statement. When the database executes the statement, if the judgment condition is met, the execution time is short. If the judgment condition is not met, it will cause a long execution time. The attacker can judge whether the test statement is correct by the length of the response time, thereby obtaining the database information; Boolean blind injection is mainly used in situations where there is no echo, and is generally used for query. Boolean blind injection judges the database information by responding to the returned true or false. Before using Boolean blind injection, it is necessary to first determine whether the data is character type or numeric type, and then construct a Boolean statement to judge the page echo, which is used to query whether the database has the information. If so, the information details are returned, and if not, there will be a corresponding error.

[0080] The directory scanning module in this embodiment is mainly implemented in a multi-threaded manner, collecting and collating commonly used dictionaries for directory blasting. If the request response packet status code is 200, 302 or 403, then the directory exists.

[0081] By adopting the above technical solution disclosed in the present invention, the following beneficial effects are obtained:

[0082] The present invention provides a vulnerability scanning system and method for java web services. In URL processing, the method removes non-target assets and invalid links from the URL to improve the scanning rate; in the asset collection module, input parameters are collected and sorted out in the common search box login box; before directory scanning, the sub-directories of the collected URL assets are processed to improve the discovery rate of the directory scanning module; and the SQL injection module subsequently identifies and bypasses WAF. The method simply integrates a vulnerability library of common java development template vulnerabilities.

[0083] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A vulnerability scanning system for Java web services, characterized in that: It includes an asset collection module, a fingerprint recognition module, a framework vulnerability scanning module and a basic vulnerability scanning module. The asset collection module collects the target site URL information and site sub-directory information according to the input target site; the fingerprint recognition module performs fingerprint recognition on the Java framework and determines the current framework type by searching for the HTTP response header, Server, X-Powered-By and Cookies of the HTTP response header; the framework vulnerability scanning module is used to enter the framework to perform vulnerability scanning after the fingerprint scanning module determines the framework type, and collect common Java framework vulnerabilities; the basic vulnerability scanning module includes a directory scanning sub-module, an XSS vulnerability scanning sub-module and an SQL injection vulnerability scanning sub-module; the target scanning sub-module is used to scan the sub-directories of the target asset URL; the XSS vulnerability scanning sub-module is used to scan all URLs obtained by the crawler for XSS vulnerabilities; the SQL injection vulnerability scanning sub-module is used to determine whether the SQL injection module has a database command maliciously constructed by the user to enter the database for execution; The fingerprint recognition module determines the current frame type by searching several common locations, specifically including the following steps: First, get the HTTP response header information in the response package, and then confirm whether there are HTTP response headers such as Server, X-Jenkins, X-Powered-By, and Powered By. If so, directly get the corresponding Java framework information; The SQL injection vulnerability scanning submodule performs vulnerability judgment based on the difference between the test statements injected by the SQL injection module and the response packets of different test statements, specifically including: B1, first perform WAF judgment, try to use the URL containing special characters to access the injected website, and judge whether WAF exists. If not, go directly to step B2; if it exists, it is necessary to judge whether it can be bypassed again. If it can be bypassed, modify the test statement, try to bypass the payload and then go to step B2; if it cannot be bypassed, go directly to step B2; B2, the test SQL injection module includes error injection, Boolean blind injection and delayed blind injection. Error injection and joint query statements in SQL injection are used for testing. Different test responses are compared to determine whether there is a vulnerability. If there is a vulnerability, the test result is directly output, and then the Boolean blind injection and delayed blind injection are tested; otherwise, the Boolean blind injection and delayed blind injection are directly tested.

2. The vulnerability scanning system for Java web services according to claim 1, characterized in that: The asset collection module adopts a breadth-first crawler strategy to crawl the URL of the entire site, uses Python's BeautifulSoup module to obtain all a tags with href attributes, extracts the href attributes in the a tags, removes duplicate links, and removes non-target assets if extracted. If the link does not start with HTTP, the asset root directory is included. The processed links are added to the unvisited list, and the links that have been crawled are added to the visited list; the URLs in the unvisited list are taken out and crawled again according to the crawling steps. After the crawling is completed, the crawling results are placed in a file for the convenience of subsequent fingerprint recognition module, framework vulnerability scanning module and basic vulnerability scanning module to call.

3. The vulnerability scanning system for Java web services according to claim 1, characterized in that: The method of using a URL containing special characters to access the injected website and determining whether there is a WAF specifically includes: using a URL containing special characters to access the website and a response of 403, 500 or a response containing keywords such as banned or firewall appears; Step B2 includes: using error injection, Boolean blind injection and delayed blind injection as SQL basic tests, wherein the error injection refers to injecting enumerated passwords in a brute force test manner to obtain the correct password; delayed blind injection, when the page cannot echo the query information, consider using delayed blind injection. The delayed blind injection attacker constructs a delay statement. When the database executes the statement, if the judgment condition is met, the execution time is short. If the judgment condition is not met, the execution time will be very long. The attacker determines whether the test statement is correct by the length of the response time, thereby obtaining the database information; Boolean blind injection is used in the case of no echo. The database information is judged by the true or false returned by the response. Before using Boolean blind injection, it is necessary to first determine whether the data is character type or numeric type, and then construct a Boolean statement to determine the page echo, which is used to query whether the database has the information. If so, the information details are returned. If not, there will be a corresponding error.

4. A vulnerability scanning method for Java web services, characterized in that: The vulnerability scanning system of the Java web service according to any one of claims 1 to 3 is implemented, comprising the following steps: S1, input the target asset to be scanned into the asset collection module, and use the breadth-first crawler algorithm to crawl the full site URL of the target asset; S2, extracting the URL data input points that meet the crawler requirements and saving them together with their directory nodes into a unified folder as the crawler results; S3, using the fingerprint recognition module to identify the web framework in the crawler results, and identifying the framework type by looking up the HTTP response header, the Server, X-Powered-By and Cookies of the HTTP response header; for different framework types, different vulnerability scanning modules are selected to perform the vulnerability scanning process; after using the fingerprint recognition module to determine the web framework type, the directory scanning submodule is used to find the service interface that a website can provide, and the link provided by this service interface is used to further scan the website directory. The subsequent vulnerability detection function needs to be further scanned based on the website directory, and a request is made through the link displayed on the website. If the status code is 200, 302, 401 or 403, it means that there are files in the directory. After determining the accessible directory of the website, the XSS and SQL injection vulnerability scanning modules are called to test whether the website has known vulnerabilities; S4, based on the scanning results from S1 to S3, forms a vulnerability scanning result report.

5. The vulnerability scanning method for Java web services according to claim 4, characterized in that: Step S2 specifically includes: S21, use Python's BeautifulSoup module to obtain all a tags with href attributes, extract the href attributes in the a tags, remove duplicate links, if the extracted non-target assets are removed, if they do not start with HTTP, bring the asset root directory, add the processed links to the unvisited list, and add the links that have been crawled to the visited list; S22, take out the URLs in the unvisited list and crawl again according to the crawling steps. After the crawling is completed, put the crawling results into a file for the convenience of calling the subsequent fingerprint recognition module, framework vulnerability scanning module and basic vulnerability scanning module.

6. The vulnerability scanning method for Java web services according to claim 4, characterized in that: In step S3, the fingerprint recognition module is used to identify the web framework in the crawler result, and the framework type is identified by searching the HTTP response header. The HTTP response header Server, X-Powered-By and Cookies identification specifically include: obtaining the HTTP response header information in the response package, and then confirming whether there are HTTP response headers such as Server, X-Jenkins, X-Powered-By and Powered By in it. If there are, then obtain the Java framework information in it, and identify the Struts2 framework: First, by passing the actionErrors parameter, if the response packet is abnormal, it is considered that the target is built based on Struts2. There are mainly the following abnormal situations: (1) Response packet status code 400, 500 or 302; (2) The parameters passed by actionErrors are echoed on the page; (3) The content structure of the page has changed significantly; Secondly, we can judge whether / struts / webconsole.html exists. If the response package is normal, it is determined to be the Struts framework. Finally, through the keyword and checkbox_keyword parameters, if keyword=11 is passed, the page will be displayed normally or 11 will be echoed to the page, while passing _checkbox_keyword=111 will echo an error, then the website is definitely a Struts framework; For WebLogic framework identification, the following default path is used to identify the WebLogic framework: (1) / console / login / LoginForm.jsp (2) / wls-wsat / CoordinatorPortType (3) / _async / AsyncResponseService (4) / ws_utc / config.do.

7. The vulnerability scanning method for Java web services according to claim 6, characterized in that: In step S3, for different framework types, different vulnerability scanning modules are selected to perform vulnerability scanning. The specific process includes: to be determined as Struct2 and weblogic frameworks, a framework vulnerability scanning module is used to collect Struct2 and weblogic framework vulnerabilities, and the Struct2 vulnerability detection method is analyzed. The Struct2 vulnerability is mainly transmitted through POST or GET. Then, it is determined whether the return package command is executed. If the command result is executed, it is determined that the vulnerability exists; by executing the command {str1+str2}, if the response package contains the result of str1+str2, then the vulnerability exists; for other framework types, no framework vulnerability scanning is performed.

Images