Web security scanning method, related equipment and storage medium

Abstract

The present invention provides a web security scanning method and related equipment, primarily intended to address issues encountered during web security testing, such as the use of vulnerability scanning applications using crawler technology. These applications typically obtain the web server's directory structure and accessed URL list through crawler technology, resulting in inaccurate scan results, high device performance consumption, and a lack of focus. The method comprises: obtaining a user's access request for a target web page, the access request including URL information; determining target traffic data reported by the server associated with the target web page and associated with the URL information; and performing a vulnerability scan on the target traffic data.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a web security scanning method and related equipment. Background Art

[0002] With the continuous development of network security in my country, web security testing has received more and more attention. At present, most web security tests mainly use a type of security vulnerability scanning application with a crawler. The URLs obtained by the crawler are sent through the http protocol through web page requests. The URLs obtained by the crawler are not very accurate, and some URLs will be missed, resulting in the URL not being scanned; the crawler movement is relatively large, and generally in order to improve the efficiency of the crawler, concurrent technology will be used, so the performance consumption of the device under test is relatively high; there is a lack of key objects, and all URLs are extracted indiscriminately without corresponding emphasis, which may result in useless work and waste time and performance. Summary of the Invention

[0003] In response to the above issues, this patent proposes a web security scanning method. This method obtains URLs through user operations. URLs are real and not easily missed. It does not rely on crawlers to obtain URLs. This passive method accepts user input, requires minimal effort, consumes no additional performance, and allows for more focused scanning based on user access. The primary purpose is to improve the accuracy and efficiency of web security scanning.

[0004] To solve at least one of the above technical problems, in a first aspect, the present invention provides a web security scanning method, the method comprising:

[0005] Obtaining a user's access request to a target web page, wherein the access request includes URL information;

[0006] Determine target traffic data fed back by a server to which the target webpage associated with the URL information belongs;

[0007] Perform a vulnerability scan on the target traffic data.

[0008] Optionally, the above method further includes:

[0009] A proxy is configured in a web application, wherein the web application is used to obtain and forward a user's access request to a target web page.

[0010] Optionally, the above method further includes:

[0011] The proxy is configured in the vulnerability scanning application so that the vulnerability scanning application and the web application have the same proxy configuration parameters.

[0012] Optionally, the above method includes:

[0013] parse the target traffic data to obtain a target URL using the vulnerability scanning application;

[0014] The target URL is scanned for vulnerabilities based on a preset vulnerability rule base and application validation tests.

[0015] Optionally, the above method further includes:

[0016] The vulnerability scanning application parses the target traffic data based on the HTTP protocol to obtain the target URL.

[0017] Optionally, the above method further includes:

[0018] A risk assessment report is generated. In the case where the target URL has a vulnerability, the risk assessment report includes risky URLs in the target URL determined based on the scan and risk types corresponding to the risky URLs.

[0019] Optionally, the above method further includes:

[0020] In the event that a vulnerability exists in the target URL, data transmission to the web server to which the risky URL belongs is blocked.

[0021] In a second aspect, an embodiment of the present invention further provides an apparatus for a web security scanning method, comprising:

[0022] An acquiring unit, configured to acquire a user's access request to a target web page, wherein the access request includes URL information;

[0023] a determining unit, configured to determine target traffic data fed back by a server to which the target webpage associated with the URL information belongs;

[0024] The scanning unit is used to perform vulnerability scanning on the target traffic data.

[0025] To achieve the above object, according to a third aspect of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the web security scanning method is implemented.

[0026] To achieve the above-mentioned objective, according to a fourth aspect of the present invention, there is provided an electronic device comprising at least one processor and at least one memory connected to the processor; wherein the processor is configured to call program instructions in the memory to execute the web security scanning method.

[0027] Through the above technical solution, the embodiment of the present invention provides that for some common security testing methods currently used, vulnerability scanning applications with crawler technology are usually used for scanning. After the crawler technology is used to obtain the directory structure of the web server and the list of URLs accessed, the scanning results are not accurate, the performance consumption of the device is large, and there is a lack of key scanning objects. The present invention first obtains the user's access request to the target web page, the access request includes URL information; then determines the target traffic data fed back by the server to which the target web page belongs that is associated with the URL information; and finally performs a vulnerability scan on the target traffic data. This ensures that when performing web security scanning under complex conditions, the URL to be tested generated by the traffic data returned by the web server based on the access to the target page can be obtained, so as to facilitate more accurate security scanning. This solves the current problems of conventional vulnerability scanning applications with crawler technology being used for scanning, which have low scan results accuracy, high performance consumption of the device, and a lack of key scanning objects.

[0028] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0030] Figure 1 A schematic diagram showing a flow chart of a web security scanning method provided by an embodiment of the present invention is shown;

[0031] Figure 2 A schematic structural block diagram of a web security scanning device provided by an embodiment of the present invention is shown;

[0032] Figure 3 A schematic structural block diagram of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0034] This aims to address the current issues of vulnerability scanning applications using crawler technology, which result in low scan accuracy, high device performance consumption, and a lack of focused scan targets.

[0035] The embodiment of the present invention provides a web security scanning method, such as Figure 1 As shown, the method includes:

[0036] S101: Obtain the user's access address to the target web page, where the access address includes URL information.

[0037] It should be noted that the above-mentioned actual application scenario may be that the user uses a web application in the address bar, and inputs a request address for accessing the target web page through an instruction and data input device or a voice device running through an operating device. The request address is a URL, that is, a uniform resource locator system.

[0038] URL (Uniform Resource Locator) is a method used to specify the location of information on the World Wide Web. Available resources on the Internet can be represented by simple strings. This document describes the syntax and semantics of these strings. These strings are called "Uniform Resource Locators."

[0039] For example, a user enters www.google.com in the address bar of a Chrome browser using a keyboard; another example is a user entering "youku.com" in the address bar of an IE browser using a voice device, which recognizes the user's voice command "youku.com".

[0040] S102: Determine target traffic data fed back by the server to which the target webpage associated with the URL information belongs.

[0041] When the user is not offline and connected to the Internet, after entering the URL into the web application address bar using the method in S101, the visual interaction page between the web application and the user jumps to the target web page corresponding to the input URL, and the web page returns all traffic data in the target website to the proxy server through the server.

[0042] S103: Perform vulnerability scanning on the target traffic data.

[0043] By parsing the traffic data to obtain the target URL to be tested, vulnerability scanning and detection are performed on all URLs to be tested, and the detection matches the preset vulnerability rule library. The attacks that can match the preset vulnerability rule library include but are not limited to: SQLDET, XXS, XXE, brute-force, dirscan, path-traversal, upload, cmd-injection, crlf-injection, and SSRF.

[0044] SQLDET: SQL injection refers to a situation where a web application fails to judge the legitimacy of user input data or does not filter it strictly. An attacker can add additional SQL statements to the end of pre-defined query statements in the web application, performing illegal operations without the administrator's knowledge. This allows the attacker to trick the database server into executing unauthorized queries and obtain the corresponding data information.

[0045] XXS: Cross Site Script Attack, which refers to the use of website vulnerabilities to maliciously steal information from users.

[0046] XXE: XML External Entity Injection, that is, XML external entity injection attack.

[0047] Brute-force: Brute-force cracking refers to an attacker using an account or password dictionary to use exhaustive methods to guess the user account or password.

[0048] Dirscan: Directory scan.

[0049] Path-traversal: Path traversal attacks (also known as directory traversal) aim to access files and directories stored outside of the web root folder by manipulating files with "dot-slash (. / ... / )" sequences and their variations or by using absolute file paths to reference files.

[0050] Upload: File upload

[0051] cmd-injection: command injection

[0052] crlf-injection: short for CRLF carriage return and line feed. CRLF injection attack is an attack technique that triggers a vulnerability when a user inserts CRLF characters into an application.

[0053] SSRF: Server-Side Request Forgery, also known as server-side request forgery, is a network attack constructed by an attacker and initiated by the server. It is generally used to detect or attack internal network services on the external network. Its impact varies depending on the function used by the server.

[0054] In the above solution, it can be ensured that when performing web security scanning under complex conditions, the URL to be tested generated by the traffic data returned by the web server based on the access target page can be obtained, so as to facilitate more accurate security scanning. This solves the current conventional use of vulnerability scanning applications with crawler technology for scanning, the problem of low scanning result accuracy, high device performance consumption, and lack of key scanning objects.

[0055] In some embodiments, the above method, when executed, further comprises:

[0056] S201. Configuring a proxy in a web application, wherein the web application is used to obtain and forward a user's access request to a target web page.

[0057] Set the proxy destination address on the web application used by the user. The web application can be a commonly used browser with a configured proxy function, so that the traffic data of the browser accessing the page can pass through the proxy of the vulnerability scanning application, preparing for the next step of vulnerability scanning application to parse the traffic data.

[0058] It should be noted that the specific parameters for configuring the proxy server are the proxy protocol, proxy server, and proxy port. Among them, the proxy protocol is configured as the HTTP protocol so that the subsequent vulnerability scanning application can parse the traffic data forwarded through the proxy server. The proxy server address is configured so that the data fed back by the web server when the browser is used to access the page can be forwarded on the proxy server. The advantage is that after configuring the proxy server address, when the browser accesses the web server, the traffic data will be sent to the proxy server. The proxy server forwards the traffic data to the vulnerability scanning application and feeds back the received traffic data to the web server. By configuring the proxy server in the browser, it is possible to access the target web page and the vulnerability scanning application can perform scanning simultaneously without interfering with each other.

[0059] A proxy port refers to a number that is a specific virtual location on a computer. A computer has many ports to perform different tasks. The ports are configured so that subsequent vulnerability scanning applications can listen to them and transmit data.

[0060] HTTP: Hyper Text Transfer Protocol, also known as Hypertext Transfer Protocol, is a simple request-response protocol that usually runs on top of TCP. It specifies what messages a client may send to a server and what responses it may receive.

[0061] In some embodiments, the above method, when executed, further comprises:

[0062] S301. Configure a proxy in a vulnerability scanning application so that the vulnerability scanning application and the web application have the same proxy configuration parameters.

[0063] Start the vulnerability scanning application and enable the proxy server function built into the vulnerability scanning application, configure the port monitoring of the proxy server function so that it is consistent with the proxy server parameters in step S201, so as to facilitate the subsequent use of command line mode instructions to monitor the data forwarded by the port of the above-mentioned proxy server through the vulnerability scanning application.

[0064] For example, if the proxy server address is configured as 127.0.0.1 and the proxy port is 12345, the command line instruction is: xxxx (application name) webscan --listen 127.0.0.1:12345

[0065] Through the above method, when using a browser to access the target web page, the security of the target web page can be scanned through the configured vulnerability scanning application. There is no need to package the traffic data returned by the web server and then test it. It is more efficient and convenient, with high accuracy. The scanned traffic data is based on the traffic data generated by the target web page actually visited.

[0066] In some embodiments, the vulnerability scanning of the target traffic data includes:

[0067] S401: parse the target traffic data using the vulnerability scanning application to obtain a target URL.

[0068] It is understood that after successfully launching the vulnerability scanning application and enabling the proxy server function built into the vulnerability scanning application according to step S301, when using a browser to access the target page, an access request is sent to the target page's web server through the browser's proxy server node. The target page's web server returns the traffic data after the request to the browser's proxy server node, and the browser's proxy server node then forwards the returned traffic data to the vulnerability scanning application according to the port. The vulnerability scanning application parses the traffic data forwarded by the proxy server node and identifies the URL information therein as the target URL to be tested.

[0069] For example, when visiting "youku.com," the browser's front-end visual page displays video previews, images, text, animations, and more. This information is sent via the youku.com web server, along with the traffic data contained within the page, to a proxy server node. The proxy server node forwards this traffic data, where it is monitored by the vulnerability scanning application. The application then analyzes the traffic data to obtain the target, vulnerability type, payload, position, paramkey, paramvalue, feature, and type. The data corresponding to the target is the target URL to be tested.

[0070] S402: Perform vulnerability scanning on the target URL based on a preset vulnerability rule library and application verification testing.

[0071] The vulnerability scanning application scans the URL to be tested obtained in step S401 based on a preset vulnerability rule library in the vulnerability scanning application and using a verification test.

[0072] Application verification testing: PoC, Proof of Concept, this solution refers to some scripts or programs that prove the existence of vulnerabilities.

[0073] Exemplary:

[0074]

[0075]

[0076] In some embodiments, the step of parsing the target traffic data by the vulnerability scanning application to obtain the target URL includes:

[0077] S501: parse the target traffic data based on the HTTP protocol to obtain a target URL through the vulnerability scanning application.

[0078] For example, when accessing "bilibili.com," the browser's front-end visual page displays video preview information, images, text, animations, and more. This information is sent via the bilibili.com web server, along with the traffic data contained within the page, to a proxy server node. The proxy server node forwards this traffic data, which is then monitored by the vulnerability scanning application and retrieved. The traffic data is then parsed using the HTTP protocol to obtain the Target, VulnType, Payload, Position, ParamKey, ParamValue, Feature, and Type fields. The data corresponding to the Target is the target URL to be tested. The parsing using the HTTP protocol is based on the HTTP configuration of the proxy protocol parameters in the web application's proxy server in step S201. This configuration of the proxy protocol parameters in the proxy server provides more reliable data transmission during forwarding. The underlying TCP protocol ensures the correctness of the content transmission sequence and prevents packet loss during transmission. When a client requests a service from the server, it only needs to transmit the request method and path. HTTP also allows the transmission of any type of data object, providing greater flexibility at the forwarding level.

[0079] In some embodiments, the above method, when executed, further comprises:

[0080] S601: Generate a risk assessment report. When a vulnerability exists in the target URL, the risk assessment report includes risky URLs in the target URL determined based on scanning and risk types corresponding to the risky URLs.

[0081] By scanning the target URL for vulnerabilities, the vulnerability scanning application will generate a risk assessment report at the end of the scan and provide a payload for verification.

[0082] For example, a vulnerability scanning application analyzes traffic data forwarded by a proxy server node, identifies the URLs within, and then performs vulnerability checks on the identified URLs to generate the following risk assessment report. The advantage is that it can pinpoint the specific files within the directory of the target page that correspond to the risk type.

[0083] http: / / 192.168.203.178 / DVWA /

[0084] Corresponding to baseline / sensitive / server-error risk types;

[0085] http: / / 192.168.203.178 / DVWA / vulnerabilities / fi /

[0086] Corresponding to baseline / sensitive / server-error risk types;

[0087] http: / / 192.168.203.178 / DVWA / vulnerabilities / brute /

[0088] Corresponding to brute-force / form-brute / default risk types;

[0089] http: / / 192.168.203.178 / DVWA / vulnerabilities / exec /

[0090] Corresponding to cmd-injection / injection / cmd;

[0091] http: / / 192.168.203.178 / DVWA / phpinfo.php

[0092] Corresponding to dirscan / debug / php risk types;

[0093] http: / / 192.168.203.178 / DVWA / vulnerabilities / fi /

[0094] Corresponding to the path-traversal / path-traversal / default risk type;

[0095] http: / / 192.168.203.178 / DVWA / vulnerabilities / brute /

[0096] Corresponding to xss / reflected / default risk types.

[0097] In some embodiments, the above method, when executed, further comprises:

[0098] S701: When a vulnerability exists in the target URL, data transmission to the web server to which the risky URL belongs is blocked.

[0099] It should be noted that according to the above method, this solution can analyze and scan the traffic data fed back by the web server to which the target access page belongs when the vulnerability scanning application is accessing the page. At this time, if some more serious security vulnerability types are scanned during the scanning process, the TCP connection with the web server to which the target access page belongs will be immediately blocked to prevent attacks by security threats.

[0100] TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communications protocol. TCP is designed to fit into a layered protocol hierarchy that supports multiple network applications. Pairs of processes in host computers connected to different but interconnected computer communications networks rely on TCP for reliable communication services. TCP assumes that it can obtain simple, potentially unreliable datagram services from lower-level protocols.

[0101] It should be noted that, as a Figure 1 In addition to the implementation of the methods shown in various embodiments, the present invention also provides a web security scanning device for scanning the above Figure 1 This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not describe the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can implement all the contents of the aforementioned method embodiment. Figure 2 As shown, the device includes:

[0102] An acquiring unit, configured to acquire a user's access request to a target web page, wherein the access request includes URL information;

[0103] a determining unit, configured to determine target traffic data fed back by a server to which the target webpage associated with the URL information belongs;

[0104] The scanning unit is used to perform vulnerability scanning on the target traffic data.

[0105] By means of the above technical solution, an embodiment of the present invention provides a web security scanning method. For some common security testing methods currently used, a vulnerability scanning application with crawler technology is usually used for scanning. After the crawler technology is used to obtain the directory structure and accessible URL list of the web server, the scanning result is not accurate, the performance consumption of the device is large, and there is a lack of key scanning objects. The present invention first obtains the user's access request for the target web page, the access request includes URL information; then determines the target traffic data fed back by the server to which the target web page belongs that is associated with the URL information; and finally performs a vulnerability scan on the target traffic data. This ensures that when performing web security scanning under complex conditions, the URL to be tested generated by the traffic data returned by the web server based on the access to the target page can be obtained, so as to facilitate more accurate security scanning. This solves the current problems of conventional scanning using vulnerability scanning applications with crawler technology, which result in low accuracy, high performance consumption of the device, and a lack of key scanning objects.

[0106] The processor includes a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured, and by adjusting kernel parameters, an automated call-based communication method is implemented to address the problem that existing call-based communication methods are unable to meet forwarding requirements.

[0107] An embodiment of the present invention provides a storage medium on which a program is stored. When the program is executed by a processor, the web security scanning method is implemented.

[0108] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a web security scanning method when running.

[0109] The embodiment of the present invention provides a device 30, such as Figure 3 As shown, the device includes at least one processor 31, and at least one memory 32 and a bus 33 connected to the processor; wherein the processor 31 and the memory 32 communicate with each other through the bus 33; the processor 31 is used to call the program instructions in the memory to execute the above-mentioned web security scanning method.

[0110] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0111] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: obtaining a user's access request to a target web page, the access request including URL information; determining target traffic data fed back by a server to which the target web page associated with the URL information belongs; and performing a vulnerability scan on the target traffic data.

[0112] Furthermore, the above method also includes:

[0113] A proxy is configured in a web application, wherein the web application is used to obtain and forward a user's access request to a target web page.

[0114] Furthermore, the above method also includes:

[0115] The proxy is configured in the vulnerability scanning application so that the vulnerability scanning application and the web application have the same proxy configuration parameters.

[0116] Furthermore, the above method includes:

[0117] parse the target traffic data to obtain a target URL using the vulnerability scanning application;

[0118] The target URL is scanned for vulnerabilities based on a preset vulnerability rule base and application validation tests.

[0119] Furthermore, the above method also includes:

[0120] The vulnerability scanning application parses the target traffic data based on the HTTP protocol to obtain the target URL.

[0121] Furthermore, the above method also includes:

[0122] A risk assessment report is generated. In the case where the target URL has a vulnerability, the risk assessment report includes risky URLs in the target URL determined based on the scan and risk types corresponding to the risky URLs.

[0123] Furthermore, the above method also includes:

[0124] In the event that a vulnerability exists in the target URL, data transmission to the web server to which the risky URL belongs is blocked.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] In a typical configuration, the device includes one or more processors (CPUs), memory, and a bus. The device may also include input / output interfaces, network interfaces, and the like.

[0127] Memory may include non-permanent memory in a computer-readable medium, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip. Memory is an example of a computer-readable medium.

[0128] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0129] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0131] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A web security scanning method, characterized in that: include: Obtaining a user's access request to a target web page, wherein the access request includes URL information; Determine target traffic data fed back by a server to which the target webpage associated with the URL information belongs; Performing a vulnerability scan on the target traffic data includes: parsing the target traffic data based on the HTTP protocol by the vulnerability scanning application to obtain a target URL; performing a vulnerability scan on the target URL based on a preset vulnerability rule library and an application verification test, wherein the application verification test includes a PoC; configuring a proxy in a web application, wherein the web application is used to obtain and forward user access requests to a target web page; and configuring a proxy in the vulnerability scanning application so that the vulnerability scanning application and the web application have the same proxy configuration parameters.

2. The method according to claim 1, characterized in that Also includes: A risk assessment report is generated. In the case where the target URL has a vulnerability, the risk assessment report includes risky URLs in the target URL determined based on the scan and risk types corresponding to the risky URLs.

3. The method according to claim 2, characterized in that Also includes: In the event that a vulnerability exists in the target URL, data transmission to the web server to which the risky URL belongs is blocked.

4. A web security scanning device, characterized in that: include: an acquiring unit, configured to acquire a user's access request to a target web page, wherein the access request includes URL information; a determining unit, configured to determine target traffic data fed back by a server to which the target webpage associated with the URL information belongs; The scanning unit is configured to perform vulnerability scanning on the target traffic data, including: parsing the target traffic data based on the HTTP protocol by the vulnerability scanning application to obtain a target URL; performing vulnerability scanning on the target URL based on a preset vulnerability rule library and application verification testing, wherein the application verification testing includes a PoC; configuring a proxy in a web application, wherein the web application is configured to obtain and forward user access requests to a target web page; and configuring a proxy in the vulnerability scanning application so that the vulnerability scanning application and the web application have the same proxy configuration parameters.

5. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the web security scanning method according to any one of claims 1 to 3 is implemented.

6. An electronic device, characterized in that: The electronic device includes at least one processor and at least one memory connected to the processor; wherein the processor is configured to call program instructions in the memory to execute the web security scanning method according to any one of claims 1 to 3.

Images