Cache poisoning detection method, device, electronic device and storage medium

Abstract

The present invention discloses a cache poisoning detection method, device, electronic device and storage medium. The cache poisoning detection method includes: first obtaining the IP address set and network resource address set of the target domain name to be detected; then selecting the first IP address to be tested and the first network resource address to be tested from the IP address set and the network resource address set, respectively, and binding the two; according to the first IP address to be tested and the first network resource address to be tested, sending poisoned network request information to the cache server and receiving poisoned network response information; judging whether the poisoned network response information comes from the cache server; if not, sending normal network request information to the cache server and receiving detection network response information; judging whether the target domain name has a cache poisoning defect according to the poisoned network response information and the detection network response information. The present invention can effectively and accurately detect cache poisoning defects without relying on cache buster.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a cache poisoning detection method, device, electronic device and storage medium. Background Art

[0002] In order to solve the problem of long response time of WEB servers, WEB servers have developed a caching mechanism, which is to add a cache server between the user and the WEB server. The user's HTTP (Hyper Text Transfer Protocol) request first reaches the cache server. If the cache server finds that the URL (Uniform / Universal Resource Locator) resource requested by the user is already stored in the cache server, it will directly respond to the user with HTTP; if it finds that the URL resource is not in the cache server, it will forward the HTTP request to the background WEB server and cache the response content of the WEB server. If subsequent users request the same URL resource, the cache server can respond directly.

[0003] However, if the WEB server or cache server is improperly configured, there may be a cache poisoning flaw, which allows criminals to exploit the cache mechanism and deliver harmful HTTP responses to victim users.

[0004] The current method for detecting whether the accessed target has a cache poisoning flaw generally uses URL parameters as a cache buster, and the cache buster as part of the cache key. However, in actual testing, it was found that some domain names ignore URL parameters when configuring the cache key, and do not allow URL parameters to participate in the calculation of the cache key. This makes the method based on URL parameters as a cache buster unfeasible. If the URL parameter is not part of the cache key, then in the first step of the traditional testing method, a cache copy will be formed on the cache server, causing the HTTP request in the second step to not reach the backend WEB server, but instead be responded to by the cache server, making it impossible to accurately detect cache poisoning flaws. Summary of the Invention

[0005] To overcome the above problems and defects, the present invention provides a cache poisoning detection method, device, electronic device and storage medium, which can effectively and accurately detect cache poisoning defects without relying on cache buster.

[0006] To achieve the above objectives, the present invention provides a cache poisoning detection method in a first aspect, comprising:

[0007] Obtain the IP address set and network resource address set of the target domain name to be detected, where the target domain name is associated with a cache server and a web server;

[0008] Selecting a first IP address to be tested and a first network resource address to be tested from the IP address set and the network resource address set, respectively, and binding the first IP address to be tested and the first network resource address to be tested;

[0009] Sending poisoned network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receiving poisoned network response information, wherein the poisoned network request information includes network virus information;

[0010] Determine whether the poisoned network response information comes from the cache server;

[0011] If not, sending normal network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receiving detection network response information;

[0012] Based on the poisoning network response information and the detection network response information, determine whether the target domain name has a cache poisoning defect.

[0013] Optionally, after the step of determining whether the poisoned network response information comes from the cache server, the method further includes:

[0014] If the poisoned network response information comes from the cache server, then determine whether all network resource addresses in the network resource address set have been detected;

[0015] If not, selecting an undetected second network resource address to be tested from the network resource address set, and binding the first IP address to be tested to the second network resource address to be tested;

[0016] According to the first IP address to be tested and the second network resource address to be tested, poisoning network request information is sent to the cache server.

[0017] Optionally, after the step of determining whether all network resource addresses in the network resource address set have been detected, the method further includes:

[0018] If all network resource addresses in the network resource address set have been detected, then determine whether all IP addresses in the IP address set have been detected;

[0019] If not, selecting an undetected second IP address to be tested from the IP address set, selecting a third network resource address to be tested from the network resource address set, and binding the second IP address to be tested and the third network resource address to be tested;

[0020] According to the first IP address to be tested and the second network resource address to be tested, poisoned network request information is sent to the cache server, and poisoned network response information is received.

[0021] Optionally, the step of determining whether the poisoned network response information comes from the cache server includes:

[0022] Get the header field of the poisoned network response information;

[0023] Based on the header field, determine whether the poisoned network response information comes from the cache server.

[0024] Optionally, the step of determining whether the target domain name has a cache poisoning flaw based on the poisoning network response information and the detection network response information includes:

[0025] Obtaining poisoning content associated with network virus information according to the poisoning network response information;

[0026] Check whether the network response information contains poisoned content;

[0027] If so, it is determined that the target domain name has a cache poisoning vulnerability, otherwise it does not exist.

[0028] Optionally, the step of determining whether the target domain name has a cache poisoning flaw based on the poisoning network response information and the detection network response information includes:

[0029] Get the identification field of the detection network response information;

[0030] According to the identification field, determining whether the detection network response information is generated based on the poisoning network response information;

[0031] If so, it is determined that the target domain name has a cache poisoning vulnerability, otherwise it does not exist.

[0032] Optionally, the step of determining whether the target domain name has a cache poisoning flaw based on the poisoning network response information and the detection network response information includes:

[0033] Obtaining a first HTTP status code of the poisoned network response information, and detecting a second HTTP status code of the network response information;

[0034] It is determined whether the target domain name has a cache poisoning flaw according to the first HTTP status code and the second HTTP status code.

[0035] A second aspect of the present invention provides a cache poisoning detection device, comprising:

[0036] An acquisition module is used to acquire an IP address set and a network resource address set of a target domain name to be detected, wherein the target domain name is associated with a cache server and a WEB server;

[0037] A selection module is used to select a first IP address to be tested and a first network resource address to be tested from the IP address set and the network resource address set, respectively, and bind the first IP address to be tested and the first network resource address to be tested;

[0038] The first transceiver module is used to send poisoned network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive poisoned network response information, wherein the poisoned network request information includes network virus information;

[0039] The first judgment module is used to judge whether the poisoned network response information comes from the cache server;

[0040] The second transceiver module is used to send normal network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive the detection network response information when the poisoned network response information comes from the network server;

[0041] The second judgment module is used to judge whether the target domain name has a cache poisoning defect according to the poisoning network response information and the detection network response information.

[0042] A third aspect of the present invention provides an electronic device, comprising a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the above-mentioned cache poisoning detection method is implemented.

[0043] A fourth invention of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the cache poisoning detection method described above is implemented.

[0044] Compared with the prior art, the present invention has the following advantages: when the poisoned network response information does not come from the cache server (i.e., from the WEB server), it can be determined that the first network resource to be tested, bound to the first IP address to be tested, is being used for the first time and there is no corresponding cache copy on the cache server; thus, there is no need to rely on the cache buster mechanism to bypass the cache server; and then, based on the poisoned network response information and the detection network response information, it is determined whether the target domain name has a cache poisoning defect. Therefore, the present invention can effectively and accurately detect cache poisoning defects in the network server or cache server of the target domain name, allowing technicians to promptly eliminate security defects and prevent them from being illegally exploited to cause network security problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification, are used to explain the principles of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and those skilled in the art can derive other drawings based on these drawings without inventive effort. In the drawings:

[0046] Figure 1 Schematic diagram of the process of the cache poisoning detection method according to the embodiment of the present invention Figure 1 ;

[0047] Figure 2 Schematic diagram of the process of the cache poisoning detection method according to the embodiment of the present invention Figure 2 ;

[0048] Figure 3 Schematic diagram of the process of the cache poisoning detection method according to the embodiment of the present invention Figure 3 ;

[0049] Figure 4 Schematic diagram of the process of the cache poisoning detection method according to the embodiment of the present invention Figure 4 ;

[0050] Figure 5 This is a schematic diagram of the architecture of a cache poisoning detection device according to an embodiment of the present invention;

[0051] Figure 6 FIG. 1 is a schematic diagram of the architecture of a computer system of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art.

[0053] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present invention. However, it will be appreciated by those skilled in the art that the technical solutions of the present invention can be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring various aspects of the present invention.

[0054] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks, processor devices, or microcontroller devices.

[0055] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, while others may be combined or partially combined. Therefore, the actual execution order may vary depending on the actual situation.

[0056] Improper configuration of a web server or cache server may lead to security vulnerabilities or flaws, allowing criminals to exploit these vulnerabilities and flaws to perform web cache poisoning (Web Cache Poisoning). The process of web cache poisoning is as follows: First, the attacker constructs a "poisonous" HTTP request and sends it to the target web server. The target web server generates a polluted HTTP response and returns it to the attacker. At the same time, this polluted HTTP response is cached in the cache server. When the victim user subsequently accesses the same URL (Uniform / Universal Resource Locator) resource, the web cache recognizes that the victim's HTTP request and the attacker's HTTP request are equivalent HTTP requests, so it directly responds to the victim with the cached, polluted HTTP response.

[0057] During the entire process, the cache key of the HTTP request sent by the attacker and the cache key of the HTTP request sent by the victim must be the same, so that they will be considered equivalent requests by the cache server and can hit the same cache copy; at the same time, the attacker must ensure that the HTTP field that causes pollution, that is, the "toxic" field, cannot be part of the cache key.

[0058] The following is a typical web cache poisoning attack process. Assume that the target domain name is "www.example.com" and the domain name controlled by the attacker is "attacker.com";

[0059] 1. The attacker sends an HTTP request to the target domain www.example.com’s “ / scripts” and adds a “toxic” field “X-Forwarded-Host:attacker.com”;

[0060] 2. The target web server returns an HTTP response, which is cached and redirects the user to the attacker's server, causing the user's browser to load the malicious code.

[0061] 3. The victim visits "http: / / www.example.com / scripts". Since the Host, URL, User-Agent and other fields accessed by the victim and the attacker are the same, the cache key is the same. Therefore, the cache server considers them to be equivalent HTTP requests and directly replies to the cached copy to the victim. The victim will be redirected to the attacker's server, and then the malicious code will be loaded.

[0062] The poisoning method used by the attackers involves adding a poisonous HTTP header field, "X-Forwarded-Host: attacker.com." The server uses the value of this field as the redirection target. The attackers first set this value to a domain name they control, then deliver it to other victims through the cache mechanism, achieving their goal of attacking other users. It is important to note that these HTTP header fields themselves are not problematic and are widely used in normal HTTP communications. It is only under specific web server configurations that attackers maliciously exploit them, which is why we call them "poisonous" HTTP header fields.

[0063] In response to the aforementioned cache poisoning attack methods, the current cache poisoning detection methods are as follows:

[0064] The first step is to find an HTTP header field that can be poisoned, for example, the "X-Forwarded-Host" field. The web server will display the value of this field in the HTTP response.

[0065] The second step is to simulate an attacker sending a "poisonous" HTTP request to the target URL, here is to add the poisonous HTTP header field X-Forwarded-Host: a."> <script>alert(1)< / script> It is important to note that a URL parameter is added as a cache buster, namely "?dontpoisoneveryone=1" in the URL. This poisonous HTTP request successfully causes a polluted HTTP response, injecting malicious JavaScript code into the HTML page of the HTTP response.

[0066] In the third step, the victim is simulated to send a normal HTTP request to the target URL. This URL must be the same as the one in the previous step. This HTTP request does not carry the poisoned HTTP header field, but the tainted HTTP response page is still received. This detects the cache poisoning vulnerability.

[0067] Most of the aforementioned methods for detecting web cache poisoning flaws are based on the cache buster mechanism. This is done for two reasons: first, to ensure that HTTP requests can reach the backend web server without being responded to by the cache server; second, to avoid contaminating real HTTP requests, thereby affecting real users other than the tester. Adding a cache buster ensures that this HTTP request can reach the backend web server instead of being responded to by the cache server because the cache buster is part of the cache key. Once the cache buster is added, the cache server will consider this to be a new HTTP request. By selecting a randomly generated string as the cache buster, it can be guaranteed that this HTTP request has not been cached by the cache server before. Since the cache buster uses a randomly generated string, it can be guaranteed that HTTP requests carrying the cache buster will not exist in normal traffic, ensuring that the detection will not affect other real users.

[0068] When selecting a cache buster, current detection methods default to using URL parameters. This choice is based on a rationale. Selecting a cache buster requires certain criteria: first, the cache buster must be part of the cache key; second, its inclusion must not alter the HTTP response. The most common and fundamental cache keys include the Host field, the URL field, and the HTTP request method. While any HTTP field can theoretically be used as a cache key, the purpose of caching is to maximize HTTP requests hitting the cache server's cached copy, resulting in faster user responses and reduced server load. Therefore, in practice, cache keys are typically selected based on a minimal set, with new fields added as cache keys only when necessary. Therefore, to accommodate a wide range of target domains under test, the test method can only select one cache buster from the most common HTTP fields that can be used as cache keys. In other words, the cache buster must be selected from the intersection of the cache key fields for all domains, typically consisting of the Host field, the URL field, and the HTTP request method. Modifying the Host field or the HTTP request method would violate the HTTP protocol and alter the HTTP response. Therefore, these two fields cannot be used as cache keys. Therefore, the most suitable field for cache key selection is the URL field. Among all URL fields, URL parameter fields are the most suitable for cache busters because if a URL parameter field name is not recognized by the web server, it will generally be ignored, thus not affecting the HTTP response.

[0069] For example, the original URL is "https: / / www.example.com / test.html," and the URL with the added URL parameter is "https: / / www.example.com / test.html?cb=123." The URL parameter here is the string "cb=123," which acts as a cache buster. The web server doesn't recognize the "cb" parameter and automatically ignores it. Therefore, the web server processes both URLs identically, returning the contents of the test.html file. However, the cache server uses the full URL as the cache key, resulting in two different cache keys. It interprets these as two different HTTP requests, requiring the respective HTTP responses to be cached separately.

[0070] For these reasons, current methods for detecting web cache poisoning mostly use URL parameters as cache busters. However, actual testing has found that some domain names ignore URL parameters when configuring cache keys, preventing them from being included in cache key calculations. This directly renders traditional detection methods based on URL parameters as cache busters infeasible. If URL parameters are not part of the cache key, a cache copy will be created on the cache server during the first step of the traditional testing method. This will cause the HTTP request in the second step to not reach the backend web server, but instead be responded to by the cache server, rendering the detection ineffective.

[0071] Therefore, the embodiment of the present invention provides a cache poisoning detection method that can effectively and accurately detect cache poisoning defects without relying on cache buster. Figure 1 As shown, it includes step 100, step 200, step 300, step 400, step 500 and step 600, which are specifically as follows:

[0072] Step 100: Acquire the IP address set and network resource address set of the target domain name to be detected, where the target domain name is associated with a cache server and a web server.

[0073] Specifically, DNS (Domain Name System) resolution is performed on the target domain name to obtain all IP addresses and form an IP address list. This DNS resolution requires collecting public DNS servers from around the world and initiating DNS requests to them from around the world to obtain a comprehensive list of IP addresses. A network resource address is specifically a URL, and a set of network resource addresses is specifically a URL list.

[0074] Step 200 : Select a first IP address to be tested and a first network resource address to be tested from an IP address set and a network resource address set respectively, and bind the first IP address to be tested and the first network resource address to be tested.

[0075] After the first IP address to be tested is bound to the first network resource address to be tested, all traffic data requested for the first network resource address to be tested will be sent to the bound first IP address to be tested.

[0076] Step 300: Send poisoned network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive poisoned network response information, wherein the poisoned network request information includes network virus information.

[0077] This embodiment does not add URL parameters to the first network resource address to be tested as a cache buster. Specifically, the poisoned network request information is a poisoned HTTP request, and the poisoned network response information is an HTTP response R1. The HTTP response R1 includes the first HTTP status code of the response, the first HTTP response header, and the first HTTP response body. The network virus information is the poison field.

[0078] Step 400 determines whether the poisoned network response information comes from a cache server. Specifically, if the poisoned network response information does not come from a cache server (i.e., from a web server), it can be determined that the first network resource bound to the first IP address to be tested is being used for the first time and there is no corresponding cache copy on the cache server. This eliminates the need to rely on the cachebuster mechanism to bypass the cache server.

[0079] In one embodiment, step 400 further includes: obtaining header fields of the poisoned network response information; and determining whether the poisoned network response information comes from a cache server based on the header fields. For example, the header fields of the HTTP response R1 are checked to see if a cache hit marker appears. Specifically, the header fields of the HTTP response R1 are checked to see if cache-related header fields, such as "Pragma," "Cache-Control," "X-Cache," and "Age," appear in the header of the HTTP response R1. Based on the meaning of these fields, we can infer whether the HTTP response R1 is a cached copy of the cache server.

[0080] The following field values ​​cannot be cached:

[0081] Pragma: no-cache;

[0082] Cache-Control:private;

[0083] Cache-Control: no-cache, no-store.

[0084] The following field values ​​indicate that caching is possible:

[0085] Cache-Control: public;

[0086] Cache-Control:max-age=3600;

[0087] Cache-Control:s-maxage=604800.

[0088] The following fields indicate a cache miss for this request:

[0089] X-Cache:Miss.

[0090] The following fields indicate whether this request hits the cache:

[0091] X-Cache:Hit;

[0092] Age:10.

[0093] If a cache hit indicator, such as "X-Cache: Hit" or "Age: 10," is found in the HTTP response R1 header, it indicates that the request did not reach the web server but was instead responded to directly by the cache server. In this case, we need to change the URL for testing. This ensures that the first network resource bound to the first IP address under test is being used for the first time and that there is no corresponding cached copy on the cache server. This also eliminates the need to rely on the cache buster mechanism to bypass the cache server.

[0094] Step 500: If not, then send normal network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive detection network response information.

[0095] The normal network request information is an HTTP request without poisoning, and the detection network response information is an HTTP response R2. The HTTP response R2 includes the second HTTP status code of the response, the second HTTP response header, and the second HTTP response body.

[0096] Step 600: Determine whether the target domain name has a cache poisoning defect based on the poisoning network response information and the detection network response information.

[0097] In one embodiment, Figure 2 As shown, step 600 further includes:

[0098] Step 611, obtaining poisoning content associated with the network virus information according to the poisoning network response information;

[0099] Step 612: Check whether the network response information contains poisoned content;

[0100] Step 613: If yes, it is determined that the target domain name has a cache poisoning vulnerability, otherwise it does not exist.

[0101] In the above steps, the poisoned field is echoed back to HTTP response R1. If the poisoned field also appears in HTTP response R2, then HTTP response R2 can be determined to be a cached copy of HTTP response R1. This means that the cache server has cached the poisoned HTTP response R1, causing subsequent normal user requests to be directly returned by the cache server as a cached copy. This constitutes a cache poisoning vulnerability.

[0102] In one embodiment, Figure 3 As shown, step 600 further includes:

[0103] Step 621, obtaining the identification field of the detection network response information;

[0104] Step 622, determining whether the detection network response information is generated based on the poisoning network response information;

[0105] Step 623: If yes, it is determined that the target domain name has a cache poisoning vulnerability, otherwise it does not exist.

[0106] Specifically, if HTTP response R2 contains cache hit identification fields, such as "X-Cache:Hit" and "Age:10," then HTTP response R2 can be determined to be a cached copy of HTTP response R1. This means that the cache server has cached the poisoned HTTP response R1, causing subsequent normal user requests to be directly returned by the cache server as the poisoned cached copy. This presents a cache poisoning vulnerability.

[0107] In one embodiment, Figure 4 As shown, step 600 further includes:

[0108] Step 631, obtaining a first HTTP status code of the poisoned network response information, and detecting a second HTTP status code of the network response information;

[0109] Step 632: Determine whether the target domain name has a cache poisoning vulnerability based on the first HTTP status code and the second HTTP status code.

[0110] Specifically, if the first and second HTTP status codes are the same, HTTP response R2 can be determined to be a cached copy of HTTP response R1. This means that the cache server has cached the poisoned HTTP response R1, causing subsequent normal user requests to be directly returned by the cache server as the poisoned cached copy. This presents a cache poisoning vulnerability.

[0111] In one embodiment, after the step of determining whether the poisoned network response information comes from the cache server, the method further includes:

[0112] If the poisoned network response information comes from the cache server, it is determined whether all network resource addresses in the network resource address set have been detected. Specifically, after each URL to be tested is selected from the URL list, this URL is deleted. If the URL list is empty, it indicates that all URLs in the URL list under the current first IP address to be tested have been detected and used.

[0113] If all the network resource addresses in the network resource address set have not been detected, a second undetected network resource address to be tested is selected from the network resource address set, and the first IP address to be tested is bound to the second network resource address to be tested.

[0114] According to the first IP address to be tested and the second network resource address to be tested, the poisoned network request information is sent to the cache server, and then according to the poisoned network response information, it is determined whether the poisoned network response information comes from the cache server.

[0115] The above steps can ensure that the URL to be tested, which is selected from the set of network resource addresses, is used for the first time and has no corresponding cache copy on the cache server; thus, there is no need to rely on the cache buster mechanism to bypass the cache server.

[0116] In one embodiment, after the step of determining whether all network resource addresses in the network resource address set have been detected, the method further includes:

[0117] If all network resource addresses in the network resource address set have been tested, then a check is performed to determine whether all IP addresses in the IP address set have been tested. Each time an IP address is selected from the IP address set for testing, it is removed from the IP address list. If the IP address list is empty, this indicates that all IP addresses and URLs have been tested and are in use, and that there are valid cached copies on the cache server, indicating that the target domain name is not susceptible to poisoning.

[0118] If not, select an undetected second IP address to be tested from the IP address set, select a third network resource address to be tested from the network resource address set, and bind the second IP address to be tested and the third network resource address to be tested.

[0119] According to the first IP address to be tested and the second network resource address to be tested, a poisoned network request message is sent to the cache server, and poisoned network response message is received, and then it is determined whether the poisoned network response message comes from the cache server according to the poisoned network response message.

[0120] In this embodiment, the target domain name generally uses a service similar to CDN (Content Delivery Network), and will use CDN nodes deployed around the world to speed up domain name access. At this time, the domain name will be resolved to multiple CDN node IP addresses through DNS resolution. The CDN mechanism will generally route the user's traffic to the nearest CDN node based on the geographical location to speed up user access. CDN nodes independently process HTTP requests and perform caches. The CDN node mechanism can be used to perform WEB cache poisoning tests. The technical principle is that CDN nodes are distributed around the world. At any time, there must be some URL resources that do not have cached copies on certain CDN nodes. This can be used to complete the detection.

[0121] For example, the target domain name may be located on a CDN node in Asia, which has cached all URL resources, but only a small number of URL resources are cached on the CDN node in America. In this case, the CND node in America can be used for testing. Unless all URL resources have cached copies on all CDN nodes, the detection method of this embodiment will lose the test conditions. For example, assuming that the target domain name has 1,000 URLs that are cacheable URL resources, and there are 100 CDN node IP addresses for the domain name, first select an IP address for testing. If there is one URL among these 1,000 URL resources that has not been cached, this embodiment can successfully complete the test. If all URLs have been cached on the selected IP address, then switch to the next IP address for testing.

[0122] This embodiment does not rely on the cache buster mechanism, but instead performs detection by controlling the number of times a URL is used. In addition to the mechanism of using URLs for detection, this embodiment also uses a mechanism based on CDN distributed nodes for detection. This mechanism can be combined with the URL detection mechanism to achieve the best detection effect.

[0123] Through the cache poisoning detection method of this embodiment, when the poisoned network response information does not come from the cache server (i.e., from the WEB server), it can be determined that the first network resource to be tested, bound to the first IP address to be tested, is being used for the first time and that there is no corresponding cache copy on the cache server. This eliminates the need to rely on the cache buster mechanism to bypass the cache server. Furthermore, based on the poisoned network response information and the detection network response information, it is determined whether the target domain name has a cache poisoning flaw. Therefore, this embodiment can effectively and accurately detect cache poisoning flaws in the network server or cache server of the target domain name, allowing technicians to promptly eliminate security flaws and prevent them from being illegally exploited and causing network security issues.

[0124] The embodiment of the present invention provides a cache poisoning detection device, such as Figure 5 As shown, including:

[0125] An acquisition module 701 is used to acquire an IP address set and a network resource address set of a target domain name to be detected, where the target domain name is associated with a cache server and a web server;

[0126] A selection module 702 is configured to select a first IP address to be tested and a first network resource address to be tested from the IP address set and the network resource address set, respectively, and bind the first IP address to be tested and the first network resource address to be tested;

[0127] The first transceiver module 703 is configured to send poisoned network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive poisoned network response information, wherein the poisoned network request information includes network virus information;

[0128] The first determination module 704 is used to determine whether the poisoned network response information comes from the cache server;

[0129] The second transceiver module 705 is used to send normal network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive the detection network response information when the poisoned network response information comes from the network server;

[0130] The second judgment module 706 is used to judge whether the target domain name has a cache poisoning defect according to the poisoning network response information and the detection network response information.

[0131] The cache poisoning detection device of this embodiment adopts the cache poisoning detection method provided in the above embodiment. When the poisoned network response information does not come from the cache server (i.e., from the WEB server), it can be determined that the first network resource to be tested, which is bound to the first IP address to be tested, is being used for the first time and there is no corresponding cache copy on the cache server. This means that there is no need to rely on the cache buster mechanism to bypass the cache server. Furthermore, based on the poisoned network response information and the detection network response information, it is determined whether the target domain name has a cache poisoning defect. Therefore, this embodiment can effectively and accurately detect cache poisoning defects in the network server or cache server of the target domain name, allowing technical personnel to promptly eliminate security defects and prevent security defects from being illegally exploited to cause network security problems.

[0132] Figure 6 A schematic structural diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present invention is shown.

[0133] It should be noted that Figure 6The computer system of the electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0134] like Figure 6 As shown, the computer system includes a central processing unit (CPU) 1801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1802 or the program loaded from the storage part 1808 into the random access memory (RAM) 1803, such as executing the method described in the above embodiment. Various programs and data required for system operation are also stored in the RAM 1803. The CPU 1801, ROM 1802 and RAM 1803 are connected to each other via a bus 1804. An input / output (I / O) interface 1805 is also connected to the bus 1804.

[0135] The following components are connected to the I / O interface 1805: an input section 1806 including a keyboard, a mouse, and the like; an output section 1807 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 1808 including a hard disk; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1805 as needed. Removable media 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 1810 as needed, so that computer programs read from the removable media can be installed in the storage section 1808 as needed.

[0136] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product that includes a computer program carried on a computer-readable medium, the computer program including a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1809, or installed from a removable medium 1811. When the computer program is executed by the central processing unit (CPU) 1801, the various functions defined in the system of the present invention are performed.

[0137] It should be noted that the computer-readable medium shown in the embodiments of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable computer program. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. A computer program embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes shown in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0139] The units involved in the embodiments of the present invention may be implemented in software or hardware, and the units described may also be provided in a processor. In some cases, the names of these units do not limit the units themselves.

[0140] Specifically, through the electronic device of this embodiment, when the poisoned network response information does not come from the cache server (i.e., from the WEB server), it can be determined that the first network resource to be tested, bound to the first IP address to be tested, is being used for the first time and there is no corresponding cache copy on the cache server. This eliminates the need to rely on the cache buster mechanism to bypass the cache server. Furthermore, based on the poisoned network response information and the detection network response information, it can be determined whether the target domain name has a cache poisoning flaw. Therefore, this embodiment can effectively and accurately detect cache poisoning flaws in the network server or cache server of the target domain name, allowing technicians to promptly eliminate security flaws and prevent them from being illegally exploited to cause network security issues.

[0141] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments, or may exist independently and not incorporated into the electronic device. The storage medium carries one or more programs, and when executed by the electronic device, the electronic device implements the methods provided in the above embodiments.

[0142] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0143] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the embodiments of the present invention.

[0144] Specifically, through the storage medium of this embodiment, when the poisoned network response information does not come from a cache server (i.e., from a WEB server), it can be determined that the first network resource to be tested, bound to the first IP address to be tested, is being used for the first time and that there is no corresponding cache copy on the cache server. This eliminates the need to rely on the cache buster mechanism to bypass the cache server. Furthermore, based on the poisoned network response information and the detection network response information, it can be determined whether the target domain name has a cache poisoning flaw. Therefore, this embodiment can effectively and accurately detect cache poisoning flaws in the network server or cache server of the target domain name, allowing technicians to promptly eliminate security flaws and prevent them from being illegally exploited to cause network security issues.

[0145] Other embodiments of the present invention will readily occur to those skilled in the art after considering the specification and practicing the embodiments disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein.

[0146] It should be understood that the present invention is not limited to the exact construction described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A cache poisoning detection method, characterized in that: include: Obtaining an IP address set and a network resource address set of a target domain name to be detected, wherein the target domain name is associated with a cache server and a web server; Selecting a first IP address to be tested and a first network resource address to be tested from the IP address set and the network resource address set, respectively, and binding the first IP address to be tested and the first network resource address to be tested; Sending poisoned network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receiving poisoned network response information, wherein the poisoned network request information includes network virus information; Determining whether the poisoned network response information comes from the cache server; If not, sending normal network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receiving detection network response information; Determining whether the target domain name has a cache poisoning defect based on the poisoning network response information and the detection network response information; Wherein, after the step of determining whether the poisoned network response information comes from the cache server, the method further includes: If the poisoned network response information comes from the cache server, determining whether all network resource addresses in the network resource address set have been detected; If not, selecting an undetected second network resource address to be tested from the network resource address set, and binding the first IP address to be tested to the second network resource address to be tested; Send poisoning network request information to the cache server according to the first IP address to be tested and the second network resource address to be tested.

2. The cache poisoning detection method according to claim 1, characterized in that: After the step of determining whether all network resource addresses in the network resource address set have been detected, the method further includes: If all network resource addresses in the network resource address set have been detected, determining whether all IP addresses in the IP address set have been detected; If not, selecting an undetected second IP address to be tested from the IP address set, selecting a third network resource address to be tested from the network resource address set, and binding the second IP address to be tested to the third network resource address to be tested; According to the first IP address to be tested and the second network resource address to be tested, poisoned network request information is sent to the cache server, and poisoned network response information is received.

3. The cache poisoning detection method according to any one of claims 1 to 2, characterized in that: The step of determining whether the poisoned network response information comes from the cache server includes: Obtaining the header field of the poisoned network response information; According to the header field, it is determined whether the poisoned network response information comes from the cache server.

4. The cache poisoning detection method according to claim 1, wherein: The step of determining whether the target domain name has a cache poisoning defect based on the poisoning network response information and the detection network response information includes: Obtaining poisoning content associated with the network virus information according to the poisoning network response information; Checking whether the detection network response information contains the poisoned content; If so, it is determined that the target domain name has a cache poisoning flaw, otherwise it does not exist.

5. The cache poisoning detection method according to claim 1, wherein: The step of determining whether the target domain name has a cache poisoning defect based on the poisoning network response information and the detection network response information includes: Obtaining an identification field of the detection network response information; According to the identification field, determining whether the detection network response information is generated based on the poisoning network response information; If so, it is determined that the target domain name has a cache poisoning flaw, otherwise it does not exist.

6. The cache poisoning detection method according to claim 1, characterized in that: The step of determining whether the target domain name has a cache poisoning defect based on the poisoning network response information and the detection network response information includes: Obtaining a first HTTP status code of the poisoning network response information and a second HTTP status code of the detection network response information; Determine whether the target domain name has a cache poisoning flaw according to the first HTTP status code and the second HTTP status code.

7. A cache poisoning detection device, characterized in that: include: An acquisition module is used to acquire an IP address set and a network resource address set of a target domain name to be detected, wherein the target domain name is associated with a cache server and a web server; A selection module, configured to select a first IP address to be tested and a first network resource address to be tested from the IP address set and the network resource address set, respectively, and bind the first IP address to be tested and the first network resource address to be tested; a first transceiver module, configured to send poisoned network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive poisoned network response information, wherein the poisoned network request information includes network virus information; A first judgment module is used to judge whether the poisoned network response information comes from the cache server; A second transceiver module is configured to, when the poisoned network response information comes from the network server, send normal network request information to the cache server according to the first IP address to be tested and the first network resource address to be tested, and receive detection network response information; a second judgment module, configured to judge whether the target domain name has a cache poisoning defect according to the poisoning network response information and the detection network response information; The first judgment module is further configured to, if the poisoned network response information comes from the cache server, determine whether all network resource addresses in the network resource address set have been detected; if not, select an undetected second network resource address to be tested from the network resource address set, and bind the first IP address to be tested to the second network resource address to be tested; Send poisoning network request information to the cache server according to the first IP address to be tested and the second network resource address to be tested.

8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the cache poisoning detection method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the cache poisoning detection method according to any one of claims 1 to 6 is implemented.

Images