Web penetration detection method and device based on honey bait

Abstract

The present disclosure relates to a method and device for Web penetration perception based on honey bait, the method comprising: acting as a proxy for all traffic of a Web server, and analyzing the HTML structure of the background login interface and / or background management interface in the traffic during the process of forwarding the traffic to obtain a DOM node suitable for embedding the honey bait; embedding the honey bait in the DOM node suitable for embedding the honey bait to obtain a page after the honey bait is embedded; wherein the similarity between the page after the honey bait is embedded and the page without the honey bait embedded is greater than a set threshold; when a traffic accesses the honey bait in the page after the honey bait is embedded, redirecting the traffic to the corresponding container to perform vulnerability perception of the traffic; when a traffic does not access the honey bait in the page after the honey bait is embedded, redirecting the traffic to the Web server to complete the traffic access. The present invention realizes the function of deploying honey bait in HTML pages by one-click proxy.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a honey bait-based Web penetration perception method and device. Background Art

[0002] The development of the internet has brought about continuous innovation and breakthroughs in web technology. From the earliest days of static web pages to the flourishing of today's web frameworks, technological advancements have brought improvements in functionality and user experience, but this has also brought with it more and more serious security issues. In recent years, network security issues have been increasing year by year, with security issues in the web field accounting for a major part of this. Web attack methods have become more decentralized than before, and attackers are using more and more subtle methods and adjusting their attack strategies in a timely manner. This has increased the difficulty of network security defense and the accuracy of attack identification.

[0003] Currently, the commonly used defense technologies in the Web field are mainly concentrated in two categories: the first category is firewall technology represented by WAF (Web Application Firewall). The main feature of this type of technology is to identify and match key features in network traffic, and determine whether there is abnormal behavior from its continuously updated matching rule library; the second category is honeypot technology represented by network deception technology. The main feature of this type of technology is to set up false vulnerable targets at various stages of network attacks to confuse, deceive, and lure hackers to attack.

[0004] Both types of defense technologies have their advantages but also corresponding disadvantages: WAF is easy to deploy, can withstand high throughput, and has a wide protection range, but there is a certain possibility of bypassing WAF's feature matching and rule detection mechanism; honeypot technology is highly targeted, and most of the data it collects is related to attacks, and can discover potential security issues to a certain extent, but honeypots usually exist as independent network nodes. If the honeypot is not attacked, it cannot provide early warning and analysis and tracing functions for the information system. Summary of the Invention

[0005] In response to the above problems, the present invention proposes a Web penetration perception method and device based on honey bait. The present invention sets up a proxy server to take over the traffic communicating with the Web server, and in the process of transmitting request and response data packets, embeds special code into the data packet to perceive the attack. Specifically, the present invention first proxies the communication traffic of the Web server, analyzes the structure of the background login page and the background management page after obtaining the complete HTML content, finds a suitable embedding position on the page through a special algorithm, and embeds the front-end code of the honey bait into the page to realize the functions of automatic analysis and automatic embedding. The three types of honey bait are: forgotten password, avatar upload, and template management. When the attacker accesses the honey bait and exploits the vulnerability, the interactive traffic is forwarded to the sandbox environment. Starting from solving the shortcomings of the honeypot, the present invention deeply integrates the HTML page of the Web application, and realizes the function of deploying the honey bait in the HTML page with one-click proxy.

[0006] In order to achieve the above object, the specific technical solution adopted by the present invention is:

[0007] A web penetration detection method based on honey bait, using a proxy server, the method comprising:

[0008] Proxy all traffic to a web server and analyze the HTML structure of the backend login interface and / or backend management interface in the process of forwarding traffic to obtain the DOM node suitable for embedding honey bait;

[0009] Embedding the honey bait in a DOM node suitable for embedding the honey bait to obtain a page after the honey bait is embedded; wherein the similarity between the page after the honey bait is embedded and the page without the honey bait embedded is greater than a set threshold;

[0010] When a flow accesses the honey bait in the page embedded with the honey bait, the flow is redirected to a corresponding container to detect vulnerabilities in the flow;

[0011] When a flow does not access the honey bait in the web page embedded with the honey bait, the flow is redirected to the Web server to complete the access of the flow.

[0012] Furthermore, the honey bait includes: at least one of: a forgotten password honey bait, an avatar upload honey bait and a template management honey bait; wherein, the forgotten password honey bait includes: an SQL injection vulnerability or a verification code logic vulnerability, the template management honey bait includes: a file upload vulnerability, and the avatar upload honey bait includes: an avatar image file upload vulnerability.

[0013] Furthermore, in the process of forwarding traffic, the HTML structure of the background login interface and / or the background management interface in the traffic is analyzed to obtain a DOM node suitable for embedding the honey bait, including:

[0014] Render the HTML code intercepted during the forwarding traffic process, and after the rendering is completed, obtain the coordinates and length and width attribute sets of all DOM nodes of the background login page and / or background management page relative to the page by writing a script to call the interface;

[0015] In the case where the honey bait is a forgot password honey bait, locate the form tag and use the form tag as the root node, find the parent node of the username and forgot password form input boxes using the greatest common ancestor node algorithm, and use the second-to-last child node of the parent node as the DOM node suitable for embedding the honey bait;

[0016] In the case where the honey bait is a template management honey bait, after finding the root node of the sidebar in the DOM node corresponding to the background login page, a depth-first traversal is performed on the DOM node corresponding to the background login page based on the root node of the sidebar, and all nodes in the obtained second leaf node set are backtracked and compared based on the coordinates and the length and width attribute set to obtain the DOM node embedded in the template management honey bait; wherein the root node of the sidebar is the DOM node with the largest length multiplied by the width;

[0017] In the case where the honey bait is an avatar upload honey bait, the head navigation bar node is found in the DOM node corresponding to the background login page, and the child node position of the head navigation bar node is used as the DOM node for embedding the avatar upload honey bait; wherein, the head navigation bar node is the DOM node with the smallest vertical coordinate and the longest length.

[0018] Furthermore, the step of performing a backtracking comparison on all nodes in the obtained first leaf node set based on the coordinates and the length and width attribute set to obtain a DOM node embedded with the forgotten password bait includes:

[0019] For the first leaf node set, analyze whether the parent node of each node is the same;

[0020] When the parent node of any two nodes is the same, the length and width attributes of the two nodes are compared to determine whether the two nodes are page elements of the same size;

[0021] If the two nodes are page elements of the same size, the two nodes are added to the set that meets the conditions;

[0022] Traverse the set of conditions that meet the requirements, and use the node after the last node in the set of conditions that meet the requirements as the DOM node for embedding the forgotten password bait.

[0023] Furthermore, in the case where the bait is a forgotten password bait and the forgotten password bait includes an SQL injection vulnerability, redirecting the traffic to a corresponding container to perform vulnerability awareness on the traffic includes:

[0024] Setting a honey bait tag; wherein a special injectable parameter is set in the honey bait tag;

[0025] When the traffic uses an error injection method to detect the honey bait tag, the SQL server generates an error warning based on the special injectable parameter.

[0026] Furthermore, in the case where the bait is a forgotten password bait and the forgotten password bait includes a verification code logic vulnerability, redirecting the traffic to a corresponding container to perform vulnerability awareness on the traffic includes:

[0027] For the password retrieval operation corresponding to this traffic, the reset verification code will be sent to the administrator's email address;

[0028] Receive the input reset verification code;

[0029] If the reset verification code entered is incorrect, the reset verification code error will be displayed and the page will be redirected back to the login homepage;

[0030] When the reset verification code entered is correct, a false password modification function is displayed and an attack alarm is triggered.

[0031] Furthermore, in the case where the honey bait is a template management honey bait, redirecting the traffic to a corresponding container to perform vulnerability awareness of the traffic includes:

[0032] The operation corresponding to the traffic is determined to be file upload in the configuration file management page;

[0033] Receive files uploaded by users;

[0034] When a user uploads a template file containing a Trojan, the template file is uploaded to the container;

[0035] When the user finds the URL address of the template file, it is determined that the system has been attacked.

[0036] Furthermore, in the case where the honey bait is an avatar upload honey bait, redirecting the traffic to a corresponding container to perform vulnerability awareness of the traffic includes:

[0037] The operation corresponding to this traffic is determined to be image upload in the configuration file management page;

[0038] Receive an image file uploaded by a user; wherein the image file includes a picture;

[0039] When the image file does not have the image type suffix, the image will be displayed abnormally in the user background management page, and the browser will throw an exception of loading resource error;

[0040] Upload the image file to an isolated environment.

[0041] A web penetration detection device based on honey bait, the device using a proxy server, the device comprising:

[0042] An analysis module is used to proxy all traffic of the web server and analyze the HTML structure of the backend login interface and / or backend management interface in the process of forwarding traffic to obtain a DOM node suitable for embedding the honey bait;

[0043] The embedding module is used to embed the honey bait in a DOM node suitable for embedding the honey bait, and obtain a page after the honey bait is embedded; wherein the similarity between the page after the honey bait is embedded and the page without the honey bait is greater than a set threshold;

[0044] The perception module is used to redirect the traffic to a corresponding container when a traffic accesses the honey bait in the page after the honey bait is embedded, so as to perceive the vulnerability of the traffic; when a traffic does not access the honey bait in the page after the honey bait is embedded, redirect the traffic to a Web server to complete the access of the traffic.

[0045] A computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions implement any of the above methods when executed.

[0046] Compared with the prior art, the present invention has the following positive effects:

[0047] Currently, common defense technologies used in the web field fall into two main categories: the first is firewall technology, represented by WAF (Web Application Firewall). This type of technology primarily identifies and matches key features in network traffic, determining whether abnormal behavior exists based on its continuously updated matching rule base. However, it is less effective in defending against targeted attacks, as its feature matching mechanism can be bypassed. The second category is honeypot technology, represented by network deception technology. This type of technology primarily sets up false vulnerable targets at various stages of a network attack to confuse, deceive, and lure hackers into attacking, thereby enabling detection and source analysis of their attack behavior. However, honeypots typically exist as independent network nodes, with a low degree of integration with the target information system being protected. If a honeypot is not attacked, it cannot provide early warning and source analysis for the information system.

[0048] Therefore, the present invention innovates in deployment mode and the integration of deception defense technology with Web applications. It proposes a middleman proxy approach to modify HTML pages in traffic, embedding honey baits in appropriate locations to detect attacks. The use of a middleman proxy approach solves the complex operations associated with the deployment of previous deception defense technology products. Embedding honey baits in web pages improves the integration of deception defense technology with the protected target, restoring the authenticity of the information system to the greatest extent possible. Furthermore, the present invention improves the honey baits by building corresponding vulnerability service programs in the service backends corresponding to all honey baits, greatly enhancing interactivity. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Technical schematic diagram of the method proposed in the present invention.

[0050] Figure 2 Schematic diagram of the process of the method proposed in the present invention.

[0051] Figure 3 Flowchart of the Maximum Common Ancestor algorithm.

[0052] Figure 4 SQL injection honey bait detection strategy.

[0053] Figure 5 Verification code logic vulnerability perception strategy.

[0054] Figure 6 File upload awareness policy.

[0055] Figure 7 Avatar upload awareness strategy. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the technical solution of the present invention and to make the features and purposes of the present invention more readily understood, a specific embodiment will be described below with reference to the accompanying drawings.

[0057] This invention mainly proposes a new idea for network deception defense technology, which highly integrates the honey bait technology with the protected Web information system to deceive and attract attackers to attack, thereby achieving the purpose of perceiving attacks. Figure 1As shown, the present invention uses a reverse proxy approach to intercept all traffic from the web server. After analyzing the HTML structure of the backend login interface and the backend management interface in the traffic, the corresponding honey bait HTML code is embedded under the appropriate DOM node, so that the page after the honey bait is embedded looks highly similar to the page before the embedding. While embedding the honey bait, each function corresponding to the honey bait has a backend program to provide service support. These backend programs are deliberately designed with vulnerabilities. When an attacker logs in to the corresponding page and exploits the vulnerability of the honey bait, the attack traffic will be forwarded to the isolated container. The following will describe the details of the training and actual use of the present invention based on the specific figures:

[0058] like Figure 2 As shown, the process diagram of the method proposed by the present invention includes:

[0059] Step 100: Build a proxy server.

[0060] Set up reverse proxy rules for the Web server so that all traffic of the Web server is forwarded through the proxy server. The present invention uses MitmProxy components for secondary development to build a proxy server.

[0061] Step 200: Obtain a set of node coordinate attributes and two-dimensional attributes.

[0062] First, the HTML code of the web server is intercepted. Some pages need to be loaded and JavaScript code executed before they can be fully displayed. Therefore, the present invention first renders the HTML code in the Selemium component. After the rendering is completed, the coordinates and length and width attribute sets of all DOM nodes of the page relative to the page are obtained by writing a script to call the interface.

[0063] In one embodiment, the present invention obtains the complete HTML content of the backend login page and backend management page during the forwarding process. For pages that require JavaScript loading to fully display, Selenium components are used to render the HTML page at a 16:9 ratio, and then the DOM nodes in the HTML are objectified. Finally, after the complete HTML page code is rendered in a simulated browser within Selenium, each DOM element is traversed to obtain a set of coordinates and length and width attributes.

[0064] Step 300: Analyze the structure to find the best embedding position.

[0065] The present invention analyzes and filters the attribute set and filters out irrelevant DOM pages, that is, it mainly analyzes the structure of the background login page and the structure of the background management page. The present invention adopts the maximum common ancestor node algorithm as Figure 3As shown, starting from the leaf nodes of the target DOM tree, backtracking to the root node, during the backtracking process, determine whether the node set is of the same type. The purpose is to find a set of nodes under the root node that share the same parent node and the same length and width attributes, select a suitable embedding location from this set, and after embedding the front-end code, de-objectify the modified and reorganized DOM tree, reconstruct the HTML code, and forward it. The maximum common ancestor node algorithm is described below for three scenarios: the forgotten password bait, the avatar upload bait, and the template management bait.

[0066] Forgot password bait embedded location.

[0067] In the backend login interface, the embedded bait is "Forgot Password". The best embedding position should be after the password input form box. The acquisition process is:

[0068] Step 311: Locate the unique <form>Label;

[0069] Step 312: Filter out nodes other than the form tag and its descendant nodes;

[0070] Step 313: Then, using the label as the root node, perform a depth-first traversal and record all traversed leaf nodes into a leaf node set;

[0071] Step 314: Backtrack and compare all nodes in the leaf node set, performing two comparison operations in sequence, mainly including:

[0072] Comparison of parent node homology, pairwise analysis of whether the parent node of each node is the same;

[0073] If yes, compare the length and width attributes of the two nodes. Compare the length and width attributes of the nodes to analyze whether the two nodes are page elements of the same size;

[0074] Step 315: Analyze all nodes that meet the conditions in the traversal results, that is, the same parent node and the same length and width attributes, record the nodes that meet the conditions into a set, and traverse to the second to last position of the set. The node after this node is the best embedding point for the forgotten password bait.

[0075] The template manages the embedding location of the honey bait.

[0076] In the background management page, the embedded honey bait is "Template Management". Its best embedding position should be in the sidebar. The acquisition process is:

[0077] Step 321: Filter the set of coordinates and length and width attributes to remove nodes whose horizontal coordinates are less than half of the mean horizontal coordinate of the set;

[0078] Step 322: Find the root node of the sidebar in the filtered node set, that is, the node with the largest length multiplied by width;

[0079] Step 323: Starting from the node with the largest length multiplied by width, traverse to each leaf node and form all leaf nodes into a set;

[0080] Step 324: Backtrack and compare all nodes in the leaf node set, performing two comparison operations in sequence, mainly including:

[0081] Comparison of parent node homology, pairwise analysis of whether the parent node of each node is the same;

[0082] If yes, compare the length and width attributes of the two nodes. Compare the length and width attributes of the nodes to analyze whether the two nodes are page elements of the same size;

[0083] Step 325: Analyze all nodes in the results that meet the conditions. If they share the same parent node and have the same length and width attributes, then the node is considered to be the parent node of the sidebar option button. Then, the nodes that meet the conditions are recorded in a set. This set is the maximum nesting of all small grids in the sidebar.

[0084] Step 326: Embed the front-end code of the template management bait into any node in the collection.

[0085] The embed location for the avatar upload bait.

[0086] In the backend management page, the embedded bait is "Avatar Upload". The best embedding location should be in the head navigation bar. The acquisition process is:

[0087] Step 331: Filter the set of coordinates and length and width attributes to find the coordinate with the smallest vertical coordinate and the longest length, which is the head navigation bar;

[0088] Step 332: Since the avatar image is usually on the far right of the head navigation bar, the front-end code of the avatar upload bait is embedded into the child node position of the head navigation bar, and the cascading style attribute is set to float right.

[0089] Step 400: Build the honey bait backend service program.

[0090] To enhance the interactivity of honey baits, the present invention divides the design of honey baits into a front-end module, corresponding to the HTML code in the web page; and a back-end vulnerability service, corresponding to each honey bait and containing a vulnerability. These back-end service programs run in isolated containers, highly isolated from the protected web information system. Furthermore, the present invention designs multiple vulnerability exploits for the three honey baits: the login box "forgot password" honey bait exploits SQL injection and verification code logic vulnerabilities; the sidebar template management honey bait exploits file uploads; and the avatar upload honey bait exploits image uploads.

[0091] Step 500: Sense the attack.

[0092] When the Web server is installed Figure 1 After the structure shown is connected, the perception function of Web penetration attacks described in the present invention can be realized. During the client's request cycle, it is identified whether the traffic is accessing the honey bait. If so, the traffic is redirected to the corresponding container. If not, the traffic is redirected to the Web server.

[0093] This paper designs three types of honey baits in two types of pages. The attack detection strategies are described as follows:

[0094] 1) SQL injection vulnerability awareness strategy for the forgotten password bait:

[0095] The present invention uses the principle of error injection to detect whether a penetration attack has occurred. Error injection is usually accompanied by the addition of some special symbols to the parameters. This study takes advantage of this and sets a special injectable parameter in the honey bait tag. When an attacker wants to use the error injection method to detect the honey bait tag, the SQL server will generate an error warning, and it is judged that the system has been attacked maliciously. The advantage of this is that it bypasses the detection of character rules and judges whether an error has occurred based on the running status of the SQL server, so that the attacker's malicious attack will not be missed due to the failure to include certain special characters. The main process is as follows: Figure 4 shown.

[0096] 2) Forgot password bait verification code logic vulnerability detection strategy:

[0097] When the attacker clicks on the Retrieve Password button, the process goes to the Retrieve Account stage. At this point, the attacker enters the administrator's account "admin", and then proceeds to the next stage to enter the verification code received in the mailbox. Because the attacker does not have the administrator's mailbox, he cannot obtain the reset verification code sent to the administrator's mailbox. At this point, if the verification code is entered incorrectly, the system will jump back to the login homepage. If the attacker intercepts the returned response and modifies it to a correct verification status code (200), the attack alarm will be triggered and the password modification stage will be entered. However, the password modification function at this point cannot actually modify the administrator's account, but is only a means to confuse the attacker. The process is as follows: Figure 5 shown.

[0098] 3) Template Management Honey Bait Perception Strategy

[0099] The template management function is on the sidebar. When the attacker clicks on the template management, the template file management page will be displayed on the right. The backend vulnerability corresponding to this bait is file upload. When a normal user uploads a page template file, the template is uploaded to the container. This file will not have any effect on the Web server. When an attacker uploads a template file containing a Trojan horse, the file is uploaded to the container. When the attacker finds the URL address of the template file containing the Trojan horse, if the attacker requests the URL address of the file, the system is determined to be under attack. The Webshell obtained by the attacker at this time is the permission in the container and will not pose any threat to the Web server. Its perception logic is as follows Figure 6 As shown:

[0100] 4) Avatar upload bait perception strategy

[0101] When a normal user uploads an image, the image file is actually uploaded to an isolated environment, and the uploaded image file can be correctly displayed in the user's backend management page. When the image file uploaded by the attacker does not have the image type suffix, the avatar part of the page will be displayed abnormally, and the browser will throw a "Loading Resource Error" exception, which triggers the attack alarm. However, the upload operation is not intercepted at this time. The image Trojan is uploaded to an isolated environment, and if the attacker attempts to obtain a Webshell, the permissions obtained are also those in the isolated environment. The process is as follows Figure 7 shown.

[0102] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The embodiments are to be considered merely as illustrative, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof.< / form>

Claims

1. A honey-bait-based Web penetration perception method, characterized in that: Using a proxy server, the method includes: Proxy all traffic of a web server and analyze the HTML structure of the backend login interface and / or backend management interface in the traffic during the forwarding process to obtain a DOM node suitable for embedding a honey bait; wherein the honey bait includes: at least one of a forgotten password honey bait, an avatar upload honey bait, and a template management honey bait, and the process of obtaining a DOM node suitable for embedding a honey bait includes: Render the HTML code intercepted during the forwarding traffic process, and after the rendering is completed, obtain the coordinates and length and width attribute sets of all DOM nodes of the background login page and / or background management page relative to the page by writing a script to call the interface; In the case where the honey bait is a forgot password honey bait, locate the form tag and use the form tag as the root node, find the parent node of the username and forgot password form input boxes using the greatest common ancestor node algorithm, and use the second-to-last child node of the parent node as the DOM node suitable for embedding the honey bait; In the case where the honey bait is a template management honey bait, after finding the root node of the sidebar in the DOM node corresponding to the background login page, a depth-first traversal is performed on the DOM node corresponding to the background login page based on the root node of the sidebar, and all nodes in the obtained second leaf node set are backtracked and compared based on the coordinates and the length and width attribute set to obtain the DOM node embedded in the template management honey bait; wherein the root node of the sidebar is the DOM node with the largest length multiplied by the width; In the case where the honey bait is an avatar upload honey bait, the head navigation bar node is found in the DOM node corresponding to the background login page, and the child node position of the head navigation bar node is used as the DOM node for embedding the avatar upload honey bait; wherein the head navigation bar node is the DOM node with the smallest vertical coordinate and the longest length; Embedding the honey bait in a DOM node suitable for embedding the honey bait to obtain a page after the honey bait is embedded; wherein the similarity between the page after the honey bait is embedded and the page without the honey bait embedded is greater than a set threshold; When a flow accesses the honey bait in the page embedded with the honey bait, the flow is redirected to a corresponding container to detect vulnerabilities in the flow; When a flow does not access the honey bait in the web page embedded with the honey bait, the flow is redirected to the Web server to complete the access of the flow.

2. The method according to claim 1, wherein The password forgetting bait includes: SQL injection vulnerability or verification code logic vulnerability, the template management bait includes: file upload vulnerability, and the avatar upload bait includes: avatar image file upload vulnerability.

3. The method according to claim 2, wherein In a case where the bait is a forgotten password bait and the forgotten password bait includes an SQL injection vulnerability, redirecting the traffic to a corresponding container to perform vulnerability awareness on the traffic includes: Setting a honey bait tag; wherein a special injectable parameter is set in the honey bait tag; When the traffic uses an error injection method to detect the honey bait tag, the SQL server generates an error warning based on the special injectable parameter.

4. The method according to claim 2, wherein In a case where the bait is a forgotten password bait and the forgotten password bait includes a verification code logic vulnerability, redirecting the traffic to a corresponding container to perform vulnerability awareness on the traffic includes: For the password retrieval operation corresponding to this traffic, the reset verification code will be sent to the administrator's email address; Receive the input reset verification code; If the reset verification code entered is incorrect, a message "Reset verification code error" will be displayed, and the user will be redirected back to the login homepage. If the reset verification code entered is correct, a fake password modification function will be displayed, and an attack alarm will be triggered.

5. The method according to claim 2, wherein In the case where the honey bait is a template management honey bait, redirecting the traffic to a corresponding container to perform vulnerability awareness on the traffic includes: The operation corresponding to the traffic is determined to be file upload in the configuration file management page; Receive files uploaded by users; When a user uploads a template file containing a Trojan, the template file is uploaded to the container; When the user finds the URL address of the template file, it is determined that the system has been attacked.

6. The method according to claim 2, wherein In the case where the honey bait is an avatar upload honey bait, redirecting the traffic to a corresponding container to perform vulnerability awareness on the traffic includes: The operation corresponding to this traffic is determined to be image upload in the configuration file management page; Receive an image file uploaded by a user; wherein the image file includes a picture; When the image file does not have the image type suffix, the image will be displayed abnormally in the user background management page, and the browser will throw an exception of loading resource error; Upload the image file to an isolated environment.

7. A web penetration detection device based on honey bait, characterized in that: The device uses a proxy server, and the device includes: The analysis module is used to proxy all traffic of the Web server and analyze the HTML structure of the background login interface and / or the background management interface in the traffic during the forwarding process to obtain a DOM node suitable for embedding the honey bait; wherein the honey bait includes: at least one of the forgotten password honey bait, the avatar upload honey bait and the template management honey bait. The process of obtaining the DOM node suitable for embedding the honey bait includes: Render the HTML code intercepted during the forwarding traffic process, and after the rendering is completed, obtain the coordinates and length and width attribute sets of all DOM nodes of the background login page and / or background management page relative to the page by writing a script to call the interface; In the case where the honey bait is a forgot password honey bait, locate the form tag and use the form tag as the root node, find the parent node of the username and forgot password form input boxes using the greatest common ancestor node algorithm, and use the second-to-last child node of the parent node as the DOM node suitable for embedding the honey bait; In the case where the honey bait is a template management honey bait, after finding the root node of the sidebar in the DOM node corresponding to the background login page, a depth-first traversal is performed on the DOM node corresponding to the background login page based on the root node of the sidebar, and all nodes in the obtained second leaf node set are backtracked and compared based on the coordinates and the length and width attribute set to obtain the DOM node embedded in the template management honey bait; wherein the root node of the sidebar is the DOM node with the largest length multiplied by the width; In the case where the honey bait is an avatar upload honey bait, the head navigation bar node is found in the DOM node corresponding to the background login page, and the child node position of the head navigation bar node is used as the DOM node for embedding the avatar upload honey bait; wherein the head navigation bar node is the DOM node with the smallest vertical coordinate and the longest length; The embedding module is used to embed the honey bait in a DOM node suitable for embedding the honey bait, and obtain a page after the honey bait is embedded; wherein the similarity between the page after the honey bait is embedded and the page without the honey bait is greater than a set threshold; The perception module is used to redirect the traffic to a corresponding container when a traffic accesses the honey bait in the page after the honey bait is embedded, so as to perceive the vulnerability of the traffic; when a traffic does not access the honey bait in the page after the honey bait is embedded, redirect the traffic to a Web server to complete the access of the traffic.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: The computer program instructions implement the method of any one of claims 1 to 6 when executed.

Images