A vulnerability detection method, device, medium and program product

Abstract

Embodiments of the present application provide a vulnerability detection method, device, medium and program product, relating to the technical field of network security. The method comprises: obtaining an original web access request sent by a user to an application server and an original web access response returned by the application server; sending a target command execution request obtained by adding a target command to the original web access request to the application server, and monitoring an execution result of the target command in the target command execution request; determining whether the original web access request has a command execution vulnerability according to the execution result; sending a fake web access request obtained by editing user identification information in the original web access request to the application server, and receiving a fake web access response returned by the application server; and determining whether the original web access request has a permission access vulnerability according to a comparison result of the original web access response and the fake web access response. The embodiments of the present application can comprehensively detect various Web security vulnerabilities.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a vulnerability detection method, device, medium and program product. BACKGROUND

[0002] With the wide application of Web (World Wide Web) application programs, network security problems are increasingly prominent. For example, the service end where the Web application program is located does not strictly filter the execution commands input by the user, resulting in command execution vulnerabilities such as unauthorized command execution vulnerabilities and authorized command execution vulnerabilities, and the user access permission control strategy in the Web application program has defects, resulting in permission access vulnerabilities such as unauthorized access vulnerabilities and unauthorized access vulnerabilities.

[0003] However, at present, there is still a lack of effective detection means for various Web security vulnerabilities such as command execution vulnerabilities and permission access vulnerabilities, and it is difficult to comprehensively detect various Web security vulnerabilities. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a vulnerability detection method, device, medium and program product, which can achieve the technical effect of comprehensively detecting various Web security vulnerabilities.

[0005] In a first aspect, the embodiments of the present application provide a vulnerability detection method, comprising:

[0006] obtaining an original web access request sent by a user to an application server and an original web access response returned by the application server;

[0007] sending a target command execution request to the application server and monitoring the execution result of a target command in the target command execution request; wherein the target command execution request is obtained by adding the target command to the original web access request;

[0008] determining whether the original web access request has a command execution vulnerability according to the execution result of the target command in the target command execution request;

[0009] sending a fake web access request to the application server and receiving a fake web access response returned by the application server; wherein the fake web access request is obtained by editing the user identifier information in the original web access request;

[0010] determining whether the original web access request has a permission access vulnerability according to the comparison result of the original web access response and the fake web access response.

[0011] In the implementation process, the target command execution request is used to detect whether the original web access request has a command execution vulnerability, and the fake web access request is used to detect whether the original web access request has a permission access vulnerability, so that various web security vulnerabilities such as command execution vulnerabilities and permission access vulnerabilities can be comprehensively detected.

[0012] Further, the original web access request sent by the user to the application server includes:

[0013] The original web access request is captured by the proxy server.

[0014] In the implementation process, the original web access request is automatically acquired by the client through the proxy server to perform vulnerability detection, which is beneficial to improve the vulnerability detection efficiency.

[0015] Further, before the target command execution request is sent to the application server and the execution result of the target command in the target command execution request is monitored, the method further includes:

[0016] In a case where the access resource in the original web access request is a static resource, the target command is added to the original web access request to obtain the target command execution request;

[0017] And / or, before the fake web access request is sent to the application server and the fake web access response returned by the application server is received, the method further includes:

[0018] In a case where the access resource in the original web access request is a static resource, the user identifier information in the original web access request is edited to obtain the fake web access request.

[0019] In the implementation process, in a case where the access resource in the original web access request is a static resource, vulnerability detection is allowed, so that vulnerability detection can be strictly performed on static resources with lower security, and the problems of missed judgment and misjudgment can be avoided.

[0020] Further, the target command includes a restart command;

[0021] The target command execution request is sent to the application server, and the execution result of the target command in the target command execution request is monitored, including:

[0022] The target command execution request is sent to the application server, and the execution result of the target command in the target command execution request is monitored by using an Internet Control Message Protocol (ICMP) ping;

[0023] The step of determining whether the original webpage access request has a command execution vulnerability based on the execution result of the target command in the target command execution request includes:

[0024] If the ping is interrupted, it is determined that the original webpage access request contains the command execution vulnerability.

[0025] In the above implementation process, by sending a target command execution request containing a restart command to the application server, using ping to monitor the execution result of the restart command in the target command execution request, and determining that the original web page access request has a command execution vulnerability when the ping is interrupted, it is possible to conveniently and efficiently detect whether the original web page access request has a command execution vulnerability, which is conducive to further improving the vulnerability detection efficiency.

[0026] Furthermore, the method also includes:

[0027] After determining that the original webpage access request contains the command execution vulnerability, an unauthorized command execution request is sent to the application server, and the execution result of the target command in the unauthorized command execution request is monitored; wherein, the unauthorized command execution request is obtained by deleting the user identification information in the target command execution request;

[0028] Based on the execution result of the target command in the unauthorized command execution request, determine whether the command execution vulnerability is an unauthorized command execution vulnerability.

[0029] In the above implementation process, after determining that the original webpage access request has a command execution vulnerability, an unauthorized command execution request is constructed based on the target command execution request. The unauthorized command execution request is then used to determine whether the command execution vulnerability is an unauthorized command execution vulnerability. This allows users to quickly determine the vulnerability type and further improves the efficiency of vulnerability detection.

[0030] Furthermore, the forged webpage access request includes an unauthorized webpage access request;

[0031] The step of sending a fake webpage access request to the application server and receiving a fake webpage access response returned by the application server includes:

[0032] Send the unauthorized webpage access request to the application server and receive the unauthorized webpage access response returned by the application server; wherein, the unauthorized webpage access request is obtained by modifying the user identification information in the original webpage access request with the identification information of an unauthorized user;

[0033] The step of determining whether the original webpage access request has an access vulnerability based on the comparison result between the original webpage access response and the forged webpage access response includes:

[0034] In a case where the original webpage access response is same as the unauthorized webpage access response, it is determined that the original webpage access request has an unauthorized access vulnerability.

[0035] In the implementation process, the unauthorized webpage access request is constructed according to the original webpage access request, and the unauthorized webpage access request is used to detect whether the original webpage access request has an unauthorized access vulnerability, so that the unauthorized access vulnerability can be quickly and accurately detected.

[0036] Further, the fake webpage access request includes an unauthorized webpage access request.

[0037] The sending of the fake webpage access request to the application service end and the receiving of the fake webpage access response returned by the application service end include:

[0038] The sending of the unauthorized webpage access request to the application service end and the receiving of the unauthorized webpage access response returned by the application service end, wherein the unauthorized webpage access request is obtained by deleting user identification information in the original webpage access request.

[0039] The determining of whether the original webpage access request has an unauthorized access vulnerability according to the comparison result of the original webpage access response and the fake webpage access response includes:

[0040] In a case where the original webpage access response is same as the unauthorized webpage access response, it is determined that the original webpage access request has an unauthorized access vulnerability.

[0041] In the implementation process, the unauthorized webpage access request is constructed according to the original webpage access request, and the unauthorized webpage access request is used to detect whether the original webpage access request has an unauthorized access vulnerability, so that the unauthorized access vulnerability can be quickly and accurately detected.

[0042] Further, the method further includes:

[0043] In a case where the original webpage access request has the command execution vulnerability and / or the authorized access vulnerability, a vulnerability detection report is generated.

[0044] In the implementation process, in a case where the original webpage access request has a command execution vulnerability and / or an authorized access vulnerability, a vulnerability detection report is generated, so that the vulnerability detection report can be provided to the user, and actual business requirements are met.

[0045] In a second aspect, an embodiment of the present application provides a vulnerability detection device, including:

[0046] An original request response obtaining module is configured to obtain an original web access request sent by a user to an application server and an original web access response returned by the application server.

[0047] A target command execution processing module is configured to send a target command execution request to the application server and monitor an execution result of a target command in the target command execution request, wherein the target command execution request is obtained by adding the target command to the original web access request.

[0048] A command execution vulnerability detection module is configured to determine whether the original web access request has a command execution vulnerability according to the execution result of the target command.

[0049] A fake request response obtaining module is configured to send a fake web access request to the application server and receive a fake web access response returned by the application server, wherein the fake web access request is obtained by editing user identification information in the original web access request.

[0050] A permission access vulnerability detection module is configured to determine whether the original web access request has a permission access vulnerability according to a comparison result of the original web access response and the fake web access response.

[0051] In a third aspect, an embodiment of the present application provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor implements the method described above when executing the computer program.

[0052] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, including a stored computer program; wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the method described above when the computer program runs.

[0053] In a fifth aspect, an embodiment of the present application provides a computer program product, including instructions, which, when executed by a computer, cause the computer to implement the method described above. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0055] Figure 1 A flowchart of a vulnerability detection method provided by the first embodiment of the present application is shown in FIG. 1.

[0056] Figure 2 A flowchart of the vulnerability detection method shown in the first embodiment of the present application is shown in FIG. 1.

[0057] Figure 3 A structural diagram of a vulnerability detection device provided by the second embodiment of the present application is shown in FIG. 2.

[0058] Figure 4 A structural diagram of an electronic device provided by the third embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0060] It should be noted that in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. Meanwhile, the step numbers in the text are only for the convenience of explaining the embodiments of the present application and do not serve as the function of limiting the execution sequence of the steps. The method provided by the embodiments of the present application can be executed by the related terminal device, and the client is taken as the execution subject in the following description.

[0061] In order to facilitate the description and make the technical solutions in the embodiments of the present application easier to understand, before describing the method provided by the embodiments of the present application, the terms involved in the embodiments of the present application are defined as follows:

[0062] Application server: refers to a server on which a Web application is installed.

[0063] Command execution vulnerability: refers to that because the application server does not strictly filter the execution commands input by the user, the attacker takes the opportunity to inject the execution command into the system command of the Web application to execute. The command execution vulnerability belongs to one of the high-risk vulnerabilities. The command execution vulnerability is usually divided into authorized command execution vulnerability and unauthorized command execution vulnerability.

[0064] Authorized command execution vulnerability: refers to that the attacker exploits the security vulnerability in the system to execute the command in the case of obtaining the legal user's permission.

[0065] Unauthorized command execution vulnerability: refers to that the attacker exploits the security vulnerability in the system to execute the command without authorization.

[0066] Permission access vulnerability: refers to that the attacker accesses the resources that he / she has no right to access or performs unauthorized operations. The permission access vulnerability includes the over-privileged access vulnerability and the unauthorized access vulnerability.

[0067] Privilege Escalation Vulnerability: refers to an attacker exceeding the current user's permission range to access or operate other users or higher permission resources. Privilege escalation vulnerabilities are usually divided into horizontal privilege escalation vulnerabilities and vertical privilege escalation vulnerabilities. Horizontal privilege escalation vulnerabilities occur between users at the same permission level, for example, a user may access the resources of other users at the same level, such as viewing, modifying or deleting their data, through certain means. Vertical privilege escalation vulnerabilities involve a low-privilege user attempting to access or operate high-privilege user resources, for example, a normal user attempting to perform operations that only administrators can perform.

[0068] Unauthorized Access Vulnerability: refers to an attacker directly accessing or operating resources that require authentication authorization without authorization.

[0069] See Figure 1 , Figure 1 A flowchart of a vulnerability detection method provided by the first embodiment of the present application. The first embodiment of the present application provides a vulnerability detection method, which includes steps S101-S105:

[0070] S101, obtaining an original web access request sent by a user to an application server and an original web access response returned by the application server;

[0071] S102, sending a target command execution request to the application server and monitoring the execution result of the target command in the target command execution request; wherein the target command execution request is obtained by adding a target command to the original web access request;

[0072] S103, determining whether the original web access request has a command execution vulnerability according to the execution result of the target command in the target command execution request;

[0073] S104, sending a fake web access request to the application server and receiving a fake web access response returned by the application server; wherein the fake web access request is obtained by editing the user identification information in the original web access request;

[0074] S105, determining whether the original web access request has a permission access vulnerability according to the comparison result of the original web access response and the fake web access response.

[0075] As an example, according to actual application requirements, a user such as a super administrator can send an original web access request to an application server through a client to request access to a resource of a web application. For example, a user sends an HTTP (Hypertext Transfer Protocol) request to an application server through a web browser on a client to request access to a resource of a web application, and the HTTP request is an original web access request, and a web address URL (Uniform Resource Locator) in the HTTP request is an access resource.

[0076] After the user sends the original web access request to the application server through the client, the client obtains the original web access request sent by the user to the application server, and obtains an original web access response returned by the application server in response to the original web access request.

[0077] The client adds a target command to the original web access request to obtain a target command execution request after obtaining the original web access request.

[0078] In actual applications, the target command is a command commonly used by attackers, and the target command can be added after a request parameter in the original web access request to obtain a target command execution request.

[0079] The client sends the target command execution request to the application server and monitors the execution result of the target command in the target command execution request, and determines whether the original web access request has a command execution vulnerability according to the execution result of the target command in the target command execution request.

[0080] It can be understood that if the execution result of the target command in the target command execution request is that the target command is executed successfully, it is determined that the original web access request has a command execution vulnerability, and if the execution result of the target command in the target command execution request is that the target command fails, it is determined that the original web access request does not have a command execution vulnerability.

[0081] The client continues to edit the user identification information in the original web access request to obtain a forged web access request after determining whether the original web access request has a command execution vulnerability.

[0082] In actual applications, the purpose of editing the user identification information in the original web access request is to forge the original web access request into a request that does not access the access resource according to user permissions, and the cookie information in the original web access request can be edited to obtain a forged web access request.

[0083] It should be noted that the cookie information refers to data stored on the client side by the application server in order to identify the user identity and perform session (referred to as "session control" in network application) tracking, and information temporarily or permanently saved by the client.

[0084] After obtaining the fake web page access request, the client sends the fake web page access request to the application server, receives the fake web page access response returned by the application server in response to the fake web page access request, compares the original web page access response with the fake web page access response, and determines whether the original web page access request has a permission access vulnerability according to the comparison result of the original web page access response and the fake web page access response.

[0085] It can be understood that if the original web page access response is the same as the fake web page access response, it is determined that the original web page access request has a permission access vulnerability, and if the original web page access response is different from the fake web page access response, it is determined that the original web page access request does not have a permission access vulnerability.

[0086] By first detecting whether the original web page access request has a command execution vulnerability and then detecting whether the original web page access request has a permission access vulnerability, the command execution vulnerability with a higher danger level can be detected first, and the user can take timely countermeasures.

[0087] In actual applications, the original web page access request can also be detected for whether it has a command execution vulnerability and whether it has a permission access vulnerability.

[0088] The embodiment of the application can comprehensively detect various Web security vulnerabilities such as command execution vulnerabilities and permission access vulnerabilities by constructing a target command execution request and a fake web page access request based on the original web page access request, detecting whether the original web page access request has a command execution vulnerability by using the target command execution request, and detecting whether the original web page access request has a permission access vulnerability by using the fake web page access request.

[0089] In optional embodiments, the original web page access request sent by the user to the application server is obtained by capturing the original web page access request through a proxy server.

[0090] As an example, after the user sends the original web page access request to the application server through the client, the client can capture the original web page access request sent by the user to the application server through a proxy server between the client and the application server.

[0091] It can be understood that the client captures the original web access request through the proxy server, and the original web access request can be automatically captured based on the proxy mechanism to perform vulnerability detection, so that the user can normally operate on the client to send the original web access request without additional operations on the client.

[0092] The embodiment of the application can automatically obtain the original web access request to perform vulnerability detection by capturing the original web access request through the proxy server, which is beneficial to improve the vulnerability detection efficiency.

[0093] In optional embodiments, before the sending of the target command execution request to the application server and the monitoring of the execution result of the target command in the target command execution request, the method further includes: in the case that the access resource in the original web access request is a static resource, adding a target command to the original web access request to obtain a target command execution request; and / or, before the sending of the fake web access request to the application server and the receiving of the fake web access response returned by the application server, the method further includes: in the case that the access resource in the original web access request is a static resource, editing the user identification information in the original web access request to obtain a fake web access request.

[0094] As an example, if it is selected to first detect whether the original web access request has a command execution vulnerability and then detect whether the original web access request has a permission access vulnerability, the client first judges whether the access resource in the original web access request is a static resource after obtaining the original web access request, and then adds a target command to the original web access request to obtain a target command execution request in the case that the access resource in the original web access request is a static resource, and uses the target command execution request to detect whether the original web access request has a command execution vulnerability, and after determining whether the original web access request has a command execution vulnerability, since it is determined that the access resource in the original web access request is a static resource at this time, the user identification information in the original web access request is directly edited to obtain a fake web access request, and the fake web access request is used to detect whether the original web access request has a permission access vulnerability; or in the case that the access resource in the original web access request is a dynamic resource, the vulnerability detection operation is ended.

[0095] If it is selected to detect whether the original web access request exists the command execution vulnerability and whether the original web access request exists the permission access vulnerability, the client, after obtaining the original web access request, first judges whether the access resource in the original web access request is a static resource, and then, in the case that the access resource in the original web access request is a static resource, adds a target command to the original web access request to obtain a target command execution request, uses the target command execution request to detect whether the original web access request exists the command execution vulnerability, and edits the user identification information in the original web access request to obtain a fake web access request, and uses the fake web access request to detect whether the original web access request exists the permission access vulnerability; or in the case that the access resource in the original web access request is a dynamic resource, ends the vulnerability detection operation.

[0096] If it is selected to first detect whether the original web access request exists the permission access vulnerability and then detect whether the original web access request exists the command execution vulnerability, the client, after obtaining the original web access request, first judges whether the access resource in the original web access request is a static resource, and then, in the case that the access resource in the original web access request is a static resource, edits the user identification information in the original web access request to obtain a fake web access request, uses the fake web access request to detect whether the original web access request exists the permission access vulnerability, and after determining whether the original web access request exists the permission access vulnerability, since it is determined that the access resource in the original web access request is a static resource, directly adds a target command to the original web access request to obtain a target command execution request, and uses the target command execution request to detect whether the original web access request exists the command execution vulnerability; or in the case that the access resource in the original web access request is a dynamic resource, ends the vulnerability detection operation.

[0097] It should be noted that, in the case that the access resource in the original web access request is a static resource, adding a target command to the original web access request to obtain a target command execution request and / or editing the user identification information in the original web access request to obtain a fake web access request includes the following three cases: in the case that the access resource in the original web access request is a static resource, only adding a target command to the original access request to obtain a target command execution request; in the case that the access resource in the original web access request is a static resource, only editing the user identification information in the original web access request to obtain a fake web access request; in the case that the access resource in the original web access request is a static resource, adding a target command to the original access request to obtain a target command execution request and editing the user identification information in the original web access request to obtain a fake web access request.

[0098] It can be understood that the static resource refers to the fixed data stored in the application server in advance, and the dynamic resource refers to the data dynamically generated by the application server according to the request. The security of the dynamic resource is higher than that of the static resource. The client allows vulnerability detection only when the access resource in the original web page access request is a static resource. The vulnerability detection can be strictly performed on the static resource with lower security, and the problems of missed judgment and misjudgment can be avoided.

[0099] The embodiment of the application allows vulnerability detection when the access resource in the original web page access request is a static resource. The vulnerability detection can be strictly performed on the static resource with lower security, and the problems of missed judgment and misjudgment can be avoided.

[0100] In an optional embodiment, the target command includes a restart command; the sending of the target command execution request to the application server and the monitoring of the execution result of the target command in the target command execution request include: sending the target command execution request to the application server and monitoring the execution result of the target command in the target command execution request by using the Internet Control Message Protocol (ICMP) echo request and reply (ping); and the determination of whether the original web page access request has a command execution vulnerability according to the execution result of the target command in the target command execution request includes: determining that the original web page access request has a command execution vulnerability in the case of ping interruption.

[0101] As an example, considering that the restart command can be used to conveniently and efficiently detect whether the original web page access request has a command execution vulnerability, the restart command is selected, so that the target command includes the restart command.

[0102] After the client obtains the original web page access request, the client adds the target command including the restart command to the original web page access request to obtain a target command execution request, sends the target command execution request to the application server, monitors the execution result of the restart command in the target command execution request by using ping, and determines that the execution of the restart command is successful in the case of ping interruption, and determines that the original web page access request has a command execution vulnerability. Otherwise, it is determined that the execution of the restart command fails, and it is determined that the original web page access request does not have a command execution vulnerability.

[0103] It can be understood that since the restart command is used to restart the application server, and ping is used to confirm whether a host on the Internet is reachable, the execution result of the restart command in the target command execution request is monitored by using ping. Once ping is interrupted, it means that the application server has been disconnected from the client for restarting, and whether the original web page access request has a command execution vulnerability can be conveniently and efficiently detected.

[0104] In actual application, the reboot command can be "`reboot`", "; reboot;", "$(reboot)", "| reboot" or other forms of statements, the client adds the reboot command behind the request parameter in the original web access request to obtain a target command execution request including the reboot command, sends the target command execution request to the application server, monitors the execution result of the reboot command by ping, obtains the execution result of reboot commands in multiple forms such as "`reboot`", "; reboot;", "$(reboot)" and "| reboot", and determines whether the original web access request has a command execution vulnerability according to the execution result of the reboot commands in multiple forms, for example, if the execution result of any form of reboot command is ping interruption, it is determined that the original web access request has a command execution vulnerability, otherwise it is determined that the original web access request does not have a command execution vulnerability.

[0105] The embodiment of the application can conveniently and efficiently detect whether the original web access request has a command execution vulnerability by sending a target command execution request including a reboot command to the application server, monitoring the execution result of the reboot command in the target command execution request, and determining that the original web access request has a command execution vulnerability if the ping is interrupted, which is beneficial to further improve the vulnerability detection efficiency.

[0106] In optional embodiments, the method further includes steps S106-S107:

[0107] S106, after determining that the original web access request has a command execution vulnerability, an unauthorized command execution request is sent to the application server, and the execution result of the target command in the unauthorized command execution request is monitored; wherein the unauthorized command execution request is obtained by deleting the user identifier information in the target command execution request;

[0108] S107, according to the execution result of the target command in the unauthorized command execution request, it is determined whether the command execution vulnerability is an unauthorized command execution vulnerability.

[0109] As an example, in order to further determine whether the command execution vulnerability existing in the original web access request is an unauthorized command execution vulnerability, the client deletes the user identifier information in the target command execution request to obtain an unauthorized command execution request after determining that the original web access request has a command execution vulnerability, sends the unauthorized command execution request to the application server, monitors the execution result of the target command in the unauthorized command execution request, and determines whether the command execution vulnerability is an unauthorized command execution vulnerability according to the execution result of the target command in the unauthorized command execution request.

[0110] In actual application, the purpose of deleting the user identification information in the target command execution request is to make the target command execution request appear as a target command execution request without any user authority, and the cookie information in the target command execution request can be deleted to obtain an unauthorized command execution request.

[0111] In an optional implementation of the embodiment, the target command includes a restart command; the sending of the unauthorized command execution request to the application server and the monitoring of the execution result of the target command in the unauthorized command execution request include: sending the unauthorized command execution request to the application server and monitoring the execution result of the target command in the unauthorized command execution request by using ping; and the determining of whether the command execution vulnerability is an unauthorized command execution vulnerability according to the execution result of the target command in the unauthorized command execution request includes: in the case of interruption of the ping, determining that the command execution vulnerability is an unauthorized command execution vulnerability.

[0112] As an example, after the client obtains the unauthorized command execution request including the restart command, the client sends the unauthorized command execution request to the application server, monitors the execution result of the restart command in the unauthorized command execution request by using ping, and in the case of interruption of the ping, considers that the execution of the restart command is successful, determines that the command execution vulnerability is an unauthorized command execution vulnerability, or otherwise, considers that the execution of the restart command fails, and determines that the command execution vulnerability is an authorized command execution vulnerability.

[0113] It can be understood that since the restart command is used to restart the application server and the ping is used to confirm whether a host on the Internet is reachable, the execution result of the restart command in the unauthorized command execution request is monitored by using the ping, and once the ping is interrupted, it means that the application server has been disconnected from the client for restarting, and whether the command execution vulnerability is an unauthorized command execution vulnerability can be conveniently and efficiently determined.

[0114] The embodiment of the application can determine the type of the vulnerability quickly and conveniently by constructing the unauthorized command execution request according to the target command execution request after determining that the original web page access request has the command execution vulnerability, and determining whether the command execution vulnerability is an unauthorized command execution vulnerability by using the unauthorized command execution request, which is beneficial to further improve the efficiency of the vulnerability detection.

[0115] In an optional embodiment, the fake webpage access request comprises an unauthorized webpage access request; the sending of the fake webpage access request to the application server and the receiving of the fake webpage access response returned by the application server comprise: sending an unauthorized webpage access request to the application server and receiving an unauthorized webpage access response returned by the application server; wherein the unauthorized webpage access request is obtained by modifying the user identification information in the original webpage access request into the identification information of an unauthorized user; and the determining of whether the original webpage access request has a permission access loophole according to the comparison result of the original webpage access response and the fake webpage access response comprises: in the case that the original webpage access response is the same as the unauthorized webpage access response, it is determined that the original webpage access request has an unauthorized access loophole.

[0116] For example, in order to detect whether the original webpage access request has an unauthorized access loophole, an unauthorized user, i.e., a user without any user permission, is pre-configured. In actual application, the cookie information of the unauthorized user can be configured.

[0117] After the client obtains the original webpage access request, the user identification information in the original webpage access request is modified into the identification information of an unauthorized user to obtain an unauthorized webpage access request, the unauthorized webpage access request is sent to the application server, an unauthorized webpage access response returned by the application server is received, the original webpage access response is compared with the unauthorized webpage access response, and whether the original webpage access request has an unauthorized access loophole is determined according to the comparison result of the original webpage access response and the unauthorized webpage access response.

[0118] It can be understood that if the original webpage access response is the same as the unauthorized webpage access response, it is determined that the original webpage access request has an unauthorized access loophole, and if the original webpage access response is different from the unauthorized webpage access response, it is determined that the original webpage access request does not have an unauthorized access loophole.

[0119] The embodiment of the application can quickly and accurately detect an unauthorized access loophole by constructing an unauthorized webpage access request according to an original webpage access request and detecting whether the original webpage access request has an unauthorized access loophole by using the unauthorized webpage access request.

[0120] In an optional embodiment, the fake webpage access request comprises an unauthorized webpage access request;

[0121] The sending of the fake webpage access request to the application service end and the receiving of the fake webpage access response returned by the application service end comprises: sending an unauthorized webpage access request to the application service end and receiving an unauthorized webpage access response returned by the application service end; wherein the unauthorized webpage access request is obtained by deleting the user identification information in the original webpage access request; and the determining of whether the original webpage access request has an authorized access vulnerability according to the comparison result of the original webpage access response and the fake webpage access response comprises: in the case that the original webpage access response is the same as the unauthorized webpage access response, determining that the original webpage access request has an unauthorized access vulnerability.

[0122] As an example, in order to detect whether the original webpage access request has an unauthorized access vulnerability, the client deletes the user identification information in the original webpage access request after obtaining the original webpage access request, obtains an unauthorized webpage access request, sends the unauthorized webpage access request to the application service end, receives an unauthorized webpage access response returned by the application service end, compares the original webpage access response with the unauthorized webpage access response, and determines whether the original webpage access request has an unauthorized access vulnerability according to the comparison result of the original webpage access response and the unauthorized webpage access response.

[0123] It can be understood that if the original webpage access response is the same as the unauthorized webpage access response, it is determined that the original webpage access request has an unauthorized access vulnerability, and if the original webpage access response is different from the unauthorized webpage access response, it is determined that the original webpage access request does not have an unauthorized access vulnerability.

[0124] The embodiment of the application can quickly and accurately detect the unauthorized access vulnerability by constructing an unauthorized webpage access request according to the original webpage access request and detecting whether the original webpage access request has an unauthorized access vulnerability by using the unauthorized webpage access request.

[0125] In an optional embodiment, the method further comprises the following step S108:

[0126] S108, in the case that the original webpage access request has a command execution vulnerability and / or an authorized access vulnerability, generating a vulnerability detection report.

[0127] As an example, in the case that the client determines that the original webpage access request has a command execution vulnerability and / or an authorized access vulnerability, the client can also generate a vulnerability detection report according to the vulnerability information, wherein the vulnerability information comprises a vulnerability name, a vulnerability type, and a code location where the vulnerability is located, etc.

[0128] It should be noted that the original web access request has a command execution vulnerability and / or a permission access vulnerability, including the following three cases: the original web access request only has a command execution vulnerability; the original web access request only has a permission access vulnerability; and the original web access request has both a command execution vulnerability and a permission access vulnerability.

[0129] The embodiment of the application can provide the user with the vulnerability detection report together by generating the vulnerability detection report in the case that the original web access request has a command execution vulnerability and / or a permission access vulnerability, so as to meet the actual business requirements.

[0130] In order to more clearly illustrate the vulnerability detection method provided by the first embodiment of the application, the vulnerability detection method is applied to perform vulnerability detection on the original web access request initiated by the super administrator, and a flowchart is shown in Figure 2 .

[0131] Please refer to Figure 3 , Figure 3 The structure diagram of a vulnerability detection device provided by the second embodiment of the application is shown. The second embodiment of the application provides a vulnerability detection device, which comprises: an original request response acquisition module 201, configured to acquire an original web access request sent by a user to an application server and an original web access response returned by the application server; a target command execution processing module 202, configured to send a target command execution request to the application server and monitor the execution result of a target command in the target command execution request; wherein the target command execution request is obtained by adding the target command to the original web access request; a command execution vulnerability detection module 203, configured to determine whether the original web access request has a command execution vulnerability according to the execution result of the target command in the target command execution request; a fake request response acquisition module 204, configured to send a fake web access request to the application server and receive a fake web access response returned by the application server; wherein the fake web access request is obtained by editing the user identifier information in the original web access request; and a permission access vulnerability detection module 205, configured to determine whether the original web access request has a permission access vulnerability according to the comparison result of the original web access response and the fake web access response.

[0132] In optional embodiments, the original web access request sent by the user to the application server is acquired by capturing the original web access request through a proxy server.

[0133] In optional embodiments, the target command execution processing module 202 is further configured to, before the sending of the target command execution request to the application server and the monitoring of the execution result of the target command in the target command execution request, add a target command to the original web page access request to obtain a target command execution request, in a case where the accessed resource in the original web page access request is a static resource; and / or the fake request response acquisition module 204 is further configured to, before the sending of the fake web page access request to the application server and the receiving of the fake web page access response returned by the application server, edit the user identification information in the original web page access request to obtain a fake web page access request, in a case where the accessed resource in the original web page access request is a static resource.

[0134] In optional embodiments, the target command includes a restart command; the sending of the target command execution request to the application server and the monitoring of the execution result of the target command in the target command execution request include: sending the target command execution request to the application server and monitoring the execution result of the target command in the target command execution request by using an Internet Control Message Protocol (ICMP) ping; and the determination of whether the original web page access request has a command execution vulnerability according to the execution result of the target command in the target command execution request includes: determining that the original web page access request has a command execution vulnerability in a case where the ping is interrupted.

[0135] In optional embodiments, the command execution vulnerability detection module 203 is further configured to: after determining that the original web page access request has a command execution vulnerability, send an unauthorized command execution request to the application server and monitor the execution result of the target command in the unauthorized command execution request; wherein the unauthorized command execution request is obtained by deleting the user identification information in the target command execution request; and determine whether the command execution vulnerability is an unauthorized command execution vulnerability according to the execution result of the target command in the unauthorized command execution request.

[0136] In optional embodiments, the fake web page access request includes an unauthorized web page access request; the sending of the fake web page access request to the application server and the receiving of the fake web page access response returned by the application server include: sending the unauthorized web page access request to the application server and receiving the unauthorized web page access response returned by the application server; wherein the unauthorized web page access request is obtained by modifying the user identification information in the original web page access request to identification information of an unauthorized user; and the determination of whether the original web page access request has a permission access vulnerability according to the comparison result of the original web page access response and the fake web page access response includes: determining that the original web page access request has an unauthorized access vulnerability in a case where the original web page access response is the same as the unauthorized web page access response.

[0137] In an optional embodiment, the fake webpage access request comprises an unauthorized webpage access request; the sending of the fake webpage access request to the application server and the receiving of the fake webpage access response returned by the application server comprises: sending an unauthorized webpage access request to the application server and receiving an unauthorized webpage access response returned by the application server; wherein the unauthorized webpage access request is obtained by deleting the user identification information in the original webpage access request; and the determining of whether the original webpage access request has a permission access vulnerability according to the comparison result of the original webpage access response and the fake webpage access response comprises: in the case that the original webpage access response is the same as the unauthorized webpage access response, determining that the original webpage access request has an unauthorized access vulnerability.

[0138] In an optional embodiment, the apparatus further comprises a vulnerability detection report generation module configured to generate a vulnerability detection report in the case that the original webpage access request has a command execution vulnerability and / or a permission access vulnerability.

[0139] The implementation process of the functions and roles of the modules in the apparatus is specifically described in the implementation process of the corresponding steps in the above method, and will not be described here.

[0140] Please refer to Figure 4 , Figure 4 A structural schematic diagram of an electronic device provided by the third embodiment of the present application. The third embodiment of the present application provides an electronic device 30, which comprises a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the memory 302 is coupled to the processor 301, and the processor 301 implements the method described in the first embodiment of the present application when executing the computer program, and can achieve the same beneficial effects.

[0141] Wherein, the processor 301 reads the computer program from the memory 302 through the bus 303 and executes the computer program to implement the method of any embodiment included in the method described in the first embodiment of the present application.

[0142] The processor 301 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, the processor 301 can be a microprocessor.

[0143] The memory 302 can be used to store instructions executed by the processor 301 or data related to the instruction execution process. The instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 301 of the embodiments of the present disclosure can be used to execute the instructions in the memory 302 to implement the method as described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory well known to those skilled in the art.

[0144] The fourth embodiment of the present application provides a computer readable storage medium, which includes a stored computer program; wherein the computer program, when running, controls the device where the computer readable storage medium is located to perform the method as described in the first embodiment of the present application and achieve the same beneficial effects.

[0145] The fifth embodiment of the present application provides a computer program product, which includes instructions, and the instructions, when executed by a computer, cause the computer to implement the method as described in the first embodiment of the present application and achieve the same beneficial effects.

[0146] The method described in the first embodiment of the present application can be implemented by software, hardware, firmware or any combination thereof, in whole or in part. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model) or other programmable devices.

[0147] The computer programs or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer programs or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available media can be a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape; an optical medium, such as a digital video disc; a semiconductor medium, such as a solid state disk. The computer readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0148] To sum up, the embodiment of the present application provides a vulnerability detection method, device, medium and program product. The vulnerability detection method comprises the following steps: obtaining an original webpage access request sent by a user to an application server and an original webpage access response returned by the application server; sending a target command execution request to the application server and monitoring an execution result of a target command in the target command execution request; wherein the target command execution request is obtained by adding the target command to the original webpage access request; determining whether the original webpage access request has a command execution vulnerability according to the execution result of the target command in the target command execution request; sending a fake webpage access request to the application server and receiving a fake webpage access response returned by the application server; wherein the fake webpage access request is obtained by editing user identifier information in the original webpage access request; and determining whether the original webpage access request has a permission access vulnerability according to a comparison result of the original webpage access response and the fake webpage access response. The embodiment of the present application can comprehensively detect various Web security vulnerabilities such as command execution vulnerabilities and permission access vulnerabilities by constructing the target command execution request and the fake webpage access request based on the original webpage access request, detecting whether the original webpage access request has the command execution vulnerability by using the target command execution request, and detecting whether the original webpage access request has the permission access vulnerability by using the fake webpage access request.

[0149] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are merely schematic, for example, the flow charts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flow chart or block diagram can represent a module, program segment or part of code containing one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementation manners, the functions noted in the blocks can also occur in different order from that noted in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flow chart, and the combination of blocks in the block diagram and / or flow chart, can be implemented by a dedicated hardware-based system for executing the specified function or action, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0150] In addition, each functional module in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0151] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the present application that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of software products. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0152] The above merely provides a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be encompassed in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A vulnerability detection method characterized by, The method comprises: obtaining an original web access request sent by a user to an application server and an original web access response returned by the application server; in a case where an accessed resource in the original web access request is a static resource, adding a target command to the original web access request to obtain a target command execution request; wherein the target command comprises a restart command; sending the target command execution request to the application server and monitoring an execution result of the target command in the target command execution request by using an Internet Control Message Protocol (ICMP) ping; in a case where the ping is interrupted, determining that the original web access request has a command execution vulnerability; and / or, in a case where the accessed resource in the original web access request is a static resource, editing user identification information in the original web access request to obtain a fake web access request; sending the fake web access request to the application server and receiving a fake web access response returned by the application server; wherein the fake web access request is obtained by editing the user identification information in the original web access request; determining whether the original web access request has a permission access vulnerability according to a comparison result of the original web access response and the fake web access response.

2. The method of claim 1, wherein, The obtaining of the original web access request sent by the user to the application server comprises: capturing the original web access request by a proxy server.

3. The method of claim 1, wherein, The method further comprises: after determining that the original web access request has the command execution vulnerability, sending an unauthorized command execution request to the application server and monitoring an execution result of a target command in the unauthorized command execution request; wherein the unauthorized command execution request is obtained by deleting the user identification information in the target command execution request; determining whether the command execution vulnerability is an unauthorized command execution vulnerability according to the execution result of the target command in the unauthorized command execution request.

4. The method of claim 1, wherein, The fake web access request comprises an unauthorized web access request; The sending of the fake web access request to the application server and the receiving of the fake web access response returned by the application server comprise: sending an unauthorized web access request to the application server and receiving an unauthorized web access response returned by the application server; wherein the unauthorized web access request is obtained by modifying the user identification information in the original web access request to identification information of an unauthorized user; The determining of whether the original web access request has the permission access vulnerability according to the comparison result of the original web access response and the fake web access response comprises: in a case where the original web access response is the same as the unauthorized web access response, determining that the original web access request has an unauthorized access vulnerability.

5. The method of claim 1, wherein, The fake web access request comprises an unauthorized web access request; The sending of the fake web access request to the application server and the receiving of the fake web access response returned by the application server comprise: sending the unauthorized webpage access request to the application server and receiving an unauthorized webpage access response returned by the application server; wherein the unauthorized webpage access request is obtained by deleting the user identification information in the original webpage access request; the determining whether the original webpage access request has the permission access vulnerability based on the comparison result of the original webpage access response and the forged webpage access response comprises: in a case that the original webpage access response is the same as the unauthorized webpage access response, determining that the original webpage access request has the unauthorized access vulnerability.

6. The method according to any one of claims 1 to 5, characterized in that, The method further comprises: in a case that the original webpage access request has the command execution vulnerability and / or the permission access vulnerability, generating a vulnerability detection report.

7. An electronic device, comprising: The computer program product comprises instructions which, when executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium comprises a stored computer program; wherein the computer-readable storage medium controls a device in which the computer-readable storage medium is located to execute the method according to any one of claims 1 to 6 when the computer program is running.

9. A computer program product, characterised in that, The computer program product comprises instructions which, when executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 6.

Images