A method for fuzz testing of SpringBoot web application vulnerability mining and verification

Abstract

The application discloses a kind of SpringBoot Web application vulnerability mining and verification's fuzz testing method, before drinking software is put on the market, need manual audit a large number of codes, mine out vulnerability and verify the exploitability of this vulnerability, improve code security.The application is based on CodeQL static analysis, Fuzz etc., exploits SpringBoot Web application vulnerability and verifies the exploitability of this vulnerability, finally provides the HTTP message of successful exploitation.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a fuzzy testing method for SpringBoot Web application vulnerability mining and verification. Background Art

[0002] With the increasing informatization of society, the internet has become a widespread part of people's daily lives, bringing enormous economic and social benefits. However, this rapid development has also created more opportunities for malicious cyberattacks, making network security issues increasingly prominent. With the rapid development of the internet, website applications are becoming increasingly widespread, but at the same time, the security risks faced by websites are also increasing.

[0003] Before a website is officially launched, it's necessary to conduct a comprehensive security audit to identify potential security vulnerabilities. Traditional source code audits rely on security researchers manually analyzing source code, constructing vulnerability verification messages, and using experience to identify potential security issues. This approach is inefficient, has low coverage, and is costly.

[0004] To improve the efficiency of source code audits, it is crucial to automatically construct vulnerability verification reports. Therefore, a system is urgently needed that can utilize program analysis techniques to traverse the code and detect potential security vulnerabilities within the source code. Furthermore, to improve the accuracy of vulnerability detection, it is necessary to automatically generate verification cases and perform vulnerability exploitation verification, thereby eliminating false positives. This allows for the efficient discovery of various security vulnerabilities within websites, improving the security of website code and reducing security risks. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a fuzzy testing method for SpringBoot Web application vulnerability mining and verification.

[0006] The purpose of the present invention is to achieve the following technical solution: a fuzzy testing method for SpringBoot Web application vulnerability mining and verification, comprising the following steps:

[0007] (1) Construct a set of SpringBoot Web application information extraction rules that can be identified by the CodeQL static analysis tool, including routing information extraction rule sets, parameter information extraction rule sets, and class attribute information extraction rule sets;

[0008] (2) Construct a set of Java potential vulnerability feature rules that can be identified by the CodeQL static analysis tool;

[0009] (3) Use the CodeQL static analysis tool to extract key information and potential vulnerability information of the target SpringBoot Web application;

[0010] (4) Use the Fuzz template script to read the vulnerability information and build a Fuzz program for each vulnerability point that needs fuzz testing;

[0011] (5) Configure the Fuzz running parameters, run the Fuzz program, and obtain the Crash set;

[0012] (6) Voting on the Crash set to construct the PoC feature.

[0013] Furthermore, in step (1), the routing information extraction rule set is used to extract routing information in the SpringBoot Web application, wherein the routing information includes a routing path and a request method type;

[0014] The parameter information extraction rule set is used to extract all parameter information corresponding to each route in the SpringBoot Web application, and the parameter information includes parameter name, parameter type and parameter request type;

[0015] The class attribute information extraction rule set is used to extract customized Class information in SpringBoot Web applications.

[0016] Furthermore, in step (2), the Java potential vulnerability feature rule set is used to extract the Sink points of potential vulnerabilities in the SpringBoot Web application and correspond to the extracted routing information and parameter information.

[0017] Furthermore, the step (3) specifically includes the following sub-steps:

[0018] (3.1) Build a database for the source code of the target SpringBoot Web application;

[0019] (3.2) Run the SpringBoot Web application information extraction rule set and the Java potential vulnerability feature rule set under CodeQL to obtain the encrypted bqrs file;

[0020] (3.3) Decrypt the encrypted bqrs file and convert it into a CSV file containing key information and potential vulnerability information of the target SpringBoot Web application.

[0021] Furthermore, in step (4), the Fuzz template script includes an initialization module, a data processing module and a simulation request module;

[0022] The initialization module is used to read and store the vulnerability information to be detected, and initialize and configure the program parameters;

[0023] The data processing module is used to process the read and stored vulnerability point information: classify and store the vulnerability point information according to parameter request type and parameter type;

[0024] The simulated request module is used to use Java reflection to build a Junit test unit to simulate access to the target detection point.

[0025] Furthermore, in step (5), the configuration of the Fuzz running parameters is specifically as follows:

[0026] (a.1) Configure the Fuzz instrumentation scope to all SpringBoot Web program source codes;

[0027] (a.2) Configure the upper limit of the number of crashes output by Fuzz;

[0028] (a.3) Configure the maximum duration of the fuzz.

[0029] Furthermore, the step (6) specifically includes the following sub-steps:

[0030] (6.1) Create a vote map, where the key is the vote object and the key value is the number of votes;

[0031] (6.2) Select any two results from the Crash set and extract the set of strings that are identical between them;

[0032] (6.3) Add the values ​​in the string set as keys to the voting map and increment the vote count by one. If a string already exists in the voting map, the vote count is incremented by one.

[0033] (6.4) Again select any two results from the Crash set and repeat steps (6.2) to (6.3) until all pairwise combinations of results in the Crash set are selected;

[0034] (6.5) Finally, all the keys with the highest number of votes in the voting map are used as PoC features.

[0035] The beneficial effects of the present invention are:

[0036] 1) Automatically construct vulnerability verification messages and perform vulnerability exploitation verification to eliminate false positives, thereby achieving the goal of efficiently discovering various security vulnerabilities in the website, improving the website's code security, and reducing security risks;

[0037] 2) Using static analysis, we can extensively search for potential vulnerabilities in SpringBoot Web applications, and then use Fuzz to perform dynamic verification, which improves the vulnerability detection rate and reduces the false negative rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of a fuzz testing method for SpringBoot Web application vulnerability discovery and verification;

[0039] Figure 2 Schematic diagram of the static analysis process and results. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to illustrate the present invention, rather than to represent all embodiments. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0041] The fuzzy testing method for SpringBoot Web application vulnerability mining and verification provided by the present invention uses static analysis to find potential vulnerability points in SpringBoot Web application, and then uses Fuzz to perform dynamic verification and construct vulnerability verification messages.

[0042] like Figure 1 As shown, the present invention provides a fuzzy testing method for SpringBoot Web application vulnerability mining and verification, comprising the following steps:

[0043] (1) Construct a set of SpringBoot Web application information extraction rules that can be recognized by the CodeQL static analysis tool, including routing information extraction rule sets, parameter information extraction rule sets, and class attribute information extraction rule sets.

[0044] In step (1), the routing information extraction rule set is used to extract routing information in the SpringBoot Web application, and the routing information includes a routing path and a request method type.

[0045] The parameter information extraction rule set is used to extract all parameter information corresponding to each route in the SpringBoot Web application, and the parameter information includes parameter name, parameter type and parameter request type.

[0046] The class attribute information extraction rule set is used to extract customized Class information in SpringBoot Web applications.

[0047] (2) Construct a set of Java potential vulnerability feature rules that can be identified by the CodeQL static analysis tool.

[0048] In step (2), the Java potential vulnerability feature rule set is used to extract the Sink points of potential vulnerabilities in the SpringBoot Web application and correspond to the extracted routing information and parameter information.

[0049] (3) Use the CodeQL static analysis tool to extract key information and potential vulnerability information of the target SpringBoot Web application.

[0050] The step (3) specifically includes the following sub-steps:

[0051] (3.1) Build a database for the source code of the target SpringBoot Web application;

[0052] (3.2) Run the SpringBoot Web application information extraction rule set and the Java potential vulnerability feature rule set under CodeQL to obtain the encrypted bqrs file;

[0053] (3.3) Decrypt the encrypted bqrs file and convert it into a CSV file containing key information and potential vulnerability information of the target SpringBoot Web application.

[0054] (4) Use the Fuzz template script to read the vulnerability information and build a Fuzz program for each vulnerability point that needs fuzz testing.

[0055] In step (4), the Fuzz template script includes an initialization module, a data processing module and a simulation request module;

[0056] The initialization module is used to read and store the vulnerability information to be detected, and initialize and configure the program parameters;

[0057] The data processing module is used to process the read and stored vulnerability point information: classify and store the vulnerability point information according to parameter request type and parameter type;

[0058] The simulated request module is used to use Java reflection to build a Junit test unit to simulate access to the target detection point.

[0059] (5) Configure the Fuzz running parameters, run the Fuzz program, and obtain the Crash set.

[0060] In step (5), the configuration of the Fuzz running parameters is as follows:

[0061] (a.1) Configure the Fuzz instrumentation scope to all SpringBoot Web program source codes;

[0062] (a.2) Set the upper limit of the number of crashes output by Fuzz to 5;

[0063] (a.3) Configure the maximum duration of Fuzz to 5 minutes.

[0064] (6) Voting on the Crash set to construct the PoC feature.

[0065] The step (6) specifically includes the following sub-steps:

[0066] (6.1) Create a vote map, where the key is the vote object and the key value is the number of votes;

[0067] (6.2) Select any two results from the Crash set and extract the set of strings that are identical between them;

[0068] (6.3) Add the values ​​in the string set as keys to the voting map and increment the vote count by one. If a string already exists in the voting map, the vote count is incremented by one.

[0069] (6.4) Again select any two results from the Crash set and repeat steps (6.2) to (6.3) until all pairwise combinations of results in the Crash set are selected;

[0070] (6.5) Finally, all the keys with the highest number of votes in the voting map are used as PoC features.

[0071] The schematic diagram of the static analysis process and results is as follows Figure 2 shown.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A fuzz testing method for SpringBoot Web application vulnerability mining and verification, characterized in that: The following steps are involved: (1) Construct a set of SpringBoot Web application information extraction rules that can be identified by the CodeQL static analysis tool, including routing information extraction rule sets, parameter information extraction rule sets, and class attribute information extraction rule sets; (2) Construct a set of Java potential vulnerability feature rules that can be identified by the CodeQL static analysis tool; (3) Use the CodeQL static analysis tool to extract key information and potential vulnerability information of the target SpringBoot Web application; The step (3) specifically includes the following sub-steps: (3.1) Build a database for the source code of the target SpringBoot Web application; (3.2) Run the SpringBoot Web application information extraction rule set and the Java potential vulnerability feature rule set under CodeQL to obtain the encrypted bqrs file; (3.3) Decrypt the encrypted bqrs file and convert it into a CSV file containing key information and potential vulnerability information of the target SpringBoot Web application; (4) Use the Fuzz template script to read the vulnerability information and build a Fuzz program for each vulnerability that needs fuzz testing; In step (4), the Fuzz template script includes an initialization module, a data processing module and a simulation request module; The initialization module is used to read and store the vulnerability information to be detected, and initialize and configure the program parameters; The data processing module is used to process the read and stored vulnerability point information: classify and store the vulnerability point information according to parameter request type and parameter type; The simulated request module is used to build a Junit test unit using Java reflection to simulate access to the target detection point; (5) Configure the Fuzz running parameters, run the Fuzz program, and obtain the Crash set; (6) Voting on the Crash set to construct the PoC feature.

2. A fuzzy testing method for SpringBoot Web application vulnerability mining and verification according to claim 1, characterized in that: In step (1), the routing information extraction rule set is used to extract routing information in the SpringBoot Web application, and the routing information includes routing path and request method type; The parameter information extraction rule set is used to extract all parameter information corresponding to each route in the SpringBoot Web application, and the parameter information includes parameter name, parameter type and parameter request type; The class attribute information extraction rule set is used to extract customized Class information in SpringBoot Web applications.

3. A fuzzy testing method for SpringBoot Web application vulnerability mining and verification according to claim 2, characterized in that: In step (2), the Java potential vulnerability feature rule set is used to extract the Sink points of potential vulnerabilities in the SpringBoot Web application and correspond to the extracted routing information and parameter information.

4. A fuzzy testing method for SpringBoot Web application vulnerability mining and verification according to claim 1, characterized in that: In step (5), the configuration of Fuzz running parameters is as follows: (a.1) Configure the Fuzz instrumentation scope to all SpringBoot Web program source code; (a.2) Configure the upper limit of the number of crashes output by Fuzz; (a.3) Configure the maximum duration of the fuzz.

5. A fuzzy testing method for SpringBoot Web application vulnerability mining and verification according to claim 1, characterized in that: The step (6) specifically includes the following sub-steps: (6.1) Create a vote map where the key is the vote object and the value is the number of votes; (6.2) Select any two results from the Crash set and extract the set of strings that are the same between them; (6.3) Add the values ​​in the string collection as keys to the voting map and increment the vote count by one. If a string already exists in the voting map, the vote count is incremented by one. (6.4) Again select any two results from the Crash set and repeat steps (6.2) to (6.3) until all pairwise combinations of results in the Crash set are selected; (6.5) Finally, all keys with the highest number of votes in the voting map are used as PoC features.

Images