A website security vulnerability detection method and system

Abstract

The present invention discloses a website security vulnerability detection method and system, the method comprises obtaining a to-be-processed Webshell file, dividing the code therein into a plurality of code segments; inserting each interactive code block screened out from a target website between each code segment; screening out the risk character string in the code and rewriting it; using a data flow graph obfuscation method to hide the variable transfer process; interacting the processed Webshell file with a selected detection tool, correcting the detection tool based on the interaction result, and using the corrected detection tool to perform security vulnerability detection on the target website. The present invention processes the Webshell file by design, comprehensively bypasses the static detection of Webshell in the prior art, thereby providing a basis for developing a more effective detection and defense strategy, and finally providing a directional guidance for the optimization and improvement of static detection tools.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a website security vulnerability detection method and system. Background Art

[0002] With the continuous updating of network technology and the popularization of network applications, the data security issues of website servers have become increasingly prominent.

[0003] In the process of network security protection, in order to achieve security monitoring of websites or servers, it is necessary to obtain Webshell samples that can bypass protection software, so that the Webshell samples that bypass the security protection system can be used as effective samples for vulnerability testing. In the prior art, Webshell samples are often selected from existing Webshell libraries. However, with the development of technology and the transformation of codes, it is no longer possible to obtain sample data with high effectiveness from the existing Webshell library, resulting in a significant reduction in the effect of vulnerability testing on the website.

[0004] It can be seen that how to improve the vulnerability detection effect of websites and promote the security protection of websites has become a technical problem that technical personnel in this field need to solve urgently. Summary of the invention

[0005] The present invention provides a website security vulnerability detection method and system to promote and optimize the security detection function of the website.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a website security vulnerability detection method, comprising:

[0007] Obtain a Webshell file to be processed, and divide the code in the Webshell file to be processed into a plurality of code segments according to the encoding rule of the Webshell file to be processed.

[0008] A plurality of interactive code blocks are screened out from the page code of the acquired target website, and each of the interactive code blocks is inserted between each of the code segments to obtain a first Webshell file, wherein the insertion process is configured to interact the selected code segment with the corresponding interactive code blocks in a coupled manner.

[0009] The first Webshell file is screened based on a string feature matching rule, and each risk string obtained by the screening is rewritten to obtain a second Webshell file.

[0010] The variable transfer process in the second Webshell file is hidden by using a data flow graph obfuscation method to obtain a third Webshell file.

[0011] The third Webshell file interacts with the selected detection tool, the detection tool is modified based on the interaction result, and the modified detection tool is used to perform security vulnerability detection on the target website.

[0012] Furthermore, the code in the Webshell file to be processed is divided into several code segments according to the encoding rule of the Webshell file to be processed, including:

[0013] Extract the code data in the Webshell file to be processed, and use a regular expression to match the specified code in the code data.

[0014] The code data is segmented according to the matching result to obtain a plurality of code segments.

[0015] Furthermore, after the code data is segmented according to the matching results to obtain a plurality of code segments, the method further includes:

[0016] Performing logic verification on each of the divided code segments, and correcting the division results of each of the code segments according to the verification results.

[0017] Furthermore, inserting each of the interactive code blocks between each of the code segments includes:

[0018] The interactive interface is determined according to the functions and logical relationships of each of the interactive code blocks.

[0019] Analyze the data information that needs to be exchanged and transmitted among the code segments.

[0020] A matching relationship between each of the code segments and each of the interactive interfaces is established according to the data information.

[0021] Each of the code segments is coupled with each of the interactive code blocks according to the matching relationship.

[0022] Furthermore, the character string feature matching rules include word matching rules, sentence matching rules and frequency detection rules.

[0023] The first Webshell file is screened based on the string feature matching rule, and each risk string obtained by the screening is rewritten, including:

[0024] The system functions in the risk character string are screened out from the first Webshell file, and the function names of the system functions are dynamically rewritten through character string operations.

[0025] The nested functions in the risk character string are screened out from the first Webshell file, the embedded functions in each of the nested functions are extracted separately, and the embedded functions are called by passing in new variables.

[0026] The risk character string in the first Webshell file is re-encoded by means of encryption mapping.

[0027] Furthermore, the step of re-encoding the risk character string in the first Webshell file by means of encryption mapping includes:

[0028] The risk character strings in the first Webshell file are encrypted using encryption mapping rules, and the encrypted risk character strings are converted into codes.

[0029] Furthermore, the encoding conversion rules include ASCII encoding rules, Unicode encoding, GBK / GB2312 encoding and Base64 encoding rules.

[0030] Furthermore, the data flow graph obfuscation method is used to hide the variable transfer process in the second Webshell file, including:

[0031] The variables in the second Webshell file are assigned values ​​using a judgment statement to hide the explicit assignment statement.

[0032] Part of the variable information is written into the file attribute information of the second Webshell file by means of file steganography.

[0033] Furthermore, the method of writing part of the variable information into the file attribute information of the second Webshell file by means of file steganography includes:

[0034] By taking advantage of the alternate data stream feature of the NTFS file system, the variable information is written into the alternate data stream of the Webshell as hidden data.

[0035] Another embodiment of the present invention provides a website security vulnerability detection system, comprising:

[0036] The code segmentation module is used to obtain the Webshell file to be processed, and segment the code in the Webshell file to be processed into a plurality of code segments according to the encoding rule of the Webshell file to be processed.

[0037] A code interaction module is used to filter out a number of interactive code blocks from the page code of the acquired target website, insert each of the interactive code blocks between the code segments, and obtain a first Webshell file, wherein the insertion process is configured to interact the selected code segment with the corresponding interactive code blocks in a coupled manner.

[0038] The string rewriting module is used to screen the first Webshell file based on a string feature matching rule, and rewrite each risk string obtained by the screening to obtain a second Webshell file.

[0039] The variable hiding module is used to hide the variable transfer process in the second Webshell file by using a data flow graph obfuscation method to obtain a third Webshell file.

[0040] The vulnerability detection module is used to interact the third Webshell file with the selected detection tool, modify the detection tool based on the interaction result, and perform security vulnerability detection on the target website with the modified detection tool.

[0041] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0042] (1) Considering the weakness of the existing Webshell detection technology, the present invention rewrites the Webshell code by designing a detection method based on Opcode / Bytecode, a detection method based on string matching, a detection method based on CFG, and a detection method based on DFG and Taint, thereby completely bypassing the static detection of Webshell in the existing technology.

[0043] (2) By analyzing the strategies and techniques of Webshell attacks, we deeply analyze the mechanisms and limitations of Webshell detection tools, thereby providing a basis for developing more effective detection and defense strategies, and ultimately providing directional guidance for the optimization and improvement of static detection tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flowchart of the steps of the website security vulnerability detection method provided by an embodiment of the present invention;

[0045] Figure 2 This is a structural block diagram of a website security vulnerability detection system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In the description of this application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the feature. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0048] In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. The terms "vertical", "horizontal", "left", "right", "upper", "lower" and similar expressions used herein are only for illustrative purposes, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0049] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0050] An embodiment of the present invention provides a method for detecting website security vulnerabilities. For details, see Figure 1 , Figure 1 The flowchart of the website security vulnerability detection method in one embodiment of the present invention includes steps S11 to S15:

[0051] Step S11, obtaining a Webshell file to be processed, and dividing the code in the Webshell file to be processed into a plurality of code segments according to the encoding rule of the Webshell file to be processed.

[0052] Specifically, the code segmentation process is: extracting the code data in the Webshell file to be processed, using regular expressions to match the specified code (such as function definitions, conditional statements, loop statements, etc.) in the code data, and locating the key parts of the code according to the matching results, thereby segmenting the code data to obtain several code segments.

[0053] In addition, code segmentation can also be achieved through static code analysis tools. Static code analysis tools are used to scan and analyze the Webshell files to be processed, identify the code logic, function calls, variable declarations, etc. in the files, and divide the code segments accordingly.

[0054] After the code is divided, in order to verify the logical rationality of the divided code, the divided code segments are logically verified, and the division results of each code segment are corrected according to the verification results to ensure that each code segment can correctly express the logic and functions in the original Webshell file.

[0055] Step S12, screening out a number of interactive code blocks from the page code in the acquired target website, inserting each of the interactive code blocks between the code segments, and obtaining a first Webshell file, wherein the insertion process is configured to interact the selected code segment with the corresponding interactive code blocks in a coupled manner.

[0056] This embodiment mainly processes Webshell files based on Opcode / Bytecode detection methods, CFG (control flow graph) detection methods, string matching detection methods, and DFG (data flow graph) detection methods. Among them, for the Opcode / Bytecode-based detection method, the processing method adopted in this embodiment is to insert the Webshell file code into the page code of the target website, or to insert the page code of the target website into the Webshell file code. Taking the insertion of the page code of the target website into the Webshell file code as an example, the specific process is: select a number of interactive code blocks from the page code of the acquired target website, and insert each interactive code block between each code segment of the Webshell file to be processed.

[0057] However, although this method can bypass detection at the Opcode level, the inserted code has no semantic association with the code block in the original Webshell file to be processed. The two non-interactive code blocks may be separated by CFG (control flow graph) and other methods and then detected by the detection tool. Therefore, for the CFG-based detection method, during the code insertion process, it is necessary to make the inserted code and the original code coupled and interactive without affecting the original control flow, so as to further increase the difficulty of deobfuscation. The specific process adopted in this embodiment is as follows:

[0058] Determine the interactive interface based on the function and logical relationship of each interactive code block, analyze the data information that each code segment needs to exchange and transmit, establish a matching relationship between each code segment and each interactive interface based on the data information, and couple each code segment with each interactive code block based on the matching relationship.

[0059] In addition, in order to further obfuscate the code and prevent the detection tool from screening out abnormal code, this embodiment can also introduce a random algorithm to generate non-deterministic input to interfere with CFG's simplification and detection of the code. Specifically, the method adopted in this embodiment is:

[0060] A random string is added to the output part of the program. The string can be accessed multiple times through remote tools during the subsequent Webshell execution process. By comparing the results of multiple accesses, the real output result of the program can be determined based on the unchanged part of the access results. For example, after the Webshell program successfully bypasses the initial detection and starts to execute, if a certain section of code is accessed multiple times and the result obtained is the string "resultlyr", "result123", "resultexc", etc., then after obtaining a certain number of strings, after comparison, it can be concluded that the real result of the execution of this section of code is the string "result", and the subsequent strings are randomly added after the real result through a random algorithm. Through this method, the program operation and output of the target website can be monitored.

[0061] Step S13, screening the first Webshell file based on the string feature matching rule, and rewriting each risk string obtained by screening to obtain a second Webshell file.

[0062] The detection method based on string matching adopts string feature matching rules to rewrite the screened risk strings to bypass detection. The string feature matching rules include word matching rules, sentence matching rules, frequency detection rules, etc.

[0063] Rewriting the risk strings obtained through screening includes the following methods:

[0064] Filter out system functions in risk strings from the first Webshell file, and dynamically rewrite the function names of each system function through string operations.

[0065] Filter out the nested functions in the risk string from the first Webshell file, extract the embedded functions in each nested function separately, and call the embedded functions by passing in new variables.

[0066] The risk character string in the first Webshell file is re-encoded by encryption mapping. The specific process is: each risk character string in the first Webshell file is encrypted using the encryption mapping rule, and each risk character string after encryption is converted into code using the ASCII encoding rule, Unicode encoding, GBK / GB2312 encoding, and Base64 encoding rule.

[0067] Additionally, risky strings can be rewritten in the following ways to bypass string matching based detection:

[0068] Hide global variables: Avoid detection of variable names. You can dynamically generate variable names through string operations or define new variables to wrap existing variables.

[0069] Rename function parameters: Avoid detection of function and variable combinations, extract the original function parameters and assign them to new variables, and use the new variables to pass parameters.

[0070] Limit the number of operations per line of code: Avoid frequency-related detection and split long lines of code in the AST.

[0071] Adjust the position of each line of program in the code: To avoid the detection of relevant positions, normal codes can be inserted between each code.

[0072] Step S14, using a data flow graph obfuscation method to hide the variable transfer process in the second Webshell file to obtain a third Webshell file.

[0073] Currently, some detection tools use Taint technology to track user control input to form a data flow graph DFG, and detect its sink point in the graph, so as to analyze the input source and destination of the data and realize the detection of Webshell.

[0074] For the detection method based on DFG (data flow graph), the variables in the second Webshell file can be assigned values ​​using judgment statements such as if, while, and for to hide explicit assignment statements and avoid detection.

[0075] For some variable data that occupies a small amount of memory, the alternate data stream feature of the NTFS file system can be used to write this part of the variable information as hidden data into the file attribute information, CPU cache or other alternate data streams of the second Webshell file through file steganography, thereby evading detection.

[0076] Step S15, interacting the third Webshell file with the selected detection tool, modifying the detection tool based on the interaction result, and performing security vulnerability detection on the target website with the modified detection tool.

[0077] The website security vulnerability detection method of the present invention considers the fragility of the existing Webshell detection technology, and rewrites the Webshell code by designing a detection method based on Opcode / Bytecode, a detection method based on string matching, a detection method based on CFG, and a detection method based on DFG and Taint, thereby comprehensively bypassing the static detection of Webshell in the prior art. By analyzing the strategies and techniques of Webshell attacks, the mechanism and limitations of Webshell detection tools are deeply analyzed, thereby providing a basis for developing more effective detection and defense strategies, and finally providing direction guidance for the optimization and improvement of static detection tools.

[0078] The embodiment of the present invention also provides a website security vulnerability detection system, which is used to execute the website security vulnerability detection system as described above. Figure 2 This is a structural block diagram of a website security vulnerability detection system according to an embodiment of the present invention, wherein the system comprises:

[0079] The code segmentation module 21 is used to obtain a Webshell file to be processed, and segment the code in the Webshell file to be processed into a plurality of code segments according to the coding rule of the Webshell file to be processed.

[0080] The code interaction module 22 is used to filter out a number of interactive code blocks from the page code in the acquired target website, insert each of the interactive code blocks between the code segments, and obtain a first Webshell file, wherein the insertion process is configured to interact the selected code segment with the corresponding interactive code blocks in a coupled manner.

[0081] The string rewriting module 23 is used to screen the first Webshell file based on the string feature matching rule, and rewrite each risk string obtained by the screening to obtain a second Webshell file.

[0082] The variable hiding module 24 is used to hide the variable transfer process in the second Webshell file by using a data flow graph obfuscation method to obtain a third Webshell file.

[0083] The vulnerability detection module 25 is used to interact the third Webshell file with the selected detection tool, modify the detection tool based on the interaction result, and perform security vulnerability detection on the target website with the modified detection tool.

[0084] The technical features and technical effects of the system proposed in the embodiment of the present invention are the same as those of the method proposed in the embodiment of the present invention, and are not described in detail here. Each module in the above system can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0085] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A website security vulnerability detection method, characterized in that: include: Obtain a Webshell file to be processed, and divide the code in the Webshell file to be processed into a plurality of code segments according to the encoding rule of the Webshell file to be processed; A plurality of interactive code blocks are screened out from the page code of the acquired target website, and each of the interactive code blocks is inserted between each of the code segments to obtain a first Webshell file, wherein the insertion process is configured to interact the selected code segment with the corresponding interactive code blocks in a coupled manner; specifically comprising: determining an interactive interface according to the function and logical relationship of each of the interactive code blocks; analyzing the data information to be exchanged and transmitted by each of the code segments; establishing a matching relationship between each of the code segments and each of the interactive interfaces according to the data information; coupling each of the code segments with each of the interactive code blocks according to the matching relationship; the interactive code block is a code that can generate a semantic association with the code block to be processed; The first Webshell file is screened based on a string feature matching rule, and each risk string obtained by the screening is rewritten to obtain a second Webshell file; A data flow graph obfuscation method is used to hide the variable transfer process in the second Webshell file to obtain a third Webshell file; The third Webshell file interacts with the selected detection tool, the detection tool is modified based on the interaction result, and the modified detection tool is used to perform security vulnerability detection on the target website.

2. The website security vulnerability detection method according to claim 1, characterized in that: The code in the Webshell file to be processed is divided into several code segments according to the encoding rule of the Webshell file to be processed, including: Extract code data from the Webshell file to be processed, and use regular expressions to match specified codes in the code data; The code data is segmented according to the matching result to obtain a plurality of code segments.

3. The website security vulnerability detection method according to claim 2, characterized in that: After the code data is segmented according to the matching results to obtain a plurality of code segments, the method further includes: Performing logic verification on each of the divided code segments, and correcting the division results of each of the code segments according to the verification results.

4. The website security vulnerability detection method according to claim 1, characterized in that: The string feature matching rules include word matching rules, sentence matching rules and frequency detection rules; The first Webshell file is screened based on the string feature matching rule, and each risk string obtained by the screening is rewritten, including: Filtering out system functions in risk strings from the first Webshell file, and dynamically rewriting the function names of each of the system functions through string operations; Filter out nested functions in the risk string from the first Webshell file, extract the embedded functions in each nested function separately, and call the embedded functions by passing in new variables; The risk character string in the first Webshell file is re-encoded by means of encryption mapping.

5. The website security vulnerability detection method according to claim 4, characterized in that: The step of re-encoding the risk character string in the first Webshell file by means of encryption mapping includes: The risk character strings in the first Webshell file are encrypted using encryption mapping rules, and the encrypted risk character strings are converted into codes.

6. The website security vulnerability detection method according to claim 5, characterized in that: The encoding conversion rules include ASCII encoding rules, Unicode encoding rules, GBK / GB2312 encoding rules and Base64 encoding rules.

7. The website security vulnerability detection method according to claim 1, characterized in that: The method of using a data flow graph obfuscation method to hide the variable transfer process in the second Webshell file includes: Using a judgment statement to perform assignment transformation on the variables in the second Webshell file to achieve hiding of the explicit assignment statement; Part of the variable information is written into the file attribute information of the second Webshell file by means of file steganography.

8. The website security vulnerability detection method according to claim 7, characterized in that: The method of writing part of the variable information into the file attribute information of the second Webshell file by means of file steganography includes: By taking advantage of the alternate data stream feature of the NTFS file system, the variable information is written into the alternate data stream of the Webshell as hidden data.

9. A website security vulnerability detection system, characterized in that: include: A code segmentation module is used to obtain a Webshell file to be processed, and segment the code in the Webshell file to be processed into a plurality of code segments according to the encoding rule of the Webshell file to be processed; A code interaction module is used to filter out a number of interactive code blocks from the page code of the acquired target website, insert each of the interactive code blocks between the code segments, and obtain a first Webshell file, wherein the insertion process is configured to interact the selected code segment with the corresponding interactive code blocks in a coupled manner; specifically including: determining an interactive interface according to the function and logical relationship of each of the interactive code blocks; analyzing the data information to be exchanged and transmitted by each of the code segments; establishing a matching relationship between each of the code segments and each of the interactive interfaces according to the data information; coupling each of the code segments with each of the interactive code blocks according to the matching relationship; the interactive code block is a code that can generate a semantic association with the code block to be processed; A string rewriting module, used for screening the first Webshell file based on a string feature matching rule, and rewriting each risk string obtained by screening to obtain a second Webshell file; A variable hiding module, used to hide the variable transfer process in the second Webshell file by using a data flow graph obfuscation method to obtain a third Webshell file; The vulnerability detection module is used to interact the third Webshell file with the selected detection tool, modify the detection tool based on the interaction result, and perform security vulnerability detection on the target website with the modified detection tool.

Images