Apache Http Server path crossing vulnerability detection system and method

Abstract

The invention provides an Apache Http Server path crossing vulnerability detection system and method, and the method comprises the steps: inputting a target I P address list to a scanning module, and detecting the network accessibility of each I P address in the target I P address list; if the network reachable IP address exists, all ports of the IP address are detected, and the number of the opened ports is recorded; service classification is carried out by identifying services running under open ports; if the service is classified as an Apache service, initiating a Curl request command to an i-cons directory path of the Apache service; if the Curl request is successfully connected and the / etc / pass file is read, carrying out analysis processing on the / etc / pass file, and extracting a detected host user; detecting the user of the detected host to obtain an Apache Http Server path crossing vulnerability, and detecting the Apache Http Server path crossing vulnerability; and generating a detection report of the detected host according to the Apache Http Server path crossing vulnerability.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a system, method, electronic device and storage medium for detecting path traversal vulnerabilities of Apache Http Server. Background Art

[0002] Apache HTTP Server, or Apache for short, is an open source web server that can run on most computer operating systems. Due to its cross-platform nature and security, Apache HTTP Server is widely used and is one of the most popular web server software. Apache may have a path traversal vulnerability that allows attackers to access files outside the document root directory if they are not protected.

[0003] Vulnerability detection does not have the ability to deeply analyze system files after traversing the Apache HTTP Server path. It usually only detects basic system information, making it difficult to further mine effective user information and enhance users and permissions.

[0004] To solve the above problems, a system, method, electronic device and storage medium for detecting path traversal vulnerability of Apache Http Server are proposed. Summary of the invention

[0005] The embodiments of the present disclosure aim to solve at least one of the technical problems existing in the prior art, and provide a system, method, electronic device and storage medium for detecting path traversal vulnerabilities of Apache Http Server.

[0006] In a first aspect of the present disclosure, a path traversal vulnerability detection system for Apache Http Server is provided, comprising:

[0007] A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0008] Request module, used to initiate Curl request command and read / etc / passwd file;

[0009] A parsing module, used to extract the detected host user from the / etc / passwd file;

[0010] A detection module, used for detecting the detected host user to obtain a path traversal vulnerability of Apache Http Server;

[0011] The detection report module is used to generate a detection report of the detected host according to the Apache Http Server path traversal vulnerability.

[0012] A second aspect of the present disclosure provides a method for detecting a path traversal vulnerability of an Apache Http Server, comprising:

[0013] Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the target IP address list;

[0014] If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0015] Classify services by identifying services running under open ports;

[0016] If the service is classified as an Apache service, initiate a Curl request command to the icons directory path of the Apache service;

[0017] If the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed to extract the user of the detected host;

[0018] Detecting the detected host user to obtain the Apache Http Server path traversal vulnerability;

[0019] A detection report of the detected host is generated according to the Apache Http Server path traversal vulnerability.

[0020] In combination with the second aspect, the detecting the network reachability of each IP address in the IP address list includes sending an ICMP request packet to each IP address through Ping scanning, and determining the network reachability of the IP address according to the response information.

[0021] In combination with the second aspect, if there is a network-reachable IP address, detecting all ports of the IP address includes scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in order from 1 to 65535.

[0022] In combination with the second aspect, the service classification by identifying the services running under the open port includes sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of the running service.

[0023] In conjunction with the second aspect, the Curl request command includes: curl-v --path-as-is

[0024] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / %2e / etc / passwd.

[0025] In combination with the second aspect, if the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed, and the detected host user is extracted, including extracting the mysql database user and the ftp file transfer user in the / etc / passwd file.

[0026] In combination with the second aspect, the detecting of the detected host user to obtain the Apache Http Server path traversal vulnerability includes:

[0027] Crack user passwords by brute force;

[0028] Find user weaknesses and use attack scripts to verify the weaknesses and obtain the first-level permission user;

[0029] The authority of the first-authorized user is upgraded to obtain the administrator user system authority.

[0030] According to a third aspect of the present disclosure, an electronic device is provided, including:

[0031] one or more processors;

[0032] A storage unit is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors can implement any one of the above-mentioned methods for detecting path traversal vulnerabilities of Apache Http Server.

[0033] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the above-mentioned methods for detecting path traversal vulnerabilities in Apache Http Server can be implemented.

[0034] The present invention provides a path traversal vulnerability detection system and method for Apache Http Server, which detects the network accessibility of the target IP address list, records the open ports and identifies the running service types, uses the Curl command to launch a path traversal attack on the port classified as the Apache service, and parses the user information in the / etc / passwd file. By further detecting the strength and weakness of the user password, the user authority is finally improved, and a detailed vulnerability detection report is generated, achieving the effect of automatically, comprehensively and efficiently detecting the path traversal vulnerability of the Apache HTTP Server and deeply analyzing the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a structural diagram of a path traversal vulnerability detection system for Apache Http Server according to an embodiment of the present disclosure;

[0036] Figure 2 A schematic diagram of a process for detecting a path traversal vulnerability of Apache Http Server according to an embodiment of the present disclosure;

[0037] Figure 3 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present disclosure.

[0039] The terms used in the disclosed embodiments are only for the purpose of describing specific embodiments and are not intended to limit the disclosed embodiments. The singular forms of "a", "said" and "the" used in the disclosed embodiments and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0040] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the disclosed embodiments, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0041] like Figure 1 FIG. 1 is a schematic diagram of the structure of the Apache Http Server path traversal vulnerability detection system according to an embodiment of the present disclosure. The system includes:

[0042] The scanning module 110 is used to receive a target IP address list, detect the network reachability of each IP address in the IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0043] The request module 120 is used to initiate a Curl request command to read the / etc / passwd file;

[0044] The parsing module 130 is used to extract the detected host user from the / etc / passwd file;

[0045] A detection module 140 is used to detect the detected host user to obtain a path traversal vulnerability of Apache Http Server;

[0046] The detection report module 150 is used to generate a detection report of the detected host according to the Apache Http Server path traversal vulnerability.

[0047] Specifically, the scanning module 110 is used to receive a list of target IP addresses and detect the network reachability of each IP address in the list in turn. Specifically, the module will send ICMP request packets to each target IP address through network detection technology, such as Ping scanning, and determine the connectivity of the network based on the received response. In addition, the module will also perform port scanning on network-reachable IP addresses, using methods such as TCP SYN scanning or TCP Connect scanning to scan all ports (usually 1 to 65535) of the IP address. During the scanning process, the module will record all open port numbers and identify the services running on each port by sending specific data packets to these open ports. Finally, the scanning module will classify the identified services to provide basic data for subsequent detection steps.

[0048] Through the scanning module, the system can quickly determine which target IP addresses are accessible and identify their open service ports. This step is the basis of vulnerability detection, ensuring that subsequent operations can accurately locate the target Apache service and perform effective attack tests.

[0049] The request module 120 is responsible for sending a specific Curl request command to the identified Apache service in an attempt to trigger the path traversal vulnerability. Specifically, the module uses the command

[0050] curl -v --path-as-is

[0051] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / %2e / etc / passwd, send a request in verbose mode and keep the original path for testing. This request is designed to bypass the path verification mechanism of the Apache server and obtain the / etc / passwd file stored on the server through path traversal, which contains basic information of system users.

[0052] The parsing module 130 is used to parse the / etc / passwd file obtained from the server and extract the user information of the detected host contained in the file. The / etc / passwd file records the basic information of all users in the system, including user name, user ID, user group ID, user home directory and login shell, etc. The parsing module will identify specific users in the file, such as mysql database users, ftp file transfer users, etc., and evaluate whether these users have security risks.

[0053] By parsing the / etc / passwd file, the system can gain in-depth insights into the user configuration of the detected host, providing data support for subsequent user vulnerability analysis and privilege escalation.

[0054] The detection module 140 is used to perform further security detection on the parsed user information to confirm whether the Apache HTTP Server has a path traversal vulnerability. The specific operation includes brute-forcing the extracted users (such as using a common password dictionary to perform password exhaustiveness), finding weaknesses in the user configuration (such as weak passwords or other vulnerabilities that are vulnerable to attack), and using attack scripts to verify these weaknesses. If a user is detected to have a security vulnerability, the module will try to obtain access rights of a low-privilege user.

[0055] The task of the detection module is to further verify the security of the system, especially through brute force cracking and weakness analysis, to evaluate the system's resistance to actual attacks.

[0056] The detection report module 150 is responsible for generating a detailed detection report based on the results of the entire detection process. The report will include all vulnerability information found, the users involved and their permission status, the executed attack steps and results, etc.

[0057] The output of the detection report module is the final result of the system, which helps users fully understand the security risks in the system and guide the subsequent repair work. Through the detailed report, users can evaluate the overall security status of the system and take appropriate protective measures.

[0058] Beneficial effects: The various modules of the system work closely together, from network detection, vulnerability exploitation to information analysis and final report generation, forming a complete Apache HTTP Server path traversal vulnerability detection process. Through this system, users can comprehensively and efficiently detect and analyze path traversal vulnerabilities in Apache servers, obtain in-depth security analysis results, and effectively improve system security.

[0059] like Figure 2 FIG. 1 is a flow chart of a method for detecting path traversal vulnerabilities of Apache Http Server according to an embodiment of the present disclosure. The method includes:

[0060] S201: Input a target IP address list to a scanning module, and detect the network reachability of each IP address in the target IP address list;

[0061] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0062] S203: Classifying services by identifying services running under open ports;

[0063] S204: If the service is classified as an Apache service, a Curl request command is initiated to the icons directory path of the Apache service;

[0064] S205: If the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed to extract the detected host user;

[0065] S206: Detect the detected host user to obtain a path traversal vulnerability of Apache Http Server;

[0066] S207: Generate a detection report of the detected host according to the Apache Http Server path traversal vulnerability.

[0067] Specifically, S201: input a target IP address list and detect network reachability.

[0068] The user inputs the target IP address list into the scanning module, and the system will automatically detect the network reachability of these IP addresses. The detection method is usually through Ping scanning, that is, sending ICMP request packets to each IP address, and judging whether the IP address is online or reachable based on whether a response is received.

[0069] By filtering out reachable IP addresses, the system can focus resources on effective targets, reducing unnecessary network load and time waste. If an IP address is unreachable, subsequent port scanning and service detection will not be performed on it.

[0070] S202: Detect the ports of the IP addresses that are reachable on the network and record the open port numbers.

[0071] For IP addresses that have been confirmed to be reachable on the network, the system will perform a port scan to identify open ports. Port scanning can be performed in a variety of ways, such as TCP SYN scanning or TCP Connect scanning. The system will detect all ports from 1 to 65535 in turn and record those open port numbers.

[0072] Open ports usually correspond to running services. Through port scanning, the system can further drill down to the specific service level for detection and lay the foundation for the next step of service classification.

[0073] S203: Service identification and classification.

[0074] After the port scan is completed, the system will identify the services running on the open ports and categorize them. This is usually done by sending a preset packet to the open port and then calling a tool such as the Nmap database to analyze the response information to identify the service type.

[0075] The purpose of service classification is to organize all identified services into categories so that subsequent detection can perform relevant vulnerability tests on specific services. For example, the port running the identified Apache service can be distinguished from other services to lay the foundation for the detection of path traversal vulnerabilities.

[0076] S204: Initiate a Curl request command to the Apache service.

[0077] Once an open port is identified as running an Apache service, the system will initiate a specific Curl request command to the icons directory path of the service. The specific command requested is

[0078] curl -v --path-as-is

[0079] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / %2e / etc / passwd. This command is designed to bypass the path verification mechanism of the Apache server to read the server's / etc / passwd file.

[0080] This step is the core of detecting Apache path traversal vulnerabilities. By sending a constructed HTTP request, the system can verify whether the target Apache server has a path traversal vulnerability. If the request successfully connects and reads the / etc / passwd file, it means that the server has a serious path traversal vulnerability.

[0081] S205: Parse the / etc / passwd file to extract user information.

[0082] After the Curl request is successful, the system will parse the / etc / passwd file and extract the user information. This file usually contains basic information of all users in the system, such as user name, user ID, group ID, etc. The system will pay special attention to mysql database users, ftp file transfer users, etc. to determine whether there are potential security risks.

[0083] By parsing the / etc / passwd file and extracting key user information, the system can better understand the user configuration of the target server and provide strong support for subsequent security detection and privilege escalation.

[0084] S206: Detect path traversal vulnerability.

[0085] After extracting user information, the system will conduct further security checks on these users. Specific operations include brute-forcing passwords of extracted users, finding user weaknesses, and verifying these weaknesses using specific attack scripts. After successfully obtaining low-privileged users, the system will also try to escalate permissions and eventually obtain the administrator user's system permissions.

[0086] Through attack operations, the system can confirm and verify whether the Apache server actually has an exploitable path traversal vulnerability and assess its severity.

[0087] S207: Generate a test report.

[0088] After completing all detection steps, the system will generate a detailed detection report based on the detection results. The report will include all detected vulnerability information, the users involved and their permission status, the attack steps performed, the test results and the recommended repair measures.

[0089] The detection report is the final output, which provides a comprehensive security assessment and operation guide for system administrators or security experts. By reading the report, users can understand the current security status of the server and take appropriate measures to fix the detected vulnerabilities and improve the overall security of the system.

[0090] Beneficial effects: The entire process from network detection, service identification to vulnerability exploitation and report generation forms a closed-loop security detection process. Through this method, users can systematically detect path traversal vulnerabilities in Apache HTTP Server, comprehensively evaluate and repair the security risks of the server.

[0091] Furthermore, the Curl request command includes: curl-v --path-as-is

[0092] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / %2e / etc / passwd.

[0093] The curl command initiates a get request and returns the content of the IP address page. The -v parameter is in detailed mode, which displays the detailed process of the network request, including the header information of the request and response, the request method, the URL, the data sent, etc. The --path-as-is parameter allows the original data to be used for packet sending.

[0094] The http: / / IP address / icons parameter is a path point that may have a path traversal vulnerability. The / .%2e / %2e%2e / %2e%2e / %2e%2e / etc / passwd parameter can be decoded by the Apache server and converted into standard characters, such as %2e will be converted to ".". The converted parameter is / .. / .. / .. / .. / .. / etc / passwd, where each / .. / parameter symbol returns the path to the previous level, and multiple / .. / parameters return the path to the root directory, bypassing the Apache server's detection of path traversal symbols, thereby achieving path traversal and reading the / etc / passwd file on the Apache server.

[0095] The Curl command obtains the file content on the target server by sending an HTTP GET request. The path traversal attack exploits the path parsing vulnerability of the Apache server. By recursively accessing the parent directory symbol / .. / , the attacker can access server files that should not be made public (such as / etc / passwd), thereby bypassing the server's security mechanism.

[0096] By understanding the role of the Curl command and its parameters, the path traversal vulnerability can be effectively exploited to read sensitive files on the server. In actual operation, the attacker can further adjust the command according to the specific configuration of the server to increase the success rate of the attack.

[0097] If the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed, and the detected host user is extracted, including extracting the mysql database user and the ftp file transfer user in the / etc / passwd file.

[0098] The / etc / passwd file contains basic information of all users in the system, such as user name, user ID, group ID, home directory, and shell path. By analyzing this information, attackers can identify which users may have weak passwords or other vulnerabilities, thus laying the foundation for further attacks.

[0099] The extracted user information can not only be used for further attacks, but also help attackers understand the user structure of the target system and choose appropriate attack strategies. For example, some specific service accounts (such as mysql or ftp) are usually configured with weak passwords or improper permissions. Using this information, more in-depth vulnerability exploitation and privilege escalation can be carried out.

[0100] The detection of the detected host user to obtain the Apache Http Server path traversal vulnerability includes:

[0101] Crack user passwords by brute force;

[0102] Find user weaknesses and use attack scripts to verify the weaknesses and obtain the first-level permission user;

[0103] The authority of the first-authority user is upgraded to obtain the administrator user system authority.

[0104] The extracted user passwords are cracked using Python scripts and common password dictionaries. By enumerating all possible password combinations, the attacker attempts to obtain the user's valid login credentials.

[0105] Brute force is a heuristic-based password cracking method, usually using an automated script to generate a large number of possible password combinations and try them one by one. Python scripts can automate this process and speed up the cracking process, especially when using a wide range of password dictionaries, as common weak passwords are more likely to be cracked.

[0106] Brute force cracking may be limited by password policies (such as locking mechanisms or delayed responses) in some cases, so the cracking method should be adjusted according to the security policy of the specific system. For example, the cracking efficiency can be improved through distributed cracking tools or social engineering methods. In addition, integrating brute force cracking functions in detection tools can further verify the actual threat level of path traversal vulnerabilities.

[0107] After identifying the users in the / etc / passwd file, the system will verify the weaknesses of these users or services through known targeted attack scripts. This process is designed to confirm whether there are exploitable security vulnerabilities for specific users.

[0108] Targeted attack scripts are attack tools based on known vulnerabilities or weaknesses, usually used to verify the security of specific services or users. For example, for certain versions of FTP services or database services, public vulnerabilities may be used in unpatched systems to further exploit these weaknesses for privilege escalation or data theft.

[0109] The success of a targeted attack depends on the speed of updating the attack script and the accuracy of targeting the target service. Attackers need to constantly update their attack tools to cope with different versions of software and operating systems. At the same time, this also reminds system administrators to update and patch known vulnerabilities in the system in a timely manner to reduce the risk of targeted attacks.

[0110] After the first-privilege user (low-privilege user) account is cracked or exploited, the system will try to escalate user privileges through known vulnerabilities. Attackers can query the system kernel version by issuing commands such as uname -r, and further escalate privileges by exploiting known kernel vulnerabilities, ultimately obtaining the highest privileges of the administrator user (root or admin user).

[0111] Privilege escalation attack is the process of elevating a low-privileged user account (such as a normal user) to a high-privileged account (such as a system administrator). By querying the system kernel version, the attacker can determine whether the system has an unpatched privilege escalation vulnerability and use the corresponding attack script to obtain higher system permissions.

[0112] Successful privilege escalation means that the attacker can fully control the target system and perform any operations, such as installing malware, modifying system configurations, stealing sensitive data, etc. For system administrators, the key to preventing privilege escalation attacks is to update the kernel and applications in a timely manner, set strict privilege management policies, and monitor abnormal behavior.

[0113] Through the interpretation, explanation and extension of these claims, we can see that the entire Apache HTTP Server path traversal vulnerability detection method covers the complete attack chain from detection to exploitation to privilege escalation. It not only verifies the existence of path traversal vulnerabilities, but also demonstrates the actual threat posed to the system by exploiting these vulnerabilities.

[0114] The embodiments of the present disclosure provide a system and method for detecting path traversal vulnerabilities in Apache HTTP Server, which scans the target IP address list, detects its network reachability, records open ports and identifies the types of running services, uses the Curl command to launch a path traversal attack on the port classified as an Apache service, and parses the user information in the obtained / etc / passwd file. By further detecting the strength and weaknesses of the user password, the user's rights are finally improved, and a detailed vulnerability detection report is generated, achieving the effect of automatically, comprehensively and efficiently detecting the path traversal vulnerability of Apache HTTP Server and deeply analyzing the security of the system.

[0115] The electronic device 300 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 300 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 300 and does not constitute a limitation of the electronic device 300. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0116] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0117] The memory 302 may be an internal storage unit of the electronic device 300, for example, a hard disk or memory of the electronic device 300. The memory 302 may also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Further, the memory 302 may also include both an internal storage unit of the electronic device 300 and an external storage device. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0118] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present disclosure. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0119] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0120] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0121] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0122] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0123] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0124] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0125] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. A path traversal vulnerability detection system for Apache Http Server, characterized in that: include: A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service; Request module, used to initiate Curl request command and read / etc / passwd file; A parsing module, used to extract the detected host user from the / etc / passwd file; A detection module, used for detecting the detected host user to obtain a path traversal vulnerability of Apache Http Server; The detection report module is used to generate a detection report of the detected host according to the Apache Http Server path traversal vulnerability.

2. A method for detecting path traversal vulnerabilities in Apache Http Server, characterized in that: include: Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the target IP address list; If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers; Classify services by identifying services running under open ports; If the service is classified as an Apache service, initiate a Curl request command to the icons directory path of the Apache service; If the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed to extract the user of the detected host; Detecting the detected host user to obtain the Apache Http Server path traversal vulnerability; A detection report of the detected host is generated according to the Apache Http Server path traversal vulnerability.

3. The method according to claim 2, characterized in that The Curl request command includes: curl-v --path-as-is http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / %2e / etc / passwd.

4. The method according to claim 2, characterized in that: If the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed, and the detected host user is extracted, including extracting the mysql database user and the ftp file transfer user in the / etc / passwd file.

5. The method according to claim 2, characterized in that: The detection of the detected host user to obtain the Apache Http Server path traversal vulnerability includes: Crack user passwords by brute force; Find user weaknesses and use attack scripts to verify the weaknesses and obtain the first-level permission user; The authority of the first-authorized user is upgraded to obtain the administrator user system authority.

6. An electronic device, characterized in that: include: one or more processors; A storage unit is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors can implement the path traversal vulnerability detection method for Apache Http Server according to any one of claims 2 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it can implement the path traversal vulnerability detection method for Apache Http Server according to any one of claims 2 to 5.

Images