Network application vulnerability detection method and device based on SQL (Structured Query Language) tracking and computer readable medium

Abstract

The invention provides a network application vulnerability detection method and device based on SQL (Structured Query Language) tracking, a computer readable medium and a program product. The method comprises the following steps: acquiring an access log of a to-be-detected network application; uRL parameter information is extracted from the access log, and SQL parameter information executed by a database corresponding to the URL is tracked in a distributed mode; screening out potential SQL injection points according to the URL parameter information and SQL parameter information executed by the database; and performing an injection penetration test on the potential SQL injection points, and detecting whether the network application has vulnerabilities or not. According to the method, the SQL injection test is combined with a log system and a distributed tracking system, potential injection points are screened out, invalid scanning of URLs without data access is avoided, injection test is only carried out on URL parameters actually executing database statements, and the success rate and the detection efficiency of SQL injection detection are improved; an automatic and intelligent SQL injection detection process is adopted, so that human errors are reduced, and the automation degree of penetration testing is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a network application vulnerability detection method, device, computer-readable medium and program product based on SQL tracing. Background Art

[0002] With the rapid development of information technology, network applications and database systems are becoming more and more popular in enterprises. At the same time, network security issues are becoming increasingly prominent. SQL injection attacks are a common means of network attacks. They insert malicious SQL codes into the input parameters of Web applications to illegally access or destroy databases. Internal penetration drills can effectively protect enterprise systems from SQL injection attacks.

[0003] The existing detection and defense against SQL injection attacks usually include using SQL injection detection tools (such as sqlmap) for automated scanning and penetration testing. Usually, a list of uniform resource locators (URLs) of internal services is collected and traversed, and SQL injection tests are performed on the parameters of each URL to determine whether there are vulnerabilities. Although the existing technology can detect SQL injection vulnerabilities to a certain extent, it still has the following defects:

[0004] Inefficiency: Existing tools need to scan all URLs and their parameters one by one, which is a time-consuming process, especially in large websites or applications, and also leads to a waste of resources.

[0005] Low success rate: Since not all URLs access the database, existing tools waste a lot of resources on useless URLs during the scanning process. Not all parameters are passed to the database query. Existing tools cannot distinguish which URLs access the database and which do not, resulting in a large number of invalid operations during the scanning process.

[0006] Much manual intervention: During the penetration test, manual intervention is required to screen URLs and parameters, and the degree of automation is not high. Summary of the invention

[0007] Multiple aspects of the present application provide a network application vulnerability detection method, device, computer-readable storage medium and program product based on SQL tracing, which screen out potential injection points and avoid invalid scanning of URLs with no data access, so as to solve the problem of low efficiency and success rate of existing tools when traversing all URL injection points.

[0008] In one aspect of the present application, a method for detecting network application vulnerabilities based on SQL tracing is provided, comprising: obtaining an access log of a network application to be detected;

[0009] Extracting URL parameter information from the access log, and distributed tracing SQL parameter information executed by the database corresponding to the URL;

[0010] Screening out potential SQL injection points based on the URL parameter information and the SQL parameter information executed by the database;

[0011] Perform injection penetration testing on the potential SQL injection points to detect whether the network application has vulnerabilities.

[0012] According to a preferred embodiment of the present invention, obtaining the access log of the network application to be detected further includes:

[0013] Determine the module information to be detected in the network application;

[0014] Get all access logs of the module to be tested within one month.

[0015] According to a preferred embodiment of the present invention, the step of extracting URL parameter information from the access log and distributedly tracing SQL parameter information executed by the database corresponding to the URL further includes:

[0016] Extracting URL parameter information and a distributed tracing ID of the URL from the access log;

[0017] Distributed tracing is performed according to the distributed tracing ID to query whether a database is accessed when obtaining the URL parameter information, and if so, SQL parameters executed by the database are extracted.

[0018] According to a preferred embodiment of the present invention, the step of screening out potential SQL injection points according to the URL parameter information and the SQL parameter information executed by the database further comprises:

[0019] The URL parameters are compared with the SQL parameters executed by the database. If the two values ​​are consistent, the URL is determined to be a potential SQL injection point.

[0020] According to a preferred embodiment of the present invention, the injection penetration test is performed on the potential SQL injection point to detect whether the network application has a vulnerability further comprising:

[0021] Using SQL injection detection tools to perform injection penetration detection on the potential SQL injection points;

[0022] Record the test results, determine whether the injection is successful, and generate a test report based on the test results.

[0023] According to a preferred embodiment of the present invention, after determining whether the injection is successful, the method further includes:

[0024] Generate corresponding repair suggestions based on the injection details and detection results of the URL injection point, and send the suggestions to the corresponding administrator.

[0025] Another aspect of the present application provides a network application vulnerability detection device based on SQL tracing, the device comprising:

[0026] A log acquisition module is used to obtain the access log of the network application to be detected;

[0027] A parameter extraction module is used to extract URL parameter information from the access log and to distribute and track the SQL parameter information executed by the database corresponding to the URL;

[0028] An injection point screening module, used to screen out potential SQL injection points according to the URL parameter information and the SQL parameter information executed by the database;

[0029] The vulnerability detection module is used to perform injection penetration testing on the potential SQL injection point to detect whether the network application has a vulnerability.

[0030] Another aspect of the present application provides a network application vulnerability detection device based on SQL tracing, the device comprising:

[0031] at least one processor; and

[0032] a memory communicatively connected to the at least one processor; wherein,

[0033] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described above.

[0034] In another aspect of the present application, a computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions can be executed by a processor to implement the method.

[0035] Another aspect of the present application provides a computer program product, comprising a computer program, wherein the computer program implements the method when executed by a processor.

[0036] In the solution provided in the embodiment of the present application, by combining SQL injection testing with a log system and a distributed tracing system, potential injection points are screened out, invalid scanning of URLs with no data access is avoided, and the success rate and detection efficiency of SQL injection detection are improved; an automated and intelligent SQL injection detection process reduces manual intervention and improves the degree of automation of penetration testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0039] Figure 1 A flowchart of a network application vulnerability detection method based on SQL tracing provided in one embodiment of the present application;

[0040] Figure 2 A schematic diagram of a network application vulnerability detection device based on SQL tracing provided in an embodiment of the present application;

[0041] Figure 3 The present invention is a schematic diagram of the structure of a device suitable for implementing the solution in the embodiment of the present application.

[0042] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0045] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0046] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer program instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0047] The existing SQL injection detection tools lack specificity when traversing all URLs and parameters, resulting in waste of resources and low efficiency. At the same time, due to the lack of effective use of information in the log system and distributed tracing system, these tools cannot quickly locate URLs that may actually have SQL injection risks. These technical defects directly lead to low success rates and efficiency issues in SQL injection detection.

[0048] Term explanation: SQL Injection: A common network attack method in which attackers insert malicious SQL codes into the input parameters of Web applications to illegally access or destroy databases.

[0049] Internal Penetration Testing: A security assessment method that simulates hacker attacks and is designed to assess the security of an enterprise's internal network and systems. Testers simulate attack methods to detect whether the target system has security vulnerabilities.

[0050] SQL Injection Detection Tool: An automated tool used to detect whether a Web application has SQL injection vulnerabilities, such as sqlmap.

[0051] Log System: A system that records various information generated during the operation of network applications and systems, including user access logs, operation logs, etc.

[0052] Distributed Tracing System: A system used to monitor and track the request processing process in a distributed system, which can track the propagation path and execution status of requests between various services.

[0053] An embodiment of the present application provides a network application vulnerability detection method based on SQL tracing. The method integrates a log module and a distributed tracing module, compares the data in the request log and the distributed tracing module, and can identify potential injection points if the request parameters are passed to the database. SQL injection detection is only performed on the URL that accesses the database, which can greatly reduce the number of URLs that need to be scanned. At the same time, injection tests are only performed on the URL parameters that actually execute database statements, which increases the probability of detecting real injection points.

[0054] In actual scenarios, the execution subject of the method can be a user device, or a device formed by integrating a user device and a network device through a network, or an application running on the above device. The user device includes but is not limited to various terminal devices such as computers, mobile phones, tablet computers, smart watches, and bracelets. The network device includes but is not limited to network hosts, single network servers, multiple network server sets, or cloud computing-based computer sets, which can be used to implement some processing functions when setting an alarm. Here, the cloud is composed of a large number of hosts or network servers based on cloud computing, where cloud computing is a type of distributed computing, a virtual computer composed of a group of loosely coupled computer sets.

[0055] Figure 1 A flowchart of a network application vulnerability detection method based on SQL tracing provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method comprises at least the following processing steps:

[0056] Step S101, obtaining the access log of the network application to be detected.

[0057] Specifically, security inspectors submit the name of the module to be inspected and the log query request to the background server through the system. The background server's log management module determines the name of the module to be inspected and other information, and queries all application access logs of the module in the past month. The logs include time, server name and other related information.

[0058] Step S102: extracting URL parameter information from the access log, and distributedly tracing SQL parameter information executed by the database corresponding to the URL.

[0059] Specifically, the backend server sends the JSON structured data of the relevant logs to the system. The system parses the JSON data packet and extracts the URL request data and distributed tracking ID, namely request_id, in the access log.

[0060] For example, the URL parameter in the JSON data packet is: "url": " / leccallcenter / ivr / zybivrcallback?call_id=16675b41-1747-4c5a-9c1a-183be59062f0", and the distributed tracing ID is: "request_id": "8ee3da7400ae3048:d599621d8194bd6f:8ee3da7400ae3048:1".

[0061] Using the above distributed tracing ID, the distributed tracing module of the request system performs distributed tracing, and inquires whether the database is accessed when obtaining the URL parameter information. If so, the SQL parameters executed by the database are extracted. For example, using 8ee3da7400ae3048 in the distributed tracing ID in the above embodiment, the distributed tracing module is requested to perform distributed tracing, and a json structured return value is obtained. The JSON structure includes distributed tracing data, which is used to monitor and diagnose the request processing flow in the microservice architecture. The JSON structure specifically includes:

[0062] traceID: Tracing ID, used to identify the entire request chain.

[0063] spans: An array containing the individual operations or "spans" in the request chain.

[0064] Each span contains:

[0065] traceID: Same as the trace ID it belongs to.

[0066] spanID: A unique identifier for the span.

[0067] flags: Flags may be used to indicate certain states or properties.

[0068] operationName: The name of the operation, describing the operation or request represented by this span.

[0069] references: An array of references that contains references to other spans, usually indicating parent-child relationships.

[0070] startTime: The timestamp when the operation started.

[0071] duration: The duration of the operation.

[0072] tags: An array of objects containing key-value pairs that provide additional information about the operation, such as host name, client IP, HTTP status code, etc.

[0073] logs: An array that may be used to record log information during the operation.

[0074] processID: Identifies the process or service instance that performed the operation.

[0075] warnings: May contain warning messages during operation.

[0076] When the distributed tracing module queries, it queries the request (span) object (tags) to see whether there is an instruction with the operation name (operationName) as the database query (mysql query). If so, it means that the database was accessed when obtaining the URL parameter information. Therefore, the parameter value of "SQL" is obtained from the request object. The parameter value is: "value":"SELECT*FROM`tb_call_record`WHERE call_id in('16675b41-1747-4c5a-9c1a-183be59062f0')". The parameter value is the SQL parameter executed by the database.

[0077] Step S103, screening out potential SQL injection points according to the URL parameter information and the SQL parameter information executed by the database.

[0078] Specifically, the URL parameters are compared with the SQL parameters executed by the database. If the two values ​​are consistent, the URL is determined to be a potential SQL injection point, and URLs that do not access the database and URLs without injection points are excluded to reduce invalid scanning.

[0079] For example, in the above embodiment, the URL parameter "url": " / leccallcenter / ivr / zybivrcallback?call_id=16675b41-1747-4c5a-9c1a-183be59062f0" has been obtained from the feedback log, and the SQL parameter "value": "SELECT*FROM`tb_call_record`WHERE call_id in('16675b41-1747-4c5a-9c1a-183be59062f0')" obtained from the database by distributed tracing has been obtained. By comparison, it can be found that both contain call_id, and the transmitted values ​​are consistent, both of which are 16675b41-1747-4c5a-9c1a-183be59062f0. Then call_id is the potential injection point of the SQL injection.

[0080] Step S104, performing an injection penetration test on the potential SQL injection point to detect whether the network application has a vulnerability.

[0081] Specifically, firstly, the potential SQL injection point is subjected to injection penetration detection using a SQL injection detection tool. For example, after finding the potential injection point, the system will automatically use sqlmap to perform an injection penetration test on the potential injection point in the above embodiment.

[0082] The system records the returned results and determines whether the injection is successful based on the returned results. If the returned results contain "no SQL injection, the injection failed", it means that there is no vulnerability at the potential injection point; if the returned results contain "the back-end DBMS is MySQL, it means that the injection tool successfully entered the back-end database and the injection was successful", it means that there is a vulnerability at the potential injection point. The system records the points where the injection is successful and the points where the injection fails, and generates a detailed test report based on the test results. The report includes the details of the SQL injection points of the URL and the test statistics.

[0083] For example, if the injection is successful, the test report will display " / leccallcenter / ivr / zybivrcallback call_id succ"; if the injection fails, the test report will display " / leccallcenter / ivr / zybivrcallback session_id fail".

[0084] Preferably, the system can automatically generate corresponding repair suggestions based on the injection details and detection results of the URL injection point, and send the suggestions in the form of a report to the corresponding administrator, who can view the detection results and download the detection report and suggestions.

[0085] The embodiment of the present invention integrates a log module and a distributed tracing module, compares the data in the request log and the distributed tracing module, and can identify potential injection points if the request parameters are passed to the database. Only the URL that accesses the database is subjected to SQL injection detection, which can greatly reduce the number of URLs that need to be scanned and improve detection efficiency. At the same time, only the URL parameters that actually execute database statements are injected. The probability of detecting the real injection point will increase, the success rate will be improved, the SQL injection detection process will be optimized, and effective monitoring of database access behavior and rapid response to potential risks will be achieved. The entire detection process is automatically completed under system control, which reduces human errors, reduces errors, and saves human resources.

[0086] In addition, the embodiment of the present application also provides a network application vulnerability detection device based on SQL tracing, Figure 2 A schematic diagram of a network application vulnerability detection device based on SQL tracing provided in an embodiment of the present application is shown in FIG. Figure 2As shown, the device comprises:

[0087] The log acquisition module 11 is used to acquire the access log of the network application to be detected;

[0088] The parameter extraction module 22 is used to extract URL parameter information from the access log and to distribute and track the SQL parameter information executed by the database corresponding to the URL;

[0089] An injection point screening module 33 is used to screen out potential SQL injection points according to the URL parameter information and the SQL parameter information executed by the database;

[0090] The vulnerability detection module 44 is used to perform injection penetration testing on the potential SQL injection point to detect whether there is a vulnerability in the network application.

[0091] The above-mentioned device can execute the network application vulnerability detection method based on SQL tracing in the aforementioned embodiment, wherein the log acquisition module 11 executes step S101; the parameter extraction module 22 executes step S102; the injection point screening module 33 executes step S103; and the vulnerability detection module 44 executes step S104.

[0092] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the method corresponding to the electronic device may be the network application vulnerability detection method based on SQL tracing in the aforementioned embodiment, and its principle of solving the problem is similar to that of the method. The electronic device provided in an embodiment of the present application includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the methods and / or technical solutions of the aforementioned multiple embodiments of the present application.

[0093] The electronic device may be a user device, or a device formed by integrating a user device and a network device through a network, or may be an application running on the above device. The user device includes but is not limited to various terminal devices such as computers, mobile phones, tablet computers, smart watches, and bracelets. The network device includes but is not limited to network hosts, single network servers, multiple network server sets, or cloud computing-based computer sets, which can be used to implement some processing functions when setting an alarm. Here, the cloud is composed of a large number of hosts or network servers based on cloud computing, where cloud computing is a type of distributed computing, a virtual computer composed of a group of loosely coupled computer sets.

[0094] Figure 3A schematic diagram of a structure of a device suitable for implementing the solution in the embodiment of the present application, the device 1200 includes a central processing unit (CPU, Central Processing Unit) 1201, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM, Read Only Memory) 1202 or the program loaded from the storage part 1208 to the random access memory (RAM, Random Access Memory) 1203. In RAM 1203, various programs and data required for system operation are also stored. CPU 1201, ROM 1202 and RAM 1203 are connected to each other through bus 1204. Input / output (I / O, Input / Output) interface 1205 is also connected to bus 1204.

[0095] The following components are connected to the I / O interface 1205: an input section 1206 including a keyboard, a mouse, a touch screen, a microphone, an infrared sensor, etc.; an output section 1207 including a cathode ray tube (CRT), a liquid crystal display (LCD), an LED display, an OLED display, etc., and a speaker, etc.; a storage section 1208 including one or more computer-readable media such as a hard disk, an optical disk, a magnetic disk, a semiconductor memory, etc.; and a communication section 1209 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1209 performs communication processing via a network such as the Internet.

[0096] In particular, the methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the central processing unit (CPU) 1201, the above functions defined in the method of the present application are executed.

[0097] Another embodiment of the present application further provides a computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the methods and / or technical solutions of any one or more embodiments of the present application described above.

[0098] Specifically, the present embodiment may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device, or device.

[0099] Computer readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than a computer readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0100] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0101] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0102] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0104] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or page components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0105] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0107] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0109] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in a device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A network application vulnerability detection method based on SQL tracing, characterized in that: include: Obtain access logs of the network application to be tested; Extracting URL parameter information from the access log, and distributed tracing SQL parameter information executed by the database corresponding to the URL; Screening out potential SQL injection points based on the URL parameter information and the SQL parameter information executed by the database; Perform injection penetration testing on the potential SQL injection points to detect whether the network application has vulnerabilities.

2. The network application vulnerability detection method based on SQL tracing according to claim 1 is characterized in that: The obtaining of the access log of the network application to be detected further comprises: Determine the module information to be detected in the network application; Get all access logs of the module to be tested within one month.

3. The network application vulnerability detection method based on SQL tracing according to claim 1 is characterized in that: The step of extracting URL parameter information from the access log and distributedly tracing SQL parameter information executed by the database corresponding to the URL further includes: Extracting URL parameter information and a distributed tracing ID of the URL from the access log; Distributed tracing is performed according to the distributed tracing ID to query whether a database is accessed when obtaining the URL parameter information, and if so, SQL parameters executed by the database are extracted.

4. The network application vulnerability detection method based on SQL tracing according to claim 3 is characterized in that: The step of screening out potential SQL injection points according to the URL parameter information and the SQL parameter information executed by the database further includes: The URL parameters are compared with the SQL parameters executed by the database. If the two values ​​are consistent, the URL is determined to be a potential SQL injection point.

5. The network application vulnerability detection method based on SQL tracing according to claim 1 is characterized in that: The performing of injection penetration test on the potential SQL injection point to detect whether the network application has a vulnerability further includes: Using SQL injection detection tools to perform injection penetration detection on the potential SQL injection points; Record the test results, determine whether the injection is successful, and generate a test report based on the test results.

6. The network application vulnerability detection method based on SQL tracing according to claim 5 is characterized in that: After determining whether the injection is successful, the method further includes: Generate corresponding repair suggestions based on the injection details and detection results of the URL injection point, and send the suggestions to the corresponding administrator.

7. A network application vulnerability detection device based on SQL tracing, characterized in that: The device comprises: A log acquisition module is used to obtain the access log of the network application to be detected; A parameter extraction module is used to extract URL parameter information from the access log and to distribute and track the SQL parameter information executed by the database corresponding to the URL; An injection point screening module, used to screen out potential SQL injection points according to the URL parameter information and the SQL parameter information executed by the database; The vulnerability detection module is used to perform injection penetration testing on the potential SQL injection point to detect whether the network application has a vulnerability.

8. A network application vulnerability detection device based on SQL tracing, the electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

9. A computer readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images