Application security check method based on Yakit tool

Abstract

The invention provides an application security check method based on a Yakit tool, belongs to the technical field of network security, and adopts a Yaklang language and plug-in ecology as key technologies. The method comprises the steps of information collection, vulnerability analysis, risk assessment, vulnerability repair and test report generation. The security check efficiency and accuracy of the application system are improved, and comprehensive security guarantee is provided. The method is suitable for security check scenes of various application systems, and meanwhile, common service unauthorized access tests, injection type vulnerability tests, file uploading vulnerability tests, interface encryption, interface current limiting tests and the like can be carried out by utilizing plug-in functions. The application security check method based on the Yakit tool has the advantages of being efficient, accurate, high in expandability and the like.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an application security inspection method based on a Yakit tool. Background Art

[0002] With the rapid development of the Internet, application security issues are becoming increasingly prominent. Traditional security testing tools are unable to cope with complex and ever-changing network attacks and are unable to fully and accurately discover security vulnerabilities in applications. Therefore, a more intelligent and efficient security inspection tool is needed to meet current security challenges.

[0003] As a revolutionary interactive application security testing platform, Yakit integrates multiple security testing functions and a powerful plug-in ecosystem. It can also customize the implementation logic according to the vulnerability principle, and use the Yakit language to flexibly develop scripts to establish a customized plug-in warehouse, providing an efficient and comprehensive solution for application security inspection. With its unique technology and powerful functions, the Yakit tool has become an ideal choice to solve this problem. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides an application security inspection method based on the Yakit tool to solve the problems of low efficiency, insufficient accuracy, poor scalability, etc. in the existing application security inspection technology. By integrating a variety of security testing technologies and tools, a comprehensive, efficient, and accurate security inspection of the application system is achieved, potential security vulnerabilities are discovered in a timely manner, and effective repair solutions are provided, providing a strong guarantee for the safe and stable operation of various application systems.

[0005] The technical solution of the present invention is:

[0006] An application security inspection method based on the Yakit tool includes the following steps:

[0007] (1) Perform port detection and fingerprint identification on the target;

[0008] (2) Use plug-ins to perform vulnerability detection on open services;

[0009] (3) Import plug-ins to perform special tests on the application;

[0010] (4) Check the vulnerability list and fix the vulnerabilities according to the repair suggestions;

[0011] (5) If you need to export a report, use the report export module to export the test results into a report in CSV or HTML format.

[0012] Furthermore,

[0013] During the plug-in installation process, the compatibility and security of the plug-in will be automatically checked; the plug-in has an update function, which allows users to obtain the latest version of the plug-in in a timely manner; at the same time, plug-ins can collaborate and communicate with each other to form an organic whole.

[0014] During the port scanning process, the service type and version information of the target application system are identified, and the HTTP server software type and version information used by the server are determined by analyzing the HTTP header information, specific page content characteristics, and response time patterns returned by the server.

[0015] Vulnerability detection is carried out on the target application system through the built-in vulnerability detection modules and plug-ins of the Yakit platform.

[0016] The plugin detects vulnerabilities by simulating various attack scenarios and exploitation methods.

[0017] The general detection logic of the further plugin is as follows:

[0018] a. Initialize the Yakit environment

[0019] Call the yakit.AutoInitYakit() function.

[0020] b. Define input parameters

[0021] Use the cli.String function to define the input parameters, and finally call the cli.check() function to check whether the input parameters meet the set requirements.

[0022] c. Define a list of test paths

[0023] A list named PATHS is created containing one or more string paths that will be used as the destination paths for subsequent test requests.

[0024] d. Construct HTTP request packet template

[0025] Define a string variable named packet. This template contains common HTTP request header information and specifies the request method.

[0026] e. Start vulnerability check

[0027] f. End vulnerability check

[0028] A check-end message is outputted through yakit.Info, marking the end of the complete vulnerability check process.

[0029] Among them, vulnerability checks specifically include:

[0030] First, a message about starting the check is output through yakit.Info so that the starting status of the check can be seen at runtime;

[0031] Then use a loop to iterate over each path in the PATHS list:

[0032] For each path, send the constructed HTTP request data packet by calling the poc.HTTP function, and obtain the response byte data rspBytes and the request byte data reqBytes;

[0033] Then use the str.FixHTTPResponse function to process the response data to obtain the processed fixed response fixedResponse, the response body content body, and the possible error message err; if an error occurs, the die(err) function is used to terminate the program execution.

[0034] After converting the response body content from bytes to a string, use the json.loads function to parse it into a JSON object bodyRaw, and then use the json.Find function to find the value of the statusCode field from the parsed JSON object.

[0035] If the value of the statusCode field is equal to "200", it is considered that the application has XX vulnerability.

[0036] The corresponding prompt information is output through yakit.Info.

[0037] Call the risk.NewRisk function to create a new risk object, passing in a series of risk-related information.

[0038] If statusCode is not equal to "200", a prompt message indicating that the application does not have the vulnerability is output through yakit.Info("The application does not have the XX vulnerability").

[0039] Going further,

[0040] After the vulnerability detection is completed, the detected security vulnerability information is organized and displayed; in the vulnerability list, users can see the details of each security vulnerability; vulnerabilities are divided into common types, and repair plans are formulated based on the specific circumstances of the vulnerabilities.

[0041] After the test is completed, the target application system will be repaired according to the repair plan given in the vulnerability review phase.

[0042] Generate a test report as a summary output of the security check process. The vulnerability list section of the report details the specific information of each vulnerability. In addition to the specific repair solutions for each vulnerability, the repair suggestion section also provides security suggestions.

[0043] The beneficial effects of the present invention are

[0044] By utilizing the various security testing functions and plug-in ecology of the Yakit platform, a comprehensive and in-depth security check of the application system is achieved. The method of the present invention has the advantages of high efficiency, accuracy, and scalability, and can timely discover and repair security vulnerabilities in the application system, thereby improving the security and stability of the application system. The present invention solves the problems of low efficiency, insufficient accuracy, and poor scalability in existing application security inspection technologies, and provides a strong guarantee for the safe and stable operation of the application system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0046] Figure 2 This is a diagram of the self-developed plug-in list;

[0047] Figure 3 It is the overall architecture diagram of the method of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0049] The present invention provides an application security inspection method based on the Yakit tool. The key technologies are the Yaklang language and the plug-in ecosystem. The method covers the steps of information collection, vulnerability analysis, risk assessment, vulnerability repair and test report generation. It can improve the efficiency and accuracy of application system security inspection and provide comprehensive security protection. It is suitable for security inspection scenarios of various application systems, such as MITM interactive hijacking test, port scanning and fingerprint detection, weak password detection, and plug-in functions can be used to perform common service unauthorized access test, injection vulnerability test, file upload vulnerability test, interface encryption, interface current limiting test, etc.

[0050] 1) Key technologies

[0051] ①Yaklang language

[0052] As a dedicated programming language for the Yakit platform, Yaklang plays a core role in the entire security testing system. It has a unique design concept and powerful functions, and can seamlessly integrate various security tools and products. The syntax of the Yaklang language is concise and clear, easy to learn and use, and highly flexible and scalable. It supports multiple programming paradigms, such as object-oriented programming, functional programming, etc., allowing security testers to choose the most appropriate programming method according to different security testing needs.

[0053] In terms of integration with security tools, the Yaklang language can easily interact with various existing security tools through its rich APIs and interfaces. For example, it can be deeply integrated with port scanning tools, vulnerability detection tools, network protocol analysis tools, etc. to achieve data sharing and collaborative work. This integration capability not only improves the efficiency of security testing, but also fully utilizes the advantages of various security tools to build a more comprehensive and powerful security testing solution. In addition, the Yaklang language also supports flexible customization of the security testing process. Security testers can use the Yaklang language to write customized security testing scripts based on specific test scenarios and goals to achieve targeted detection of specific security issues.

[0054] ②Plug-in ecosystem

[0055] The plug-in ecosystem is an important technical highlight of the present invention based on the Yaklang language. The system supports users to import plug-in modules developed based on the Yaklang language to expand security testing capabilities through plug-ins. The plug-in development process is relatively simple and standardized. Security testers and developers can use the powerful functions of the Yaklang language to quickly develop plug-ins that meet specific needs. These plug-ins can be customized for different application systems, different types of security vulnerabilities, and different industry standards.

[0056] The plug-in ecosystem has a good management mechanism, including plug-in installation, uninstallation, update and security review functions. During the plug-in installation process, the system automatically checks the compatibility and security of the plug-in to ensure that the plug-in can run stably in the system and will not introduce new security risks. The plug-in update function allows users to obtain the latest version of the plug-in in a timely manner and maintain the ability to detect the latest security threats. At the same time, plug-ins can collaborate and communicate with each other to form an organic whole and jointly complete complex security testing tasks. For example, a plug-in for detecting network vulnerabilities can cooperate with a plug-in for analyzing application vulnerabilities to achieve comprehensive security testing of the entire system.

[0057] 2) Safety inspection methods

[0058] ①Information Collection

[0059] Information collection is the first step of security inspection, and its accuracy and comprehensiveness are crucial for subsequent vulnerability detection. At this stage, the system uses a variety of advanced technical means, including but not limited to port scanning and fingerprint recognition technology. During the port scanning process, the service type and version information of the target application system are accurately identified. The system can accurately determine the type of HTTP server software (such as ApacheTomcat, Nginx, etc.) and its version information used by the server by analyzing multiple factors such as the HTTP header information returned by the server, specific page content characteristics, and the time pattern of the response, etc., to build a comprehensive information foundation for subsequent vulnerability detection.

[0060] ②Vulnerability detection

[0061] Based on the comprehensive information collected in the early stage, the vulnerability detection stage is the core link of the entire security inspection process. The Yakit platform gives full play to its powerful functions, using built-in vulnerability detection modules and self-developed plug-ins to conduct comprehensive and in-depth vulnerability detection on the target application system. The built-in vulnerability detection modules cover a wide range of security vulnerability types, and these modules are designed based on professional vulnerability detection algorithms and security rule libraries. For example, for common SQL injection vulnerabilities, the system will simulate the behavior of malicious attackers by injecting carefully constructed SQL statements into the input interface of the target system, while monitoring the system's response to determine whether there is an SQL injection vulnerability.

[0062] Self-developed plug-ins further expand the breadth and depth of vulnerability detection. These plug-ins are specially designed for specific security vulnerability scenarios and detect vulnerabilities by simulating various complex attack scenarios and exploitation methods. For example, unauthorized access detection plug-ins for each service, general application security check plug-ins, and customized application security check plug-ins. The general detection logic of self-developed plug-ins is as follows:

[0063] a. Initialize the Yakit environment

[0064] All plugins first call the yakit.AutoInitYakit() function, which is used to initialize Yakit-related environment settings, load necessary libraries or modules, etc., so that subsequent code can run normally and utilize the various functions provided by Yakit.

[0065] b. Define input parameters

[0066] Use the cli.String function to define input parameters. Common input parameters are as follows:

[0067] target: used to specify the target to be tested. Its purpose is clarified through a series of setting functions (such as setting help information, display name, etc.), and a default value is set. Usually, this parameter needs to be set as a required parameter.

[0068] contextPath: used to input application context. Related attributes are also set, including default values ​​and required fields.

[0069] Cookie: used to enter valid cookie information, with detailed help instructions, display name and default value (such as "JSESSIONID = 0A9D20A9A525E27AE7CC2A785A4DDD07; webfinal.session.errorCount = 0; James_cookie_sYQDUGqqzHtheme = custom") set. The default value is used to provide an example to help users understand the format of the input parameters. This parameter should usually also be set as required.

[0070] Finally, the cli.check() function is called to check whether the above input parameters meet the set requirements (such as whether the required parameters have been provided, etc.).

[0071] c. Define a list of test paths

[0072] A list named PATHS is created, which contains one or more string paths. Usually the test path is fixed, but for file upload vulnerabilities, if there are multiple file upload paths in the system, multiple paths need to be defined. These paths will be used as the target paths to which subsequent test requests will be sent.

[0073] d. Construct HTTP request packet template

[0074] A string variable named packet is defined, which is actually a template for an HTTP request data packet. This template contains common HTTP request header information, such as Host, Accept, User-Agent, Origin, Referer, Cookie, Accept-Language, Content-Type, etc., and specifies the request method.

[0075] For example, in the request body of the file upload vulnerability plug-in, a multipart / form-data format request body is constructed by setting the boundary, which contains some information related to the simulated uploaded file, such as the file name (set to "test.jsp"), type (set to "image / png"), and a file domain named "file", whose filename is also set to "test.jsp", but the actual content is empty ({}). At the same time, the target path and related parameters of the request (such as target, contextPath, cookies, etc.) are used in the template in the form of {{params(...)}} to occupy the placeholder so that they can be dynamically replaced with the actual value when sending the request later.

[0076] e. Start vulnerability check

[0077] First, output a check start message through yakit.Info("Check item 1-XX vulnerability-Start checking!-----------------------------"), so that the starting status of the check can be clearly seen during runtime.

[0078] Then use a loop to iterate over each path in the PATHS list:

[0079] For each path, the constructed HTTP request data packet is sent by calling the poc.HTTP function (the packet and related parameters are passed in, and the dynamically replaced parameter values ​​are passed in through poc.params, such as the currently traversed path, target address, cookie, etc., and the timeout is set to 10 seconds and the number of retries is set to 3 times), and the response byte data rspBytes and the request byte data reqBytes are obtained.

[0080] Then use the str.FixHTTPResponse function to process the response data and obtain the processed fixed response fixedResponse, the response body content body, and the possible error message err. If an error occurs (err is not empty), the die(err) function terminates the program execution.

[0081] After converting the response body content from bytes to a string, use the json.loads function to parse it into a JSON object bodyRaw, and then use the json.Find function to find the value of the statusCode field from the parsed JSON object.

[0082] If the value of the statusCode field is equal to "200", it is considered that the application has XX vulnerability:

[0083] The corresponding prompt information is output through yakit.Info("The application has XX vulnerability").

[0084] Call the risk.NewRisk function to create a new risk object, passing in a series of risk-related information, such as the target address, risk type, risk payload (i.e. the request packet sent), risk severity ("high", "middle", "low"), risk title, risk request (also packet), risk description, risk solution, and risk details.

[0085] If statusCode is not equal to "200", a prompt message indicating that the application does not have the vulnerability is output through yakit.Info("The application does not have the XX vulnerability").

[0086] f. End vulnerability check

[0087] Finally, a check end message is output through yakit.Info("Check item 1-XX vulnerability check-check completed! -----------------------------"), marking the end of the complete process of this vulnerability check.

[0088] ③Results View

[0089] After the vulnerability detection is completed, the system will organize and display the detected security vulnerability information. In the vulnerability list, users can clearly see the details of each security vulnerability, including risk level, classification, description and repair plan. Vulnerabilities are divided into common types to facilitate user statistical analysis. The repair plan is formulated by security experts based on the specific situation of the vulnerability, which is highly targeted and operational and can guide subsequent repair work.

[0090] ④Vulnerability repair

[0091] After the test is completed, developers can fix the vulnerabilities in the target application system according to the repair plan given in the vulnerability review phase. The repair plan is detailed, including the location of the vulnerability, the cause, the possible security risks, as well as the specific repair plan and code examples, providing powerful help for developers to fix the vulnerability.

[0092] ⑤Test report

[0093] A detailed test report is generated through the export report module as a summary output of the security check process. The vulnerability list section of the report details the specific information of each vulnerability, and the repair suggestion section may include general security suggestions in addition to the specific repair solutions for each vulnerability, such as strengthening access control, regularly updating patches, adding protective equipment, etc., which helps users understand the security status of the system and formulate security strategies and measures.

[0094] like Figure 1 The specific steps are as follows:

[0095] (1) Perform port detection and fingerprint identification on the target;

[0096] (2) Select appropriate plug-ins to perform vulnerability detection on open services;

[0097] (3) Import self-developed plug-ins to conduct special tests on the application;

[0098] Self-developed file upload vulnerability detection plug-in code example:

[0099] This plug-in detects whether the application has a file upload vulnerability, mainly including the following steps

[0100] ① Set the test input information, including the application's IP port and context and valid cookies

[0101]

[0102]

[0103] ②Set the test path and initialize the request package

[0104]

[0105]

[0106] ③ Start calling the interface for testing, determine whether there is a vulnerability through the response code, and call the result generation method to output the test results

[0107]

[0108]

[0109] (4) Check the vulnerability list and fix the vulnerabilities according to the repair suggestions;

[0110] (5) If you need to export a report, use the report export module to export the test results into a report in CSV or HTML format.

[0111] The above description is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. An application security inspection method based on the Yakit tool, characterized in that: The steps include: (1) Perform port detection and fingerprint identification on the target; (2) Use plug-ins to perform vulnerability detection on open services; (3) Import plug-ins to perform special tests on the application; (4) Check the vulnerability list and fix the vulnerabilities according to the repair suggestions; (5) If you need to export a report, use the report export module to export the test results into a report in CSV or HTML format.

2. The method according to claim 1, characterized in that: The compatibility and security of the plug-in are automatically checked during the plug-in installation process; the plug-in has an update function that allows users to obtain the latest version of the plug-in in a timely manner; at the same time, the plug-ins collaborate and communicate with each other to form an organic whole.

3. The method according to claim 1, characterized in that During the port scanning process, the service type and version information of the target application system are identified, and the HTTP server software type and version information used by the server are determined by analyzing the HTTP header information, specific page content characteristics, and response time patterns returned by the server.

4. The method according to claim 1, characterized in that: Vulnerability detection is carried out on the target application system through the built-in vulnerability detection modules and plug-ins of the Yakit platform.

5. The method according to claim 4, characterized in that The plugin detects vulnerabilities by simulating various attack scenarios and exploitation methods.

6. The method according to claim 5, characterized in that The general detection logic of the plug-in is as follows a. Initialize the Yakit environment Call yakit.AutoInitYakit() function b. Define input parameters Use the cli.String function to define the input parameters, and finally call the cli.check() function to check whether the input parameters meet the set requirements; c. Define a list of test paths Create a list named PATHS containing one or more string paths that will be used as the target paths to which subsequent test requests will be sent; d. Construct HTTP request packet template Define a string variable named packet. This template contains the HTTP request header information and specifies the request method. e. Start vulnerability check f. End vulnerability check The information about the end of the check is output by yakit.Info, marking the end of the complete process of this vulnerability check.

7. The method according to claim 6, characterized in that Vulnerability checks, including: First, output the start check information through yakit.Info so that you can see the starting status of the check at runtime; Then use a loop to iterate over each path in the PATHS list: For each path, send the constructed HTTP request data packet by calling the poc.HTTP function, and obtain the response byte data rspBytes and the request byte data reqBytes; Then use the str.FixHTTPResponse function to process the response data, obtain the processed fixed response fixedResponse, the response body content body, and the possible error message err; if an error occurs, terminate the program execution through the die(err) function; Convert the response body content from bytes to a string and then use the json.loads function to parse it into a JSON object bodyRaw. Then use the json.Find function to find the value of the statusCode field from the parsed JSON object. If the value of the statusCode field is equal to "200", it is considered that the application has XX vulnerability: Output corresponding prompt information through yakit.Info; Call the risk.NewRisk function to create a new risk object and pass in a series of risk-related information; If statusCode is not equal to "200", a prompt message indicating that the application does not have the vulnerability is output through yakit.Info.

8. The method according to claim 1, characterized in that After the vulnerability detection is completed, the detected security vulnerability information is organized and displayed; in the vulnerability list, users can see the details of each security vulnerability; vulnerabilities are divided into common types, and repair plans are formulated based on the specific circumstances of the vulnerabilities.

9. The method according to claim 8, characterized in that After the test is completed, the vulnerabilities in the target application system are repaired according to the repair plan given in the vulnerability review phase.

10. The method according to claim 9, characterized in that Generate a test report as a summary output of the security check process. The vulnerability list section of the report details the specific information of each vulnerability. In addition to the specific repair solutions for each vulnerability, the repair suggestion section also provides security suggestions.

Images