Request message generation method and apparatus, station security testing method and apparatus

Abstract

The present disclosure discloses a request message generation method, which relates to the technical field of computers, and the specific implementation scheme is: obtaining a request message template, the request message template is a template of a request message, and the request message is communication data sent by a client to a server; analyzing the request message template to obtain template analysis data including a specified field representing at least one site information; obtaining specified data of the specified field to determine the site information of a target site through the specified data; and generating a target request message capable of being sent to the target site based on the template analysis data and the specified data, thereby improving the flexibility of request message generation.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, particularly to the fields of network security, security operation, and security testing, and specifically relates to a request message generation method and apparatus, a site security testing method and apparatus, an electronic device, and a computer-readable storage medium. Background Technology

[0002] A Web Application Firewall (WAF) is a product that provides protection for web application servers by enforcing a series of security policies for HTTP / HTTPS.

[0003] Testing a Web Application Firewall (WAF) requires sending a large number of HTTP (Hypertext Transfer Protocol) packets, each of which needs a unique identifier. Traditional methods typically involve manually constructing these HTTP packets, but this is inefficient and severely impacts the overall testing efficiency of WAFs.

[0004] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to solve the technical problem of low efficiency when manually constructing request messages or testing target sites, and to provide a request message generation method and apparatus, a site security testing method and apparatus, an electronic device, and a non-transitory computer-readable storage medium storing computer instructions.

[0006] The first aspect of this disclosure provides a method for generating a request message, the method comprising: obtaining a request message template, wherein the request message template is a template of a request message, and the request message is communication data sent by a client to a server; parsing the request message template to obtain template parsing data including specified fields representing at least one type of site information; obtaining specified data of the specified fields to determine the site information of a target site through the specified data; and generating a target request message that can be sent to the target site based on the template parsing data and the specified data.

[0007] The second aspect of this disclosure provides a site security testing method, which includes: obtaining a target request message related to a target site, wherein the target request message is generated using a request message generation method as described in any implementation of the first aspect; establishing a connection with the target site; sending the target request message to the target site; obtaining response information from the target site; and generating a security assessment result of the target site based on the response information.

[0008] A third aspect of this disclosure provides a request message generation apparatus, comprising: a template acquisition unit configured to acquire a request message template, wherein the request message template is a template for a request message, and the request message is communication data sent by a client to a server; a parsing unit configured to parse the request message template to obtain template parsing data including specified fields representing at least one type of site information; a data acquisition unit configured to acquire specified data of specified fields to determine site information of a target site through the specified data; and a message generation unit configured to generate a target request message that can be sent to the target site based on the template parsing data and the specified data.

[0009] This disclosure provides a site security testing apparatus in a fourth aspect. The apparatus includes: a message acquisition unit configured to acquire a target request message related to a target site, wherein the target request message is generated using a request message generation method as described in any implementation of the third aspect; a connection unit configured to establish a connection with the target site; a sending unit configured to send the target request message to the target site; a response acquisition unit configured to acquire response information fed back by the target site; and a result generation unit configured to generate a security assessment result of the target site based on the response information.

[0010] According to a fifth aspect, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a method as described in any implementation of the first or second aspect.

[0011] According to a sixth aspect, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing a computer to perform the method described in any implementation of the first or second aspect.

[0012] The request message generation method and apparatus provided in the embodiments of this disclosure first obtain a request message template, which is a template for a request message, whereby the request message is communication data sent by a client to a server; second, parse the request message template to obtain template parsing data including specified fields representing at least one type of site information; third, obtain specified data for the specified fields to determine the site information of the target site; and finally, based on the template parsing data and the specified data, generate a target request message that can be sent to the target site. Thus, by automatically generating the target request message by filling the specified data into the template parsing data of the request message template, no manual intervention is required, improving the efficiency of target request message generation; this disclosure also allows for batch generation of target request messages, saving the cost of generating target request messages. Attached Figure Description

[0013] Figure 1 This is a flowchart of an embodiment of the message generation method according to this disclosure request;

[0014] Figure 2 This is a structural diagram of a public request message template;

[0015] Figure 3 This is a flowchart of one embodiment of the site security testing method disclosed herein;

[0016] Figure 4 This is a schematic diagram of a structure of an embodiment of the message generation apparatus according to this disclosure request;

[0017] Figure 5 This is a schematic diagram of a structure of one embodiment of the site security testing apparatus disclosed herein;

[0018] Figure 6 This is a block diagram of an electronic device used to implement the request message generation method or site security testing method of the embodiments of this disclosure. Detailed Implementation

[0019] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0020] The technical solution of the present invention is illustrated below through specific embodiments. It should be understood that the one or more steps mentioned in the present invention do not preclude the existence of other methods and steps before or after the combined steps, or that other methods and steps may be inserted between these explicitly mentioned steps. It should also be understood that these examples are for illustrative purposes only and are not intended to limit the scope of the present invention. Unless otherwise stated, the numbering of each method step is only for the purpose of identifying each method step, and not for limiting the order of each method or limiting the scope of the present invention. Changes or adjustments to their relative relationships, without substantial changes to the technical content, can also be considered as within the scope of the present invention.

[0021] The raw materials and instruments used in the examples are not subject to any specific restrictions on their source; they can be purchased from the market or prepared according to conventional methods known to those skilled in the art.

[0022] BAS (Breach and Attack Simulation) is an automated security testing technology used to simulate real-world cyberattacks and evaluate the strength and effectiveness of an enterprise's defense system. By simulating various attack scenarios, BAS helps identify security vulnerabilities, misconfigurations, and defensive weaknesses, ensuring that security measures can cope with real-world threats. When testing target sites, BAS needs to construct a large number of request message packets, such as HTTP (Hypertext Transfer Protocol) packets. Constructing these packets presents several challenges:

[0023] The cost and speed of constructing a large number of data packets are significantly reduced if the template cannot be configured simply, intuitively, or extensibly due to the diversity of malicious data packets.

[0024] The ability to dynamically generate different data packets is required because each data packet contains a unique identifier for testing and fields that change dynamically based on each different target site (such as the Host header).

[0025] The data packet sending process must be controllable by the target. Since most target sites provide their systems in the form of domain names, such as https: / / www.zhiqiansec.com, such target sites may obtain multiple IP addresses A, B, and C after domain name resolution. If it is necessary to specify that address B should be used to test https: / / www.zhiqiansec.com during the entire packet sending test process, then the entire connection process needs to be fixed.

[0026] The aforementioned problems are all unresolved in traditional technologies and require appropriate solutions.

[0027] To address the shortcomings of existing technologies, this disclosure provides a method for generating request messages. Figure 1 A flow 100 illustrating an embodiment of a request message generation method is shown, the request message generation method comprising the following steps:

[0028] Step 101: Obtain the request message template.

[0029] In this embodiment, a request message is communication data sent by the client to the server to request a specific resource or trigger the server to perform a specific operation. In computer networks, especially under the HTTP protocol, request messages are a core component of client-server interaction. Generally, request messages are sent to the server in the form of data packets, and the target request message is a request message that meets business or development requirements.

[0030] In this embodiment, the request message template is the template for the aforementioned request message. The request message template defines the structure and content of the request message. Based on the content of the request message, the request message template can be divided into multiple areas, each representing different content of the request message. Specifically, the request message template can be a YAML template. YAML format is easy to read and write, suitable for configuring complex HTTP request messages. A YAML template is a template that defines the structure and content of a request message using the YAML (YAML Ain't Markup Language) language. It can be used in scenarios such as configuration files, data exchange, and object persistence. YAML is a text-based markup language used for data serialization.

[0031] In this embodiment, the request message template contains the general structure and content of various types of request messages. For example, the request message template is divided into four areas: request line, request header, space, and request body. Each area can contain different structures and contents of the request message. For instance, the request line area contains the request method, the URL (Uniform Resource Locator) field, the placeholder for the corresponding URL field, and the protocol version; the request header area contains the client environment and useful information for the request body; the space area is simply a blank line used to indicate the end of the request header; and the request body area can contain content or not. When no content is contained, it is determined that the request message has no request body. The URL (Uniform Resource Locator) field is a specified field, while the placeholder for the corresponding URL field and the protocol version are the site information of the site to be filled in.

[0032] Step 102: Parse the request message template to obtain template parsing data that includes specified fields representing at least one site information.

[0033] In this embodiment, the request message template records the structure and content of the request message. By parsing the content in the request message template, such as determining which content represents the request method in the request line of the request message, the general information of the request message can be determined.

[0034] In this embodiment, the specified field can be a field in the request message protocol that can be flexibly changed according to business needs or specifically designated for a particular site, such as a URL field. Since the actual content of the specified field needs to be specified, the request message template records the specified field and also provides the corresponding position for the actual content of the specified field. After parsing the request message template, the specified field and the position of the corresponding actual content can be obtained. The template parsing data is data obtained after understanding the request message format content of the information recorded in the request message template. The template parsing data contains the specified field, and the position of the actual content corresponding to the specified field can be determined through the specified field.

[0035] Step 102 above includes: determining the request protocol of the target request message, identifying information in the request message template according to the request protocol; detecting whether a specified field in the request message template is identified, and when a specified field in the request message template is identified, placing a corresponding empty space in the specified field, continuing to identify information in the request message template until all information in the request message template is identified, and obtaining template parsing data including the specified field.

[0036] Step 103: Obtain the specified data of the specified field to determine the site information of the target site through the specified data.

[0037] In this embodiment, the specified data is the actual data that needs to be filled in the specified field, that is, the site information corresponding to the specified field. The specified data can be directly specified by the R&D personnel, or it can be automatically generated according to the target request message generation requirements when generating target request messages in batches. For example, when generating target request messages in batches, if it is necessary to generate target request messages for target sites, the URL of the target site is directly determined and the URL is used as the specified data of the URL field. The URL is the site information of the target site.

[0038] Step 104: Based on the template parsing data and the specified data, generate a target request message that can be sent to the target site.

[0039] In this embodiment, specified data is filled into the positions corresponding to specified fields in the template parsed data to obtain filled data. The filled data is then packaged according to a preset message protocol to generate a target request message that can be sent to the target site. By processing the target request message with a specific data parser, the site information of the target site can be determined, and the target request message can be sent to the target site based on the site information.

[0040] The request message generation method provided in the embodiments of this disclosure first obtains a request message template, which is a template for a request message, and the request message is communication data sent by the client to the server; second, it parses the request message template to obtain template parsing data including specified fields representing at least one site information; third, it obtains specified data for the specified fields to determine the site information of the target site; and finally, based on the template parsing data and the specified data, it generates a target request message that can be sent to the target site. Therefore, by automatically generating the target request message by filling the specified data into the template parsing data of the request message template, no manual intervention is required, thus improving the efficiency of target request message generation; this disclosure also allows for batch generation of target request messages, saving the cost of generating target request messages.

[0041] In some optional implementations of this disclosure, parsing the request message template to obtain template parsing data including a specified field representing at least one site information includes: determining the message structure data and body content data in the request message template; sorting the data in the message structure data according to a preset message protocol to obtain protocol parsing data including a specified field representing at least one site information and a specified placeholder; and using the protocol parsing data and body content data as template parsing data.

[0042] In this optional implementation, the message structure data is data that represents the structure of different types of request messages. The message structure data may include multiple fields corresponding to different request message protocols, such as POST, HOST, etc. The message structure data may also include: the content corresponding to each field, such as HTTP / 1.1; and the body content data, which represents the request body of the request message, such as u0000.

[0043] In this optional implementation, the message structure data corresponds to the part of the request message excluding the request body. The part of the request message excluding the request body can be obtained by parsing the message structure data. The body content data corresponds to the request body in the request message. The positions of the message structure data and body content data in the message template can be mapped to the request message message format accordingly. For example... Figure 2The image shows a request message template related to the HTTP protocol. This request message template includes: a variable definition area, a first area containing message structure data, and a body content area. Both the variable definition area and the body content area are areas where the body content data is located. The variable definition area is the area that defines the information corresponding to the variables in the body content data, and the body content area is the area where the request body is located in the message request.

[0044] In this optional implementation, sorting the data in the message structure data according to the preset message protocol to obtain protocol parsing data including specified fields and specified placeholders includes: matching the data in the message structure data sequentially according to the fields in the preset message protocol; since all fields corresponding to the message protocol are in the message structure data, the fields with placeholders in the information content are used as specified fields, and all successfully matched fields and their information content are used as protocol parsing data.

[0045] like Figure 2 As shown, variables are defined in the main text data that need to be dynamically rendered, such as null_hex, null_b64, and null_raw. These variables can identify, for example, the file being read or binary byte information that is not easily identified by text.

[0046] The http:attack:raw information displays the HTTP text identifier. The part that needs to be rendered can be marked with "{{", "}}" and variables defined in variables, such as "null_raw", and the final result is "{{null_raw}}". The rendered part refers to the part that needs to be filled in the parsed data in the parsed request message template.

[0047] Figure 2 The request message template shown is a YAML template. The execution body running on the request message generation method parses the YAML template and extracts various fields from the HTTP protocol, such as the HTTP Method (POST in the figure), the HTTP relative URL (e.g., / upload.jsp), the HTTP protocol version (e.g., HTTP / 1.1), and HTTP headers (e.g., User-Agent), as well as the body content data (e.g., null_hex:{{null_hex}}, null_b64:{{null_b64}}, null_raw:{{null_raw}}), to obtain the template parsing data.

[0048] This optional implementation provides a method for obtaining template parsing data, which involves determining the message structure data and body content data in the request message template; sorting the data in the message structure data according to a preset message protocol to obtain protocol parsing data including specified fields representing at least one site information and specified placeholders; and using the protocol parsing data and body content data as template parsing data, thus providing a reliable implementation method for dividing template parsing data.

[0049] In some optional implementations of this disclosure, the above-mentioned generation of a target request message that can be sent to a target site based on template parsing data and specified data includes: identifying a specified placeholder from the protocol parsing data; replacing the specified placeholder with the specified data to obtain protocol message data; processing the body content data to obtain body key-value pairs; obtaining body extracted data based on the body key-value pairs; sequentially combining the protocol message data and body extracted data according to the message protocol format to obtain a request message to be processed; and performing binary data conversion on the request message to be processed to obtain a target request message that can be sent to the target site.

[0050] In this embodiment, the above-mentioned processing of the main text content data to obtain main text key-value pairs includes: identifying variables in the main text content area and the variable values ​​of those variables, and using the variables and variable values ​​as main text key-value pairs. The above-mentioned obtaining the main text extracted data based on the main text key-value pairs includes: using the variable values ​​in the main text key-value pairs as the main text extracted data.

[0051] In this embodiment, the designated placeholder is a symbol predefined in the request message template, and different designated fields correspond to different designated placeholders; the body key-value pair consists of a key and a value, wherein the key can be a variable predefined in the request message template, and the value can be the value of the aforementioned variable. The variable value can be a value pre-set in the request message template, or a value obtained based on a pre-set rule.

[0052] like Figure 2 As shown, in Host:{{Hostname}}, Host is a specified field and Hostname is a specified placeholder. By replacing the specified placeholder with the specified data, the target request message can be obtained.

[0053] In this optional implementation, the request message to be processed is a data packet in the form of a string. In order to meet the requirements of the preset message protocol, the request message to be processed has a variety of characters, such as carriage return and space. The target request message is a data packet after the request message to be processed has been transformed into binary data. When actually sending the request message, a binary data packet needs to be sent.

[0054] In this optional implementation, a target request message is generated based on the variables or rules in the template and the unique identifier in the sent data packet. The target site and the dynamic variables defined in variables are used to render the request message template data.

[0055] The request message generation method provided by this optional implementation divides the content in the request message template into message structure data and body content data when parsing the request message template. After parsing the message structure data, it fills in the specified data, and after processing the body content data, it extracts the body content data, thereby improving the accuracy of obtaining the target request message.

[0056] In some optional implementations of this disclosure, the aforementioned text content data includes: defining region variable key-value pairs and variable placeholders for different variables in the text region; processing the text content data to obtain text key-value pairs includes at least one of the following: responding to the value of a variable in the variable key-value pair being an environment function of the independent variable changing with the environment, calculating the value of the environment function, and replacing the variable placeholder with the value of the environment function to obtain the text key-value pair; responding to the value of a variable in the variable key-value pair being a fixed function of the independent variable having a preset fixed value, calculating the value of the fixed function, and replacing the variable placeholder with the value of the fixed function to obtain the text key-value pair; responding to the value of a variable in the variable key-value pair being a preset fixed value, replacing the variable placeholder with the preset fixed value to obtain the text key-value pair.

[0057] exist Figure 2 In Chinese, hex_decode('00') is a fixed function with the argument '00', base64_decode('AA==') is a fixed function with the argument 'AA==', and \u0000 is a preset fixed value.

[0058] This optional implementation provides a method for processing text content data, which performs different processing on different cases of text content data to obtain corresponding text key-value pairs. It provides multiple optional implementation methods for processing text content data and improves the comprehensiveness of text content data processing.

[0059] For some types of request messages, if the request body is empty or has a fixed value, there is no need to set variables for the body in the request message template. Instead, the template can be parsed directly, and the data can be parsed using the template parsing function to generate a target request message that can be sent to the target site.

[0060] In some optional implementations of this disclosure, the above-mentioned generation of a target request message that can be sent to a target site based on template parsing data and specified data includes: identifying a specified placeholder corresponding to a specified field from the template parsing data; replacing the specified placeholder with the specified data to obtain a request message to be processed; and performing binary data conversion on the request message to be processed to obtain a target request message that can be sent to the target site.

[0061] In this optional implementation, the part of the template parsing data related to the main text is empty or contains fixed values. Since the request message template is parsed based on a preset protocol, the template parsing data is sorted according to the preset protocol.

[0062] In this optional implementation, the above-mentioned method of replacing the specified placeholder with specified data to obtain the request message to be processed includes: replacing the specified placeholder with specified data to obtain template processing data; and adding a string related to the protocol (such as HTTP protocol) to the template processing data to obtain the request message to be processed.

[0063] In this optional implementation, the request message to be processed is a data packet in the form of a string. In order to meet the requirements of the preset message protocol, the request message to be processed contains various characters, such as carriage return and space characters. The target request message is a data packet after the request message to be processed has been transformed into binary data. When actually sending the request message, a binary data packet needs to be sent.

[0064] The method for generating the target request message provided by this optional implementation directly replaces the specified placeholder with the specified data after determining the specified placeholder, thus providing a reliable way to obtain the target request message.

[0065] To address the shortcomings of existing technologies, this disclosure provides a site security testing method. Figure 3 A flow 300 illustrating an embodiment of a site security testing method is provided, which includes the following steps:

[0066] Step 301: Obtain the target request message related to the target site.

[0067] In this embodiment, the target request message is generated by the request message generation method provided in any of the above embodiments. The target request is a request simulated through a request message template. Based on the differences in the content filled in the request message template, the target request message generated by the request message generation method can be a legitimate request message or an illegitimate request message, such as a malicious request.

[0068] Step 302: Establish a connection with the target site.

[0069] In this embodiment, the core means of establishing a connection with the target site can be divided into three categories: transport layer protocol control, application layer protocol implementation, and encrypted tunnel technology. When the message protocol of the target request message is different, the way to establish a connection with the target site can be different. The way to establish a connection with the target site is a conventional method, which will not be described in detail here.

[0070] Step 303: Send the target request message to the target site.

[0071] In this embodiment, the target request message is a data packet encapsulated according to a message protocol (such as the HTTP protocol). Sending this data packet to the target site can simulate a real protocol request and trigger the detection and response mechanisms of WAF or other security devices.

[0072] Step 304: Obtain the response information from the target site.

[0073] In this embodiment, after sending the target request message, the execution entity running on the site security testing method waits for the target site's response information and records it. The response information includes a status code, response headers, and a response body. After receiving the target request message, the target site encapsulates the status line, response headers, and response body (such as HTML content or JSON data) into response information according to a message protocol (such as HTTP protocol) and sends it back to the execution entity through the established connection.

[0074] Step 305: Based on the response information, generate the security assessment results for the target site.

[0075] In this embodiment, the security assessment result is the result after evaluating the security protection performance of the target site. The execution entity (such as the client) running on the site security testing method analyzes the response information to evaluate the security protection capability of the target site (such as whether the WAF successfully intercepts malicious requests) and gives the security assessment result. The security assessment result may include: normal protection, no normal protection, etc.

[0076] The site security testing method disclosed herein performs security assessments on target sites by generating target request messages, and can support the rapid generation of simulated attack methods on BAS to simulate and test real hacker intrusions.

[0077] The site security testing method provided in this embodiment first obtains a target request message related to the target site, which is generated using a request message generation method; second, a connection is established with the target site; third, the target request message is sent to the target site; fourth, the response information from the target site is obtained; and finally, a security assessment result for the target site is generated based on the response information. Therefore, by generating a target request using a request message generation method to perform a security assessment of the target site, the convenience of target site assessment is improved.

[0078] Generally, when connecting to a target site, the target site's system usually only provides a domain name, and the domain name corresponds to multiple IP addresses. If site security testing requires testing using a specific IP address, traditional security testing using a domain name cannot control the communication path with the target site.

[0079] In some alternative implementations of this disclosure, establishing a connection with the target site includes: obtaining the IP address associated with the target site; and suggesting a connection with the target site based on the IP address.

[0080] In this optional implementation, the IP address associated with the target site can be a fixed IP address that the developers need to specify for the site security testing method. Obtaining the IP address associated with the target site includes obtaining the fixed IP address specified by the developers corresponding to the target site. The above-mentioned connection suggestion to the target site based on the IP address includes establishing a TCP (Transmission Control Protocol, a connection-oriented, reliable, byte-stream-based transport layer communication protocol) connection with the target site before sending the target request message, and establishing the connection based on the fixed IP address.

[0081] This optional implementation provides a method for establishing a connection with the target site, obtaining the IP address associated with the target site; based on the IP address, it suggests a connection with the target site, and can test the target site using only a fixed IP address. The overall connection process of the fixed target site ensures the stability and controllability of the site security test, and avoids connection problems caused by DNS (Domain Name System) resolution or network fluctuations.

[0082] In some optional implementations of this disclosure, before sending the target request message to the target site, the above request message generation method further includes: in response to detecting that the message protocol of the target request message is Hypertext Transfer Protocol, performing evasion verification processing on the target request message.

[0083] In this optional implementation, bypassing the validity verification process is a way to avoid performing validity verification on the HTTP protocol before sending. This is because HTTP data in simulated security tests often contains data and configurations that violate the HTTP protocol itself, and the verification of these target request messages before sending needs to be bypassed.

[0084] In this optional implementation, the above-mentioned processing to evade the validity verification of the target request message includes: verifying the target request message using a verification method from a third-party verification method library; collecting the verification result of the verification method in real time; obtaining a pass result based on the verification result, and sending the target request message with the pass result. Specifically, obtaining a pass result based on the verification result includes: if the target request message fails in the verification result, directly modifying the verification result to pass. It should be noted that the verification method in the third-party verification method library is a conventional method for verifying the validity of a request, which will not be elaborated here.

[0085] The request message generation method provided by this optional implementation, in response to the detection that the message protocol of the target request message is Hypertext Transfer Protocol, performs evasion processing on the target request message. When the target request message is a Hypertext Parameter Protocol message, the evasion processing is used to process the target request message, so that both simulated normal request messages and abnormal request messages are sent to the target site, effectively realizing the security testing of the target site and improving the comprehensiveness of the security testing of the target site.

[0086] Further reference Figure 4 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a request message generation apparatus, which is similar to... Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0087] like Figure 4 As shown, the request message generation apparatus 400 provided in this embodiment includes: a template acquisition unit 401, a parsing unit 402, a data acquisition unit 403, and a message generation unit 404. The template acquisition unit 401 is configured to acquire a request message template, which is a template for a request message, where the request message is communication data sent by the client to the server. The parsing unit 402 can be configured to parse the request message template to obtain template parsing data including specified fields representing at least one type of site information. The data acquisition unit 403 can be configured to acquire specified data for specified fields to determine the site information of the target site. The message generation unit 404 can be configured to generate a target request message that can be sent to the target site based on the template parsing data and the specified data.

[0088] In this embodiment, the specific processing of the template acquisition unit 401, parsing unit 402, data acquisition unit 403, and message generation unit 404 in the request message generation device 400, and the resulting technical effects, can be found in the following references: Figure 1The relevant descriptions of steps 101, 102, 103, and 104 in the corresponding embodiments will not be repeated here.

[0089] In one embodiment of this disclosure, the parsing unit 402 is configured to: determine the message structure data and body content data in the request message template; sort the data in the message structure data according to a preset message protocol to obtain protocol parsing data including a specified field representing at least one site information and a specified placeholder; and use the protocol parsing data and body content data as template parsing data.

[0090] In one embodiment of this disclosure, the message generation unit 404 is configured to: identify a specified placeholder from the protocol parsing data; replace the specified placeholder with specified data to obtain protocol message data; process the body content data to obtain body key-value pairs; obtain body extracted data based on the body key-value pairs; sequentially combine the protocol message data and body extracted data according to the message protocol format to obtain a request message to be processed; and perform binary data conversion on the request message to be processed to obtain a target request message that can be sent to the target site.

[0091] In one embodiment of this disclosure, the aforementioned text content data includes: definition area variable key-value pairs and variable placeholders for different variables in the text area; the aforementioned parsing unit 402 is configured to at least one of the following: in response to the value of a variable in a variable key-value pair being an environment function of the independent variable changing with the environment, calculate the value of the environment function, and replace the variable placeholder of the variable with the value of the environment function to obtain a text key-value pair; in response to the value of a variable in a variable key-value pair being a fixed function of the independent variable being a preset fixed value, calculate the value of the fixed function, and replace the variable placeholder of the variable with the value of the fixed function to obtain a text key-value pair; in response to the value of a variable in a variable key-value pair being a preset fixed value, replace the variable placeholder of the variable with the preset fixed value to obtain a text key-value pair.

[0092] In one embodiment of this disclosure, the message generation unit 404 is configured to: identify a specified placeholder corresponding to a specified field from the template parsing data; replace the specified placeholder with specified data to obtain a request message to be processed; and perform binary data conversion on the request message to be processed to obtain a target request message that can be sent to the target site.

[0093] In the request message generation apparatus provided in this embodiment of the present disclosure, firstly, a template acquisition unit 401 acquires a request message template; secondly, a parsing unit 402 parses the request message template to obtain template parsing data including specified fields representing at least one site information; thirdly, a data acquisition unit 403 acquires specified data of the specified fields to determine the site information of the target site through the specified data; finally, a message generation unit 404 generates a target request message that can be sent to the target site based on the template parsing data and the specified data. Thus, by automatically generating the target request message by filling the specified data into the template parsing data of the parsing request message template, no manual intervention is required, improving the efficiency of target request message generation; this disclosure also allows for batch generation of target request messages, saving the cost of generating target request messages.

[0094] Further reference Figure 5 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a site security testing device, which is similar to... Figure 3 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0095] like Figure 5 As shown, the site security testing apparatus 500 provided in this embodiment includes: a message acquisition unit 501, a connection unit 502, a sending unit 503, a response acquisition unit 504, and a result generation unit 505. The message acquisition unit 501 can be configured to acquire a target request message related to the target site, and the target request message is generated using the request message generation apparatus of the above embodiment. The connection unit 502 can be configured to establish a connection with the target site. The sending unit 503 can be configured to send the target request message to the target site. The response acquisition unit 504 can be configured to acquire response information from the target site. The result generation unit 505 can be configured to generate a security assessment result for the target site based on the response information.

[0096] In this embodiment, the specific processing and technical effects of the message acquisition unit 501, connection unit 502, sending unit 503, response acquisition unit 504, and result generation unit 505 in the request message generation device 500 can be found in the following references. Figure 3 The relevant descriptions of steps 301, 302, 303, 304, and 305 in the corresponding embodiments will not be repeated here.

[0097] In some embodiments of this disclosure, the connection unit 502 is further configured to: obtain the IP address associated with the target site; and suggest a connection with the target site based on the IP address.

[0098] In some embodiments of this disclosure, the apparatus 500 further includes a verification unit (not shown in the figure), which is configured to perform evasion verification processing on the target request message in response to detecting that the message protocol of the target request message is Hypertext Transfer Protocol.

[0099] The site security testing apparatus provided in this embodiment firstly, the message acquisition unit 501 acquires a target request message related to the target site, which is generated using a request message generation method; secondly, the connection unit 502 establishes a connection with the target site; thirdly, the sending unit 503 sends the target request message to the target site; next, the response acquisition unit 504 acquires the response information from the target site; and finally, the result generation unit 505 generates a security assessment result for the target site based on the response information. Therefore, by generating a target request using the request message generation method to perform a security assessment of the target site, the convenience of target site assessment is improved.

[0100] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0101] Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their patterns are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0102] like Figure 6 As shown, device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 602 or a computer program loaded from storage unit 608 into random access memory (RAM) 603. RAM 603 may also store various programs and data required for the operation of device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0103] Multiple components in device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of monitors, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0104] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as a request message generation method or a site security testing method. For example, in some embodiments, the request message generation method or site security testing method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the request message generation method or site security testing method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured by any other suitable means (e.g., by means of firmware) to perform a request message generation method or a site security testing method.

[0105] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0106] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to the processor or controller of a general-purpose computer, special-purpose computer, or other programmable request message generation apparatus or site security testing apparatus, such that when executed by the processor or controller, the program code causes the patterns / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0107] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0108] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0109] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0110] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0111] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A method for generating a request message, characterized in that, The method includes: Obtain a request message template, which is a template for a request message, and the request message is a security test sent by the client to the site; the request message includes valid request messages and invalid request messages; Parse the request message template to obtain template parsing data including specified fields representing at least one site information; Obtain specified data from the specified field to determine the site information of the target site using the specified data; Based on the template parsing data and the specified data, a target request message capable of being sent to the target site is generated. The template parsing data includes protocol parsing data and body content data. Generating a target request message capable of being sent to the target site based on the template parsing data and the specified data includes: identifying a specified placeholder from the protocol parsing data; replacing the specified placeholder with the specified data to obtain protocol message data; processing the body content data to obtain body key-value pairs; obtaining body extracted data based on the body key-value pairs; and sequentially processing the data according to the message protocol format. The protocol message data and the extracted body data are combined to obtain a request message to be processed; the request message to be processed is converted into binary data to obtain a target request message that can be sent to the target site; the body content data includes: defining region variable key-value pairs and variable placeholders for different variables in the body region; the processing of the body content data to obtain body key-value pairs includes: in response to the value of the variable in the variable key-value pair being an environment function of the independent variable changing with the environment, calculating the value of the environment function, and replacing the variable placeholder with the value of the environment function to obtain the body key-value pair.

2. The method according to claim 1, characterized in that, The process of parsing the request message template to obtain template parsing data including specified fields representing at least one type of site information includes: Determine the message structure data and body content data in the request message template; The data in the message structure data are sorted according to a preset message protocol to obtain protocol parsing data including a specified field representing at least one site information and a specified placeholder; The protocol parsing data and the text content data are used as the template parsing data.

3. The method according to claim 1, characterized in that, The processing of the text content data to obtain text key-value pairs includes at least one of the following: In response to the fact that the value of the variable in the variable key-value pair is a fixed function whose independent variable is a preset fixed value, the value of the fixed function is calculated, and the variable placeholder of the variable is replaced with the value of the fixed function to obtain the text key-value pair; In response to the fact that the value of the variable in the variable key-value pair is a preset fixed value, the variable placeholder is replaced with the preset fixed value to obtain the text key-value pair.

4. The method according to claim 1, characterized in that, The step of generating a target request message that can be sent to the target site based on the template parsing data and the specified data includes: Identify the specified placeholder corresponding to the specified field from the parsed data of the template; Replace the specified placeholder with the specified data to obtain the request message to be processed; The pending request message is converted into binary data to obtain a target request message that can be sent to the target site.

5. A site security testing method, characterized in that, The method includes: Obtain a target request message related to the target site, wherein the target request message is generated using the request message generation method according to any one of claims 1-4; Establish a connection with the target site; Send the target request message to the target site; Obtain the response information from the target site; Based on the response information, a security assessment result for the target site is generated.

6. The method according to claim 5, characterized in that, Establishing a connection with the target site includes: Obtain the IP address associated with the target site; Based on the IP address, a connection is recommended with the target site.

7. The method according to claim 5, characterized in that, Before sending the target request message to the target site, the method further includes: In response to the detection that the target request message uses the Hypertext Transfer Protocol, the target request message is processed to evade legality verification.

8. A request message generation apparatus, characterized in that, The device includes: The template acquisition unit is configured to acquire request message templates, which are templates for request messages. The request message is a security test sent by the client to the site. The request message includes valid request messages and invalid request messages. The parsing unit is configured to parse the request message template to obtain template parsing data including specified fields representing at least one site information; The data acquisition unit is configured to acquire specified data from the specified field in order to determine the site information of the target site through the specified data; A message generation unit is configured to generate a target request message that can be sent to the target site based on the template parsing data and the specified data. The template parsing data includes protocol parsing data and body content data. The message generation unit is configured to: identify a specified placeholder from the protocol parsing data; replace the specified placeholder with the specified data to obtain protocol message data; process the body content data to obtain body key-value pairs; obtain body extracted data based on the body key-value pairs; sequentially combine the protocol message data and the body extracted data according to the message protocol format to obtain a request message to be processed; and perform binary data conversion on the request message to be processed to obtain a target request message that can be sent to the target site. The body content data includes: defined area variable key-value pairs and variable placeholders for different variables in the body area. The message generation unit is further configured to: in response to the value of a variable in the variable key-value pair being an environment function of the independent variable changing with the environment, calculate the value of the environment function, and replace the variable placeholder with the value of the environment function to obtain a body key-value pair.

9. A site security testing device, characterized in that, The device includes: The message acquisition unit is configured to acquire a target request message related to the target site, wherein the target request message is generated by the request message generation device as described in claim 8; The connection unit is configured to establish a connection with the target site; The sending unit is configured to send the target request message to the target site; The response acquisition unit is configured to acquire response information fed back by the target site; The result generation unit is configured to generate a security assessment result for the target site based on the response information.

10. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

11. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-7.

Images