Method and system for fixing evidence of paging website

Abstract

The invention discloses a paging website evidence fixing method and system, and the method comprises the steps: S1, obtaining an HAR file corresponding to one interface of a paging website, and carrying out the analysis to obtain a request method type corresponding to the HAR file; s2, inputting a target website corresponding to the paging website, searching a data block, corresponding to the target website, of the HAR file, acquiring a page variable name to be modified from the data block according to a request method type corresponding to the HAR file, modifying the page variable name, and re-storing the HAR file; and S3, according to the re-stored HAR file, completing page evidence fixation of the paging website. The working efficiency of judicial expertise personnel is improved, and the situation that the error rate is increased due to repeated operation content of manual operation can be effectively prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet evidence collection, and in particular to a method and system for fixing evidence on a paging website. Background Art

[0002] Website evidence preservation is a key step in forensic electronic data authentication, aiming to ensure the authenticity, integrity, and traceability of online data. This process involves the comprehensive extraction and preservation of webpage content, source code, images, videos, and other data, typically achieved through screenshots, screen recordings, and file downloads. To ensure the legal validity of the evidence, specialized equipment must be used and the entire process must be recorded to form a complete chain of evidence. This ensures the legitimacy and reliability of the evidence and provides effective support for subsequent judicial proceedings.

[0003] However, traditional methods have significant drawbacks when dealing with paged websites (such as member information pages and order pages): Without access to the website database, forensic experts must save the contents of each page through their browser. For websites with large data volumes, manually saving thousands or even tens of thousands of pages is not only time-consuming but also prone to manual errors that could lead to omissions or duplications of evidence, compromising the legitimacy and reliability of the evidence. Summary of the Invention

[0004] In order to solve these problems, the present invention proposes a method and system for fixing evidence of a paginated website.

[0005] According to one aspect of the present invention, a method for fixing evidence of a paginated website is proposed, comprising the following steps:

[0006] S1, obtain the HAR file corresponding to an interface of the paging website, and parse it to obtain the request method type corresponding to the HAR file;

[0007] S2: input the target URL corresponding to the paging website, search the data block corresponding to the target URL in the HAR file, obtain the page number variable name to be modified in the data block according to the request method type corresponding to the HAR file, modify it, and re-save the HAR file;

[0008] S3: According to the re-saved HAR file, the page evidence of the paginated website is fixed.

[0009] Preferably, S1 specifically includes obtaining a HAR file corresponding to an interface of the paging website by opening the "network" tool of the "developer device" of the paging website, and obtaining the corresponding request method type by parsing the "method" field of the "request" element of the HAR file.

[0010] Preferably, the request method types corresponding to the HAR file specifically include a "GET" request method and a "POST" request method.

[0011] Preferably, S2 specifically includes: when the request method type corresponding to the HAR file is a "GET" request method, determining the page number variable name to be modified according to the value change when the page number changes, and modifying it.

[0012] Preferably, when the request method type corresponding to the HAR file is the "POST" request method, the corresponding line number is obtained according to the RequestBody parameter, and the position of the page number variable name to be modified is determined according to the corresponding line number and modified.

[0013] Preferably, if the RequestBody parameter is in urlencoded mode, the params parameter is searched to obtain the corresponding number of rows; if the RequestBody parameter is in JSON mode, the postData parameter is searched to obtain the corresponding number of rows.

[0014] Preferably, S2 further includes setting extended parameters, wherein the extended parameters include page number auto-increment, encoding type, extension name parameter, proxy server information, and timeout parameter.

[0015] Preferably, based on the re-saved HAR file, the modified page number variable name is read, a data query request is constructed and sent to the paging website, and the paging website completes the page evidence fixation of the corresponding page range according to the data query request.

[0016] According to one aspect of the present invention, a system for fixing evidence of a paginated website is proposed, wherein the method according to any one of the first aspects comprises the following modules:

[0017] File parsing module: obtains the HAR file corresponding to an interface of the paging website, and parses it to obtain the request method type corresponding to the HAR file;

[0018] File rewriting module: inputs the target URL corresponding to the paging website, searches for the data block corresponding to the target URL in the HAR file, obtains the page number variable name to be modified in the data block according to the request method type corresponding to the HAR file, modifies it, and re-saves the HAR file;

[0019] Evidence fixing module: completes page evidence fixing of the paginated website based on the re-saved HAR file.

[0020] According to one aspect of the present invention, a computer program product is provided, on which a computer program is stored. When the computer program is executed by a processor, the method according to the first aspect is implemented.

[0021] The benefits of the present invention are that the method and system proposed in the present invention not only improve the work efficiency of forensic experts, but also can effectively prevent the increase in error rates caused by repeated manual operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and, together with the description, serve to explain the principles of the present invention. Other embodiments and many of the expected advantages of the embodiments will be readily apparent as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with respect to each other. Like reference numerals designate corresponding similar parts.

[0023] Figure 1 A schematic flow chart showing a method for fixing evidence of a paginated website according to the present invention is shown;

[0024] Figure 2 It shows a schematic structural diagram of a system for fixing evidence of a paginated website according to the present invention;

[0025] Figure 3 A schematic diagram of the computer system structure of an electronic device suitable for implementing the embodiments of the present application is shown. DETAILED DESCRIPTION

[0026] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0027] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] Figure 1 A method for fixing evidence of a paginated website is shown, comprising the following steps:

[0029] S1, obtain the HAR file corresponding to an interface of the paging website, and parse it to obtain the request method type corresponding to the HAR file;

[0030] S2: input the target URL corresponding to the paging website, search the data block corresponding to the target URL in the HAR file, obtain the page number variable name to be modified in the data block according to the request method type corresponding to the HAR file, modify it, and re-save the HAR file;

[0031] S3: According to the re-saved HAR file, the page evidence of the paginated website is fixed.

[0032] S1 specifically includes obtaining a HAR file corresponding to an interface of the paging website by opening the "network" tool of the "developer device" of the paging website, and obtaining the corresponding request method type by parsing the "method" field of the "request" element of the HAR file.

[0033] HAR files, or HTTP Archive format, record all network requests and responses during a user's interaction with a web page. These files contain all the parameters associated with the request. By replaying the request, you can complete most requests by modifying only the "variable parameters" while preserving the remaining parameters and rebuilding the request.

[0034] In one embodiment, a fixed person of the "paged website" first visits the relevant website through the Chrome series browser and completes preliminary operations such as logging in. Then, the "Network" tool of the "Developer Device" of the Chrome browser is opened, and one of the pages of the 'paged website' is visited at the same time. The "Network" tool is allowed to capture the data packets of the relevant page and save the relevant data packets as HAR files. The HAR files are then read to parse the contents of the data packets and determine the parameters.

[0035] The paging website fixing method proposed in the present invention is aimed at HAR files corresponding to the request method types including the "GET" request method and the "POST" request method.

[0036] After entering the target URL corresponding to one of the "paged websites," if the request method type corresponding to the HAR file is "GET," the page number variable name to be modified is determined based on the value change when the page number changes. When the page number jumps from page 1 to page 2, the page number variable name to be modified is determined by determining whether the corresponding value in the parameter changes from 1 to 2, or changes according to a certain pattern.

[0037] After entering the target URL corresponding to one of the "paged websites", when the request method type corresponding to the HAR file is the "POST" request method, search the data block of the "target URL" in the HAR file, and further search for the keywords of the POST parameters in the data block of the "target URL". The POST parameter type is "application / x-www-form-urlencoded" (form mode) or "application / json" (JSON mode). If the type of "RequestBody" in the POST parameter is "form mode", then retrieve the [number of rows] of the "params" keyword in the data block; if the type of "RequestBody" in the POST parameter is "JSON mode", then retrieve the [number of rows] of the "postData" keyword in the data block.

[0038] Modify the variable information according to the [Number of Lines] in the previous section. For example, you will be prompted: [The location to be modified may be after line XX in the HAR file. Please look for Page or page number related variables after line XX. Please modify the page number variable of the imported HAR file to ★★. The modification location is the "text" variable in "postData"]. Edit the HAR file, find the [Page Number Variable Name] to be modified under the [Number of Lines] prompt, and change the corresponding value to the replacement character [★★] prompted by the program. Save the HAR file after modification.

[0039] In one embodiment, the method of the present invention is made more universal by setting extended parameters, which include page number auto-increment, encoding type, extension parameter, proxy server information, and timeout parameter.

[0040] For example, some "paged websites" have page number 1 for page 1 and 2 for page 2; some "paged websites" have page number 0 for page 1 and 50 for page 2 (loading 50 data items per page). Therefore, in special cases, you need to set the input page number to automatically increment to adjust (the default value is 1 if not modified).

[0041] Generally, the content encoding of a web page is "UTF8", but some websites may use non-standard content encoding, which may cause garbled characters on fixed pages. Therefore, it is necessary to set the encoding type in special cases.

[0042] The extension parameter can help users determine the type of data received later for further analysis without affecting the fixed content.

[0043] In some cases, you need to access the target website through a proxy server, so you need to set the proxy server information in special cases.

[0044] Some websites may have poor network connections, which may cause timeout errors during the request process. Therefore, in special cases, it is necessary to set timeout parameters to wait for the website to respond.

[0045] Finally, based on the re-saved HAR file, the saved HAR file is re-read, the target data block is automatically found, the previously marked [★★] mark is obtained, and finally the [page number variable name] of the modified page number variable name and the extended parameters are obtained, and a data query request is constructed and sent to the paging website. The paging website completes the page evidence fixation of the corresponding page range according to the data query request.

[0046] According to one aspect of the present invention, a system for fixing evidence of a paginated website is proposed, wherein the method according to any one of the first aspects is as follows: Figure 2 As shown, it includes the following modules:

[0047] File parsing module 201: obtains a HAR file corresponding to an interface of a paging website, and parses the HAR file to obtain a request method type corresponding to the HAR file;

[0048] File rewriting module 202: inputs the target URL corresponding to the paging website, searches the data block corresponding to the target URL in the HAR file, obtains the page number variable name to be modified from the data block according to the request method type corresponding to the HAR file, modifies it, and re-saves the HAR file;

[0049] Evidence fixing module 203: completes page evidence fixing of the paginated website according to the re-saved HAR file.

[0050] Reference below Figure 3 , which shows a structural diagram of a computer system 300 suitable for implementing an electronic device of an embodiment of the present application. Figure 3 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0051] like Figure 3 As shown, the computer system 300 includes a central processing unit (CPU) 301, which performs various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage unit 309 into a random access memory (RAM) 304. Various programs and data required for the operation of the system 300 are also stored in the RAM 304. The CPU 301, ROM 302, ROM 303, and RAM 304 are connected to each other via a bus 305. An input / output (I / O) interface 306 is also connected to the bus 305.

[0052] The following components are connected to the I / O interface 306: an input section 307 including a keyboard, a mouse, and the like; an output section 308 including devices such as a liquid crystal display (LCD) and speakers; a storage section 309 including devices such as a hard disk; and a communication section 310 including a network interface card such as a LAN card or a modem. The communication section 310 performs communication processing via a network such as the Internet. A drive 311 is also connected to the I / O interface 306 as needed. Removable media 312, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 311 as needed, so that computer programs read therefrom can be installed in the storage section 309 as needed.

[0053] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart is implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program is downloaded and installed from the network via the communication section 310, and / or installed from the removable medium 312. When the computer program is executed by the central processing unit (CPU) 301, the above-mentioned functions defined in the method of the present application are performed.

[0054] It should be noted that the computer-readable storage medium of the present application is a computer-readable signal medium or a computer-readable storage medium or any combination of the two. Computer-readable storage media are, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or devices, or any combination of the above. More specific examples of computer-readable storage media include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium is any tangible medium that contains or stores a program that is used by or in conjunction with an instruction execution system, device, or device. In the present application, a computer-readable signal medium includes a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal takes a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium is any computer-readable storage medium other than a computer-readable storage medium that transmits, propagates, or transports a program for use by or in connection with an instruction execution system, apparatus, or device. The program code embodied on the computer-readable storage medium is transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0055] Computer program code for performing the operations of the present application is written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code is executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer is connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or is connected to an external computer (e.g., through the Internet using an Internet service provider).

[0056] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram represents a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession are actually executed substantially in parallel, and they are sometimes also executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart, are implemented using a dedicated hardware-based system that performs the specified function or operation, or are implemented using a combination of dedicated hardware and computer instructions.

[0057] The modules involved in the embodiments described in this application are implemented by software and hardware.

[0058] As another aspect, the present application also provides a computer-readable storage medium, which is included in the electronic device described in the above embodiment; it also exists independently and is not assembled into the electronic device. The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: S1, obtains the HAR file corresponding to an interface of the paging website, and parses to obtain the request method type corresponding to the HAR file; S2, inputs the target URL corresponding to the paging website, and searches for the data block corresponding to the target URL in the HAR file, obtains the page number variable name to be modified in the data block according to the request method type corresponding to the HAR file, and sets the extended parameters to re-save the HAR file; S3, completes the page evidence fixation of the paging website according to the re-saved HAR file.

[0059] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for fixing evidence of a paginated website, characterized in that: The following steps are involved: S1, obtain the HAR file corresponding to an interface of the paging website, and parse it to obtain the request method type corresponding to the HAR file; S2: input the target URL corresponding to the paging website, search the data block corresponding to the target URL in the HAR file, obtain the page number variable name to be modified in the data block according to the request method type corresponding to the HAR file, modify it, and re-save the HAR file; S3: According to the re-saved HAR file, the page evidence of the paginated website is fixed.

2. A method for fixing evidence of a paginated website according to claim 1, characterized in that: S1 specifically includes obtaining a HAR file corresponding to an interface of the paging website by opening the "network" tool of the "developer device" of the paging website, and obtaining the corresponding request method type by parsing the "method" field of the "request" element of the HAR file.

3. The method for fixing evidence of a paginated website according to claim 1, characterized in that: The request method types corresponding to the HAR file specifically include "GET" request method and "POST" request method.

4. A method for fixing evidence of a paginated website according to claim 3, characterized in that: S2 specifically includes: when the request method type corresponding to the HAR file is a "GET" request method, determining the page number variable name to be modified according to the value change when the page number changes, and modifying it.

5. The method for fixing evidence of a paginated website according to claim 3, characterized in that: When the request method type corresponding to the HAR file is the "POST" request method, the corresponding line number is obtained according to the RequestBody parameter, and the position of the page number variable name to be modified is determined according to the corresponding line number and modified.

6. A method for fixing evidence of a paginated website according to claim 5, characterized in that: If the RequestBody parameter is in urlencoded mode, search the params parameter to obtain the corresponding row number; if the RequestBody parameter is in JSON mode, search the postData parameter to obtain the corresponding row number.

7. The method for fixing evidence of a paginated website according to claim 1, characterized in that: S2 also includes setting extended parameters, which include page number auto-increment, encoding type, extension name parameter, proxy server information, and timeout parameter.

8. The method for fixing evidence of a paginated website according to claim 1, characterized in that: S3 specifically includes: reading the modified page number variable name according to the re-saved HAR file, constructing and sending a data query request to the paging website, and the paging website completing the page evidence fixation of the corresponding page range according to the data query request.

9. A system for fixing evidence on a paginated website, characterized in that: The method according to any one of claims 1 to 8, comprising the following modules: File parsing module: obtains the HAR file corresponding to an interface of the paging website, and parses it to obtain the request method type corresponding to the HAR file; File rewriting module: inputs the target URL corresponding to the paging website, searches for the data block corresponding to the target URL in the HAR file, obtains the page number variable name to be modified in the data block according to the request method type corresponding to the HAR file, modifies it, and re-saves the HAR file; Evidence fixing module: completes page evidence fixing of the paginated website based on the re-saved HAR file.

10. A computer program product, characterized in that A computer program is stored thereon, which implements the method according to any one of claims 1 to 8 when executed by a processor.

Images