Middleware security detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a security detection method and system for middleware, electronic equipment and a storage medium. The method comprises the following steps: triggering a security test on a set scanned application; for each security test case, generating an HTTP request corresponding to the security test case; wherein the security test case comprises HTTP method detection, middleware Banner information leakage detection, Host head attack detection, XFF and XFH vulnerability detection and cross-domain vulnerability detection; an HTTP request corresponding to the security test case is sent to a target site of the scanned application; receiving a response message fed back by the target site; matching a character string of a specified field corresponding to the security test case in the response message based on a pre-configured judgment rule, and determining a detection result corresponding to the security test case; and generating a test report based on a detection result corresponding to each security test case and feeding back the test report.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a security detection method and system of middleware, an electronic device and a storage medium. BACKGROUND

[0002] At present, with the rapid development of information technology in the financial and banking industry, the demand for agile development is imminent, and the requirements for security testing efficiency and accuracy are also significantly improved. In the traditional security testing, each test case needs to be manually executed for each interface, so there is a low test efficiency, and the execution case is easy to be missed and wrong, which cannot meet the needs of the rapid iteration of the current business.

[0003] Therefore, a current vulnerability detection method specifically defines the security label of the business system according to the security requirements and security policy of the financial business system, then scans the code of the business system through the security label of the system, dynamically generates a security change point, associates it with the security test case library, determines the security threat point, and detects the corresponding vulnerability, thereby improving the security testing efficiency and accuracy to a certain extent.

[0004] Although this method improves the security testing efficiency to a certain extent, it is not specific and cannot effectively detect the vulnerabilities of the related information of the server middleware, and is directly applicable to various financial business systems, so it cannot guarantee the accurate detection of the vulnerabilities of the server middleware. SUMMARY

[0005] Based on the above deficiencies of the prior art, the present application provides a security detection method and system of middleware, an electronic device and a storage medium to solve the problem that the prior art cannot guarantee the detection accuracy and has poor applicability.

[0006] In order to achieve the above purpose, the present application provides the following technical solutions:

[0007] The first aspect of the present application provides a security detection method of middleware, comprising:

[0008] Triggering security testing of a set of scanned applications;

[0009] generate an HTTP request corresponding to each security test case respectively; wherein the security test case includes HTTP method detection, middleware Banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection; the HTTP request corresponding to the HTTP method detection includes HTTP requests of all method types in original form; the HTTP request corresponding to the middleware Banner information leakage detection includes HTTP requests triggering server redirection, client errors, and server errors, and HTTP requests of all method types in original form; the HTTP request corresponding to the Host header attack detection includes HTTP requests with modified Host fields; the HTTP request corresponding to the XFF and XFH vulnerability detection includes HTTP requests with modified XFF fields and XFH fields; and the HTTP request corresponding to the cross-domain vulnerability detection includes HTTP requests with modified source fields;

[0010] send the HTTP request corresponding to the security test case to a target site of the scanned application;

[0011] receive a response message fed back by the target site;

[0012] match a string in a specified field corresponding to the security test case in the response message based on a preconfigured judgment rule, to determine a detection result corresponding to the security test case;

[0013] generate a test report based on the detection result corresponding to each security test case and feed back the test report.

[0014] Optionally, in the middleware security detection method described above, when the security test case is the HTTP method detection, the matching of the string in the specified field corresponding to the security test case in the response message based on the preconfigured judgment rule, to determine the detection result corresponding to the security test case, includes:

[0015] for the response message of each method type of HTTP request, match whether a response status code in the response message is a target status code in the preconfigured judgment rule;

[0016] if the response status code in the response message is the target status code in the preconfigured judgment rule, it is determined that there is a security vulnerability supporting the HTTP request of the unsafe method type.

[0017] Optionally, in the middleware security detection method, when the security test case is the middleware Banner information leakage detection, the matching of the specified field string corresponding to the security test case in the response message based on the pre-configured judgment rule determines the detection result corresponding to the security test case, including:

[0018] Based on the pre-configured judgment rule, whether there is a configured string of any one of the middleware Banner information in the service field of the request header and each string of the request body in the response message is matched;

[0019] If there is a configured string of any one of the middleware Banner information, it is determined that there is a vulnerability of the middleware Banner information leakage.

[0020] Optionally, in the middleware security detection method, when the security test case is the Host header attack detection, the generation of the HTTP request corresponding to the security test case includes:

[0021] The Host field in the request header of the HTTP request initiated to the target site is modified to the specified address information;

[0022] A Host field of the specified address information is added to the request header of the HTTP request initiated to the target site;

[0023] The path of the HTTP request initiated to the target site is modified to the route absolute path of the target site, and the Host field in the request header is modified to the specified address information;

[0024] The matching of the specified field string corresponding to the security test case in the response message based on the pre-configured judgment rule determines the detection result corresponding to the security test case, including:

[0025] For each HTTP request response message corresponding to the Host header attack detection, whether the specified address information exists in the response message is matched;

[0026] If the specified address information exists in the response message, it is determined that there is a Host header attack vulnerability.

[0027] Optionally, in the middleware security detection method, when the security test case is the XFF and XFH vulnerability detection, the generation of the HTTP request corresponding to the security test case includes:

[0028] modifying an XFF field in a request header of an HTTP request initiated to the target site into the specified address information, or adding an XFF field of the specified address information in a request header of an HTTP request initiated to the target site, to obtain a first request;

[0029] modifying an XFF field in a request header of an HTTP request initiated to the target site into the specified address information, or adding an XFF field of the specified address information in a request header of an HTTP request initiated to the target site, to obtain a first request;

[0030] The matching of the specified field string corresponding to the security test case in the response message based on the pre-configured judgment rule to determine the detection result corresponding to the security test case comprises:

[0031] respectively matching whether the specified address information appears in the response message of the first request and the response message of the second request;

[0032] If the specified address information appears in the response message of the first request, it is determined that the XFF header exists;

[0033] If the specified address information appears in the response message of the second request, it is determined that the XFH header exists.

[0034] Optionally, in the middleware security detection method, when the security test case is the cross-domain vulnerability detection, the generation of the HTTP request corresponding to the security test case comprises:

[0035] modifying an XFF field in a request header of an HTTP request initiated to the target site into the specified address information, or adding an XFF field of the specified address information in a request header of an HTTP request initiated to the target site, to obtain a first request;

[0036] The matching of the specified field string corresponding to the security test case in the response message based on the pre-configured judgment rule to determine the detection result corresponding to the security test case comprises:

[0037] based on the pre-configured judgment rule, matching whether the specified address information appears in the request header or the request body of the response message, matching whether a resource control field appears in the request header of the response message is a set string, and matching whether the resource control field is empty and a cross-domain control field is an allowed string at the same time;

[0038] If the specified address information appears in the request header or request body of the matching response message, or if the resource control field of the matching response message is set to a specific string, and the resource control field is empty while the cross-domain control field is set to an allowed string, then a cross-domain attack vulnerability is identified.

[0039] Optionally, in the above-described middleware security detection method, after determining the detection result corresponding to the security test case by matching the string of the specified field corresponding to the security test case in the response message based on the pre-configured evaluation rules, the method further includes:

[0040] Based on the detection results corresponding to the security test case, a current issue ticket for the security test case is generated and feedback is provided;

[0041] In response to the retesting operation of the current issue ticket for the security test case, for the security test case, return the HTTP request that generated the security test case;

[0042] If the retest results of the security test case indicate that no vulnerabilities exist, a retest report for the security test case is generated, and the current issue ticket for the security test case is closed.

[0043] If the retest results of the security test case indicate that a vulnerability exists, the current issue ticket for the security test case will be re-circulated.

[0044] A second aspect of this application provides a middleware security detection system, comprising:

[0045] The triggering unit is used to trigger security tests on the specified scanned applications.

[0046] The generation unit is used to generate HTTP requests corresponding to each security test case. The security test cases include HTTP method detection, middleware banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection. The HTTP requests corresponding to HTTP method detection include the original HTTP requests for all method types. The HTTP requests corresponding to middleware banner information leakage detection include HTTP requests that trigger server-side redirection, client errors, and server errors, as well as the original HTTP requests for all method types. The HTTP requests corresponding to Host header attack detection include HTTP requests that modify the Host field. The HTTP requests corresponding to XFF and XFH vulnerability detection include HTTP requests that modify the XFF and XFH fields. The HTTP requests corresponding to cross-domain vulnerability detection modify the source field.

[0047] a sending unit, configured to send an HTTP request corresponding to the security test case to a target site of the scanned application;

[0048] a packet receiving unit, configured to receive a response packet fed back by the target site;

[0049] a matching unit, configured to match a string of a specified field corresponding to the security test case in the response packet based on a preconfigured judgment rule, and determine a detection result corresponding to the security test case;

[0050] a result feeding back unit, configured to generate a test report based on the detection result corresponding to each security test case and feed back the test report.

[0051] Optionally, in the middleware security detection system, when the security test case is the HTTP method detection, the matching unit, when performing the matching of the string of the specified field corresponding to the security test case in the response packet based on the preconfigured judgment rule and determining the detection result corresponding to the security test case, is configured to:

[0052] match, for the response packet of each type of HTTP request, whether a response status code in the response packet is a target status code in the preconfigured judgment rule;

[0053] if the response status code in the response packet is the target status code in the preconfigured judgment rule, it is determined that there is a security vulnerability supporting an unsafe HTTP request of the method type.

[0054] Optionally, in the middleware security detection system, when the security test case is the middleware Banner information leakage detection, the matching unit, when performing the matching of the string of the specified field corresponding to the security test case in the response packet based on the preconfigured judgment rule and determining the detection result corresponding to the security test case, is configured to:

[0055] based on the preconfigured judgment rule, match whether there is a string of any one of the configured middleware Banner information in each string of a service field of a request header and a request body in the response packet;

[0056] if there is the string of any one of the configured middleware Banner information, it is determined that there is a vulnerability of leaking the middleware Banner information.

[0057] Optionally, in the middleware security detection system, when the security test case is the Host header attack detection, the production unit, when generating the HTTP request corresponding to the security test case, is configured to:

[0058] modify the Host field in the request header of the HTTP request initiated to the target site to the specified address information;

[0059] add a Host field of the specified address information in the request header of the HTTP request initiated to the target site;

[0060] modify the path of the HTTP request initiated to the target site to the route absolute path of the target site, and modify the Host field in the request header to the specified address information;

[0061] The matching unit, when matching the specified field string in the response message corresponding to the security test case based on the pre-configured judgment rule to determine the detection result corresponding to the security test case, is configured to:

[0062] respectively for each HTTP request response message corresponding to the Host header attack detection, match whether the specified address information exists in the response message;

[0063] If the specified address information exists in the response message, it is determined that there is a Host header attack vulnerability.

[0064] Optionally, in the middleware security detection system, when the security test case is the XFF and XFH vulnerability detection, the production unit, when generating the HTTP request corresponding to the security test case, is configured to:

[0065] modify the XFF field in the request header of the HTTP request initiated to the target site to the specified address information, or add the XFF field of the specified address information in the request header of the HTTP request initiated to the target site to obtain a first request;

[0066] modify the XFH field in the request header of the HTTP request initiated to the target site to the specified address information, or add the XFH field of the specified address information in the request header of the HTTP request initiated to the target site to obtain a second request;

[0067] The matching unit, when matching the specified field string in the response message corresponding to the security test case based on the pre-configured judgment rule to determine the detection result corresponding to the security test case, is configured to:

[0068] Match whether the specified address information appears in the response message of the first request and the response message of the second request respectively.

[0069] If the specified address information appears in the response message of the first request, it is determined that the header has an XFF vulnerability.

[0070] If the specified address information appears in the response message of the second request, it is determined that the header has an XFH vulnerability.

[0071] Optionally, in the middleware security detection system, when the security test case is for cross-domain vulnerability detection, the generating unit is configured to:

[0072] Modify the source field in the HTTP request initiated to the target site to the specified address information, or add the source field of the specified address information in the HTTP request initiated to the target site.

[0073] The matching unit is configured to:

[0074] Based on the preconfigured evaluation rule, match whether the specified address information appears in the request header or the request body of the response message, match whether the resource control field is a set string in the request header of the response message, and match whether the resource control field is empty and the cross-domain control field is an allowed string in the request header of the response message.

[0075] If the specified address information appears in the request header or the request body of the response message, or the resource control field is a set string in the request header of the response message, or the resource control field is empty and the cross-domain control field is an allowed string in the request header of the response message, it is determined that there is a cross-domain attack vulnerability.

[0076] Optionally, in the middleware security detection system, the system further comprises:

[0077] A bug report unit configured to generate a current bug report of the security test case based on the detection result corresponding to the security test case and feed back the current bug report.

[0078] A retest unit configured to return the generating unit in response to a retest operation on the current bug report of the security test case.

[0079] A report unit is configured to generate a retest report of the security test case and close the current issue list of the security test case when the detection result of the retest of the security test case indicates that there is no vulnerability.

[0080] A flow transfer unit is configured to retransfer the current issue list of the security test case when the detection result of the retest of the security test case indicates that there is a vulnerability.

[0081] The third aspect of the present application provides an electronic device, comprising:

[0082] a memory and a processor;

[0083] The memory is configured to store a program.

[0084] The processor is configured to execute the program, and the program is configured to implement the security detection method of the middleware as any one of the preceding aspects when executed.

[0085] The fourth aspect of the present application provides a computer storage medium for storing a computer program, and the computer program is configured to implement the security detection method of the middleware as any one of the preceding aspects when executed by a processor.

[0086] The application provides a security detection method of middleware, triggering security tests of set scanned applications. Then, for each security test case, a corresponding HTTP request of the security test case is generated, and the corresponding HTTP request of the security test case is sent to a target site of the scanned application; wherein the security test case includes HTTP method detection, middleware Banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection; the corresponding HTTP request of the HTTP method detection includes all method type original HTTP requests; the corresponding HTTP request of the middleware Banner information leakage detection includes HTTP requests triggering server redirection, client errors and server errors, and all method type original HTTP requests; the corresponding HTTP request of the Host header attack detection includes HTTP requests modifying the Host field; the corresponding HTTP request of the XFF and XFH vulnerability detection includes HTTP requests modifying the XFF field and the XFH field; and the corresponding HTTP request of the cross-domain vulnerability detection modifies the source field, so that corresponding requests can be sent according to comprehensive information of the middleware, so as to enable comprehensive detection. The response message fed back by the target site is received, and a string in a specified field corresponding to the security test case in the response message is matched based on a preconfigured judgment rule, so as to determine a detection result corresponding to the security test case. Finally, a test report is generated based on the detection result corresponding to each security test case and is fed back. Therefore, comprehensive information detection is realized, the accuracy of server middleware vulnerability detection is effectively ensured, and the method can be applied to different financial business systems. BRIEF DESCRIPTION OF DRAWINGS

[0087] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the provided drawings.

[0088] Figure 1 A flowchart of a security detection method of middleware provided by the embodiments of the present application;

[0089] Figure 2 A flowchart of an HTTP method detection method provided by the embodiments of the present application;

[0090] Figure 3 A flowchart of a middleware Banner information leakage detection method provided by the embodiments of the present application;

[0091] Figure 4A flowchart of a method for generating a HTTP request corresponding to Host header attack detection provided by an embodiment of the present application is shown in the figure;

[0092] Figure 5 A flowchart of a Host header attack detection method provided by an embodiment of the present application is shown in the figure;

[0093] Figure 6 A flowchart of a vulnerability rechecking method provided by an embodiment of the present application is shown in the figure;

[0094] Figure 7 An architecture diagram of a security detection system of a middleware provided by an embodiment of the present application is shown in the figure;

[0095] Figure 8 An architecture diagram of an electronic device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0096] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0097] In the present application, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms “include”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement “including a…” does not exclude the presence of another identical element in the process, method, article or device including the element.

[0098] The embodiments of the present application provide a security detection method of a middleware, as shown in the figure, including the following steps: Figure 1

[0099] S101, triggering a security test on a set scanned application.

[0100] Optionally, the security test can be triggered by scheduling or inventory, etc.

[0101] ​Optionally, in order to effectively carry out subsequent testing, in the embodiment of the present application, before step S101 is performed, a customized security scanning strategy needs to be configured, including test case rule setting and judgment rule setting.

[0102] The test case rule setting supports customized setting according to a security test case list, including but not limited to unsafe HTTP method detection, middleware information leakage, Host header attack, CORS cross-domain attack, X-Forwarded-For attack, X-Forwarded-Host attack, etc. The judgment rule can also be customized according to the security test case list, and also includes but is not limited to unsafe HTTP method detection, middleware information leakage, Host header attack, CORS cross-domain attack, X-Forwarded-For attack, X-Forwarded-Host attack, etc.

[0103] The scanned application can be set at this time, or can be manually selected when the subsequent exhaust or inventory security test is actually triggered, and the application is scanned URL can be automatically taken out or manually set.

[0104] S102, for each security test case, generate the HTTP request corresponding to the security test case.

[0105] It should be noted that, in the embodiment of the present application, all information is comprehensively detected through corresponding security test cases. Different information detection needs to be implemented through corresponding HTTP requests, so it is necessary to respectively initiate corresponding HTTP requests to the target site for each security test case. Therefore, it is necessary to generate the HTTP request corresponding to the information to be tested for each security test case.

[0106] In the embodiment of the present application, the security test case includes HTTP method detection, middleware Banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection.

[0107] The HTTP method detection is to detect unsafe HTTP methods, so the generated and sent HTTP method only needs the original HTTP request, that is, no modification is needed for the original HTTP request, so the HTTP request corresponding to the HTTP method detection includes all method types of original HTTP requests.

[0108] The middleware Banner information leakage detection is to detect whether the middleware Banner information is leaked in the process of processing the request. To determine whether the middleware Banner information is leaked, the response message of the normal request can be directly analyzed and determined. In addition, the error response can also be analyzed. Therefore, in the embodiment of the present application, an abnormal structure request needs to be constructed to trigger the error response of the service end 3XX, 4XX and 5XX, that is, to trigger the response of the service end redirection, client error and server error. Therefore, the HTTP request corresponding to the middleware Banner information leakage detection includes the HTTP request triggering the service end redirection, client error and server error, and all method type original HTTP requests.

[0109] Optionally, the abnormal structure request can be constructed by modifying the URI content, Header label, Host field, HTTP request method, payload content and the like of the HTTP request.

[0110] The Host header attack detection is to detect whether the Host header of the HTTP request has an attack vulnerability. Therefore, the Host field of the initiated HTTP request needs to be analyzed to determine whether it will be affected after modifying the Host field. Therefore, the HTTP request corresponding to the Host header attack detection includes the HTTP request modifying the Host field.

[0111] Optionally, the Host header field content can be modified by covering, two Host fields can be added in the Header, and a space Tab can be added in front of the Host field to bypass the modification.

[0112] The XFF and XFH vulnerability detection is to detect whether the XFF field and XFH field in the request header of the HTTP request have vulnerabilities, so as to determine whether the request header has vulnerabilities. Therefore, the XFF field and XFH field in the request need to be modified to determine whether they are affected by the modified response message. Therefore, the HTTP request corresponding to the XFF and XFH vulnerability detection includes the HTTP request modifying the XFF field and XFH field.

[0113] The XFF field and XFH field are specifically the X-Forwarded-For field and the X-Forwarded-Host field.

[0114] The cross-domain vulnerability detection is to detect the vulnerability of cross-domain resources, so the source field of the resource needs to be modified. Therefore, the HTTP request corresponding to the cross-domain vulnerability detection modifies the source field of the HTTP request.

[0115] S103, send the HTTP request corresponding to the security test case to the target site of the scanned application.

[0116] S104, receiving a response message fed back by the target station.

[0117] It should be noted that the target station will respond to the HTTP request and feed back a response message after receiving the HTTP request.

[0118] S105, matching a string in a specified field in the response message corresponding to the security test case based on the pre-configured evaluation rule, to determine a detection result corresponding to the security test case.

[0119] It should be noted that if the middleware information has various vulnerabilities, the corresponding string will appear in the response message fed back. Different security test cases are used to test different vulnerabilities, so the string that needs to be matched can be set in the judgment rule in advance according to the vulnerabilities, and therefore the string in the specified field in the response message corresponding to the security test case is matched based on the pre-configured evaluation rule. Then, the detection result corresponding to the security test case is determined according to the matching result of the string, that is, whether there is a vulnerability and the type of the specific vulnerability.

[0120] Optionally, in another embodiment of the present application, when the current security test case is HTTP method detection, one specific implementation of step S102 can be:

[0121] generating an OPTIONS request, a HEAD request, a DELETE request, a PUT request, a SET request, a TRACE request, a MOVE request, a COPY request, a CONNECT request, and a PATCH request.

[0122] Correspondingly, in the embodiment of the present application, one specific implementation of step S105, as shown in Figure 2 , includes:

[0123] S201, for the response message of each type of HTTP request, matching whether the response status code in the response message is a target status code in the pre-configured evaluation rule.

[0124] If the response status code in the response message is the target status code in the pre-configured evaluation rule, step S202 is performed.

[0125] Optionally, the target status code can be 200.

[0126] S202, determining that there is a security vulnerability of supporting an unsafe method type of HTTP request.

[0127] Optionally, in another embodiment of the present application, when the security test case is the detection of middleware Banner information leakage, a specific implementation of step S102 includes:

[0128] generating an OPTIONS request, a HEAD request, a DELETE request, a PUT request, a SET request, a TRACE request, a MOVE request, a COPY request, a CONNECT request, a PATCH request, and modifying the Host field of the HTTP request. Specifically, a question mark can be inserted in the http character.

[0129] Correspondingly, in the embodiment of the present application, a specific implementation of step S105 includes: Figure 3

[0130] S301, based on the pre-configured evaluation rule, matching the service field of the request header and each string in the request body in the response message, whether there is a configured string of any one of the middleware Banner information.

[0131] If there is a configured string of any one of the middleware Banner information, step S302 is executed.

[0132] Specifically, the Server field in the headers and all strings in the body in the response message are matched. If there is a string of middleware Banner information such as “nginx”, “Apache”, “IBM”, “tomcat” regardless of case, it proves that there is a server Banner information leakage vulnerability, so step S302 is executed at this time.

[0133] S302, determining that there is a vulnerability of the leaked middleware Banner information.

[0134] Optionally, in another embodiment of the present application, when the security test case is the detection of Host header attack, a specific implementation of step S102 includes: Figure 4

[0135] S401, modifying the Host field in the request header of the HTTP request initiated to the target site to specified address information.

[0136] Optionally, the specified address information can be the address information of the test learning platform.

[0137] Specifically, the Host field in the request HTTP packet Header is modified to the specified address information, so as to obtain a modified request as a corresponding HTTP request for Host header attack detection.

[0138] ​​S402, adding a Host field of the specified address information in the request header of the HTTP request initiated to the target site.

[0139] Specifically, a Host: specified address can be added in the request directly, and a %20Host: specified address can be added.

[0140] S403, modifying the path of the HTTP request initiated to the target site to the route absolute path of the target site, and modifying the Host field in the request header to the specified address information.

[0141] Correspondingly, in the embodiment of the present application, a specific implementation of step S105 includes: Figure 5

[0142] S501, respectively detecting the response message of each HTTP request corresponding to the Host header attack, and matching whether the specified address information exists in the response message.

[0143] If the specified address information exists in the response message, step S502 is performed.

[0144] S502, determining that the Host header attack vulnerability exists.

[0145] Optionally, in another embodiment of the present application, a specific implementation of step S102 includes:

[0146] modifying the XFF field in the request header of the HTTP request initiated to the target site to the specified address information, or adding the XFF field of the specified address information in the request header of the HTTP request initiated to the target site, to obtain a first request, and modifying the XFH field in the request header of the HTTP request initiated to the target site to the specified address information, or adding the XFH field of the specified address information in the request header of the HTTP request initiated to the target site, to obtain a second request.

[0147] Correspondingly, in the embodiment of the present application, a specific implementation of step S105 includes:

[0148] respectively matching whether the specified address information appears in the response message of the first request and the response message of the second request.

[0149] If the specified address information appears in the response message of the first request, it is determined that the XFF header exists. If the specified address information appears in the response message of the second request, it is determined that the XFH header exists.

[0150] ​Since the XFF field and the XFH field are fields in the request header, when it is determined that the XFF vulnerability or the XFH vulnerability exists, it is also determined that the Host header attack vulnerability exists.

[0151] Optionally, in another embodiment of the present application, a specific implementation of step S102 includes:

[0152] The source field in the HTTP request initiated to the target site is modified to the specified address information, or a source field of the specified address information is added to the HTTP request initiated to the target site.

[0153] That is, the Origin field in the request HTTP packet Header is added or modified to the specified address information when the request is initiated.

[0154] Correspondingly, in another embodiment of the present application, a specific implementation of step S105 includes:

[0155] Based on the pre-configured evaluation rule, it is matched whether the specified address information appears in the request header or the request body of the response message, whether the resource control field is the set string in the request header of the response message, and whether the resource control field is empty and the cross-domain control field is the allowed string in the request header of the response message.

[0156] If the specified address information appears in the request header or the request body of the response message, or the resource control field is the set string in the request header of the response message, and the resource control field is empty and the cross-domain control field is the allowed string in the request header of the response message, it is determined that the cross-domain attack vulnerability exists.

[0157] Specifically, if the specified address information string appears in the Header or the Body of the response message, it is determined that the cross-domain attack vulnerability exists. If the "Access-Control-Allow-Origin:*" string appears in the Header of the response message, it is determined that the cross-domain attack vulnerability exists. If the "Access-Control-Allow-Origin: null" and "Access-Control-Allow-Credentials: true" strings appear in the Header of the response message, it is determined that the cross-domain attack vulnerability exists.

[0158] Since the source field and the matched information are all Host header information, when it is determined that the cross-domain attack vulnerability exists, it is also determined that the Host header attack vulnerability exists.

[0159] S106, generating a test report based on the detection results of each security test case and feeding back.

[0160] It should be noted that after obtaining the detection result, not only can it be directly viewed, but also a test report can be automatically generated and exported and fed back to the user, and local retention can be performed.

[0161] Optionally, in another embodiment of the present application, further comprising vulnerability rechecking. As shown in the figure, the vulnerability rechecking method provided by the embodiment of the present application comprises the following steps: Figure 6

[0162] S601, generating a current problem list of the security test case based on the detection result corresponding to the security test case and feeding back.

[0163] In order to enable relevant personnel to repair the vulnerability, a current problem list of the security test case can be generated based on the detection result corresponding to the security test case and fed back.

[0164] S602, in response to the retest operation of the current problem list of the security test case, retesting the security test case.

[0165] Among them, retesting the security test case means that for the security test case, the step S102 is returned to perform again, so as to test again.

[0166] S603, judging whether the detection result of the retest of the security test case indicates that there is a vulnerability.

[0167] Among them, if the detection result of the retest of the security test case indicates that there is no vulnerability, step S604 is executed. If the detection result of the retest of the security test case indicates that there is a vulnerability, step S605 is executed.

[0168] S604, generating a retest report of the security test case and closing the current problem list of the security test case.

[0169] S605, reflowing the current problem list of the security test case.

[0170] Since the vulnerability is not solved at this time, it needs to be reflowed to the relevant personnel for repair.

[0171] ​The embodiment of the application provides a security detection method of middleware, triggers security testing of a set scanned application. Then, for each security testing case, a corresponding HTTP request of the security testing case is generated, and the corresponding HTTP request of the security testing case is sent to a target site of the scanned application; wherein the security testing case comprises HTTP method detection, middleware Banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection; the corresponding HTTP request of the HTTP method detection comprises original HTTP requests of all method types; the corresponding HTTP request of the middleware Banner information leakage detection comprises HTTP requests triggering server redirection, client errors and server errors, and original HTTP requests of all method types; the corresponding HTTP request of the Host header attack detection comprises HTTP requests modifying a Host field; the corresponding HTTP request of the XFF and XFH vulnerability detection comprises HTTP requests modifying XFF fields and XFH fields; and the corresponding HTTP request of the cross-domain vulnerability detection modifies a source field, so that corresponding requests can be sent according to comprehensive information of the middleware, so as to perform comprehensive detection. A response message fed back by the target site is received, a string in a specified field corresponding to the security testing case in the response message is matched based on a preconfigured judgment rule, and a detection result corresponding to the security testing case is determined. Finally, a test report is generated based on the detection result corresponding to each security testing case and is fed back. Therefore, comprehensive information detection is realized, the accuracy of server middleware vulnerability detection is effectively ensured, and the method can be applied to different financial business systems.

[0172] Another embodiment of the application provides a security detection system of middleware, as shown in the following table, comprising: Figure 7

[0173] A triggering unit 701 is configured to trigger security testing of a set scanned application.

[0174] ​The generating unit 702 is configured to generate, for each security test case, an HTTP request corresponding to the security test case. The security test case includes HTTP method detection, middleware Banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection. The HTTP request corresponding to the HTTP method detection includes HTTP requests of all method types. The HTTP request corresponding to the middleware Banner information leakage detection includes HTTP requests triggering server redirection, client errors, and server errors, and HTTP requests of all method types. The HTTP request corresponding to the Host header attack detection includes HTTP requests with modified Host fields. The HTTP request corresponding to the XFF and XFH vulnerability detection includes HTTP requests with modified XFF fields and XFH fields. The HTTP request corresponding to the cross-domain vulnerability detection includes HTTP requests with modified source fields.

[0175] The sending unit 703 is configured to send the HTTP request corresponding to the security test case to a target site of the scanned application.

[0176] The packet receiving unit 704 is configured to receive a response packet fed back by the target site.

[0177] The matching unit 705 is configured to match, based on a preconfigured evaluation rule, a string in a specified field of the response packet corresponding to the security test case, to determine a detection result corresponding to the security test case.

[0178] The result feedback unit 706 is configured to generate a test report based on the detection result corresponding to each security test case and to feed back the test report.

[0179] Optionally, in the middleware security detection system provided in another embodiment of the present application, when the security test case is the HTTP method detection, the matching unit, when performing the matching, based on the preconfigured evaluation rule, of the string in the specified field of the response packet corresponding to the security test case to determine the detection result corresponding to the security test case, is configured to:

[0180] Match, for each response packet of the HTTP request of each method type, whether a response status code in the response packet is a target status code in the preconfigured evaluation rule.

[0181] If the response status code in the response packet is matched as the target status code in the preconfigured evaluation rule, it is determined that there is a security vulnerability of the HTTP request of the method type that is not safe.

[0182] Optionally, in the middleware security detection system provided in another embodiment of the present application, when the security test case is the middleware Banner information leakage detection, the matching unit performs matching on the strings in the specified fields corresponding to the security test case in the response message based on the preconfigured evaluation rules, and when determining the detection result corresponding to the security test case, the matching unit is configured to:

[0183] based on the preconfigured evaluation rules, match whether there is any configured middleware Banner information string in the service field of the request header and each string in the request body in the response message.

[0184] If there is any configured middleware Banner information string, it is determined that there is a vulnerability of leaking the middleware Banner information.

[0185] Optionally, in the middleware security detection system provided in another embodiment of the present application, when the security test case is the Host header attack detection, the production unit generates the HTTP request corresponding to the security test case, and the production unit is configured to:

[0186] modify the Host field in the request header of the HTTP request initiated to the target site to the specified address information.

[0187] add a Host field of the specified address information in the request header of the HTTP request initiated to the target site.

[0188] modify the path of the HTTP request initiated to the target site to the route absolute path of the target site, and modify the Host field in the request header to the specified address information.

[0189] The matching unit performs matching on the strings in the specified fields corresponding to the security test case in the response message based on the preconfigured evaluation rules, and when determining the detection result corresponding to the security test case, the matching unit is configured to:

[0190] for each HTTP request corresponding to the Host header attack detection, match whether the specified address information exists in the response message.

[0191] If the specified address information is matched in the response message, it is determined that there is a Host header attack vulnerability.

[0192] Optionally, in the middleware security detection system provided in another embodiment of the present application, when the security test case is the XFF and XFH vulnerability detection, the generation unit generates the HTTP request corresponding to the security test case, and the generation unit is configured to:

[0193] The XFF field in the request header of the HTTP request initiated to the target site is modified as the specified address information, or the XFF field of the specified address information is added in the request header of the HTTP request initiated to the target site, to obtain a first request.

[0194] The XFH field in the request header of the HTTP request initiated to the target site is modified as the specified address information, or the XFH field of the specified address information is added in the request header of the HTTP request initiated to the target site, to obtain a second request.

[0195] The matching unit is configured to match the string of the specified field corresponding to the security test case in the response message based on the preconfigured judgment rule, and determine the detection result corresponding to the security test case.

[0196] Whether the specified address information appears in the response message of the first request and the response message of the second request is matched respectively.

[0197] If the specified address information appears in the response message of the first request, it is determined that the XFF vulnerability exists in the header.

[0198] If the specified address information appears in the response message of the second request, it is determined that the XFH vulnerability exists in the header.

[0199] Optionally, in the middleware security detection system provided in another embodiment of the present application, when the security test case is a cross-domain vulnerability detection, the generation unit is configured to perform the following when generating the HTTP request corresponding to the security test case:

[0200] The source field in the HTTP request initiated to the target site is modified as the specified address information, or the source field of the specified address information is added in the HTTP request initiated to the target site.

[0201] The matching unit is configured to match the string of the specified field corresponding to the security test case in the response message based on the preconfigured judgment rule, and determine the detection result corresponding to the security test case.

[0202] Based on the preconfigured judgment rule, whether the specified address information appears in the request header or the request body of the response message, whether the resource control field in the request header of the response message is a set string, and whether the resource control field in the request header of the response message is empty and the cross-domain control field is a permitted string are matched.

[0203] If the specified address information appears in the request header or the request body of the response message, or the resource control field in the request header of the response message is a set string, or the resource control field in the request header of the response message is empty and the cross-domain control field is a permitted string, it is determined that a cross-domain attack vulnerability exists.

[0204] Optionally, in the middleware security detection system provided in another embodiment of the present application, further comprising:

[0205] a list feedback unit configured to generate a current problem list of the security test case based on the detection result corresponding to the security test case and feed back.

[0206] a retest unit configured to return the generating unit for the security test case in response to a retest operation for the current problem list of the security test case.

[0207] a reporting unit configured to generate a retest report of the security test case and close the current problem list of the security test case when the detection result of the retest of the security test case indicates that there is no vulnerability.

[0208] a flow unit configured to reflow the current problem list of the security test case when the detection result of the retest of the security test case indicates that there is a vulnerability.

[0209] It should be noted that the specific working processes of the various units provided in the above embodiments of the present application can be correspondingly referred to the implementation processes of the corresponding steps in the above method embodiments, which will not be described here.

[0210] Another embodiment of the present application provides an electronic device, as shown in the figure, comprising: Figure 8

[0211] a memory 801 and a processor 802.

[0212] The memory 801 is configured to store a program.

[0213] The processor 802 is configured to execute the program stored in the memory 801, and when the program is executed, it is specifically configured to implement the middleware security detection method provided in any one of the above embodiments.

[0214] Another embodiment of the present application provides a computer storage medium for storing a computer program, which is executed by a processor to implement the middleware security detection method provided in any one of the above embodiments.

[0215] ​Computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information for access by a computing device. According to the definitions provided herein, computer readable media does not include transitory computer readable medium, such as a modulated data signal and a carrier wave.

[0216] Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality, without reference to a specific

[0217] The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security detection method for middleware, characterized in that, include: Trigger a security test on the selected scanned application; For each security test case, generate corresponding HTTP requests. These security test cases include HTTP method detection, middleware banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection. The HTTP requests for HTTP method detection include the original HTTP requests for all method types. The HTTP requests for middleware banner information leakage detection include HTTP requests that trigger server-side redirection, client errors, and server errors, as well as the original HTTP requests for all method types. The HTTP requests for Host header attack detection include HTTP requests that modify the Host field. The HTTP requests for XFF and XFH vulnerability detection include HTTP requests that modify the XFF and XFH fields. The HTTP requests for cross-domain vulnerability detection modify the source field. Send the HTTP request corresponding to the security test case to the target site of the scanned application; Receive the response message from the target site; Based on pre-configured evaluation rules, the string of the specified field corresponding to the security test case in the response message is matched to determine the detection result corresponding to the security test case; Test reports are generated and feedback is provided based on the detection results corresponding to each of the aforementioned security test cases.

2. The method according to claim 1, characterized in that, When the security test case is the HTTP method detection, the detection result corresponding to the security test case is determined by matching the string of the specified field corresponding to the security test case in the response message based on the pre-configured evaluation rules, including: For each type of HTTP request, the response status code in the response message is matched to see if it is the target status code in the pre-configured evaluation rules. If the response status code in the response message matches the target status code in the pre-configured evaluation rules, then it is determined that there is a security vulnerability that supports HTTP requests of the insecure method type.

3. The method according to claim 1, characterized in that, When the security test case is the detection of middleware banner information leakage, the method of determining the detection result corresponding to the security test case by matching the string of the specified field corresponding to the security test case in the response message based on the pre-configured evaluation rules includes: Based on the pre-configured evaluation rules, match the service field of the request header and each string of the request body in the response message to see if there is a string of any configured middleware banner information. If any middleware banner information string exists in the configuration, then a vulnerability exists that leaks the middleware banner information.

4. The method according to claim 1, characterized in that, When the security test case is the Host header attack detection, generating the HTTP request corresponding to the security test case includes: Modify the Host field in the request header of the HTTP request sent to the target site to the specified address information; Add a Host field containing the specified address information to the request header of the HTTP request sent to the target site; Modify the path of the HTTP request sent to the target site to the absolute route path of the target site, and modify the Host field in the request header to the specified address information; The step of determining the detection result corresponding to the security test case by matching the string of a specified field corresponding to the security test case in the response message based on pre-configured evaluation rules includes: For each HTTP request corresponding to the Host header attack detection, the response message is matched to see if the specified address information exists in the response message; If the specified address information is found in the response message, then a Host header attack vulnerability is identified.

5. The method according to claim 1, characterized in that, When the security test case is for detecting the XFF and XFH vulnerabilities, generating the HTTP request corresponding to the security test case includes: The XFF field in the request header of the HTTP request initiated to the target site is modified to the specified address information, or the XFF field of the specified address information is added to the request header of the HTTP request initiated to the target site to obtain the first request; The XFH field in the request header of the HTTP request initiated to the target site is modified to the specified address information, or the XFH field of the specified address information is added to the request header of the HTTP request initiated to the target site to obtain the second request; The step of determining the detection result corresponding to the security test case by matching the string of a specified field corresponding to the security test case in the response message based on pre-configured evaluation rules includes: The specified address information is checked in the response messages of the first request and the second request, respectively. If the specified address information appears in the response message of the first request, it is determined that there is an XFF vulnerability in the header; If the specified address information appears in the response message of the second request, it is determined that the header contains an XFH vulnerability.

6. The method according to claim 1, characterized in that, When the security test case is the cross-domain vulnerability detection, generating the HTTP request corresponding to the security test case includes: Modify the source field in the HTTP request sent to the target site to the specified address information, or add the source field of the specified address information to the HTTP request sent to the target site; The step of determining the detection result corresponding to the security test case by matching the string of a specified field corresponding to the security test case in the response message based on pre-configured evaluation rules includes: Based on the pre-configured evaluation rules, the system matches whether the specified address information appears in the request header or request body of the response message, whether the resource control field of the response message is a set string, and whether the resource control field is empty and the cross-domain control field is an allowed string. If the specified address information appears in the request header or request body of the matching response message, or if the resource control field of the matching response message is set to a specific string, and the resource control field is empty while the cross-domain control field is set to an allowed string, then a cross-domain attack vulnerability is identified.

7. The method according to claim 1, characterized in that, After determining the detection result corresponding to the security test case by matching the specified field string in the response message with the pre-configured evaluation rules, the method further includes: Based on the detection results corresponding to the security test case, a current issue ticket for the security test case is generated and feedback is provided; In response to the retesting operation of the current issue ticket for the security test case, for the security test case, return the HTTP request that generated the security test case; If the retest results of the security test case indicate that no vulnerabilities exist, a retest report for the security test case is generated, and the current issue ticket for the security test case is closed. If the retest results of the security test case indicate that a vulnerability exists, the current issue ticket for the security test case will be re-circulated.

8. A middleware security detection system, characterized in that, include: The triggering unit is used to trigger security tests on the specified scanned applications. The generation unit is used to generate HTTP requests corresponding to each security test case. The security test cases include HTTP method detection, middleware banner information leakage detection, Host header attack detection, XFF and XFH vulnerability detection, and cross-domain vulnerability detection. The HTTP requests corresponding to HTTP method detection include the original HTTP requests for all method types. The HTTP requests corresponding to middleware banner information leakage detection include HTTP requests that trigger server-side redirection, client errors, and server errors, as well as the original HTTP requests for all method types. The HTTP requests corresponding to Host header attack detection include HTTP requests that modify the Host field. The HTTP requests corresponding to XFF and XFH vulnerability detection include HTTP requests that modify the XFF and XFH fields. The HTTP requests corresponding to cross-domain vulnerability detection modify the source field. The sending unit is used to send the HTTP request corresponding to the security test case to the target site of the scanned application; A message receiving unit is used to receive response messages from the target site; The matching unit is used to match the string of the specified field corresponding to the security test case in the response message based on the pre-configured evaluation rules, and determine the detection result corresponding to the security test case; The result feedback unit is used to generate and feed back test reports based on the detection results corresponding to each of the security test cases.

9. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is used to execute the program, which, when executed, is specifically used to implement the middleware security detection method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, is used to implement the middleware security detection method as described in any one of claims 1 to 7.

Images