System, method and program for inspecting vulnerability of web application

Abstract

To provide a system, method and program for inspecting vulnerability of various applications.SOLUTION: A vulnerability inspection server 10 provides a vulnerability inspection service for statically analyzing vulnerability of web applications to users who operate user terminals 30 communicably connected via a communication network 20. The server 10 uses a large-scale language model to acquire endpoint information including processing information to be executed in each of a plurality of endpoints in a web application on the basis of a source code, and acquires vulnerability information of the endpoint on the basis of corresponding endpoint information and specification information. This mechanism can be uniformly applied to inspection of vulnerability of various applications constructed in various environments.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a system, a method, and a program for testing vulnerabilities in web applications. [Background technology]

[0002] Conventionally, application vulnerabilities have been detected by static analysis of source code (see, for example, Patent Document 1 below). In such static analysis, the data flow of the entire source code is typically inspected, and the flow from malicious input to the occurrence of the vulnerability is reproduced. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-003309 Summary of the Invention [Problem to be solved by the invention]

[0004] However, because the static analysis described above requires different implementations for each environment, such as language and framework, it has been difficult to uniformly apply it to testing vulnerabilities in various applications built in diverse environments.

[0005] One of the objects of the embodiments of the present invention is to enable testing of vulnerabilities in various applications. Other objects of the embodiments of the present invention will become apparent by reading the entire specification. [Means for solving the problem]

[0006] A system according to one embodiment of the present invention is a system for testing vulnerabilities in web applications, comprising one or more computer processors, wherein the one or more computer processors perform the following steps: generating first instruction information instructing output of endpoint information related to each of multiple endpoints in the web application, the endpoint information including processing information related to processing executed at the endpoints, based on the source code of the web application; inputting the first instruction information into a first large-scale language model and acquiring the endpoint information output from the first large-scale language model; acquiring specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing output of vulnerability information related to vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model.

[0007] A method according to one embodiment of the present invention is executed by one or more computers and is a method for testing vulnerabilities in a web application, comprising the steps of: generating first instruction information instructing output of endpoint information regarding each of a plurality of endpoints in the web application, the endpoint information including processing information regarding processing executed at the endpoints, based on the source code of the web application; inputting the first instruction information into a first large-scale language model and obtaining the endpoint information output from the first large-scale language model; obtaining specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing output of vulnerability information regarding vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and obtaining the vulnerability information output from the second large-scale language model.

[0008] A program according to one embodiment of the present invention is a program for inspecting vulnerabilities in a web application, and causes one or more computers to execute the following steps: generating first instruction information instructing one or more computers to output endpoint information regarding each of multiple endpoints in the web application, the endpoint information including processing information regarding processing executed at the endpoints, based on the source code of the web application; inputting the first instruction information into a first large-scale language model and acquiring the endpoint information output from the first large-scale language model; acquiring specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing one or more computers to output vulnerability information regarding vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model. [Effects of the Invention]

[0009] Various embodiments of the present invention allow for vulnerability testing of various applications. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a diagram showing a schematic configuration of a network including a vulnerability test server 10 according to an embodiment of the present invention. [Figure 2] FIG. 3 is a diagram illustrating an example of information managed by an inspection rule information table 152. [Figure 3] FIG. 4 is a diagram illustrating an example of information managed by an examination management table 154. [Figure 4] FIG. 10 is a diagram illustrating an example of information managed by the inspection details management 156. [Figure 5] FIG. 4 is a diagram illustrating an example of an examination screen 50. [Figure 6] FIG. 6 is a diagram illustrating an example of an inspection rule specification screen 60. [Figure 7] 4 is a flowchart illustrating a process executed by the server 10 when a vulnerability test is performed. [Figure 8] FIG. 10 is a diagram illustrating a prompt for obtaining endpoint information. [Figure 9] FIG. 10 is a diagram illustrating an example of a response from a large-scale language model to which a prompt for obtaining endpoint information is input. [Figure 10] FIG. 10 is a diagram illustrating a prompt for obtaining specification information. [Figure 11] FIG. 10 is a diagram illustrating an example of a response from a large-scale language model to which a prompt for obtaining specification information is input. [Figure 12] FIG. 10 is a diagram illustrating a prompt for obtaining vulnerability information. [Figure 13] FIG. 10 is a diagram illustrating an example of a response from a large-scale language model to which a prompt for obtaining vulnerability information is input. [Figure 14] FIG. 10 is a diagram illustrating a prompt for extracting specification information. [Figure 15] FIG. 10 is a diagram illustrating an example of a response from a large-scale language model to which a prompt for extracting specification information is input. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same reference numerals may be used to designate the same or similar components.

[0012] FIG. 1 is a diagram illustrating a schematic configuration of a network including a vulnerability testing server 10 according to one embodiment of the present invention. As illustrated, the server 10 is communicably connected to a user terminal 30 via a communication network 20 such as the Internet. Although only one user terminal 30 is illustrated in FIG. 1, the server 10 is communicably connected to a plurality of user terminals 30. The vulnerability testing server 10 provides a vulnerability testing service that performs static analysis of vulnerabilities in web applications to a user operating the user terminal 30. The vulnerability testing server 10 is an example of a device that implements all or part of the system of the present invention.

[0013] First, we will explain the hardware configuration of the vulnerability check server 10. The vulnerability check server 10 is configured as a general computer, and as shown in Fig. 1, it includes a computer processor 11, a main memory 12, an input / output I / F 13, a communication I / F 14, and a storage (storage device) 15, and these components are electrically connected via a bus or the like (not shown).

[0014] The computer processor 11 is configured as a CPU, a GPU, or the like, and loads various programs stored in a storage 15 or the like into a main memory 12 and executes various instructions included in the programs. The main memory 12 is configured, for example, by a DRAM or the like.

[0015] The input / output I / F 13 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 13 includes, for example, information input devices such as a keyboard and a pointing device (e.g., a mouse, a touch panel, etc.), a voice input device such as a microphone, and an image input device such as a camera. The input / output I / F 13 also includes an image output device such as a display, and an audio output device such as a speaker.

[0016] The communication I / F 14 is implemented as hardware such as a network adapter, various communication software, or a combination of these, and is configured to enable wired or wireless communication via the communication network 20 or the like.

[0017] The storage 15 is configured, for example, by a magnetic disk or a flash memory. The storage 15 stores various programs including an operating system, various data, and the like. For example, as shown in Fig. 1, the storage 15 has an inspection rule information table 152 that manages information about inspection rules applicable to vulnerability inspections, an inspection management table 154 that manages information about individual inspections, and an inspection details management table 156 that manages information about the details of individual inspections. Some of these tables may be integrated into one table, or may be divided into multiple tables.

[0018] Furthermore, for example, the storage 15 stores a server-side program 40 according to one embodiment of the present invention. The program 40 is a program for causing the server 10 to function as all or part of a system for providing a vulnerability testing service. At least a part of the server-side program 40 can be configured to be executed on the user terminal 30 via a terminal-side program 42, which will be described later.

[0019] In this embodiment, the vulnerability test server 10 may be configured using a plurality of computers each having the above-described hardware configuration. For example, the server 10 may be configured by a plurality of server devices.

[0020] The vulnerability testing server 10 configured in this way can be configured to have the functions of a web server and an application server, and executes various processes in response to requests from the user terminal 30, and transmits screen data (e.g., HTML data) and control data according to the results of the processes to the user terminal 30. The user terminal 30 outputs a web page or other screen based on the received data.

[0021] Next, we will explain the hardware configuration of the user terminal 30. The user terminal 30 is configured as a general computer, and as shown in Fig. 1, it includes a computer processor 31, a main memory 32, an input / output I / F 33, a communication I / F 34, and a storage (storage device) 35, and these components are electrically connected via a bus or the like (not shown).

[0022] The computer processor 31 is configured as a CPU, a GPU, or the like, and loads various programs stored in a storage 35 or the like into the main memory 32 and executes various instructions included in the programs. The main memory 32 is configured, for example, by a DRAM or the like.

[0023] The input / output I / F 33 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 33 includes, for example, information input devices such as a keyboard and a pointing device (e.g., a mouse, a touch panel, etc.), an audio input device such as a microphone, and an image input device such as a camera. The input / output I / F 33 also includes an image output device such as a display, and an audio output device such as a speaker.

[0024] The communication I / F 34 is implemented as hardware such as a network adapter, various communication software, or a combination thereof, and is configured to be able to realize wired or wireless communication via the communication network 20 or the like.

[0025] The storage 35 is configured, for example, by a magnetic disk or a flash memory. The storage 35 stores various programs including an operating system, various data, and the like. The programs stored in the storage 35 can be downloaded and installed from an application market or the like. The storage 35 also stores the above-mentioned terminal-side program 42. The program 42 can be configured as a web browser or other application (for example, a terminal-side application for the vulnerability testing service of this embodiment), and can be configured to execute at least a part of the server-side program 40, as described above.

[0026] In this embodiment, the user terminal 30 may be configured as a smartphone, a tablet terminal, a personal computer, or the like.

[0027] A user operating a user terminal 30 configured in this manner can use the vulnerability testing service provided by the server 10 by communicating with the server 10 via a terminal-side program 42 installed in storage 35 or the like.

[0028] Next, we will explain the functions of the vulnerability testing server 10 configured as above. The computer processor 11 of the server 10 is configured to function as a management function control unit 112 and a testing control unit 114 by executing instructions included in a program (for example, at least a part of the server-side program 40) loaded into the main memory 12, as shown in Fig. 1.

[0029] The management function control unit 112 is configured to execute various processes related to the control of the management functions of the vulnerability testing service. For example, the management function control unit 112 transmits screen data and control data of various screens related to the management functions to the user terminal 30, executes various processes in response to operation input by the user via the screens output on the user terminal 30, and transmits screen data and control data according to the results of the processes to the user terminal 30. The management functions controlled by the management function control unit 112 include, for example, login processing (user authentication), billing control, and user account management.

[0030] The inspection control unit 114 is configured to execute various processes related to the control of vulnerability inspection. For example, the inspection control unit 114 transmits screen data and control data of various screens for controlling the inspection to the user terminal 30, executes various processes in response to operation input by the user via the screens output on the user terminal 30, and transmits screen data, control data, etc. according to the results of the processes to the user terminal 30.

[0031] In this embodiment, the test control unit 114 is configured to generate first instruction information (prompt) for acquiring endpoint information, which instructs outputting endpoint information related to each of a plurality of endpoints in a web application based on the source code of the web application. In this embodiment, the endpoint information includes processing information (e.g., HTTP method and / or code) related to processing executed at the corresponding endpoint.

[0032] An endpoint, sometimes called an API endpoint, is an entry point for clients to access specific functions or data, and can also be said to be the point or unit of entry for external attacks. A client can obtain a response from an endpoint by sending an HTTP request. Endpoint information may include the path corresponding to the endpoint.

[0033] The test control unit 114 is also configured to input the generated first instruction information to a first large-scale language model (LLM) and acquire endpoint information output from the first large-scale language model. The large-scale language model is a machine learning model in natural language processing trained using a large amount of data, and may be, for example, GPT provided by OpenAI, Inc., USA, or BERT or PaLM provided by Google, Inc., USA. For example, the instruction information is input via an API corresponding to such a large-scale language model.

[0034] Furthermore, the test control unit 114 is configured to acquire specification information in which the specifications of the corresponding endpoint are written in a natural language.

[0035] In addition, the inspection control unit 114 is configured to generate second instruction information (prompt) for acquiring vulnerability information that instructs outputting vulnerability information related to vulnerabilities of the endpoint based on the corresponding endpoint information and specification information, input the generated second instruction information to the second large-scale language model, and acquire the vulnerability information output from the second large-scale language model.

[0036] In this way, the vulnerability testing server 10 in this embodiment uses a large-scale language model to acquire endpoint information including processing information executed at each of multiple endpoints in a web application based on the source code, and acquires vulnerability information for the endpoints based on the corresponding endpoint information and specification information. This mechanism can be uniformly applied to vulnerability testing of various applications built in various environments. In other words, the server 10 enables vulnerability testing of various applications.

[0037] Furthermore, since the vulnerability check server 10 acquires vulnerability information based on specification information written in natural language, it may be possible to detect vulnerabilities based on business logic (for example, vulnerabilities in authority management problems, etc.).

[0038] In this embodiment, the first large-scale language model used to obtain endpoint information and the second large-scale language model used to obtain vulnerability information may be the same large-scale language model or different large-scale language models.

[0039] In this embodiment, the specification information can be acquired in various ways. For example, the test control unit 114 acquires specification information (for example, provided in advance by an administrator of a web application) stored in advance in the storage 15 or the like.

[0040] Alternatively, the specification information may be acquired using a large-scale language model. That is, the test control unit 114 may be configured to generate third instruction information for acquiring specification information that instructs outputting the specification information based on the endpoint information, input the third instruction information to a third large-scale language model, and acquire the specification information output from the third large-scale language model. The third large-scale language model may be the same large-scale language model as the first large-scale language model and / or the second large-scale language model, or may be a different large-scale language model. This configuration enables acquisition of endpoint specification information based on the source code of a web application.

[0041] In this embodiment, the second instruction information for acquiring vulnerability information may be configured to instruct output of the vulnerability information in accordance with a predetermined vulnerability inspection rule. For example, the inspection control unit 114 may be configured to acquire an inspection rule (e.g., registered in advance by a vulnerability inspection service provider) managed in the inspection rule information table 152 and generate second instruction information instructing output of the vulnerability information in accordance with the inspection rule. This configuration may enable improved accuracy in determining vulnerabilities in large-scale language models, application of inspection rules based on information unlearned by large-scale language models (e.g., new technologies or vulnerabilities with little recognition), and customization, such as determining a vulnerability when certain conditions are met.

[0042] Next, a specific example will be described as one aspect of the vulnerability testing server 10 of this embodiment having such functions. First, the information managed by each table in this example will be described. FIG. 2 illustrates information managed by the testing rule information table 152 in this example. The testing rule information table 152 in this example manages information related to testing rules applicable to vulnerability testing, and as shown in the figure, manages information such as "rule name" and "test rule content" in which the testing rule is written in natural language, in association with an "test rule ID" that identifies an individual testing rule. In this example, these testing rules are registered in advance by the provider of the vulnerability testing service. The testing rules include, for example, the following rules: Rule 1: If "userId" is specified as an argument to "badFunction" in the code, it should be detected as a "flaw in permission management." Rule 2: If the code uses "secureFunction" to output text, do not detect it as "Cross-Site Scripting." Rule 3: The escapex function is a function for preventing SQL injection, so even if the string is concatenated to properly escape characters, it is determined that there is no SQL injection vulnerability.

[0043] 3 illustrates information managed by the inspection management table 154 in this example. The inspection management table 154 in this example manages information related to vulnerability inspections, and as shown in the figure, manages information such as information about the user performing the inspection, "basic information" including the inspection date and time, a "source code file storage path" which is the path where the source code file containing the source code of the web application to be inspected is stored, a "source code file name" which is the file name of the source code file, and "applied inspection rule information" which is information about the inspection rule to be applied, in association with an "inspection ID" which identifies each inspection rule to be applied. The applied inspection rule information includes an inspection rule ID which identifies each inspection rule to be applied.

[0044] 4 illustrates information managed by the inspection details management table 156 in this example. The inspection details management table 156 in this example manages information for each endpoint in an inspection, and as shown in the figure, manages information such as an "HTTP method" corresponding to the processing executed at the endpoint, a "path" identifying the endpoint, a "code" corresponding to the processing executed at the endpoint, "specification information" which is information describing the specifications of the endpoint in natural language, and a "vulnerability inspection result" which is the result of a vulnerability inspection at the endpoint, in association with a combination of an "inspection ID" which identifies an individual inspection and an "endpoint ID" which identifies an individual endpoint of a web application to be inspected in the inspection.

[0045] The information managed by each table in this example has been described above. Next, the processing executed by the vulnerability check server 10 and the screens output on the user terminal 30 in this example will be described.

[0046] 5 shows an example of an inspection screen 50 output on the user terminal 30. The screen 50 is a screen for a user of the vulnerability inspection service to inspect for vulnerabilities by static analysis of source code, and as shown in the figure, has a first button 52 with the text "Specify source code file" added, a second button 54 with the text "Specify inspection rule" added, and a third button 56 with the text "Start inspection" added.

[0047] The first button 52 is an object for specifying a file containing source code for a web application to be inspected for vulnerabilities. When the button 52 is selected, a screen (not shown) for specifying a specific file is displayed, and the user can specify the file containing the source code via the screen. When the file is specified, the source code file storage path and the source code file name are registered in the inspection management table 154. Note that multiple files may be specified as the file containing the source code.

[0048] The second button 54 is an object for specifying an inspection rule to be applied to vulnerability inspection. When this button 54 is selected, an inspection rule specification screen 60, an example of which is shown in Fig. 6, is output. As shown in the figure, this screen 60 has an inspection rule specification area 62 for specifying an inspection rule, a setting button 64, and a back button 66.

[0049] The inspection rule specification area 62 displays a list of the rule names of multiple inspection rules (managed in the inspection rule information table 152) that can be applied to vulnerability inspection, with a check box 621 located to the left of each rule name. The user selects the check box 621 corresponding to the inspection rule to be applied to vulnerability inspection, and then selects the setting button 64. When the button 64 is selected, the applied inspection rule information is registered in the inspection management table 154.

[0050] The third button 56 is an object for starting a vulnerability test. Fig. 7 is a flowchart illustrating a process executed by the server 10 in response to the selection of the button 56 (i.e., when a vulnerability test is performed). As shown in the figure, the server 10 first generates a prompt (first instruction information) for obtaining endpoint information (step S100). Specifically, a prompt instructing the acquisition of endpoint information is generated based on the source code of the web application.

[0051] 8 shows an example of a prompt for obtaining endpoint information. As shown, the prompt instructs the extraction of the endpoint path and the function to be executed / called from the source code of a web application. Specifically, the prompt instructs the extraction of the HTTP method, path, and code as endpoint-specific information. The contents of the source code are obtained from the source code file identified by the source code file storage path and source code file name managed in the inspection management table 154.

[0052] 7, the server 10 then acquires and registers endpoint information (step S110). Specifically, a prompt for acquiring endpoint information is input to the large-scale language model, and endpoint information (HTTP method, path, and code) of each of the multiple endpoints output from the large-scale language model is registered in the inspection details management table 156.

[0053] Figure 9 illustrates an example of a response from a large-scale language model to which the prompt for obtaining endpoint information illustrated in Figure 8 has been input. As illustrated, based on the source code of a web application, the HTTP method, path, and code are extracted as endpoint information for each of multiple endpoints in the web application.

[0054] 7, the server 10 then generates a prompt (third instruction information) for acquiring specification information for the target endpoint (step S120). Specifically, an unprocessed endpoint is sequentially identified as the target endpoint from among the multiple endpoints, and a prompt for acquiring specification information for the target endpoint is generated. The prompt is a prompt that instructs acquisition of specification information based on the endpoint information.

[0055] 10 shows an example of a prompt for obtaining specification information. As shown in the figure, the prompt instructs the user to describe the endpoint specifications from the endpoint information. Specifically, the prompt instructs the user to describe the HTTP method executed at the endpoint, the path that identifies the endpoint, and a description of the endpoint specifications. The endpoint information (HTTP method, path, and code) is obtained from the inspection details management table 156.

[0056] Returning to the flowchart of FIG. 7, the server 10 then acquires and registers the specification information (step S130). Specifically, a prompt for acquiring the specification information is input to the large-scale language model, and the specification information output from the large-scale language model is registered in the inspection details management table 156. In this example, the specification information is acquired using the same large-scale language model as the large-scale language model used to acquire the endpoint information. Note that in another example of this embodiment, the specification information may be acquired using a large-scale language model different from the large-scale language model used to acquire the endpoint information.

[0057] Fig. 11 illustrates an example of a response from a large-scale language model to which the prompt for obtaining endpoint information illustrated in Fig. 10 has been input. As illustrated, the endpoint specifications are written in natural language (Japanese in this example) based on the endpoint information.

[0058] 7, the server 10 then generates a prompt (second instruction information) for acquiring vulnerability information for the target endpoint (step S140). Specifically, the prompt is generated to instruct acquisition of vulnerability information for the endpoint based on the specification information and the vulnerability testing rule.

[0059] 12 shows an example of a prompt for obtaining vulnerability information. As shown in the figure, the prompt instructs that vulnerabilities of the endpoint be identified from the endpoint specification information and code in accordance with the vulnerability testing rules specified by the user (the vulnerability name, vulnerability description, and relevant code are obtained). The endpoint specification information and code are obtained from the test details management table 156. The vulnerability testing rules specified by the user are obtained from the test management table 154.

[0060] Returning to the flowchart of Fig. 7, the server 10 then acquires and registers vulnerability information (step S150). Specifically, a prompt for acquiring vulnerability information is input to the large-scale language model, and the vulnerability test results including the vulnerability information output from the large-scale language model are registered in the test details management table 156. In this example, the vulnerability information is acquired using the same large-scale language model as the large-scale language model used to acquire the endpoint information and specification information. Note that in another example of this embodiment, the vulnerability information may be acquired using a large-scale language model different from the large-scale language model used to acquire the endpoint information and / or specification information.

[0061] Figure 13 shows an example of a response from a large-scale language model to which the prompt for acquiring vulnerability information shown in Figure 12 has been input. As shown in the figure, the endpoint specification information and code indicate vulnerabilities in the endpoint (a session management vulnerability and plaintext password storage). Note that if the prompt shown in Figure 12 does not include a rule for excluding SQL injection as a vulnerability testing rule (the rule is not applied), an SQL injection vulnerability may be detected.

[0062] 7, if there is an unprocessed endpoint (YES in step S160), the server 10 returns to step S120 and generates a prompt for obtaining specification information, obtains and registers the specification information, generates a prompt for obtaining vulnerability information, and obtains and registers the vulnerability information for the next endpoint (steps S120 to S150). This series of processes is repeated until there are no more unprocessed endpoints (NO in step S160).

[0063] In the above example, the endpoint specification information is acquired using a large-scale language model, but the specification information may be provided individually by the user. In this case, the endpoint specification information is acquired from a file in which the specification information of the web application is described and provided by the user (for example, a button for specifying the file is provided on the inspection screen 50). Furthermore, in this case, the specification information for each endpoint may be extracted from the specification information described in the file using a large-scale language model (prompts and responses in this case are shown as examples in FIGS. 14 and 15, respectively).

[0064] The vulnerability testing server 10 according to the present embodiment described above uses a large-scale language model to acquire endpoint information, including information on processes executed at each of multiple endpoints in a web application, based on the source code, and acquires vulnerability information for the endpoints based on the corresponding endpoint information and specification information. This mechanism can be uniformly applied to vulnerability testing of various applications built in various environments. In other words, the server 10 enables vulnerability testing of various applications.

[0065] In other embodiments of the present invention, some or all of the functions of the vulnerability testing server 10 in the above-described embodiments can be realized by cooperation between the vulnerability testing server 10 and the user terminal 30, or can be realized by the user terminal 30. In other words, the system of the present invention can be configured not only by the vulnerability testing server 10, but also by the vulnerability testing server 10 and the user terminal 30, or can be configured by the user terminal 30.

[0066] The processes and procedures described herein, other than those explicitly described, may be implemented by software, hardware, or any combination thereof. For example, the processes and procedures described herein may be implemented by implementing logic corresponding to the processes and procedures in media such as integrated circuits, volatile memory, non-volatile memory, and magnetic disks. The processes and procedures described herein may also be implemented as computer programs corresponding to the processes and procedures and executed by various computers.

[0067] Although processes and procedures described herein are described as being performed by a single device, software, component, or module, such processes or procedures may be performed by multiple devices, software, components, and / or modules. Also, the software and hardware elements described herein may be implemented by combining them into fewer components or breaking them down into more components.

[0068] In this specification, even if a component of the invention is described as either singular or plural, or is described without limitation as either singular or plural, the component may be either singular or plural unless the context requires otherwise. [Explanation of symbols]

[0069] 10 Vulnerability testing server 11. Computer Processor 112 Management function control section 114 Inspection control section 15. Storage 152 Inspection rule information table 154 Inspection Management Table 156 Inspection Details Management Table 30 User terminals 40 Server-side programs 42 Terminal side program 50 Inspection screen 60 Inspection rule specification screen

Claims

1. 1. A system for testing vulnerabilities in web applications, comprising one or more computer processors, the one or more computer processors comprising: generating first instruction information instructing output of endpoint information related to each of a plurality of endpoints in the web application, the endpoint information including processing information related to processing executed at the endpoint, based on source code of the web application; inputting the first instruction information into a first large-scale language model and obtaining the endpoint information output from the first large-scale language model; acquiring specification information in which the specification of the endpoint is described in a natural language; generating second instruction information instructing that vulnerability information related to vulnerabilities of the endpoint be output based on the endpoint information and the specification information; inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model; system.

2. the second large-scale language model is the same large-scale language model as the first large-scale language model; The system of claim 1.

3. the processing information includes an HTTP method and / or code to be executed at the endpoint; The system of claim 1.

4. The one or more computer processors further perform a step of generating third instruction information instructing that the specification information be output based on the endpoint information; the step of acquiring the specification information includes inputting the third instruction information to a third large-scale language model and acquiring the specification information output from the third large-scale language model. The system of claim 1.

5. the third large-scale language model is the same large-scale language model as the first large-scale language model and / or the second large-scale language model; The system of claim 4.

6. the second instruction information instructs outputting the vulnerability information in accordance with a predetermined vulnerability inspection rule; The system of claim 1.

7. 1. A method executed by one or more computers for testing web applications for vulnerabilities, comprising: generating first instruction information instructing output of endpoint information related to each of a plurality of endpoints in the web application, the endpoint information including processing information related to processing executed at the endpoint, based on source code of the web application; inputting the first instruction information into a first large-scale language model and obtaining the endpoint information output from the first large-scale language model; acquiring specification information in which the specification of the endpoint is described in a natural language; generating second instruction information instructing that vulnerability information related to vulnerabilities of the endpoint be output based on the endpoint information and the specification information; inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model; method.

8. A program for testing vulnerabilities in web applications, the program being installed on one or more computers: generating first instruction information instructing output of endpoint information related to each of a plurality of endpoints in the web application, the endpoint information including processing information related to processing executed at the endpoint, based on source code of the web application; inputting the first instruction information into a first large-scale language model and obtaining the endpoint information output from the first large-scale language model; acquiring specification information in which the specification of the endpoint is described in a natural language; generating second instruction information instructing that vulnerability information related to vulnerabilities of the endpoint be output based on the endpoint information and the specification information; inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model; program.

Images