System, method, and program for inspecting vulnerabilities in web application

Abstract

A vulnerability inspection server 10 according to one embodiment of the present invention enables inspection of vulnerabilities in various applications. The server 10 provides, to a user who operates a user terminal 30 communicatively connected thereto via a communication network 20, a vulnerability inspection service in which a static analysis of vulnerabilities in a web application is performed. The server 10: acquires, on the basis of a source code and by using a large language model, endpoint information including information on processing executed in a plurality of endpoints in the web application; and acquires vulnerability information on the endpoints on the basis of corresponding endpoint information and specification information. This mechanism can be uniformly applied to inspections of vulnerabilities in various applications built in diverse environments.

Description

System, method, and program for testing web application vulnerabilities

[0001] The present invention relates to a system, a method, and a program for testing vulnerabilities in web applications.

[0002] Conventionally, application vulnerabilities have been detected by static analysis of source code (see, for example, Patent Document 1 below). In such static analysis, the data flow of the entire source code is typically inspected, and the flow from malicious input to the occurrence of the vulnerability is reproduced.

[0003] Japanese Patent Application Laid-Open No. 2019-003309

[0004] However, because the static analysis described above requires different implementations for each environment, such as language and framework, it has been difficult to uniformly apply it to testing vulnerabilities in various applications built in diverse environments.

[0005] One of the objects of the embodiments of the present invention is to enable testing of vulnerabilities in various applications. Other objects of the embodiments of the present invention will become apparent by reading the entire specification.

[0006] A system according to one embodiment of the present invention is a system for testing vulnerabilities in web applications, comprising one or more computer processors, wherein the one or more computer processors perform the following steps: generating first instruction information instructing output of endpoint information related to each of multiple endpoints in the web application, the endpoint information including processing information related to processing executed at the endpoints, based on the source code of the web application; inputting the first instruction information into a first large-scale language model and acquiring the endpoint information output from the first large-scale language model; acquiring specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing output of vulnerability information related to vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model.

[0007] A method according to one embodiment of the present invention is executed by one or more computers and is a method for testing vulnerabilities in a web application, comprising the steps of: generating first instruction information instructing output of endpoint information regarding each of a plurality of endpoints in the web application, the endpoint information including processing information regarding processing executed at the endpoints, based on the source code of the web application; inputting the first instruction information into a first large-scale language model and obtaining the endpoint information output from the first large-scale language model; obtaining specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing output of vulnerability information regarding vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and obtaining the vulnerability information output from the second large-scale language model.

[0008] A program according to one embodiment of the present invention is a program for inspecting vulnerabilities in a web application, and causes one or more computers to execute the following steps: generating first instruction information instructing one or more computers to output endpoint information regarding each of multiple endpoints in the web application, the endpoint information including processing information regarding processing executed at the endpoints, based on the source code of the web application; inputting the first instruction information into a first large-scale language model and acquiring the endpoint information output from the first large-scale language model; acquiring specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing one or more computers to output vulnerability information regarding vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model.

[0009] Various embodiments of the present invention allow for vulnerability testing of various applications.

[0010] 1 is a block diagram schematically showing the configuration of a network including a vulnerability testing server 10 according to an embodiment of the present invention. FIG. 1 is a diagram illustrating an example of information managed by a testing rule information table 152. FIG. 2 is a diagram illustrating an example of information managed by a testing management table 154. FIG. 3 is a diagram illustrating an example of information managed by a testing detail management table 156. FIG. 4 is a diagram illustrating an example of a testing screen 50. FIG. 5 is a diagram illustrating an example of a testing rule specification screen 60. FIG. 6 is a flowchart illustrating a process executed by the server 10 when performing a vulnerability test. FIG. 7 is a diagram illustrating a prompt for acquiring endpoint information. FIG. 8 is a diagram illustrating a response from a large-scale language model to which a prompt for acquiring endpoint information has been input. FIG. 9 is a diagram illustrating a prompt for acquiring specification information. FIG. 10 is a diagram illustrating a response from a large-scale language model to which a prompt for acquiring specification information has been input. FIG. 11 is a diagram illustrating a prompt for acquiring vulnerability information. FIG. 12 is a diagram illustrating a response from a large-scale language model to which a prompt for acquiring vulnerability information has been input.

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same reference numerals may be used to designate the same or similar components.

[0012] FIG. 1 is a diagram illustrating a schematic configuration of a network including a vulnerability testing server 10 according to an embodiment of the present invention. As illustrated, the server 10 is communicatively connected to a user terminal 30 via a communication network 20 such as the Internet. Although only one user terminal 30 is illustrated in FIG. 1, the server 10 is communicatively connected to a plurality of user terminals 30. The vulnerability testing server 10 provides a vulnerability testing service that performs static analysis of vulnerabilities in web applications to a user operating the user terminal 30. The vulnerability testing server 10 is an example of a device that implements all or part of the system of the present invention.

[0013] First, we will explain the hardware configuration of the vulnerability testing server 10. The vulnerability testing server 10 is configured as a general computer, and as shown in Fig. 1, it includes a computer processor 11, a main memory 12, an input / output I / F 13, a communication I / F 14, and a storage (storage device) 15, and these components are electrically connected via a bus or the like (not shown).

[0014] The computer processor 11 is configured as a CPU, a GPU, or the like, and loads various programs stored in the storage 15 or the like into the main memory 12 and executes various instructions included in the programs. The main memory 12 is configured, for example, by a DRAM or the like.

[0015] The input / output I / F 13 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 13 includes, for example, information input devices such as a keyboard and a pointing device (e.g., a mouse, a touch panel, etc.), audio input devices such as a microphone, and image input devices such as a camera. The input / output I / F 13 also includes an image output device such as a display, and an audio output device such as a speaker.

[0016] The communication I / F 14 is implemented as hardware such as a network adapter, various communication software, or a combination of these, and is configured to enable wired or wireless communication via a communication network 20 or the like.

[0017] The storage 15 is configured, for example, by a magnetic disk or a flash memory. The storage 15 stores various programs including an operating system, various data, and the like. For example, as shown in FIG. 1 , the storage 15 has an inspection rule information table 152 that manages information about inspection rules applicable to vulnerability inspections, an inspection management table 154 that manages information about individual inspections, and an inspection details management table 156 that manages information about the details of individual inspections. Some of these tables may be integrated into one table, or may be divided into multiple tables.

[0018] Furthermore, for example, the storage 15 stores a server-side program 40 according to one embodiment of the present invention. The program 40 is a program for causing the server 10 to function as all or part of a system for providing a vulnerability testing service. At least a part of the server-side program 40 can be configured to be executed on the user terminal 30 via a terminal-side program 42, which will be described later.

[0019] In this embodiment, the vulnerability testing server 10 may be configured using a plurality of computers each having the above-described hardware configuration. For example, the server 10 may be configured by a plurality of server devices.

[0020] The vulnerability testing server 10 configured in this manner can be configured to function as a web server and an application server, and executes various processes in response to requests from the user terminal 30, and transmits screen data (e.g., HTML data) and control data according to the results of the processes to the user terminal 30. The user terminal 30 outputs a web page or other screen based on the received data.

[0021] Next, we will explain the hardware configuration of the user terminal 30. The user terminal 30 is configured as a general computer, and as shown in Fig. 1, it includes a computer processor 31, a main memory 32, an input / output I / F 33, a communication I / F 34, and a storage (storage device) 35, and these components are electrically connected via a bus or the like (not shown).

[0022] The computer processor 31 is configured as a CPU, a GPU, or the like, and loads various programs stored in the storage 35 or the like into the main memory 32 and executes various instructions included in the programs. The main memory 32 is configured, for example, by a DRAM or the like.

[0023] The input / output I / F 33 includes various input / output devices for exchanging information with an operator, etc. The input / output I / F 33 includes, for example, information input devices such as a keyboard and a pointing device (e.g., a mouse, a touch panel, etc.), audio input devices such as a microphone, and image input devices such as a camera. The input / output I / F 33 also includes an image output device such as a display, and an audio output device such as a speaker.

[0024] The communication I / F 34 is implemented as hardware such as a network adapter, various communication software, or a combination thereof, and is configured to realize wired or wireless communication via the communication network 20 or the like.

[0025] The storage 35 is configured, for example, by a magnetic disk or a flash memory. The storage 35 stores various programs including an operating system, various data, and the like. The programs stored in the storage 35 can be downloaded and installed from an application market or the like. The storage 35 also stores the above-mentioned terminal-side program 42. The program 42 can be configured as a web browser or other application (e.g., a terminal-side application for the vulnerability testing service of this embodiment), and can be configured to execute at least a part of the server-side program 40, as described above.

[0026] In this embodiment, the user terminal 30 may be configured as a smartphone, a tablet terminal, a personal computer, or the like.

[0027] A user operating a user terminal 30 configured in this manner can use the vulnerability testing service provided by the server 10 by communicating with the server 10 via a terminal-side program 42 installed in storage 35 or the like.

[0028] Next, we will explain the functions of the vulnerability testing server 10 configured as above. As shown in Figure 1, the computer processor 11 of the server 10 is configured to function as a management function control unit 112 and a testing control unit 114 by executing instructions included in a program (e.g., at least a part of the server-side program 40) loaded into the main memory 12.

[0029] The management function control unit 112 is configured to execute various processes related to the control of the management functions of the vulnerability testing service. For example, the management function control unit 112 transmits screen data and control data of various screens related to the management functions to the user terminal 30, executes various processes in response to operation input by the user via the screens output on the user terminal 30, and transmits screen data and control data according to the results of the processes to the user terminal 30. The management functions controlled by the management function control unit 112 include, for example, login processing (user authentication), billing control, and user account management.

[0030] The inspection control unit 114 is configured to execute various processes related to the control of vulnerability inspection. For example, the inspection control unit 114 transmits screen data and control data of various screens for controlling the inspection to the user terminal 30, executes various processes in response to operation input by the user via the screens output on the user terminal 30, and transmits screen data, control data, etc. according to the results of the processes to the user terminal 30.

[0031] In this embodiment, the test control unit 114 is configured to generate first instruction information (prompt) for acquiring endpoint information, which instructs outputting endpoint information for each of a plurality of endpoints in a web application based on the source code of the web application. In this embodiment, the endpoint information includes processing information (e.g., HTTP methods and / or code) related to processing to be executed at the corresponding endpoints.

[0032] An endpoint, sometimes called an API endpoint, is an entrance through which a client can access a specific function or data, and can also be said to be a point or unit of entry for an external attack. A client can obtain a response from an endpoint by sending an HTTP request. Endpoint information may include a path corresponding to the endpoint.

[0033] The test control unit 114 is also configured to input the generated first instruction information to a first large-scale language model (LLM) and acquire endpoint information output from the first large-scale language model. The large-scale language model is a machine learning model in natural language processing trained using a large amount of data, and may be, for example, GPT provided by OpenAI, Inc. of the United States, or BERT or PaLM provided by Google, Inc. of the United States. For example, the instruction information is input via an API corresponding to such a large-scale language model.

[0034] The test control unit 114 is also configured to acquire specification information in which the specifications of the corresponding endpoint are written in a natural language.

[0035] In addition, the inspection control unit 114 is configured to generate second instruction information (prompt) for acquiring vulnerability information that instructs the output of vulnerability information related to vulnerabilities of the endpoint based on the corresponding endpoint information and specification information, input the generated second instruction information to the second large-scale language model, and acquire the vulnerability information output from the second large-scale language model.

[0036] In this way, the vulnerability testing server 10 in this embodiment uses a large-scale language model to acquire endpoint information including processing information executed at each of multiple endpoints in a web application based on the source code, and acquires vulnerability information for the endpoints based on the corresponding endpoint information and specification information. This mechanism can be uniformly applied to vulnerability testing of various applications built in various environments. In other words, the server 10 enables vulnerability testing of various applications.

[0037] Furthermore, since the vulnerability testing server 10 acquires vulnerability information based on specification information written in natural language, it may be possible to detect vulnerabilities based on business logic (for example, vulnerabilities related to authority management problems, etc.).

[0038] In this embodiment, the first large-scale language model used to acquire endpoint information and the second large-scale language model used to acquire vulnerability information may be the same large-scale language model or different large-scale language models.

[0039] In this embodiment, the specification information can be acquired in various ways. For example, the test control unit 114 acquires specification information that is stored in advance in the storage 15 or the like (for example, provided in advance by an administrator of a web application).

[0040] Alternatively, the specification information may be acquired using a large-scale language model. That is, the test control unit 114 may be configured to generate third instruction information for acquiring specification information that instructs output of the specification information based on the endpoint information, input the third instruction information to a third large-scale language model, and acquire the specification information output from the third large-scale language model. The third large-scale language model may be the same large-scale language model as the first large-scale language model and / or the second large-scale language model, or may be a different large-scale language model. This configuration enables acquisition of endpoint specification information based on the source code of a web application.

[0041] In this embodiment, the second instruction information for acquiring vulnerability information may be configured to instruct output of the vulnerability information in accordance with a predetermined vulnerability inspection rule. For example, the inspection control unit 114 may be configured to acquire an inspection rule (e.g., registered in advance by a vulnerability inspection service provider) managed in the inspection rule information table 152 and generate second instruction information instructing output of the vulnerability information in accordance with the inspection rule. This configuration may enable improved accuracy in determining vulnerabilities in large-scale language models, application of inspection rules based on information unlearned by large-scale language models (e.g., new technologies or vulnerabilities with low recognition), and customization, such as determining a vulnerability when certain conditions are met.

[0042] Next, a specific example of one aspect of the vulnerability testing server 10 of this embodiment having such functions will be described. First, the information managed by each table in this example will be described. FIG. 2 illustrates information managed by the testing rule information table 152 in this example. The testing rule information table 152 in this example manages information related to testing rules applicable to vulnerability testing, and as shown in the figure, manages information such as "rule name" and "test rule content" in which the testing rule is written in natural language, in association with an "test rule ID" that identifies an individual testing rule. In this example, these testing rules are registered in advance by the vulnerability testing service provider. The testing rules include, for example, the following rules: Rule 1: If "userId" is specified as an argument to "badFunction" in the code, it will be detected as a "flaw in privilege management." Rule 2: If "secureFunction" is used to output characters in the code, it will not be detected as "Cross-Site Scripting." Rule 3: Because the escapex function is a function used to counter SQL injection, it will be determined that there is no SQL injection vulnerability even if strings are combined to properly escape characters.

[0043] 3 illustrates information managed by the inspection management table 154 in this example. The inspection management table 154 in this example manages information related to vulnerability inspections, and as shown in the figure, manages information such as information about the user performing the inspection, "basic information" including the inspection date and time, a "source code file storage path" which is the path where the source code file containing the source code of the web application to be inspected is stored, a "source code file name" which is the file name of the source code file, and "applied inspection rule information" which is information about the inspection rule to be applied, in association with an "inspection ID" which identifies each inspection rule to be applied. The applied inspection rule information includes an inspection rule ID which identifies each inspection rule to be applied.

[0044] 4 illustrates information managed by the inspection details management table 156. In this example, the inspection details management table 156 manages information for each endpoint in an inspection, and as shown in the figure, manages information such as an "HTTP method" corresponding to the processing executed at the endpoint, a "path" identifying the endpoint, a "code" corresponding to the processing executed at the endpoint, "specification information" which is information describing the specifications of the endpoint in natural language, and a "vulnerability inspection result" which is the result of a vulnerability inspection at the endpoint, in association with a combination of an "inspection ID" which identifies an individual inspection and an "endpoint ID" which identifies an individual endpoint of a web application to be inspected in the inspection.

[0045] The information managed by each table in this example has been described above. Next, the processing executed by the vulnerability testing server 10 and the screens output on the user terminal 30 in this example will be described.

[0046] 5 shows an example of an inspection screen 50 output on the user terminal 30. The screen 50 is a screen for a user of the vulnerability inspection service to inspect for vulnerabilities by static analysis of source code, and as shown in the figure, has a first button 52 with the text "Specify source code file" added, a second button 54 with the text "Specify inspection rule" added, and a third button 56 with the text "Start inspection" added.

[0047] The first button 52 is an object for specifying a file containing source code for a web application to be inspected for vulnerabilities. When the button 52 is selected, a screen (not shown) for specifying a specific file is displayed, and the user can specify the file containing source code via the screen. When the file is specified, the source code file storage path and source code file name are registered in the inspection management table 154. Note that multiple files may be specified as files containing source code.

[0048] The second button 54 is an object for specifying an inspection rule to be applied to the vulnerability inspection. When this button 54 is selected, an inspection rule specification screen 60, an example of which is shown in Fig. 6, is output. As shown in the figure, this screen 60 has an inspection rule specification area 62 for specifying an inspection rule, a setting button 64, and a back button 66.

[0049] The inspection rule specification area 62 displays a list of the rule names of multiple inspection rules (managed in the inspection rule information table 152) that can be applied to vulnerability inspection, with a check box 621 located to the left of each rule name. The user selects the check box 621 corresponding to the inspection rule to be applied to vulnerability inspection, and then selects the Set button 64. When the button 64 is selected, the applied inspection rule information is registered in the inspection management table 154.

[0050] The third button 56 is an object for starting a vulnerability test. Figure 7 is a flowchart illustrating a process executed by the server 10 in response to selection of the button 56 (i.e., when performing a vulnerability test). As shown in the figure, the server 10 first generates a prompt (first instruction information) for obtaining endpoint information (step S100). Specifically, the prompt instructing the user to obtain endpoint information is generated based on the source code of the web application.

[0051] 8 shows an example of a prompt for obtaining endpoint information. As shown in the figure, the prompt instructs the extraction of the endpoint path, the function to be executed, and the call destination from the source code of the web application. Specifically, the prompt instructs the extraction of the HTTP method, path, and code as endpoint-specific information. The contents of the source code are obtained from the source code file identified by the source code file storage path and source code file name managed in the inspection management table 154.

[0052] 7 , the server 10 then acquires and registers endpoint information (step S110). Specifically, a prompt for acquiring endpoint information is input to the large-scale language model, and the endpoint information (HTTP method, path, and code) of each of the multiple endpoints output from the large-scale language model is registered in the inspection details management table 156.

[0053] Fig. 9 illustrates an example of a response from a large-scale language model to which the prompt for obtaining endpoint information illustrated in Fig. 8 has been input. As illustrated, based on the source code of a web application, an HTTP method, a path, and a code are extracted as endpoint information for each of multiple endpoints in the web application.

[0054] 7 , the server 10 then generates a prompt (third instruction information) for acquiring specification information for the target endpoint (step S120). Specifically, an unprocessed endpoint is sequentially identified as the target endpoint from among the multiple endpoints, and a prompt for acquiring specification information for the target endpoint is generated. The prompt instructs the acquisition of specification information based on the endpoint information.

[0055] 10 shows an example of a prompt for obtaining specification information. As shown, the prompt instructs the user to describe the endpoint specifications from the endpoint information. Specifically, the prompt instructs the user to describe the HTTP method executed at the endpoint, the path identifying the endpoint, and a description of the endpoint specifications. The endpoint information (HTTP method, path, and code) is obtained from the inspection details management table 156.

[0056] Returning to the flowchart of FIG. 7 , the server 10 then acquires and registers the specification information (step S130). Specifically, a prompt for acquiring the specification information is input to the large-scale language model, and the specification information output from the large-scale language model is registered in the inspection details management table 156. In this example, the specification information is acquired using the same large-scale language model as the large-scale language model used to acquire the endpoint information. Note that in other examples of this embodiment, the specification information may be acquired using a large-scale language model different from the large-scale language model used to acquire the endpoint information.

[0057] Fig. 11 illustrates an example of a response from a large-scale language model to which the prompt for obtaining endpoint information illustrated in Fig. 10 has been input. As illustrated, the endpoint specifications are written in natural language (Japanese in this example) based on the endpoint information.

[0058] 7, the server 10 then generates a prompt (second instruction information) for acquiring vulnerability information for the target endpoint (step S140). Specifically, the prompt is generated to instruct acquisition of vulnerability information for the endpoint based on the specification information and the vulnerability testing rule.

[0059] 12 shows an example of a prompt for obtaining vulnerability information. As shown in the figure, the prompt instructs the system to identify vulnerabilities in an endpoint based on the endpoint's specification information and code in accordance with a vulnerability testing rule specified by the user (to obtain the vulnerability name, vulnerability description, and relevant code). The endpoint's specification information and code are obtained from the testing details management table 156. The vulnerability testing rule specified by the user is obtained from the testing management table 154.

[0060] Returning to the flowchart of FIG. 7 , the server 10 then acquires and registers vulnerability information (step S150). Specifically, a prompt for acquiring vulnerability information is input to the large-scale language model, and the vulnerability test results including the vulnerability information output from the large-scale language model are registered in the test details management table 156. In this example, the vulnerability information is acquired using the same large-scale language model as the large-scale language model used to acquire the endpoint information and specification information. Note that in other examples of this embodiment, the vulnerability information may be acquired using a large-scale language model different from the large-scale language model used to acquire the endpoint information and / or specification information.

[0061] 13 illustrates an example of a response from a large-scale language model to which the prompt for acquiring vulnerability information illustrated in FIG. 12 has been input. As illustrated, the endpoint specification information and code indicate vulnerabilities in the endpoint (a session management vulnerability and plaintext password storage). Note that if the prompt illustrated in FIG. 12 does not include a description of an SQL injection exclusion rule as a vulnerability testing rule (i.e., the rule is not applied), an SQL injection vulnerability may be detected.

[0062] 7, if there are any unprocessed endpoints (YES in step S160), the server 10 returns to step S120 and generates a prompt for acquiring specification information, acquires and registers the specification information, generates a prompt for acquiring vulnerability information, and acquires and registers vulnerability information for the next endpoint (steps S120 to S150). This series of processes is repeated until there are no more unprocessed endpoints (NO in step S160).

[0063] In the above example, the endpoint specification information is obtained using a large-scale language model. However, the specification information may be provided individually by the user. In this case, the endpoint specification information is obtained from a file containing the web application specification information provided by the user (for example, a button for specifying the file is provided on the inspection screen 50). Furthermore, in this case, the endpoint specification information may be extracted from the specification information described in the file using a large-scale language model (prompts and responses in this case are shown in FIGS. 14 and 15, respectively).

[0064] The vulnerability testing server 10 according to the present embodiment described above uses a large-scale language model to acquire endpoint information, including information on processes executed at each of multiple endpoints in a web application, based on the source code, and acquires vulnerability information for the endpoints based on the corresponding endpoint information and specification information. This mechanism can be uniformly applied to vulnerability testing of various applications built in various environments. In other words, the server 10 enables vulnerability testing of various applications.

[0065] In other embodiments of the present invention, some or all of the functions of the vulnerability testing server 10 in the above-described embodiments may be realized by cooperation between the vulnerability testing server 10 and the user terminal 30, or may be realized by the user terminal 30. In other words, the system of the present invention may be configured by the vulnerability testing server 10, as well as by the vulnerability testing server 10 and the user terminal 30, or may be configured by the user terminal 30.

[0066] The processes and procedures described herein, other than those explicitly described, may be implemented by software, hardware, or any combination thereof. For example, the processes and procedures described herein may be implemented by implementing logic corresponding to the processes and procedures in a medium such as an integrated circuit, volatile memory, non-volatile memory, or magnetic disk. Furthermore, the processes and procedures described herein may be implemented as a computer program corresponding to the processes and procedures and executed by various computers.

[0067] Although processes and procedures described herein are described as being performed by a single device, software, component, or module, such processes or procedures may be performed by multiple devices, software, components, and / or modules. Also, the software and hardware elements described herein may be implemented by combining them into fewer components or breaking them down into more components.

[0068] In this specification, even if a component of the invention is described as either singular or plural, or is described without limitation as either singular or plural, the component may be either singular or plural unless the context requires otherwise.

Claims

1. A system for testing vulnerabilities in a web application, comprising one or more computer processors, the one or more computer processors executing the following steps: generating first instruction information instructing a system to output, based on source code of the web application, endpoint information for each of a plurality of endpoints in the web application, the endpoint information including processing information for processing executed at the endpoints; inputting the first instruction information into a first large-scale language model and acquiring the endpoint information output from the first large-scale language model; acquiring specification information in which specifications of the endpoints are described in natural language; generating second instruction information instructing a system to output, based on the endpoint information and the specification information, vulnerability information for vulnerabilities in the endpoints; and inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model.

2. The system of claim 1, wherein the second large-scale language model is the same large-scale language model as the first large-scale language model.

3. The system of claim 1, wherein the processing information includes an HTTP method and / or code to be executed at the endpoint.

4. The system of claim 1, wherein the one or more computer processors further execute a step of generating third instruction information instructing that the specification information be output based on the endpoint information, and the step of acquiring the specification information includes inputting the third instruction information to a third large-scale language model and acquiring the specification information output from the third large-scale language model.

5. The system of claim 4, wherein the third large-scale language model is the same large-scale language model as the first large-scale language model and / or the second large-scale language model.

6. The system according to claim 1, wherein the second instruction information instructs that the vulnerability information be output in accordance with a predetermined vulnerability inspection rule.

7. A method executed by one or more computers for testing vulnerabilities in a web application, comprising: a step of generating first instruction information instructing output of endpoint information for each of a plurality of endpoints in the web application, the endpoint information including processing information for processing executed at the endpoint, based on the source code of the web application; a step of inputting the first instruction information into a first large-scale language model and obtaining the endpoint information output from the first large-scale language model; a step of obtaining specification information in which specifications of the endpoint are described in natural language; a step of generating second instruction information instructing output of vulnerability information for vulnerabilities in the endpoint based on the endpoint information and the specification information; and a step of inputting the second instruction information into a second large-scale language model and obtaining the vulnerability information output from the second large-scale language model.

8. A program for inspecting vulnerabilities in a web application, the program causing one or more computers to execute the following steps: generating first instruction information instructing one or more computers to output, based on the source code of the web application, endpoint information for each of a plurality of endpoints in the web application, the endpoint information including processing information for processing executed at the endpoints; inputting the first instruction information into a first large-scale language model and acquiring the endpoint information output from the first large-scale language model; acquiring specification information in which the specifications of the endpoint are described in natural language; generating second instruction information instructing one or more computers to output vulnerability information for vulnerabilities in the endpoint based on the endpoint information and the specification information; and inputting the second instruction information into a second large-scale language model and acquiring the vulnerability information output from the second large-scale language model.

Images