System and method for detecting apache HTTP server path traversal vulnerability

Abstract

The present application provides a system and a method for detecting an Apache HTTP Server path traversal vulnerability. The method comprises: inputting a target IP address list into a scanning module, and probing the network reachability of each IP address in the target IP address list; if there is a network-reachable IP address, probing all ports of the IP address, and recording open port numbers; identifying services running on the open ports and performing service classification; if a service is classified as an Apache service, initiating a Curl request command to an icons directory path of the Apache service; if the Curl request succeeds and an / etc / passwd file is read, parsing the / etc / passwd file and extracting users of a host under test; performing detection on the users of the host to obtain an Apache HTTP Server path traversal vulnerability; and generating a detection report for the host on the basis of the Apache HTTP Server path traversal vulnerability.

Description

System and method for Apache Http Server path traversal vulnerability detection

[0001] Cross-reference to related applications

[0002] The present application claims priority to the Chinese patent application No. 202411340835.1, filed on September 25, 2024, and entitled "System and method for Apache Http Server path traversal vulnerability detection", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of vulnerability detection, in particular to a system and method for Apache Http Server path traversal vulnerability detection, an electronic device and a storage medium. BACKGROUND

[0004] Apache HTTP Server, simply Apache, is an open source web server that can run on most computer operating systems. Due to its cross-platform and security, Apache HTTP Server is widely used and is one of the most popular web server-side software. Apache may have a path traversal vulnerability, and if files outside the document root directory are not protected, attackers can access these files.

[0005] The vulnerability detection does not have in-depth analysis of system files after Apache HTTP Server path traversal, usually only detects basic system information, and it is difficult to further mine effective user information and improve user and permissions.

[0006] To solve the above problems, a system and method for Apache Http Server path traversal vulnerability detection, an electronic device and a storage medium are proposed.

[0007] SUMMARY

[0008] Embodiments of the present application aim to at least solve one of the technical problems existing in the prior art, and provide a system and method for Apache Http Server path traversal vulnerability detection, an electronic device and a storage medium.

[0009] In a first aspect, a system for Apache Http Server path traversal vulnerability detection is provided, comprising:

[0010] The scanning module is configured to receive a target IP address list, detect network reachability of each IP address in the target IP address list, and record open port numbers, identify services running under the open ports, and classify services.

[0011] The request module is configured to initiate a Curl request command to read an / etc / passwd file.

[0012] The parsing module is configured to extract a detected host user from the / etc / passwd file.

[0013] The detection module is configured to detect the Apache Http Server path traversal vulnerability based on the detected host user.

[0014] The detection report module is configured to generate a detection report of the detected host based on the Apache Http Server path traversal vulnerability.

[0015] In a second aspect, the application provides an Apache Http Server path traversal vulnerability detection method, which comprises the following steps:

[0016] The scanning module is configured to receive a target IP address list, detect network reachability of each IP address in the target IP address list, and record open port numbers, identify services running under the open ports, and classify services.

[0017] If there is a network-reachable IP address, all ports of the IP address are detected, and open port numbers are recorded.

[0018] Services running under the open ports are identified, and services are classified.

[0019] If the services are classified as Apache services, a Curl request command is initiated to an icons directory path of the Apache services.

[0020] If the Curl request is successfully connected and the / etc / passwd file is read, the / etc / passwd file is parsed and processed, and a detected host user is extracted.

[0021] The Apache Http Server path traversal vulnerability is detected based on the detected host user.

[0022] A detection report of the detected host is generated based on the Apache Http Server path traversal vulnerability.

[0023] In combination with the second aspect, the detection of network reachability of each IP address in the IP address list comprises sending an ICMP request packet to each IP address through Ping scanning, and determining network reachability of the IP address based on response information.

[0024] With reference to the second aspect, if the network accessible IP address exists, the scanning of all ports of the IP address comprises scanning all ports of the target IP address by TCP SYN scanning and / or TCP Connect scanning, and recording in order from 1 to 65535.

[0025] With reference to the second aspect, the service classification by identifying the service running under the open port comprises sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of the running service.

[0026] With reference to the second aspect, the Curl request command comprises curl-v--path-as-is

[0027] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / etc / passwd.

[0028] With reference to the second aspect, if the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed to extract the detected host user, which comprises extracting the mysql database user and the ftp file transfer user in the / etc / passwd file.

[0029] With reference to the second aspect, the detection of the Apache Http Server path traversal vulnerability of the detected host user comprises:

[0030] brute force cracking of user passwords;

[0031] finding user weaknesses, verifying the weaknesses by using attack scripts to obtain a first privilege user;

[0032] promoting the privilege of the first privilege user to obtain the system privilege of an administrator user.

[0033] The third aspect of the present application provides an electronic device, comprising:

[0034] one or more processors;

[0035] a storage unit for storing one or more programs, which can enable the one or more processors to implement any one of the above Apache Http Server path traversal vulnerability detection methods when the one or more programs are executed by the one or more processors.

[0036] In a fourth aspect of the present application, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the Apache Http Server path traversal vulnerability detection method of any one of the above.

[0037] The present application provides an Apache Http Server path traversal vulnerability detection system and method. The system and method scan a target IP address list, detect network reachability, record open ports and identify running service types, initiate a path traversal attack on the ports classified as Apache services using a Curl command, and parse user information in the obtained / etc / passwd file. By further detecting the strength and weaknesses of user passwords, the system and method ultimately elevate user privileges and generate a detailed vulnerability detection report, achieving the effects of automated, comprehensive, and efficient detection of Apache HTTP Server path traversal vulnerabilities and in-depth analysis of system security. BRIEF DESCRIPTION OF DRAWINGS

[0038] Fig. 1 is a structural schematic diagram of an Apache Http Server path traversal vulnerability detection system according to an embodiment of the present application;

[0039] Fig. 2 is a flowchart of an Apache Http Server path traversal vulnerability detection method according to an embodiment of the present application;

[0040] Fig. 3 is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0041] The exemplary embodiments will be described in detail herein below with reference to the drawings. When the following description refers to the drawings, identical numbers on different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present application.

[0042] The terminology used in the present application is merely for the purpose of describing particular embodiments and is not intended to limit the embodiments of the present application. The singular forms "a," "an," and "the" used in the embodiments of the present application and the appended claims are intended to include both singular and plural forms, unless the context clearly indicates otherwise. It will be further understood that the term "and / or" used herein includes any or all possible combinations of one or more associated listed items.

[0043] It should be understood that, although the terms first, second, third, etc. can be used herein to describe various information, the information should not be limited to these terms. These terms are only used to differentiate one piece of information from another piece of information. For example, without departing from the scope of embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0044] As shown in Figure 1, it is a structural schematic diagram of an Apache Http Server path traversal vulnerability detection system according to an embodiment of the present application. It comprises:

[0045] The scanning module 110 is configured to receive a target IP address list, detect the network reachability of each IP address in the IP address list, and record the open port numbers, identify the services running under the open ports, and classify the services;

[0046] The request module 120 is configured to initiate a Curl request command and read an / etc / passwd file;

[0047] The parsing module 130 is configured to extract the detected host users in the / etc / passwd file;

[0048] The detection module 140 is configured to detect the Apache Http Server path traversal vulnerability based on the detected host users;

[0049] The detection report module 150 is configured to generate a detection report of the detected host based on the Apache Http Server path traversal vulnerability.

[0050] Specifically, the scanning module 110 is configured to receive a target IP address list and detect the network reachability of each IP address in the list in sequence. Specifically, the module will send an ICMP request packet to each target IP address through a network detection technology such as Ping scanning, and judge the network connectivity according to the received response. In addition, the module will also perform port scanning on the network-reachable IP addresses, using methods such as TCP SYN scanning or TCP Connect scanning to scan all ports (usually 1 to 65535) of the IP addresses. During the scanning process, the module will record all open port numbers, and identify the services running on each port by sending specific data packets to these open ports. Finally, the scanning module classifies the identified services to provide basic data for the subsequent detection steps.

[0051] Through the scanning module, the system can quickly determine which target IP addresses are accessible and identify their open service ports. This step is the foundation of vulnerability detection, ensuring that subsequent operations can accurately locate the target Apache service and perform effective attack testing.

[0052] The request module 120 is responsible for sending specific Curl request commands to the identified Apache service to attempt to trigger path traversal vulnerabilities. Specifically, the module uses the command

[0053] curl -v --path-as-is

[0054] http: / / IP_address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / etc / passwd to send requests in verbose mode and maintain the original path for testing. This request aims to bypass the Apache server's path verification mechanism and obtain the / etc / passwd file stored on the server through path traversal, which contains basic information about system users.

[0055] The parsing module 130 is used to parse the / etc / passwd file obtained from the server and extract the user information of the detected host contained in the file. The / etc / passwd file records the basic information of all users in the system, including username, user ID, user group ID, user home directory, and login shell. The parsing module will identify specific users in the file, such as the mysql database user and the ftp file transfer user, and assess whether these users have security vulnerabilities.

[0056] By parsing the / etc / passwd file, the system can gain a deep understanding of the user configuration of the detected host, providing data support for subsequent user weakness analysis and privilege escalation.

[0057] The detection module 140 is used to further detect the user information parsed to confirm whether the Apache HTTP Server has a path traversal vulnerability. The specific operations include brute force cracking of the extracted users (such as using a common password dictionary to perform password enumeration), finding weaknesses in user configuration (such as weak passwords or other vulnerabilities that are easy to attack), and verifying these weaknesses using attack scripts. If a security vulnerability is detected in the user, the module will attempt to obtain access to low-privilege users.

[0058] The task of the detection module is to further verify the security of the system, especially through brute force cracking and weakness analysis, to assess the system's resistance to actual attacks.

[0059] The detection report module 150 is responsible for generating a detailed detection report based on the results throughout the detection process. The report will include all vulnerability information found, users involved and their permission status, attack steps performed and results, etc.

[0060] The output of the detection report module is the final result of the system, helping users to fully understand the security risks in the system and guide the subsequent repair work. Through the detailed report, users can evaluate the overall security of the system and take appropriate protective measures.

[0061] Beneficial effects: The modules of the system work closely together, from network detection, vulnerability exploitation to information analysis and final report generation, forming a complete Apache HTTP Server path traversal vulnerability detection process. Through this system, users can comprehensively and efficiently detect and analyze path traversal vulnerabilities in Apache servers, obtain in-depth security analysis results, and effectively improve system security.

[0062] As shown in FIG. 2, it is a flowchart of the Apache Http Server path traversal vulnerability detection method of the embodiment of the present application. It includes:

[0063] S201: input target IP address list to the scanning module, and detect the network reachability of each IP address in the target IP address list;

[0064] S202: if there is a network reachable IP address, detect all ports of the IP address and record the open port number;

[0065] S203: classify services by identifying services running under open ports;

[0066] S204: if the service is classified as an Apache service, send a Curl request command to the icons directory path of the Apache service;

[0067] S205: if the Curl request connection is successful and the / etc / passwd file is read, parse the / etc / passwd file and extract the detected host user;

[0068] S206: detect the Apache Http Server path traversal vulnerability of the detected host user;

[0069] S207: generate a detection report of the detected host according to the Apache Http Server path traversal vulnerability.

[0070] Specifically, S201: input target IP address list and detect network reachability.

[0071] The user inputs a list of target IP addresses into the scanning module, and the system will automatically probe the network reachability of these IP addresses. The probing method is usually through Ping scanning, that is, sending an ICMP request packet to each IP address, and judging whether the IP address is online or reachable according to whether a response is received.

[0072] By filtering out reachable IP addresses, the system can concentrate resources on effective targets, reducing unnecessary network load and time waste. If an IP address is not reachable, it will not be subjected to subsequent port scanning and service detection.

[0073] S202: Probe the ports of the network-reachable IP addresses and record the open port numbers.

[0074] For IP addresses that have been confirmed to be network-reachable, the system will perform port scanning to identify open ports. Port scanning can be performed in various ways, such as TCP SYN scanning or TCP Connect scanning. The system will sequentially probe all ports from 1 to 65535 and record those open port numbers.

[0075] Open ports usually correspond to running services. Through port scanning, the system can further penetrate to the specific service level for detection and lay the foundation for the next step of service classification.

[0076] S203: Service identification and classification.

[0077] After port scanning is completed, the system will identify the running services under the open ports and classify these services. The identification method is usually by sending a preset data packet to the open port, and then calling a tool such as the Nmap database to analyze the response information, thereby identifying the service type.

[0078] The purpose of service classification is to organize all identified services by category, so that subsequent detection can perform relevant vulnerability tests for specific services. For example, the port identified as running Apache service is distinguished from other services, laying the foundation for path traversal vulnerability detection.

[0079] S204: Initiate a Curl request command to the Apache service.

[0080] Once an open port is identified as running an Apache service, the system will initiate a specific Curl request command to the icons directory path of the service. The specific command is

[0081] curl -v --path-as-is

[0082] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / etc / passwd, which aims to bypass the Apache server's path verification mechanism to read the server's / etc / passwd file.

[0083] This step is the core of detecting Apache path traversal vulnerabilities. By sending a specially constructed HTTP request, the system can verify whether the target Apache server has a path traversal vulnerability. If the request successfully connects and reads the / etc / passwd file, it indicates that the server has a serious path traversal vulnerability.

[0084] S205: Parse / etc / passwd file to extract user information.

[0085] After the Curl request is successful, the system will parse the / etc / passwd file to extract user information. This file usually contains basic information about all users in the system, such as username, user ID, group ID, etc. The system will pay special attention to users such as mysql database users and ftp file transfer users to determine whether there are potential security risks.

[0086] Parsing the / etc / passwd file extracts key user information, allowing the system to better understand the user configuration of the target server and provide strong support for subsequent security detection and privilege escalation.

[0087] S206: Detect path traversal vulnerabilities.

[0088] After extracting user information, the system will further detect the security of these users. The specific operation includes password brute force cracking of the extracted users, finding user weaknesses, and verifying these weaknesses using specific attack scripts. After successfully obtaining a low-privilege user, the system will also attempt to escalate privileges and ultimately obtain the system privileges of an administrator user.

[0089] Through attack operations, the system can confirm and verify whether the Apache server really has exploitable path traversal vulnerabilities and assess their severity.

[0090] S207: Generate detection report.

[0091] After completing all detection steps, the system will generate a detailed detection report based on the detection results. The report will include all detected vulnerability information, involved users and their privilege status, executed attack steps, test results, and recommended repair measures.

[0092] The detection report is the final output, which provides a comprehensive security assessment and operation guide for system administrators or security experts. By reading the report, users can understand the current security status of the server and take appropriate measures to fix the detected vulnerabilities, improving the overall security of the system.

[0093] Beneficial effects: The entire process from network detection, service identification to vulnerability exploitation and report generation forms a closed-loop security detection process. Through this method, users can systematically detect path traversal vulnerabilities in Apache HTTP Server, comprehensively assess and repair security risks of the server.

[0094] Optionally, the Curl request command includes: curl-v--path-as-is

[0095] http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / etc / passwd.

[0096] The curl in the command is a command that initiates a get request and returns the content of the IP address page. The-v parameter is the detailed mode, which displays the detailed process of network request, including the header information of request and response, request method, URL, data sending situation, etc. The --path-as-is parameter allows the use of original data for packet sending.

[0097] http: / / IP address / icons The parameter is the path point that may have a path traversal vulnerability. The / . / .. / etc / passwd parameter can be decoded by the Apache server, which will be converted into standard characters, such as %2e will be converted to ".". The converted parameter is / .. / .. / .. / .. / .. / etc / passwd, where each.. / parameter symbol will return the path to the upper level, and multiple.. / parameters will return the path to the root directory, bypassing the Apache server's detection of path traversal symbols, thus achieving path traversal and reading the / etc / passwd file located on the Apache server.

[0098] The Curl command obtains the file content on the target server by sending an HTTP GET request. Path traversal attacks take advantage of the path parsing vulnerability of Apache servers, and attackers can access server files that should not be publicly accessible (such as / etc / passwd) by recursively using the upper directory symbol.. / , thus bypassing the server's security mechanism.

[0099] By understanding the role of the Curl command and its parameters, you can effectively use path traversal vulnerabilities to read sensitive files on the server. In actual operation, attackers can further adjust the command based on the specific configuration of the server to improve the success rate of attacks.

[0100] If the Curl request connection is successful and the / etc / passwd file is read, the / etc / passwd file is parsed and processed to extract the detected host users, including extracting the mysql database user and ftp file transfer user from the / etc / passwd file.

[0101] The / etc / passwd file contains basic information about all users in the system, such as username, user ID, group ID, home directory, and Shell path. Attackers can analyze this information to identify which users may have weak passwords or other vulnerabilities, laying the foundation for further attacks.

[0102] Extracted user information can not only be used for further attacks, but also help attackers understand the user structure of the target system and choose appropriate attack strategies. For example, certain specific service accounts (such as mysql or ftp) often have weak passwords or improper permission settings, and using this information can conduct more in-depth vulnerability exploitation and privilege escalation.

[0103] The Apache Http Server path traversal vulnerability detected for the detected host users includes:

[0104] Brute force cracking of user passwords;

[0105] Finding user weaknesses and using attack scripts to verify weaknesses to get first-privilege users;

[0106] Elevating the privileges of the first-privilege user to obtain administrator user system privileges.

[0107] Password cracking of extracted users through Python scripts and common password dictionaries. By enumerating all possible password combinations, attackers attempt to obtain valid login credentials for users.

[0108] Brute force cracking is a trial-based password cracking method that typically generates a large number of possible password combinations through automated scripts and attempts one by one. Python scripts can automatically perform this process, speeding up the cracking process, especially when a wide range of password dictionaries are used, as common weak passwords are more likely to be cracked.

[0109] Brute force attacks may be limited by password policies such as lockout mechanisms or delayed responses in certain cases, so the cracking method should be adjusted according to the security policy of the specific system. For example, distributed cracking tools or social engineering methods can be used to improve cracking efficiency. In addition, integrating brute force functions into detection tools can further verify the actual threat level of path traversal vulnerabilities.

[0110] After determining the users in the / etc / passwd file, the system will perform vulnerability verification on these users or services through known targeted attack scripts. This process aims to confirm whether a specific user has exploitable security vulnerabilities.

[0111] Targeted attack scripts are attack tools based on known vulnerabilities or weaknesses, often used to verify the security of specific services or users. For example, vulnerabilities disclosed for certain versions of FTP services or database services may be used in unpatched systems to further exploit these weaknesses for privilege escalation or data theft.

[0112] The success of targeted attacks depends on the update speed of attack scripts and the accuracy of targeting services. Attackers need to constantly update attack tools to deal with different versions of software and operating systems. At the same time, this also reminds system administrators to update and patch known vulnerabilities in the system in a timely manner to reduce the risk of targeted attacks.

[0113] After the first privileged user (low-privilege user) account is cracked or exploited, the system will attempt to elevate user privileges through known vulnerabilities. Attackers can initiate queries such as the uname-r command to query the system kernel version, exploit known kernel vulnerabilities to further elevate privileges, and ultimately obtain the highest privileges of administrator users (root or admin users).

[0114] Privilege escalation attacks are the process of elevating low-privilege user accounts (such as normal users) to high-privilege accounts (such as system administrators). By querying the system kernel version, attackers can determine whether the system has unpatched privilege escalation vulnerabilities and use corresponding attack scripts to gain higher system privileges.

[0115] The success of privilege escalation means that the attacker can fully control the target system and perform arbitrary operations such as installing malicious software, modifying system configurations, and stealing sensitive data. For system administrators, the key to preventing privilege escalation attacks is to update the kernel and applications in a timely manner, set strict permission management policies, and monitor abnormal behavior.

[0116] Through the interpretation, explanation and expansion of these claims, it can be seen that the entire Apache HTTP Server path traversal vulnerability detection method covers the complete attack chain from detection to exploitation to privilege escalation. It not only verifies the existence of path traversal vulnerabilities, but also demonstrates the actual threat posed by exploiting these vulnerabilities to the system.

[0117] The embodiment of the application provides an Apache Http Server path traversal vulnerability detection system and method. By scanning a target IP address list, network reachability is detected, open ports are recorded and running service types are identified. A path traversal attack is initiated on the port classified as an Apache service by using a Curl command, and user information in the obtained / etc / passwd file is parsed. By further detecting the strength and weakness of the user password, the user privilege is finally escalated, a detailed vulnerability detection report is generated, and the effects of automatically, comprehensively and efficiently detecting Apache HTTP Server path traversal vulnerabilities and in-depth analysis of system security are achieved.

[0118] The electronic device 300 can be a desktop computer, a notebook computer, a palm computer, a cloud server and the like. The electronic device 300 can include but is not limited to a processor 301 and a memory 302. Those skilled in the art can understand that FIG. 3 is only an example of the electronic device 300, and does not constitute a limitation on the electronic device 300, and can include more or fewer components than the diagram, or combine certain components, or different components, for example, the electronic device can also include an input / output device, a network access device, a bus and the like.

[0119] The processor 301 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0120] The memory 302 can be an internal storage unit of the electronic device 300, for example, a hard disk or a memory of the electronic device 300. The memory 302 can also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Alternatively, the memory 302 can include both an internal storage unit and an external storage device of the electronic device 300. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0121] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific name of each functional unit and module is only for easy distinction, and does not limit the protection scope of the present application. The specific working process of the unit and module in the above system can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0122] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0123] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0124] In the embodiments of the present application, it should be understood that the disclosed apparatus / equipment and method can be implemented in other manners. For example, the embodiments of the apparatus / equipment described above are merely schematic, and the division of the modules or units can be changed or integrated, or some features can be ignored or not executed. In addition, the display or discussion about the coupling or direct coupling or communication connection between the modules can be achieved through some interfaces, and can be indirect coupling or communication connection between the modules.

[0125] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0126] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0127] If the integrated module / unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by computer programs instructing related hardware, and the computer programs can be stored in a computer readable storage medium. The computer program can be executed by a processor to implement the steps of each method embodiment. The computer program can include computer program code, which can be in the form of source code, object code, executable file or some intermediate form. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. Optionally, the readable storage medium is a non-transitory readable storage medium. It should be noted that the content contained in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0128] The above examples are only used to illustrate the technical solutions of the present application, but not to limit the present application; although the present application has been described in detail with reference to the foregoing examples, those ordinarily skilled in the art should understand: the technical solutions recorded in the foregoing examples can still be modified, or some technical features can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A system for Apache Http Server path traversal vulnerability detection, characterized in that, The application comprises the following steps: a scanning module receives a target IP address list, detects the network accessibility of each IP address in the target IP address list, records open port numbers, identifies services running under the open ports, and classifies the services; a request module initiates a Curl request command and reads an / etc / passwd file; a parsing module extracts users of a detected host from the / etc / passwd file; a detection module detects Apache Http Server path traversal vulnerabilities of the users of the detected host; a detection report module generates a detection report of the detected host according to the Apache Http Server path traversal vulnerabilities.

2. A method for Apache Http Server path traversal vulnerability detection, characterized in that, The application comprises the following steps: a scanning module receives a target IP address list, detects the network accessibility of each IP address in the target IP address list, records open port numbers, identifies services running under the open ports, and classifies the services; a request module initiates a Curl request command and reads an / etc / passwd file; a parsing module extracts users of a detected host from the / etc / passwd file; a detection module detects Apache Http Server path traversal vulnerabilities of the users of the detected host; a detection report module generates a detection report of the detected host according to the Apache Http Server path traversal vulnerabilities. The detection of the network accessibility of each IP address in the IP address list comprises sending an ICMP request packet to each IP address through Ping scanning and judging the network accessibility of the IP address according to response information. The detection of the network accessibility of each IP address in the IP address list comprises sending an ICMP request packet to each IP address through Ping scanning and judging the network accessibility of the IP address according to response information.

3. The method of claim 2, wherein, The classification of the services comprises sending a preset data packet to the open ports, calling an Nmap database to analyze response information, and identifying the types of the running services.

4. The method of claim 2, wherein, The Curl request command comprises: curl-v--path-as-is http: / / IP address / icons / .%2e / %2e%2e / %2e%2e / %2e%2e / etc / passwd.

5. The method of claim 2, wherein, The extraction of the users of the detected host from the / etc / passwd file comprises extracting mysql database users and ftp file transfer users in the / etc / passwd file.

6. The method of claim 2, wherein, ​ ​ 7. The method of claim 2, wherein, ​ 8. The method of claim 2, wherein, The detecting the host user to obtain an Apache Http Server path traversal vulnerability includes: Brute force cracking of user passwords; Finding user weaknesses, using attack scripts to verify weaknesses to obtain a first-privilege user; Upgrading the privilege of the first-privilege user to obtain an administrator user system privilege.

9. An electronic device, comprising: The method comprises: One or more processors; A storage unit for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more programs can enable the one or more processors to implement the Apache Http Server path traversal vulnerability detection method according to any one of claims 2 to 8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program can implement the Apache Http Server path traversal vulnerability detection method according to any one of claims 2 to 8 when executed by the processor.

Images