Method and apparatus for dynamic detection of hidden endpoints based on JSP technology, and medium

Abstract

The present invention provides a method and apparatus for dynamic detection of hidden endpoints based on JSP technology, and a medium. The method comprises: invoking a detection tool: invoking a dynamic detection tool in a web application; detecting application components: based on the dynamic detection tool, detecting components in the web application to obtain hidden endpoints therein; detecting library packages: based on the dynamic detection tool, detecting library packages invoked in the web application to obtain hidden endpoints therein; adjusting the detection tool: based on the hidden endpoints, adjusting the detection tool, and re-invoking of the detection tool by the web application; repeating detection: based on the adjusted detection tool, performing hidden endpoint detection on the components and library packages again. The technical solution in the embodiments of the present invention can more comprehensively find hidden endpoints that do not exist in project source code.

Description

A method, apparatus and medium for dynamic detection of hidden endpoints based on JSP technology Technical Field

[0001] This invention relates to the field of information security, and in particular to a method, apparatus and medium for dynamic detection of hidden endpoints based on JSP technology. Background Technology

[0002] Traditional endpoint detection methods are mainly based on static methods and primarily on Java source code. They cannot detect hidden endpoints in third-party libraries that the project depends on, as well as dynamically generated endpoints after the project runs, such as memory trojans.

[0003] Summary of the Invention

[0004] To achieve the above objectives, this invention proposes a method, apparatus, and storage medium for dynamic detection of hidden endpoints based on JSP technology, which can more comprehensively find hidden endpoints that do not exist in the project source code.

[0005] This invention proposes a method for dynamically detecting hidden endpoints based on JSP technology, comprising: invoking a detection tool: invoking a dynamic detection tool in a web application; detecting application components: detecting components in the web application based on the dynamic detection tool to obtain hidden endpoints therein; detecting library packages: detecting library packages called by the web application based on the dynamic detection tool to obtain hidden endpoints therein; adjusting the detection tool: adjusting the detection tool based on the hidden endpoints and having it re-invoked by the web application; repeating the detection: performing hidden endpoint detection on the components and library packages again based on the adjusted detection tool. This method can more comprehensively find hidden endpoints that are not present in the project's source code.

[0006] This invention proposes a hidden endpoint dynamic detection device based on JSP technology, comprising: a detection tool invocation module configured to invoke a dynamic detection tool in a web application; an application component detection module configured to detect components in the web application based on the dynamic detection tool and obtain hidden endpoints therein; a library package detection module configured to detect library packages invoked by the web application based on the dynamic detection tool and obtain hidden endpoints therein; a detection tool adjustment module configured to adjust the detection tool based on the hidden endpoints and have it re-invoked by the web application; and a duplicate detection module configured to re-detect hidden endpoints of the components and library packages based on the adjusted detection tool. This device can more comprehensively find hidden endpoints that are not present in the project's source code.

[0007] An electronic device according to an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, the memory being used to store instructions that, when executed by the at least one processor, cause the processor to perform the method described above.

[0008] The present invention provides a computer-readable storage medium storing computer instructions, which, when executed, perform the methods described in any of the above embodiments.

[0009] An embodiment of the present invention provides a computer program product, which includes a computer program that, when executed by a processor, implements the method described in any of the above embodiments. Attached Figure Description

[0010] The following figures are intended only to illustrate and explain the invention and do not limit the scope of the invention.

[0011] Figure 1 is a flowchart illustrating a method 100 for dynamic detection of hidden endpoints based on JSP technology according to an embodiment of the present invention.

[0012] Figure 2 is a schematic diagram of a hidden endpoint dynamic detection device 200 based on JSP technology according to an embodiment of the present invention.

[0013] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.

[0014] The annotations in the attached figures are explained as follows: Detailed Implementation

[0015] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0016] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the invention is not limited to the specific embodiments disclosed below.

[0017] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0018] The mainstream approach to endpoint detection still relies on static code analysis, using tools like CodeQL, and primarily focuses on controller components. However, some hidden interfaces are embedded in many library packages, making them challenging to detect using only static methods. Furthermore, some endpoints reside in components like Filters and Interceptors, which are often overlooked.

[0019] Therefore, this invention proposes a more effective method, device, and storage medium for dynamic detection of hidden endpoints based on JSP technology.

[0020] Figure 1 is a flowchart illustrating a method 100 for dynamic detection of hidden endpoints based on JSP technology according to an embodiment of the present invention. As shown in Figure 1, the method 100 may include:

[0021] Step S101, invoke the detection tool: invoke the dynamic detection tool in the web application.

[0022] In this embodiment, the dynamic detection tool exists in the web application in the form of JSP.

[0023] Specifically, compared to static analysis, Tomcat can already load the application during deployment, eliminating the need to load the classes to be analyzed separately. This saves the time spent generating code property graphs or databases and querying them for tools like CodeQL in static analysis scenarios. Compared to dynamic analysis, because it exists in JSP form, it can be modified immediately, eliminating the need for manual compilation and packaging.

[0024] Step S102, Detect application components: Detect components in the web application based on the dynamic detection tool to obtain hidden endpoints therein.

[0025] In this embodiment, the components in the web application further include: Filter, Interceptor, Controller, Servlet, Valve and / or Listener components.

[0026] In this embodiment, detecting components in the web application based on the dynamic detection tool further includes: detecting the code of the authentication and authorization logic part in the component.

[0027] In this embodiment, detecting components in the web application based on the dynamic detection tool further includes: detecting the code of the whitelist in the authentication settings section of the component.

[0028] Specifically, components such as Filters and Interceptors are often hotspots for unauthenticated vulnerabilities. This is because much of the code related to ignoring authentication in web components resides here, and authentication and authorization logic is handled within these components, making it possible to inspect the relevant code.

[0029] Step S102 Detect library packages: Based on the dynamic detection tool, detect the library packages called in the web application to obtain the hidden endpoints therein.

[0030] Specifically, Spring Boot Actuator, Swagger / OpenAPI, and custom frameworks or libraries do not exist as Java source code, but they hide attackable endpoints, and these libraries can be detected.

[0031] Step S102 Adjust the detection tool: Based on the hidden endpoint, adjust the detection tool and have it invoked again by the web application.

[0032] Step S102 Repeated Detection: Based on the adjusted detection tool, the component and library package are detected for hidden endpoints again.

[0033] Figure 2 is a schematic diagram of a hidden endpoint dynamic detection device 200 based on JSP technology according to an embodiment of the present invention. As shown in Figure 2, the device 200 may include:

[0034] The detection tool calling module 201 is configured to call the dynamic detection tool in the web application.

[0035] The application component detection module 202 is configured to detect components in the web application based on the dynamic detection tool and obtain hidden endpoints therein.

[0036] The library package detection module 203 is configured to: detect the library packages called in the web application based on the dynamic detection tool, and obtain the hidden endpoints therein.

[0037] The detection tool adjustment module 204 is configured to adjust the detection tool based on the hidden endpoint and be invoked again by the web application.

[0038] The duplicate detection module 205 is configured to perform hidden endpoint detection on the components and library packages again based on the adjusted detection tool.

[0039] The present invention also proposes an electronic device 300. Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in Figure 3, the electronic device 300 includes a processor 310 and a memory 320, wherein the memory 320 stores instructions, wherein when the instructions are executed by the processor 310, they implement the method 100 described above.

[0040] The present invention also proposes a computer-readable storage medium having computer instructions stored thereon, which, when executed, perform the methods described above.

[0041] The present invention also proposes a computer program product, including a computer program that, when executed by a processor, performs the methods described above.

[0042] Some aspects of the methods and apparatus of this invention can be executed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The aforementioned hardware or software may be referred to as a "data block," "module," "engine," "unit," "component," or "system." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. Furthermore, aspects of this invention may be embodied as computer products located on one or more computer-readable media, including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, magnetic tapes, etc.), optical discs (e.g., compact discs (CDs), digital multifunction discs (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0043] Flowcharts are used herein to illustrate the operations performed by the method according to embodiments of this application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more steps may be removed from them.

[0044] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0045] The above description is merely an illustrative embodiment of the present invention and is not intended to limit the scope of the invention. Any equivalent changes, modifications, and combinations made by those skilled in the art without departing from the concept and principles of the present invention should fall within the scope of protection of the present invention.

Claims

1. A method for dynamic detection of hidden endpoints based on JSP technology (100), characterized in that, The method includes: Invoke detection tool (S101): Invoke the dynamic detection tool in the web application; Detecting application components (S102): Detecting components in the web application based on the dynamic detection tool to obtain hidden endpoints therein; Detect library packages (S103): Detect the library packages called in the web application based on the dynamic detection tool to obtain the hidden endpoints therein; Adjust the detection tool (S104): Based on the hidden endpoint, adjust the detection tool and have it invoked again by the web application; Duplicate detection (S105): Based on the adjusted detection tool, the component and library package are detected for hidden endpoints again.

2. The method according to claim 1, characterized in that, The dynamic detection tool exists in the web application in the form of JSP.

3. The method according to claim 1, characterized in that, The components in the web application further include: Filter, Interceptor, Controller, Servlet, Valve and / or Listener components.

4. The method according to claim 3, characterized in that, Detecting components in the web application based on the dynamic detection tool further includes: detecting the code of the authentication and authorization logic part in the component.

5. The method according to claim 3, characterized in that, Detecting components in the web application based on the dynamic detection tool further includes: detecting the code of the whitelist in the authentication settings section of the component.

6. A hidden endpoint dynamic detection device (200) based on JSP technology, characterized in that, The device includes: The detection tool invocation module (201) is configured to: invoke the dynamic detection tool in the web application; The application component detection module (202) is configured to: detect components in the web application based on the dynamic detection tool and obtain hidden endpoints therein; The library package detection module (203) is configured to: detect the library packages called in the web application based on the dynamic detection tool, and obtain the hidden endpoints therein; The detection tool adjustment module (204) is configured to: adjust the detection tool based on the hidden endpoint and be re-invoked by the web application; The duplicate detection module (205) is configured to perform hidden endpoint detection on the components and library packages again based on the adjusted detection tool.

7. Electronic equipment (300), including: At least one processor (310); as well as A memory (320) coupled to the at least one processor (310) is used to store instructions that, when executed by the at least one processor (310), cause the processor (310) to perform the method as described in any one of claims 1-5.

8. A computer-readable storage medium having stored thereon computer instructions that, when executed, perform the method according to any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, performs the method according to any one of claims 1-5.

Images