Generated Web Pages for Invalid URL Penetration Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious users employ automated filtering tools to identify hidden web pages by filtering out common features of invalid URL requests, enabling continuous and efficient attempts to uncover hidden URL paths, compromising server security.
Innovation Solution
Generate a web page with content matching the style, length, and keywords of previously served pages in response to incorrect URL requests, making it difficult for automated tools to filter out, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server returns standard error codes for invalid URL requests, then the server provides clear feedback to users, but automated filtering tools can easily identify and filter these responses, enabling penetration attacks
Solution Approach 1:
The patent applies the copying principle by generating fake web pages that replicate the structure, style, and content characteristics of legitimate web pages. These counterfeit pages are returned instead of standard error codes, making them indistinguishable from real pages to automated filtering tools. The system copies the essential features of valid web pages (HTML structure, CSS styling, content format) to create deceptive responses that bypass automated security filters.
Solution Approach 2:
The patent converts the harmful effect of providing clear error feedback into a beneficial security measure. By transforming standard error responses into sophisticated fake web pages that mimic legitimate content, the system turns what would normally be helpful feedback into a security feature that confuses automated penetration tools. The 'harm' of obscuring real page information is converted into the 'benefit' of preventing automated filtering attacks.
2Reliability
If the server generates custom web pages for each incorrect request, then the server can prevent automated filtering, but the server processing load and response time increase
Solution Approach 1:
The patent applies preliminary action by pre-defining templates and patterns for generating fake web pages. Instead of creating entirely new pages from scratch for each request, the system uses pre-prepared templates that can be rapidly instantiated and customized. This preliminary preparation of page structures, styles, and content patterns enables quick generation of security responses without significant processing delay.
Solution Approach 2:
The system uses parameter changes by dynamically adjusting specific attributes of the fake web pages based on the incoming request characteristics. Rather than generating completely unique pages each time, the system modifies parameters such as page content, styling details, and structural elements to match the context of the penetration attempt while reusing core page templates. This parameter-based approach balances security customization with processing efficiency.
3Ease of operation
If the server provides detailed information about page not found errors, then users understand the issue, but malicious users can use this information to refine their penetration attack parameters
Solution Approach 1:
The patent uses copying to create fake web pages that replicate the appearance and structure of legitimate pages, thereby copying the information presentation style of valid content. This prevents information leakage about actual page structures, error conditions, or system configuration to attackers, while still providing a user-friendly interface that appears normal to legitimate users.
Solution Approach 2:
The fake web pages act as an intermediary between the server's internal state and the user/attacker interface. Rather than directly exposing server error conditions or page structure information, the intermediary fake pages translate these internal states into benign, misleading external representations. This intermediary layer protects the server from information leakage while maintaining a user-friendly appearance.
Data Source
AI summary
The present solution provides systems and methods for generating and serving web pages to a client in response to invalid URL requests The present solution can include an echo server that receives, from a web server, an indication of an incorrect request from a client device being received by web server The echo server can establishing a second web page based at least on a web page selected from the web server The echo server can provide content of the second web page based at least on one or more parameters of the uniform resource location (URL) of the incorrect request The echo server can provide the second web page to the web server to cause the web server to provide the second web page in response to the incorrect request to the client device instead of an error code