CN103942497B - Forensics type website vulnerability scanning method and system - Google Patents

Abstract

The invention relates to the field of network application security, and aims to provide a forensics type website vulnerability scanning method and system. The method comprises the steps of page capturing, vulnerability scanning, automatic forensics, information collection and manual forensics. The system comprises a page capturing module, a vulnerability scanning module, an automatic forensics module, an information collection module, a manual forensics module, a task issuing and managing module, a scanning result displaying and managing module, a reporting module, a system database module and an item file managing module. According to the forensics type website vulnerability scanning method and system, vulnerabilities can be filtered out automatically, and therefore a user can get a copy of more reliable report when automatic scanning is over by the adoption of the method; with regards to the doubtful individual vulnerability, the 'manual forensics' step in the method can be adopted, so that the vulnerability is re-determined directly and quickly.

Description

Method and system for forensic website vulnerability scanning

technical field

The invention belongs to the field of network application security, and in particular relates to a method and system for forensic website vulnerability scanning.

Background technique

With the development of the Internet, various network applications emerge in an endless stream, which greatly meet the various needs of users. However, in the process of network application development, more attention is often paid to the realization of functions, but various security problems are left behind, which are generally caused by schedule pressure, programmer level limitations, imperfect design or temporary negligence. Common website security issues include: loopholes caused by insufficient filtering of input data by the code, loopholes caused by server configuration, and sensitive information disclosure. It is generally difficult to completely eliminate these vulnerabilities during the application development process. Therefore, it is a good choice to use a website vulnerability scanning tool to conduct a security assessment of a website.

The website vulnerability scanning system generally crawls all the pages of the website, and then analyzes the captured pages one by one to find as many security problems as possible. However, due to several factors, this scanning method is very easy to cause false positives, report some vulnerabilities that do not actually exist, and cause a waste of time and energy for website development and maintenance personnel. These factors include: 1) the dynamic nature of many webpages, resulting in wrong judgments of the website vulnerability scanning system; 2) the judgment logic of the website vulnerability scanning system itself is not perfect; 3) the current application environment is very complicated, and the judgment logic of the website vulnerability scanning system It is not possible to cover all possible situations.

Among the existing known technologies, a technology that is relatively close to this method is a method called "Web vulnerability scanning method based on penetration technology", and its key steps are "including two stages of scanning and analysis". This technology mainly realizes the method of website vulnerability discovery. But as mentioned earlier, such an approach is prone to false positives, but does not provide a good way to filter false positives. The staff can use this method to scan some vulnerabilities, but some of them may actually exist, and some of them may be false positives. They can only choose to tolerate these false positives, or manually analyze the vulnerabilities one by one again.

Contents of the invention

The purpose of the present invention is to make up for the deficiencies of existing website vulnerability scanning methods, provide a vulnerability scanning method and scanning system, adopt automatic and manual evidence collection methods, improve the accuracy of website vulnerability scanning system scanning, and submit more accurate and credible website vulnerabilities scan results.

A forensic website vulnerability scanning method is provided for performing vulnerability detection on scanned websites, including the following steps:

a) Page crawling: start parsing from the initial page of the scanned website, obtain the page link of the scanned website, and then store the page link in the system database module, and ensure that the same page link is not repeatedly stored, and then from the system database module Extract the page links that have been saved and have not been processed by the page grabbing step, perform page access, and extract new page links and store them in the system database module until all pages of the scanned website are captured;

b) Vulnerability scanning: Among the pages captured in step a, determine whether there are pages that have not yet been tested for vulnerabilities. If there are no pages that have not been tested for vulnerabilities, go to step e, otherwise execute: select a page that has not yet been tested for vulnerabilities Vulnerability detection for this page, according to the corresponding detection logic of different vulnerabilities for vulnerability analysis (there are many types of vulnerabilities, each vulnerability has a different detection method, and some related technologies are already known in the industry), if found Vulnerabilities go to step c, otherwise repeat step b;

c) Automatic forensics: For the vulnerabilities found in step b, automatic forensics is performed according to the forensics logic of different vulnerabilities, and false positives are automatically filtered out to obtain forensic results that can prove the existence of the vulnerability;

d) Information collection: According to the loopholes found in step b, according to the manual evidence collection methods that can be taken for different vulnerabilities, automatically collect the evidence collection information required by the manual evidence collection method and save it, and then turn to step b to perform vulnerability detection on other pages;

e) Manual forensics: use the forensics information collected in step d, perform manual forensics according to the corresponding manual forensics methods that can be adopted for different vulnerabilities, and obtain manual forensics results for confirming the authenticity of the vulnerabilities.

In the present invention, according to different types of website vulnerabilities, the evidence collection results in step c and step e include the following data: page length, HTTP response code, page request response time, messages sent and received during page request process, HTTP header, Sessions and cookies, page content, differences between multiple page requests (such as differences in page response codes, differences in page length, differences in content, etc.), the actual display effect of the page in the browser and its screenshots (some vulnerabilities Browsers can be used for forensics. Different vulnerabilities are entered differently in the browser. For example, "cross-site scripting" can modify the title of the interface or pop up a dialog box, and the display effect of "directory browsing" is in the browser. Display all subdirectories and subfiles in a directory, there are many different situations, so I won’t list them one by one).

In the present invention, the evidence collection information in step d includes the following data: automatically constructed URL for further evidence collection, HTTP header, session and Cookie, form submission data, HTTP request data packet, HTTP response data packet.

In the present invention, the automatic evidence collection in the step c includes the following methods:

1) Directly use the response content length, response code, response time, message, and page content of the page where the vulnerability is located as the evidence collection result, and use this to determine whether the vulnerability exists;

2) Make modifications on the basis of the original page request, automatically construct at least one new http request, and compare the data of these different requests (including response content length, response code, response time, message, page content), and put Compare the difference obtained as the result of forensics, and use this to judge whether the vulnerability exists;

3) Match the text that meets the characteristics in the returned content of the page where the vulnerability is located, and use the matched content as the forensic result to determine whether the vulnerability exists;

4) Automatically simulate form submission and obtain request results, and use this to determine whether a vulnerability exists;

5) Use the browser kernel and browser to analyze and typesetting the content of the page, execute the script in the page content, and use the output result of the analysis and typesetting as the result of forensics, and judge whether the vulnerability exists.

In the present invention, the manual evidence collection of step e is optional, and step e can be selectively performed as required (manual evidence collection can be more accurate than automatic evidence collection under the participation of people); the manual evidence collection includes the following methods :

1) Use the automatically constructed URL obtained in step d for further forensics, access it in a browser, view the actual URL execution and display results, combine the characteristics of the vulnerability, determine whether the vulnerability exists, and save the screenshot of the display result ;

2) Use the HTTP simulation packet sender to fill in the URL used for further evidence collection, as well as the HTTP header, session and cookie, and form submission data information obtained in step d, into the HTTP simulation packet sender, and send an HTTP request to view the returned The content of the page, combined with the characteristics of the vulnerability, determines whether the vulnerability exists;

3) In the browser, fill in the form submission data obtained in step d into the form on the page where the vulnerability is located, and submit the form, check the page display results after submitting the form, and determine whether the vulnerability exists based on the characteristics of the vulnerability;

4) Utilize special-purpose tool, and described special-purpose tool refers to the tool of vulnerability evidence collection or penetration test, the HTTP header that obtains in the URL of further evidence collection, step d, session and Cookie, form submit data information, fills in special-purpose tool and further evidence collection Or penetration, and check the results, combined with the characteristics of the vulnerability, to determine whether the vulnerability exists;

5) Display the HTTP request data packet and HTTP response data packet obtained in step d on the user interface, and use the method of highlighting and bolding the font to highlight the important content, and combine the characteristics of the vulnerability to manually judge whether the vulnerability exists.

In the present invention, website loopholes and forensics results can be simultaneously displayed on the user interface of the program or system, or output to reports; users can judge whether loopholes exist, as well as the nature and harmfulness of loopholes based on these information.

In the present invention, the above-mentioned forensic website vulnerability scanning method has a learning function: the user judges whether the vulnerability is misreported, and the system records the user's judgment result, and when the same vulnerability reappears in subsequent scans, according to the The user judges the result to filter out false positive vulnerabilities, that is, realizes the automatic filtering of false positives in step c.

Provide a forensic website vulnerability scanning system based on the scanning method, including a page grabbing module, a vulnerability scanning module, an automatic forensics module, an information collection module, a manual forensics module, a task delivery and management module, a scanning result display and management module, Report module, system database module, project file management module;

The page crawling module is used to analyze and obtain new page links from the initial page of the scanned website or the page links saved by the system database module, and then store the obtained page links in the system database module, and ensure that the same page links Do not store repeatedly (the system database module in the page crawling module can also be replaced by the project file);

The vulnerability scanning module is used to judge whether the page has passed the vulnerability detection, and detects the pages that have not passed the vulnerability detection;

The automatic forensics module is used to automatically collect evidence for the vulnerabilities found in the vulnerability scanning module, and automatically filter out false positives to obtain evidence collection results that can prove the existence of the vulnerabilities;

The information collection module is used to automatically collect and save the evidence collection information for manual evidence collection for the vulnerabilities found in the vulnerability scanning module;

The manual evidence collection module is used to use the evidence collection information collected by the information collection module to perform manual evidence collection, and obtain manual evidence collection results for confirming the authenticity of the loophole;

The task delivery and management module is used to provide the user with an operation means to start the process of scanning the website, to achieve the ultimate goal of vulnerability discovery and evidence collection, by supporting the user to send and receive scanning tasks on the user interface, and to manage them, including suspending , stop, delete, configure;

The scanning result display and management module is used to display the scanning data on the interface during the scanning process and after the scanning is completed, and supports users to view the scanning data, manual evidence collection results and output reports. The scanning data includes discovered vulnerabilities, The page link of the corresponding website, manual evidence collection information;

The report module is used to output the results of the vulnerability detection into an independent file, and the independent file is used as a communication between staff, archived or as a basis for improving the website system, and the independent file can be imported into a third-party system for further processing ;

The system database module is used to store configuration information of the system, vulnerabilities of the website, and page links, and the configuration information of the system includes account and log information;

The project file management module is used to manage project files, including creating, deleting, and writing data; project files refer to files that can store page links and vulnerability data, and each task is issued and the tasks issued by the management module , has a corresponding project file.

The principle of the present invention is: after a loophole is scanned, the loophole itself is used to verify the loophole again or multiple times by using the characteristics of the loophole itself and the returned data of the page, so as to eliminate the loophole that is falsely reported.

Compared with prior art, the beneficial effect of the present invention is:

The present invention provides a website vulnerability scanning method with higher accuracy, so that the staff can easily generate a more credible website vulnerability report without using other means to judge the authenticity of the vulnerability, which can largely Improve work efficiency.

Forensic scanning methods can automatically filter for vulnerabilities. With this approach, users get a more reliable report at the end of the automated scan. For individual vulnerabilities that still have doubts, the steps of "manual evidence collection" described in this method can be used to directly and quickly reconfirm the vulnerabilities.

Description of drawings

Fig. 1 is a structural diagram of the main modules of the forensic website vulnerability scanning system in the present invention.

Fig. 2 is a flow chart of the forensic website vulnerability scanning method in the present invention.

detailed description

First of all, it needs to be explained that the present invention relates to Web and database technology, and is an application of computer technology in the field of information security technology. During the implementation of the present invention, the application of multiple software function modules will be involved. The applicant believes that, after carefully reading the application documents and accurately understanding the realization principle and purpose of the present invention, combined with existing known technologies, those skilled in the art can fully implement the present invention by using their software programming skills. The aforementioned software function modules include but are not limited to: page crawling module, vulnerability scanning module, automatic forensics module, information collection module, manual forensics module, task delivery and management module, scan result display and management module, report module, system database module , project file management module, etc., all mentioned in the application documents of the present invention belong to this category, and the applicant will not list them one by one.

The purpose of the present invention is to provide a website vulnerability scanning method with higher accuracy. Through the method of forensics, false positive vulnerabilities are filtered. Forensics mainly includes two steps: automatic forensics and manual forensics, in which automatic forensics is automatically completed during the scanning process.

The forensic website vulnerability scanning method specifically includes the following steps:

a) Page crawling: start parsing from the initial page of the scanned website, obtain the page link of the scanned website, and then store the page link in the system database module, and ensure that the same page link is not repeatedly stored, and then from the system database module Extract the page links that have been saved and have not been processed by the page crawling step, perform page access, and extract new page links and store them in the system database module until all pages of the scanned website are crawled. It can be carried out in various ways such as web crawler, regular expression, simulation analysis, etc., or a combination of various methods, or the existing open source web crawler, such as Labin, Nurch, etc. are well-known open source web crawlers project.

b) Vulnerability scanning: Among the pages captured in step a, determine whether there are pages that have not yet been tested for vulnerabilities. If there are no pages that have not been tested for vulnerabilities, go to step e, otherwise execute: select a page that has not yet been tested for vulnerabilities Vulnerability detection for this page, according to the corresponding detection logic of different vulnerabilities for vulnerability analysis (there are many types of vulnerabilities, each vulnerability has a different detection method, and some related technologies are already known in the industry), if found If there is a bug, go to step c, otherwise, repeat step b. Due to the diversity of loopholes, the present invention uses a policy library to realize the writing of loophole detection logic. The policy library provides a unified loophole detection framework, and each loophole is written as a strategy in the strategy library. When users deliver tasks, they can choose which policies in the policy library to execute. During the scanning process, for each page, all policies selected by the user will be executed. In the present invention, the current step should find as many loopholes as possible to reduce false positives. False positives and false negatives in the website vulnerability method are often a pair of contradictions, which need to be balanced in the scanning strategy. But in this step, the priority is to reduce the false negative rate.

c) Automatic forensics: For the vulnerabilities found in step b, automatic forensics is performed according to the forensics logic of different vulnerabilities, and false positives are automatically filtered out to obtain forensic results that can prove the existence of the vulnerability. Automatic forensics is automatically completed during the scanning process. After each policy in the policy library is executed, if possible vulnerabilities are found, the process of automatic filtering and forensics will start. If it is judged as a false positive, the result Automatically discarded, otherwise stored in the database. The basis and results of automatic forensics may include but not limited to the following information: page length, HTTP response code, page request response time, messages sent and received during page request process, HTTP header, session and cookie, page content, etc. Differences between individual page requests, such as differences in page response codes, differences in page length, and differences in content. In addition to the data-based content, the forensic results can also include the actual display effect of the page in the browser and its screenshots. Some vulnerabilities can be forensically obtained using the browser. Different vulnerabilities can be entered differently in the browser, such as "cross- "Station Script" can modify the title of the interface or pop up a dialog box, and the display effect of "Directory Browse" is to display all subdirectories and subfiles in a directory in the browser. There are many different situations, so I won't list them one by one. . Automatic forensics includes but is not limited to the following methods: 1) Directly use the response content length, response code, response time, message, and page content of the page where the vulnerability is located as the forensics result, and use this to determine whether the vulnerability exists; 2) request the vulnerability on the original page Modify on the basis of , automatically construct one or more new http requests, and compare the response content length, response code, response time, message, page content and other data of these different requests, and use the difference obtained by comparison as 3) Match the text that meets the characteristics in the returned content of the page where the vulnerability is located, and use the matched content as the forensic result to determine whether the vulnerability exists; 4) Automatically simulate form submission And get the request result, and use it to judge whether the vulnerability exists. 5) Use the browser kernel and the browser to analyze and format the content of the page, and execute the script in the page content. Use the output of parsing and typesetting as the result of forensics, and use this to determine whether a vulnerability exists.

d) Information collection: According to the vulnerability found in step b, the corresponding manual evidence collection method can be adopted for the vulnerability, and the required evidence collection information is collected and saved. After completion, turn to step b to perform vulnerability detection on other pages. Relevant data sources can come from the page itself, the HTTP data packets sent and received, and the results of automatic analysis of the program. For the possible vulnerabilities that have been discovered, after automatic filtering, due to the complexity of the detection technology, the accuracy rate cannot be fully guaranteed, so there may be human assistance to judge. After the vulnerability detection strategy is completed, relevant information is automatically collected, and this information will be used as a source and basis for manual evidence collection. When needed, the user can judge the authenticity of the vulnerability based on this information, and store or output the judgment result. The information that may be collected includes, but is not limited to: automatically constructed URLs for further forensics, HTTP headers, sessions and cookies, form submission data, HTTP request packets, HTTP response packets, etc.

e) Manual forensics: use the forensics information collected in step d, perform manual forensics according to the corresponding manual forensics methods that can be adopted for the vulnerability, and obtain the manual forensics results for confirming the authenticity of the vulnerability. Manual forensics is mainly used for manual operations, mainly for visual observation, so in addition to the information obtained in the step d, the system of the present invention should also include some tools to facilitate manual operations by users, such as: browsers, HTTP protocol-based Simulated packet sender, vulnerability verification tool, web application penetration testing tool, network packet capture and analysis tool, etc. Relevant information should also be displayed on the user interface for easy viewing by the user. According to different types of vulnerabilities, manual forensics should also use different methods. Methods that can be used include but are not limited to: 1) Use the automatically constructed URL obtained in step d for further forensics, access it in a browser, check the actual URL execution and display results, and determine whether the vulnerability is exist. At the same time, you can save the screenshot of the display result; 2) Use the HTTP simulation packet sender to fill in the URL used for further evidence collection, as well as the HTTP header, session and cookie, form submission data and other information obtained in step d into the HTTP simulation packet sender , and send an HTTP request, check the returned page content, and combine the characteristics of the vulnerability to determine whether the vulnerability exists; 3) In the browser, fill in the form submission data obtained in step d into the form on the page where the vulnerability is located, and submit Form, check the page display results after submitting the form, and judge whether the vulnerability exists based on the characteristics of the vulnerability; 4) Use other dedicated vulnerability forensics or penetration testing tools, the URL used for further forensics, and the HTTP header obtained in step d, Fill in information such as sessions, cookies, and form submission data into special tools for further evidence collection or penetration, and check the results, and combine the characteristics of the vulnerability to determine whether the vulnerability exists; 5) The HTTP request packet and HTTP response data obtained in step d The package is displayed on the user interface, and important content is highlighted using methods such as highlighting and bold fonts. Combined with the characteristics of the vulnerability, it is manually judged whether the vulnerability exists.

Manual forensics in step e is optional. If the user is still not confident about the vulnerabilities reported in the report, he can choose to execute step e as needed.

The forensic website vulnerability scanning method can simultaneously display website vulnerabilities and forensic results in the user interface of the program or system, or output them into reports at the same time; users can judge whether a vulnerability exists, and judge the nature and harmfulness of the vulnerability based on this information. The forensic website vulnerability scanning method also has a learning function: the user judges whether the vulnerability is a false positive, and the system records the user's judgment result. When the same vulnerability reappears in subsequent scans, the false positive is filtered out according to the user judgment result in the record loopholes.

The forensic website vulnerability scanning system based on the scanning method may include but not limited to the following modules: page crawling module, vulnerability scanning module, automatic forensics module, information collection module, manual forensics module, task delivery and management module, scanning Result display and management module, report module, system database module, project file management module, etc.

The following is a further description of each module:

1) The page grabbing module is used to analyze and obtain new page links from the initial page of the scanned website or the page links saved by the system database module, and then store the obtained page links in the system database module, and ensure the same page links The database described here can also be replaced by a project file without repeated storage.

2) The vulnerability scanning module is used to judge whether a page has been tested for vulnerabilities, and to detect pages that have not been tested for vulnerabilities. Different vulnerabilities have different detection methods.

3) The automatic forensics module is used for automatic forensics of the vulnerabilities found in the vulnerability scanning module, and automatically filters out false positives, and obtains forensics results that can prove the existence of the vulnerabilities.

4) The information collection module is used to automatically collect and save the evidence collection information for manual evidence collection for the vulnerabilities found in the vulnerability scanning module.

5) The manual forensics module is used to use the forensics information collected by the information collection module to perform manual forensics and obtain manual forensics results for confirming the authenticity of vulnerabilities. The operation of this module is optional for the user and can be performed as needed.

6) Task delivery and management module refers to the user sending and receiving scanning tasks on the user interface and managing them, such as pausing, stopping, deleting, configuring, etc. Its purpose is to provide users with the operation means to start the process of scanning websites, so as to achieve the ultimate goal of vulnerability discovery and evidence collection.

7) The scanning result display and management module refers to displaying the found vulnerabilities, page links of corresponding websites, manual evidence collection information and other content on the interface during and after the scanning is completed. Users can view relevant data, manually collect evidence and output reports.

8) The report module refers to outputting the results of vulnerability detection into independent files, which are used for communication between staff, archiving or as a basis for improving the website system. The output files can also be imported into third-party systems for further processing.

9) The system database module is used to store system configuration information, account and log information, etc., and can also store information such as website vulnerabilities and page links.

10) The project file management module, wherein the project file refers to a file that can store data such as page links and vulnerabilities, and each task issued and task issued by the management module can have a corresponding project file. The project file management module refers to a module for managing project files, such as creating, deleting, and writing data.

In the system, the scanning process of the user is as follows: the user first sends a task and waits for the scanning to be completed. During or after scanning, users can view the scanning results and perform manual forensics. Finally, scan results and forensics results are output to reports as required.

By implementing the forensic website vulnerability scanning method in the forensic website vulnerability scanning system, the function of forensic website vulnerability scanning can be completed.

Finally, it should be noted that what is listed above are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments, and many modifications are possible. All deformations that can be directly derived or associated by those skilled in the art from the content disclosed in the present invention should be considered as the protection scope of the present invention.

Claims (7)

1. A method for scanning the vulnerability of a forensic website, used to detect the vulnerability of the scanned website, is characterized in that, comprising the following steps: a) Page crawling: start parsing from the initial page of the scanned website, obtain the page link of the scanned website, and then store the page link in the system database module, and ensure that the same page link is not repeatedly stored, and then from the system database module Extract the page links that have been saved and have not been processed by the page grabbing step, perform page access, and extract new page links and store them in the system database module until all pages of the scanned website are captured; b) Vulnerability scanning: Among the pages captured in step a, determine whether there are pages that have not yet been tested for vulnerabilities. If there are no pages that have not been tested for vulnerabilities, go to step e, otherwise execute: select a page that has not yet been tested for vulnerabilities Vulnerability detection is performed on the page. For this page, the vulnerability analysis is performed according to the detection logic corresponding to different vulnerabilities. If a vulnerability is found, go to step c, otherwise repeat step b; c) Automatic forensics: For the vulnerabilities found in step b, automatic forensics is performed according to the forensics logic of different vulnerabilities, and false positives are automatically filtered out to obtain forensic results that can prove the existence of the vulnerability; Automatic forensics includes the following methods: 1) directly use the response content length, response code, response time, message, and page content of the page where the vulnerability is located as the forensics result, and use this to determine whether the vulnerability exists; 2) based on the original page request Modify the above, automatically construct at least one new http request, and compare the data of these different requests, and use the difference obtained by the comparison as the result of forensics, and use this to determine whether the vulnerability exists; the data of the different requests includes the response content Length, response code, response time, message, and page content; 3) Match the text that meets the characteristics in the returned content of the page where the vulnerability is located, and use the matched content as the forensic result to determine whether the vulnerability exists; 4) Automatically Simulate form submission and obtain request results, and use this to determine whether the vulnerability exists; 5) Use the browser kernel and browser to analyze and typesetting the content of the page, execute the script in the page content, and use the output results of the analysis and typesetting as evidence , and use this to determine whether the vulnerability exists; d) Information collection: According to the loopholes found in step b, according to the manual evidence collection methods that can be taken for different vulnerabilities, automatically collect the evidence collection information required by the manual evidence collection method and save it, and then turn to step b to perform vulnerability detection on other pages; e) Manual forensics: use the forensics information collected in step d, perform manual forensics according to the corresponding manual forensics methods that can be adopted for different vulnerabilities, and obtain manual forensics results for confirming the authenticity of the vulnerabilities. 2. A method for forensic website vulnerability scanning according to claim 1, characterized in that, according to different types of website vulnerabilities, the forensic results in step c and step e include the following data: page length, HTTP response code , page request response time, messages sent and received during the page request process, HTTP headers, sessions and cookies, page content, differences between multiple page requests, the actual display effect of the page in the browser and its screenshots. 3. a kind of forensic type website vulnerability scanning method according to claim 1, is characterized in that, the forensic information in the described step d comprises the following data: automatically constructed URL, HTTP header, session and Cookie for further evidence collection , form submission data, HTTP request data packet, HTTP response data packet. 4. a kind of forensic type website vulnerability scanning method according to claim 3, is characterized in that, the manual forensics of described step e is optional, can selectively execute step e as needed; Described manual forensics comprises the following method: 1) Use the automatically constructed URL obtained in step d for further forensics, access it in a browser, view the actual URL execution and display results, combine the characteristics of the vulnerability, determine whether the vulnerability exists, and save the screenshot of the display result ; 2) Use the HTTP simulation packet sender to fill in the URL used for further evidence collection, as well as the HTTP header, session and cookie, and form submission data information obtained in step d, into the HTTP simulation packet sender, and send an HTTP request to view the returned The content of the page, combined with the characteristics of the vulnerability, determines whether the vulnerability exists; 3) In the browser, fill in the form submission data obtained in step d into the form on the page where the vulnerability is located, and submit the form, check the page display results after submitting the form, and determine whether the vulnerability exists based on the characteristics of the vulnerability; 4) Utilize special-purpose tool, and described special-purpose tool refers to the tool of vulnerability evidence collection or penetration test, the HTTP header that obtains in the URL of further evidence collection, step d, session and Cookie, form submit data information, fills in special-purpose tool and further evidence collection Or penetration, and check the results, combined with the characteristics of the vulnerability, to determine whether the vulnerability exists; 5) Display the HTTP request data packet and HTTP response data packet obtained in step d on the user interface, and use the method of highlighting and bolding the font to highlight the important content, and combine the characteristics of the vulnerability to manually judge whether the vulnerability exists. 5. A method for scanning forensic website vulnerabilities according to claim 1, characterized in that website vulnerabilities and forensic results can be simultaneously displayed in the user interface of the program or system, or output to the report at the same time; the user according to these The information determines whether a vulnerability exists, as well as the nature and harmfulness of the vulnerability. 6. A kind of forensic type website vulnerability scanning method according to claim 1, characterized in that, said a kind of forensic type website vulnerability scanning method has a learning function: the user judges whether the vulnerability is misreported, and the system checks the user's judgment result Record, when the same vulnerability reappears in subsequent scans, filter out false positives according to the user judgment results in the records, that is, automatically filter out false positives in step c. 7. The forensic type website vulnerability scanning system based on the scanning method of claim 1, characterized in that it includes a page grabbing module, a vulnerability scanning module, an automatic forensics module, an information collection module, a manual forensics module, a task distribution and management module , scan result display and management module, report module, system database module, project file management module; The page crawling module is used to analyze and obtain new page links from the initial page of the scanned website or the page links saved by the system database module, and then store the obtained page links in the system database module, and ensure that the same page links Do not deposit repeatedly; The vulnerability scanning module is used to judge whether the page has passed the vulnerability detection, and detects the pages that have not passed the vulnerability detection; The automatic forensics module is used to automatically collect evidence for the vulnerabilities found in the vulnerability scanning module, and automatically filter out false positives to obtain evidence collection results that can prove the existence of the vulnerabilities; The information collection module is used to automatically collect and save the evidence collection information for manual evidence collection for the vulnerabilities found in the vulnerability scanning module; The manual evidence collection module is used to use the evidence collection information collected by the information collection module to perform manual evidence collection, and obtain manual evidence collection results for confirming the authenticity of the loophole; The task delivery and management module is used to provide the user with an operation means to start the process of scanning the website, to achieve the ultimate goal of vulnerability discovery and evidence collection, by supporting the user to send and receive scanning tasks on the user interface, and to manage them, including suspending , stop, delete, configure; The scanning result display and management module is used to display the scanning data on the interface during the scanning process and after the scanning is completed, and supports users to view the scanning data, manual evidence collection results and output reports. The scanning data includes discovered vulnerabilities, The page link of the corresponding website, manual evidence collection information; The report module is used to output the results of the vulnerability detection into an independent file, and the independent file is used as a communication between staff, archived or as a basis for improving the website system, and the independent file can be imported into a third-party system for further processing ; The system database module is used to store configuration information of the system, vulnerabilities of the website, and page links, and the configuration information of the system includes account and log information; The project file management module is used to manage project files, including creating, deleting, and writing data; project files refer to files that can store page links and vulnerability data, and each task is issued and the tasks issued by the management module , has a corresponding project file.