CN115967551B - Method and device for detecting server request forgery vulnerability based on vulnerability information guidance - Google Patents

Abstract

The invention discloses a method and a device for detecting falsification vulnerability of a server request based on vulnerability information guidance, wherein the method comprises the following steps: s01, constructing a request for a Web application server and sending the request to the Web application server; s02, when a request for a Web application server is captured, analyzing the captured request; s03, judging whether a vulnerability exists by using a staged vulnerability judging method when a detection request sent to a Web server by a detection engine is received, and feeding back to a fuzzy tester if the vulnerability exists; s04, carrying out mutation on the vulnerability load according to the corresponding vulnerability type; and S05, monitoring whether the vulnerability is triggered in the sending process of the fuzzy test request, if so, judging that the vulnerability exists, and outputting vulnerability information. The invention can realize the detection of the falsification loopholes requested by the server, and has the advantages of simple realization method, high detection efficiency and precision, low false alarm rate and false alarm rate, and the like.

Description

Method and device for detecting server request forgery vulnerability based on vulnerability information guidance

Technical Field

The present invention relates to the technical field of vulnerability detection, and in particular to a method and device for detecting a server request forgery vulnerability based on vulnerability information guidance.

Background technique

Retrieving external resources provided by other network services has become a standard feature of modern web applications. However, these external resources are often controlled by user input. For example, web applications often load links entered by users to preview images and videos, or load the resources corresponding to the links when using functions such as information collection. In order to support these convenient functions, web applications rely on server-side requests and HTTP requests generated by and communicated between servers, which also exposes server-side request functions to security threats. For example, when a web application sends a request and obtains a resource without verifying the URL provided by the user, an attacker can forge a request and make the server send a request to an unexpected location, thereby further attacking the target system. The security issue corresponding to this phenomenon is the server-side request forgery (SSRF) vulnerability.

There are few studies on SSRF vulnerability detection in PHP Web applications in the prior art. The current set of sensitive functions related to SSRF vulnerabilities is not complete and cannot cover all sensitive functions related to SSRF vulnerabilities. This makes it impossible for static analysis to comprehensively analyze and evaluate the security risks brought by SSRF vulnerabilities in source code. The traditional dynamic application security testing method uses black box scanning. Although SSRF vulnerabilities can be detected, there is a high false negative rate. Therefore, there is an urgent need for a SSRF vulnerability detection method that can reduce the false positive rate and false negative rate of SSRF vulnerabilities on the basis of fully exploring sensitive functions related to SSRF vulnerabilities.

Summary of the invention

The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a server request forgery vulnerability detection method and device based on vulnerability information guidance, which has a simple implementation method, high detection efficiency and accuracy, and low false alarm rate and missed alarm rate. The method and device can accurately and comprehensively mine server request forgery vulnerabilities, while reducing the false alarm rate and missed alarm rate of server request forgery vulnerability detection.

In order to solve the above technical problems, the technical solution proposed by the present invention is:

A method for detecting a server request forgery vulnerability based on vulnerability information guidance, comprising the following steps:

Step S01. Construct a request to the Web application server and send it to the Web server;

Step S02. When the HTTP request to the Web application server is captured, the captured HTTP request is parsed, and the input point in the request data packet is parsed and sent to the detection engine;

Step S03. When receiving the HTTP detection request sent by the detection engine to the Web server, a phased vulnerability identification method is used to determine whether there is a vulnerability based on the string of the input source and the string at the taint. If a vulnerability is determined to exist, the corresponding data packet and vulnerability type are fed back to the fuzz tester;

Step S04. The fuzz tester mutates the vulnerability payload according to the corresponding vulnerability type, and sends the mutated vulnerability payload to the Web server as input for the corresponding function point of the Web application;

Step S05. During the process of the fuzz tester sending the fuzz test request to the Web server, monitor whether the vulnerability is triggered. If so, determine that the vulnerability exists, and output the vulnerability information and the request information that triggers the vulnerability;

The staged vulnerability identification method identifies the existence of vulnerabilities by sequentially performing substring identification, string similarity identification, and comparison verification identification on the input source string and the string at the stain. The substring identification stage determines whether the input string at the stain is a substring of the input source string. The string similarity stage determines the similarity between the strings. If the similarity condition is met, the comparison verification identification stage is entered. The comparison verification identification stage determines whether there is a vulnerability based on the comparison result between the input at each parameter value and the value at the stain.

Furthermore, when executing the substring determination stage, it is determined whether the input string at the taint is a substring of the string input at the input source. If it is a substring and the length of the matching part is greater than a preset threshold, it is determined that there is a vulnerability at the current position, and it is determined that the corresponding HTTP parameter point can input a valid vulnerability payload; otherwise, it proceeds to the stage of executing the string similarity determination.

Furthermore, when executing the stage of determining the similarity of the strings, the distance between the string A of the input source and the string B at the stain is calculated to evaluate whether the number of strings required to be added and deleted to change from the string A of the input source to the string B at the stain meets the threshold condition. If the threshold condition is met, it is determined that the string A of the input source is similar to the string B at the stain.

Furthermore, when executing the comparison verification and judgment stage, two different inputs are constructed for each parameter in the data packet, and it is determined whether there is a vulnerability at the current position based on whether the values corresponding to the two inputs at the two parameter values entering the stain are the same.

Furthermore, the two inputs of each parameter construction in the data packet are _A1 and _A2 , respectively, where _A2 is obtained by randomly modifying a specified number of characters in _A1 . The values B1 and B2 corresponding to the inputs A1 and A2 at the target parameter value entering the taint are compared to see if they are the same. If so, it is determined that there is no vulnerability at the target parameter position, otherwise it is determined that there is a vulnerability at the target parameter position.

Furthermore, in step S04, mutating the vulnerability payload according to the corresponding vulnerability type includes: firstly combining all the operation types in different combinations to obtain all the combinations to form a mutation strategy chain L, and then eliminating invalid combinations to form a final mutation strategy chain L.

Furthermore, it is characterized in that the steps of step S01 include:

Step S101. Use static analysis to extract site map data from the Web application source code and construct a preliminary site map;

Step S102. Using the website map constructed in step S101 as the state-aware crawler input, interactively crawling the website map and each page of the Web application to construct a valid request to the Web application server;

Step S103: Send the request constructed in step S102 to the Web server.

Furthermore, the steps of step S02 include:

Step S201. The plugger captures the request sent to the Web server, and feeds the captured request back to the HTTP request parsing module for parsing;

Step S202: The HTTP request parsing module parses the input points corresponding to the parameters in the request, marks the input points in the request data packet, and then sends the parsed data to the detection engine.

A server request forgery vulnerability detection device based on vulnerability information guidance, comprising:

A request construction module is used to construct a request to a Web application server and send it to the Web server;

An HTTP request parsing module is used to parse the captured request to the Web application server when capturing the request, parse out the input point in the request data packet and send it to the detection engine;

The phased vulnerability identification module is used to determine whether there is a vulnerability based on the input source string and the string at the taint when receiving the detection request sent by the detection engine to the Web server. If a vulnerability is determined to exist, the corresponding data packet and vulnerability type are fed back to the fuzz tester;

The fuzz tester is used to mutate the vulnerability payload according to the corresponding vulnerability type and send the mutated vulnerability payload to the Web server as the input of the corresponding function point of the Web application;

The vulnerability detection module is used to monitor whether the vulnerability is triggered during the process of the fuzz tester sending the fuzz test request to the Web server. If so, it determines that the vulnerability exists and outputs the vulnerability information and the request information that triggers the vulnerability.

The staged vulnerability identification method in the staged vulnerability identification module determines the existence of vulnerabilities by performing substring identification, string similarity identification and comparison verification identification in three stages on the input source string and the string at the stain in sequence. The substring identification stage determines whether the input string at the stain is a substring of the input source string. The string similarity stage determines the similarity between the strings. If the similarity condition is met, the comparison verification stage is entered. The comparison verification stage determines whether there is a vulnerability based on the comparison results of the input at each parameter value and the value at the stain.

A computer-readable storage medium storing a computer program, wherein the computer program implements the above method when executed.

Compared with the prior art, the advantages of the present invention are: the present invention finds out all relevant PHP sensitive functions, and then uses a lightweight plugging method to adopt a staged vulnerability identification method to perform vulnerability identification, and sequentially identifies the existence of vulnerabilities in three stages: substring identification, string similarity identification, and comparison verification identification. After determining that the vulnerability has a high probability of existing, the vulnerability payload is mutated and the mutated vulnerability payload is used as the input of the corresponding function point of the Web application. At the same time, continuous monitoring is performed to determine whether the SSRF vulnerability can be triggered to determine whether the vulnerability really exists. The SSRF vulnerability can be accurately and comprehensively excavated, and combined with the staged vulnerability identification method, the false positives and missed positives of the SSRF vulnerability detection can be effectively avoided.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the implementation flow of the method for detecting a server-side request forgery vulnerability guided by vulnerability information according to the present embodiment.

FIG. 2 is a schematic diagram of the implementation flow of the phased vulnerability identification method in this embodiment.

Detailed ways

The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

As shown in FIG1 , the steps of the server request forgery vulnerability detection method based on vulnerability information guidance in this embodiment include:

Step S01. Construct a request to the Web application server and send it to the Web server;

Step S02. When the HTTP request to the Web application server is captured, the captured HTTP request is parsed, and the input point in the request data packet is parsed and sent to the detection engine;

Step S03. When receiving the HTTP detection request sent by the detection engine to the Web server, a phased vulnerability identification method is used to determine whether there is a vulnerability based on the string of the input source and the string at the taint. If a vulnerability is determined to exist, the corresponding data packet and vulnerability type are fed back to the fuzz tester;

Step S04. The fuzz tester mutates the vulnerability payload according to the corresponding vulnerability type, and sends the mutated vulnerability payload to the Web server as input for the corresponding function point of the Web application;

Step S05. During the process of the fuzz tester sending the fuzz test request to the Web server, monitor whether the vulnerability is triggered. If so, determine that the vulnerability exists, and output the vulnerability information and the request information that triggers the vulnerability;

In step S03, the staged vulnerability identification method determines the existence of vulnerabilities by performing substring identification, string similarity identification and comparison verification identification on the input source string and the string at the stain in sequence. The substring identification stage determines whether the input string at the stain is a substring of the input source string. The string similarity stage determines the similarity between the strings. If the similarity condition is met, the comparison verification stage is entered. The comparison verification stage determines whether there is a vulnerability based on the comparison results of the input at each parameter value and the value at the stain.

This embodiment is aimed at SSRF (Server-Side Request Forgery) vulnerability detection. First, all relevant PHP sensitive functions are found, and then a lightweight plug-in method is used to adopt a staged vulnerability identification method to perform vulnerability identification. The existence of vulnerabilities is identified in three stages: substring identification, string similarity identification, and comparison verification identification. After determining that the vulnerability is likely to exist, the vulnerability payload is mutated and the mutated vulnerability payload is used as the input of the corresponding function point of the Web application. At the same time, continuous monitoring is performed to determine whether the SSRF vulnerability can be triggered to determine whether the vulnerability really exists. The SSRF vulnerability can be accurately and comprehensively excavated. At the same time, combined with the staged vulnerability identification method, the false positives and missed positives of SSRF vulnerability detection can be effectively avoided.

In this embodiment, step S01 includes:

Step S101. Use static analysis to extract site map data from the source code of the Web application and construct a preliminary site map;

Step S102. Using the website map constructed in step S101 as the state-aware crawler input, interactively crawling the website map and each page of the Web application to construct a valid request to the Web application server;

Step S103: Send the request constructed in step S102 to the Web server.

In this embodiment, step S02 includes:

Step S201. The plugger captures the request sent to the Web server, and feeds the captured request back to the HTTP request parsing module for parsing;

Step S202: The HTTP request parsing module parses the input points corresponding to the parameters in the request, marks the input points in the request data packet, and then sends the parsed data to the detection engine.

After the above steps, you can first find all relevant PHP sensitive functions, and then further identify and detect SSRF vulnerabilities.

In order to efficiently discover the input in the HTTP request field associated with the vulnerability point, this embodiment combines the dynamic taint propagation theory to mark the variable transfer from the kernel level, that is, through the corresponding source (source) and sink (sink) mark, determine the input position of the taint. Traditional dynamic taint reasoning analysis cannot accurately determine whether the vulnerability point exists. This is because when the taint propagates, it is difficult to determine whether the intermediate filter function effectively filters the propagated value. Assuming that the filtering is insufficient, if the taint mark is removed after the variable is passed through the filter function, it will cause missed reports; if the filter function has already performed a very strict filtering operation on the data, or the taint mark continues to propagate, it will also cause missed reports.

Considering that the essence of the filtering function is to process the input string, that is, to add, delete and replace operations, as long as the string does not change much after filtering, it can be basically judged that the sink position is likely to have a vulnerability. This embodiment uses the above characteristics before and after string filtering to construct a staged vulnerability identification method to determine whether a vulnerability may exist, and then decide whether to perform the next step of fuzzy testing. As shown in Figure 2, the staged vulnerability identification method of this embodiment is divided into three stages, and the detailed process is as follows:

A. Substring determination stage: Determine whether the input string at the taint is a substring of the string input at the input source. If it is a substring and the length of the matching part is greater than the preset threshold, it is directly determined that there is a vulnerability at the current position, and the corresponding HTTP parameter point can input a valid vulnerability payload; otherwise, it proceeds to the string similarity determination stage. That is, if it is only a rough match, such as the string is replaced or added, it cannot be determined whether there is a vulnerability, and the next stage (string similarity determination stage) needs to be performed.

B. String similarity judgment stage: Calculate the distance between the input source string A and the tainted string B (specifically, the Levenshtein distance can be used) to evaluate whether the number of strings required to change from the input source string A to the tainted string B meets the threshold condition. If the threshold condition is met, it is determined that the input source string A and the tainted string B are similar. Since there may be a filter function that replaces the vulnerability payload with a dangerous operation with a fixed string, it is still not possible to determine the existence of the vulnerability here after judging that the strings are similar, and it is necessary to continue to the next stage (comparison verification judgment stage) for judgment;

C. Comparison and verification stage: The detection module constructs two inputs for each parameter in the data packet, namely _A1 and _A2 , where _A2 is obtained by randomly modifying a specified number of characters in _A1 . The inputs A1 and A2 at the target parameter value are compared to see whether the values B1 and B2 corresponding to the entry into the stain are the same. If so, it is determined that there is no vulnerability at the target parameter position, otherwise it is determined that there is a vulnerability at the target parameter position.

In the above comparison, verification and discrimination stage, two similar inputs _A1 and _A2 are constructed at the same input point, where _A2 is obtained by randomly modifying the specified number of characters in _A1 , and the values _B1 and _B2 corresponding to the inputs _A1 and _A2 at the two parameter values are compared to see if they are the same. If they are the same, it means that a relatively strict filtering is encountered, and it can be basically considered that there is no vulnerability, and it is determined that there is no vulnerability. If they are not the same, it means that the difference in the input value at the parameter value will affect the stain, and it can be basically considered that there is a vulnerability here, that is, it is determined that there is a vulnerability.

This embodiment uses the above-mentioned phased vulnerability identification method to perform three-stage judgments on the string of the input source and the string at the taint in turn, namely, substring judgment, string similarity judgment, and comparison verification judgment. It can fully explore the change state of the string after filtering processing and realize accurate judgment on whether the vulnerability may exist. It can not only reduce the probability of missed reports, but also improve the efficiency of fuzz testing.

In this embodiment, step S03 includes:

S301. The fuzz testing engine will use a targeted chain mutation strategy to generate seeds according to the currently detected vulnerability type, and send the generated seeds to the Web server;

S302. During the process of sending the fuzz test request, monitor whether the vulnerability can be triggered. If it is determined that the vulnerability can be triggered and the vulnerability exists, output the vulnerability information and the request information that can trigger the vulnerability.

In step S04 of this embodiment, a chain mutation strategy is adopted to mutate the vulnerability payload according to the corresponding vulnerability type. Specifically, for the corresponding type of vulnerability, all operation types are first combined in different combinations to form a series of mutation operation combinations, thereby completing the mutation of the initial vulnerability payload and obtaining a mutation strategy chain L. The mutation strategy chain L is a list type, which includes all mutation operation combinations of the corresponding vulnerability type. These combinations can be used to generate diversified vulnerability payloads based on the initial vulnerability payload. Compared with the vulnerability payload mutated by only one mutation operation, it is more likely to bypass complex filtering conditions, thereby effectively completing the vulnerability triggering. On the basis of the mutation strategy chain L, invalid mutation combinations are further eliminated to form the final mutation strategy chain L. That is, the generation of the perfect mutation strategy chain L in this embodiment requires two steps. First, all the operation types are combined to obtain all the combination forms. Taking the operation types in Table 1 as an example, the initially formed mutation strategy chain Linit = {S0, S1, S2, ..., S1S2, S2S3, ..., S10S11, S12S13, ... S1S2S3, ...}; then, invalid mutation combinations are eliminated. For example, the combination of S1 and S2 in Table 1 is an unnecessary combination and there will be duplication, which can be eliminated, and finally a perfect mutation strategy chain L is obtained.

Table 1: Operation types in chain mutation strategy

The present invention realizes server-side request forgery vulnerability detection through a gray-box fuzz testing method guided by vulnerability information, and can quickly locate SSRF vulnerabilities using a phased vulnerability identification method, so that while feeding back the vulnerability to the user, the PoC of the SSRF vulnerability can be effectively triggered and the location information of the vulnerability in the code can be located, thereby helping users better understand security issues.

The server-side request forgery vulnerability detection device guided by vulnerability information in this embodiment includes:

A request construction module is used to construct a request to a Web application server and send it to the Web server;

An HTTP request parsing module is used to parse the captured request to the Web application server when capturing the request, parse out the input point in the request data packet and send it to the detection engine;

The phased vulnerability identification module is used to determine whether there is a vulnerability based on the input source string and the string at the taint when receiving the detection request sent by the detection engine to the Web server. If a vulnerability is determined to exist, the corresponding data packet and vulnerability type are fed back to the fuzz tester;

The fuzz tester is used to mutate the vulnerability payload according to the corresponding vulnerability type and send the mutated vulnerability payload to the Web server as the input of the corresponding function point of the Web application;

The vulnerability detection module is used to monitor whether the vulnerability is triggered during the process of the fuzz tester sending the fuzz test request to the Web server. If so, it determines that the vulnerability exists and outputs the vulnerability information and the request information that triggers the vulnerability.

The staged vulnerability identification method in the staged vulnerability identification module determines the existence of vulnerabilities by performing substring identification, string similarity identification and comparison verification identification on the input source string and the string at the stain in sequence. The substring identification stage determines whether the input string at the stain is a substring of the input source string. The string similarity stage determines the similarity between the strings. If the similarity condition is met, the comparison verification identification stage is entered. The comparison verification identification stage determines whether there is a vulnerability based on the comparison results of the input at each parameter value and the value at the stain.

The server-side request forgery vulnerability detection device based on vulnerability information guidance in this embodiment corresponds one to one with the above-mentioned server-side request forgery vulnerability detection method based on vulnerability information guidance, and will not be described one by one here.

This embodiment also provides a computer-readable storage medium storing a computer program, and the computer program implements the above method when executed.

The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims (8)

1. A server side request fake vulnerability detection method based on vulnerability information guidance is characterized by comprising the following steps:

S01, constructing a request for a Web application server and sending the request to the Web application server;

S02, when the HTTP request to the Web application server is captured, analyzing the captured HTTP request, analyzing an input point in a request data packet and then sending the input point to a detection engine;

S03, judging whether a vulnerability exists according to the character string of an input source and the character string at a stain by using a staged vulnerability judging method when an HTTP detection request sent to a Web server by a detection engine is received, and feeding back a data packet corresponding to the vulnerability and the vulnerability type to a fuzzy tester if the vulnerability exists;

S04, the fuzzy tester mutates the vulnerability load according to the corresponding vulnerability type, and the mutated vulnerability load is sent to the Web server to serve as input of the corresponding function point of the Web application;

S05, monitoring whether the vulnerability is triggered in the sending process of sending a fuzzy test request to the Web server by the fuzzy tester, if so, judging that the vulnerability exists, and outputting vulnerability information and request information for triggering the vulnerability;

The staged vulnerability distinguishing method judges the situation of the vulnerability through sequentially executing three stages of sub-string distinguishing, string similarity distinguishing and comparison checking distinguishing on the strings of the input source and the strings of the stain, wherein the stage of sub-string distinguishing judges whether the input strings of the stain are the sub-strings of the input source or not, the stage of string similarity distinguishing the similarity among the strings, and if the similarity condition is met, the stage of comparison checking distinguishing is shifted to the stage of comparison checking distinguishing, and the stage of comparison checking distinguishing judges whether the vulnerability exists or not according to the input of each parameter value and the comparison result of the stain value;

Judging whether the input character string at the stain is a sub-string of the character string input at the input source or not when the sub-string judging stage is executed, if so, judging that the current position has a loophole and judging that the corresponding HTTP parameter point inputs a valid loophole load; otherwise, switching to a stage of executing the character string similarity discrimination;

And when the character string similarity judging stage is executed, calculating the distance from the character string A of the input source to the character string B at the taint position to evaluate whether the number of character strings which are required to be added and deleted and are changed from the character string A of the input source to the character string B at the taint position meets the threshold condition, and judging that the character string A of the input source is similar to the character string B at the taint position if the number of character strings which are required to be added and deleted and are changed from the character string A of the input source to the character string B at the taint position meets the threshold condition.

2. The method for detecting a falsified vulnerability of a server-side request based on vulnerability information guidance according to claim 1, wherein when the comparison verification and discrimination stage is performed, two different inputs are constructed for each parameter in a data packet, and whether a vulnerability exists in a current position is determined according to whether values of two input corresponding to two input positions at two parameter values entering a stain position are the same.

3. The method for detecting the falsification vulnerability of the server side request based on the vulnerability information guidance according to claim 2, wherein two inputs of each parameter structure in the data packet are a ₁ and a ₂ respectively, wherein a ₂ is obtained by randomly modifying a specified number of characters in a ₁ , comparing whether values B1 and B2 of the input A1 and A2 at the target parameter value, which correspond to the input enter the stain, are the same, if yes, determining that the vulnerability does not exist at the target parameter position, otherwise determining that the vulnerability exists at the target parameter position.

4. The method for detecting the falsified vulnerability of the server request based on the vulnerability information guidance of claim 1, wherein the mutating the vulnerability load according to the corresponding vulnerability type in step S04 comprises: all operation types are combined according to different combination modes to obtain all combination modes to form a variation strategy chain L, and invalid combinations are removed to form a final variation strategy chain L.

5. The method for detecting falsification of a server request based on guidance of vulnerability information according to any one of claims 1 to 4, wherein the step S01 includes:

S101, extracting sitemap data from a Web application source code by adopting static analysis, and constructing a preliminary sitemap;

s102, taking the sitemap constructed in the step S101 as a state sensing crawler input, and carrying out interactive crawler according to the sitemap and each page of the Web application to construct an effective request for a Web application server;

and S103, sending the request constructed in the step S102 to the Web server.

6. The method for detecting falsification of a server request based on guidance of vulnerability information according to any one of claims 1 to 4, wherein the step S02 includes:

S201, capturing a request sent to a Web server by a stake pocket, and feeding the captured request back to an HTTP request analysis module for analysis;

And S202, the HTTP request analysis module analyzes the input points corresponding to the parameters in the request, marks the input points in the request data packet, and sends the analyzed data to the detection engine.

7. A server request fake vulnerability detection device based on vulnerability information guidance is characterized by comprising:

The request construction module is used for constructing a request for the Web application server and sending the request to the Web server;

The HTTP request analysis module is used for analyzing the captured request when the request to the Web application server is captured, analyzing an input point in a request data packet and sending the input point to the detection engine;

The staged vulnerability discrimination module is used for judging whether a vulnerability exists or not by using a staged vulnerability discrimination method according to the character string of the input source and the character string at the stain when a detection request sent to the Web server by the detection engine is received, and feeding back a data packet corresponding to the vulnerability and the vulnerability type to the fuzzy tester if the vulnerability exists;

the fuzzy tester is used for mutating the vulnerability load according to the corresponding vulnerability type and sending the mutated vulnerability load to the Web server to serve as the input of the corresponding function point of the Web application;

The vulnerability detection module is used for monitoring whether the vulnerability is triggered or not in the sending process of sending the fuzzy test request to the Web server by the fuzzy tester, if so, judging that the vulnerability exists, and outputting vulnerability information and request information for triggering the vulnerability;

The staged vulnerability distinguishing method in the staged vulnerability distinguishing module judges the situation of the vulnerability through sequentially executing three stages of sub-string distinguishing, string similarity distinguishing and comparison checking distinguishing on the strings of the input source and the strings of the stain, wherein the sub-string distinguishing stage judges whether the input strings of the stain are sub-strings of the input source or not, the string similarity distinguishing stage judges the similarity among the strings, and if the similarity condition is met, the comparison checking distinguishing stage is shifted to execute the comparison checking distinguishing stage, and the comparison checking distinguishing stage judges whether the vulnerability exists or not according to the comparison result of the input of each parameter value and the stain value; judging whether the input character string at the stain is a sub-string of the character string input at the input source or not when the sub-string judging stage is executed, if so, judging that the current position has a loophole and judging that the corresponding HTTP parameter point inputs a valid loophole load; otherwise, switching to a stage of executing the character string similarity discrimination; and when the character string similarity judging stage is executed, calculating the distance from the character string A of the input source to the character string B at the taint position to evaluate whether the number of character strings which are required to be added and deleted and are changed from the character string A of the input source to the character string B at the taint position meets the threshold condition, and judging that the character string A of the input source is similar to the character string B at the taint position if the number of character strings which are required to be added and deleted and are changed from the character string A of the input source to the character string B at the taint position meets the threshold condition.

8. A computer readable storage medium storing a computer program, characterized in that the computer program, when executed, implements the method according to any one of claims 1-6.