CN110765464A - Vulnerability detection method, device, device and computer storage medium - Google Patents

Abstract

The invention relates to the technical field of financial technology (Fintech), and discloses a vulnerability detection method. The method includes: establishing a test case corresponding to an interface of a website to be tested; The test parameters are integrated to obtain the target parameters; all process events in the website host are obtained according to the preset socket netlink and the target parameters, and each of the process events and the test cases are matched in turn; If there is a target process event matching the test case in the process event, it is detected whether the process chain corresponding to the target process event satisfies the preset condition; if so, it is determined that there is a loophole in the interface of the website to be tested. The invention also discloses a vulnerability detection device, equipment and a computer storage medium. The present invention improves the efficiency of vulnerability detection.

Description

Vulnerability detection method, device, device and computer storage medium

technical field

The present invention relates to the technical field of financial technology (Fintech), and in particular, to a method, apparatus, device and computer storage medium for vulnerability detection.

Background technique

With the development of computer technology, more and more technologies (big data, distributed, blockchain, artificial intelligence, etc.) are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology (Fintech). The security and real-time requirements of the industry also put forward higher requirements for technology. For example, the current common vulnerability detection is only effective for command injection and code execution vulnerability identification of websites with significant status response packets (such as status code, returned page content), but for command injection and code execution without echoes, the discovery rate is low. , the false positive rate is high, resulting in low detection effect. In addition, the traditional non-echo command injection and code execution vulnerability detection case design usually uses API functions such as system delay waiting and network request to enhance the feature status returned by the detection point. However, on the one hand, the above detection methods are limited by network stability restrictions, and on the other hand, they may bring real attacks to normal services, which makes vulnerability detection very inefficient. Therefore, how to improve the efficiency of vulnerability detection has become an urgent technical problem to be solved.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide a vulnerability detection method, device, equipment and computer storage medium, aiming at improving the efficiency of vulnerability detection.

In order to achieve the above object, the present invention provides a vulnerability detection method, the vulnerability detection method comprises the following steps:

establishing a test case corresponding to the interface of the website to be tested, and integrating the test case and the parameters to be tested of the interface of the website to be tested to obtain target parameters;

Obtain all process events in the website host according to the preset socket netlink and the target parameters, and sequentially match each of the process events with the test case;

If there is a target process event matching the test case in each of the process events, detecting whether the process chain corresponding to the target process event satisfies a preset condition;

If satisfied, it is determined that there is a loophole in the interface of the website to be tested.

Optionally, the step of obtaining all process events in the website host according to the preset netlink and the target parameter, including:

A monitoring rule is configured on the website host based on the target parameter, and all process events in the website host are acquired through the monitoring rule and a preset netlink.

Optionally, the step of configuring monitoring rules for the website host based on the target parameters, and obtaining all process events in the website host through the monitoring rules and a preset netlink, includes:

Based on the target parameters, monitoring rules are configured for the application state in the website host, and the monitoring rules are transmitted to the kernel state in the website host through a preset netlink;

Obtain system call events of all application programs running in the website host through the kernel thread in the kernel state and the monitoring rules, and obtain all process events in the website host based on the system call events.

Optionally, the step of acquiring all process events in the website host based on each of the system call events includes:

Feedback each of the system call events from the kernel state to the application state, and parse each of the system call events according to the network control protocol in the application state, to determine the system call events in each of the system call events. Whether there is a system call event that meets the preset detection requirements;

If it exists, the system call event that meets the preset detection requirements will be regarded as the process event.

Optionally, the step of detecting whether the process chain corresponding to the target process event satisfies a preset condition includes:

Obtain the parent process corresponding to the target process event, determine the process chain corresponding to the target process event based on the parent process, and detect whether there is dynamic script parsing process information of the website host in the process chain;

If it does not exist, it is determined that the process chain corresponding to the target process event does not satisfy the preset condition.

Optionally, after the step of detecting whether there is dynamic script parsing process information of the website host in the process chain, the process includes:

If it exists, obtain the whitelist pre-stored in the website host, and sequentially match the target process event with all the historical records in the whitelist;

If there is no target history record matching the target process event in each of the history records, it is determined that the process chain corresponding to the target process event satisfies a preset condition.

Optionally, after the step of sequentially matching each of the process events with the test case, it includes:

If there is no target process event matching the test case in each of the process events, it is determined that there is no loophole in the interface of the website to be tested.

In addition, in order to achieve the above object, the present invention also provides a vulnerability detection device, the vulnerability detection device includes:

an acquisition module, used for establishing a test case corresponding to the interface of the website to be tested, and integrating the test case and the parameters to be tested of the interface of the website to be tested to obtain target parameters;

a matching module, configured to obtain all process events in the website host according to the preset socket netlink and the target parameters, and sequentially match each of the process events with the test case;

a detection module, configured to detect whether a process chain corresponding to the target process event satisfies a preset condition if there is a target process event matching the test case in each of the process events;

The determining module is used for determining that there is a loophole in the interface of the website to be tested if it is satisfied.

In addition, in order to achieve the above object, the present invention also provides a vulnerability detection device, the vulnerability detection device includes: a memory, a processor and a vulnerability detection program stored on the memory and executable on the processor, When the vulnerability detection program is executed by the processor, the steps of the vulnerability detection method as described above are implemented.

In addition, in order to achieve the above object, the present invention also provides a computer storage medium, the computer storage medium stores a vulnerability detection program, and the vulnerability detection program implements the steps of the vulnerability detection method as described above when the vulnerability detection program is executed by a processor.

The present invention obtains target parameters by establishing a test case corresponding to the interface of the website to be tested, and integrating the test case and the parameters to be tested of the interface of the website to be tested; The target parameter obtains all process events in the website host, and sequentially matches each of the process events with the test case; if there is a target process event matching the test case in each of the process events, then detect the Whether the process chain corresponding to the target process event satisfies the preset condition; if so, it is determined that there is a loophole in the interface of the website to be tested. By integrating the test case and the parameters to be tested of the website interface to be tested, the target parameters are obtained, and all the process events in the website host are obtained according to the netlink and target parameters, and the target process events are determined in all the process events, so that the It is necessary to determine whether the website host has a significant status response packet, and then the target process event can be obtained, which improves the efficiency of vulnerability detection of the website interface to be tested. In order to further improve the detection accuracy, it is also necessary to determine whether the target process event meets the requirements. If the preset conditions are satisfied, it is determined that there is a vulnerability in the interface of the website to be tested, thereby improving the accuracy of vulnerability detection.

Description of drawings

1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention;

FIG. 2 is a schematic flowchart of the first embodiment of the vulnerability detection method of the present invention;

3 is a schematic diagram of a device module of the vulnerability detection device of the present invention;

4 is a schematic flowchart of process information determination in the vulnerability detection method of the present invention;

5 is a schematic flowchart of the vulnerability detection method of the present invention;

FIG. 6 is a schematic diagram of the interaction between the host application state and the kernel state in the vulnerability detection method of the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

As shown in FIG. 1 , FIG. 1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention.

The vulnerability detection device in the embodiment of the present invention may be a PC or a server device, on which a Java virtual machine runs.

As shown in FIG. 1 , the vulnerability detection device may include: a processor 1001 , such as a CPU, a network interface 1004 , a user interface 1003 , a memory 1005 , and a communication bus 1002 . Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (eg, a WI-FI interface). The memory 1005 may be high-speed RAM memory, or may be non-volatile memory, such as disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the device structure shown in FIG. 1 does not constitute a limitation on the device, and may include more or less components than the one shown, or combine some components, or arrange different components.

As shown in FIG. 1 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module and a vulnerability detection program.

In the device shown in FIG. 1 , the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the user interface 1003 is mainly used to connect to the client (client) and perform data communication with the client; and the processor 1001 can be used to call the vulnerability detection program stored in the memory 1005, and perform operations in the vulnerability detection method described below.

Based on the above hardware structure, an embodiment of the vulnerability detection method of the present invention is proposed.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of the first embodiment of the vulnerability detection method of the present invention, and the method includes:

Step S10, establishing a test case corresponding to the interface of the website to be tested, and integrating the test case and the parameters to be tested of the interface of the website to be tested to obtain target parameters;

At present, when vulnerability detection is carried out, it is generally by providing command injection, code execution various test cases, and then sending a large number of constructed HTTP requests to the target website, analyzing the content returned by the page and the response time of the website, and determining whether the website interface is There are command injection and code execution vulnerabilities. However, when this operation is used for command injection and code execution without echo (the website has no significant status response packet), the discovery rate is very low, and the false positive rate is high. Therefore, in this embodiment, when testing through an automated vulnerability scanner or manual testing, the test request sent by the interface of the website to be tested should include in advance command operations that may be executed by the vulnerability point, test cases for network operation behaviors, and use the netlink kernel mode. 、Apply state communication mechanism to implement command operations and network connection event records at injection points suspected to exist on the website. If the use case execution is successfully monitored during the audit process, and the parent process that calls it through traversal execution has the identity of command injection and code execution attribute, it can be determined that there is a vulnerability in the interface of the website to be tested. In this way, the effect of effectively discovering loophole injection points with echoes (response packets with significant status of the website, such as status codes, returned page content, etc.) and without echoes can be realized. And in this embodiment, the application state and the kernel state are the system architecture divisions of the Linux operating system. Code execution is executed by invoking server website code, while command injection is executed by invoking operating system commands. And the final effect of code execution and command injection will execute external malicious commands on the target cluster. Netlink is a set of Linux kernel interfaces that can be used for inter-process communication, communication between the Linux kernel and user space processes, and between user processes.

When performing vulnerability detection and receiving the test request sent by the interface of the website to be tested, the test case framework module can be used to construct the test case corresponding to the interface of the website to be tested, that is, the test case of pre-framed detection command injection and code execution. . And the common command injection and code execution vulnerability trigger point will be at the interface parameter. In this embodiment, it is mainly applied to the system original command operation and network connection functions, but is not limited to these. For example, using "sleep (Sleep function can make A computer program (process, task, or thread) goes to sleep, making it inactive for a period of time)", "cat /etc/passwd (means to read the contents of the /etc/passwd file to the screen)", " curl (cURL is a file transfer tool that uses URL syntax to work under the command line)", "system (whoami)" and other test cases, and integrate the constructed test cases with the parameters to be tested of the website interface to be tested (such as Replace and splice the test case to the parameter position to be tested) to obtain the target parameter, and send the target parameter to the network packet, that is, send it to the website host. The target parameter is the parameter to be tested with the test case in the interface of the website to be tested.

Step S20, obtaining all process events in the website host according to the preset socket netlink and the target parameter, and sequentially matching each of the process events with the test case;

After obtaining the target parameters and sending the target parameters to the website host, you also need to access the netlink (socket) audit event monitoring service. And because the Linux kernel has provided a connector module and a process event event collection mechanism, and the Netlink protocol supports NETLINK_AUDIT, providing an interface for the user audit subsystem. Therefore, it is only necessary to use the NETLINK_AUDIT mechanism in the application mode to implement a lightweight custom NCP (netlink connector process) application, and to intercept all process creation and network connection events of the host. That is to say, according to the netlink and target parameters set in advance, the execution command operation and network connection event record of the suspected injection point in the website host, that is, the process event, are obtained. Specifically, since the test cases in the target parameters include command functions such as cat/etc/passwd and curl, it is necessary to monitor the system calls of native execve (execution file) and socket (socket). Therefore, monitoring rules can be configured for the management process of the application state in the website host according to the target parameters, and the kernel state can be notified by means of netlink. After the kernel-mode kauditd obtains the monitoring rules through netlink and loads them, all applications on the host will pass the kauditd process when making system calls and returning network requests, so each application can be called through the monitoring rules. , When the network request returns, the corresponding events are recorded and sent back to the NCP application in the application state through the netlink. The NCP application will parse these events, and determine to capture the cat command operation event in the test case, and the read file parameter is /etc/passwd, or capture the process network request event, and the corresponding request If the target is qq.com, it can be considered that the suspected test case was executed by the system call at the vulnerable interface. That is, after obtaining all process events, match each process event with the test case in turn. If there is a match between the target process event and the test case, it can be considered that the suspected test case was executed by the vulnerable interface. The system call. Among them, the test case refers to the description of the test task for a specific software product, and reflects the test plan, method, technology and strategy. Process events are system call events with network connections, command operations, etc., and system call events are event records when an application makes a system call and returns a network request.

Step S30, if there is a target process event matching the test case in each of the process events, then detect whether the process chain corresponding to the target process event satisfies a preset condition;

When there is a target process event matching the test case in each process event, it is also necessary to check whether the target process event satisfies the preset conditions, that is, it is determined that the target process event is called by the interface of the website to be tested, not by other interfaces. , and determine whether the target process event is one of the whitelists, and then perform different operations according to different determination results. Therefore, when the target process event is acquired, in order to further improve the detection accuracy, it is also necessary to determine the identity attribute of the target process event.

Among them, the way to judge the identity attribute may be to obtain the dynamic script parsing process information started by the website service webserver (web server). The pid of the corresponding process (that is, an id number that identifies the currently running process in Linux and Unix). And keep traversing the monitored parent process of executing the system call process until the systemd process, so as to obtain the process chain corresponding to the target process, and then determine whether there is dynamic script parsing process information in this process chain, such as php-fpm, tomcatjava process, if If yes, then determine whether the target process event is a member of the website host whitelist, and if so, determine that there is a vulnerability in the interface of the website to be tested. However, if there is no dynamic script information in the process chain, it is determined that there is no loophole in the interface of the website to be tested, and the detection stops. Wherein, the dynamic script parsing process information may be total process information after the website webpage is opened through the interface of the website to be tested.

The target process event is detected according to the process chain to determine whether there is a vulnerability in the interface of the website to be tested, as shown in the following table, that is, when the process pid of the cat/etc/passwd process is 1123, and its parent process is 850, The process chain is 1123->850->…->62->1, and since the process pid of the php-fpm dynamic parsing engine is 62, the parent process is 1, and the process chain is 850->1, it can be clearly obtained There is a process pid of the php-fpm dynamic parsing engine in the process chain corresponding to the cat/etc/passwd process, so it can be considered that the cat/etc/passwd process is suspected to have loopholes. For other application processes such as: spp_bsp_offline_ctrl The process pid is 5891, If the parent process is 1091, and the process chain is 5891->1091->34->19->1, it will not be considered, that is, it is considered that it does not exist and will be ignored.

In addition, in order to assist understanding in determining the identity attribute of the target process event, an example is given below. For example, as shown in Figure 4, during vulnerability detection on the interface of the website under test, when netlink monitors that the system executes cat/etc/passwd, it obtains the cat/etc/passwd process information, and traverses the parent process that calls the process information. , so as to obtain the process chain corresponding to the process information, and determine whether there is a php-fpm process pid: 40 in the process chain (that is, all process information running on the host, such as other applications, kernel processes, website dynamic script parsing processes, other Application process, etc.), and when it is found that the php-fpm process pid: 40 does not exist in the process chain, it is determined that no vulnerability has been found, but if it is found that the php-fpm process pid: 40 exists in the process chain, it is obtained. list, and determine whether the cat/etc/passwd process information exists in the whitelist. If it exists, it is determined that no vulnerability has been found. If it does not exist, it is determined that a vulnerability has been found.

Step S40, if satisfied, it is determined that there is a loophole in the interface of the website to be tested.

When it is determined that the target process event meets the preset condition, it can be determined that there is a vulnerability in the interface of the website to be tested. However, when it is determined that the target process event does not meet the preset conditions, it can be determined that there is no loophole in the interface of the website to be tested. In addition, in order to help understand the principle of vulnerability detection for the interface of the website to be tested, an example is given below.

For example, as shown in Figure 5, after determining the normal URL interface /? When Id=1, you can construct test cases, such as cat/etc/passwd; curl qq.com. And splice the test case into the URL interface to be tested, ie /? id = cat /etc/passwd; /? id=curlqq.com. After the splicing is completed, a data packet is formed, and the data packet is sent to the website host, and then the website host accesses the audit service, that is, the operation behavior data of the host is collected through the netlink event recording module to obtain all the command operation behavior of the system, network Connect events, and use cat/etc/passwd; curl qq.com as the judgment condition to judge these command operation behaviors and network connection events in the correlation judgment module. If it does not match the preset monitoring command line behavior, stop the detection. , and make sure that the URL interface is free of vulnerabilities. However, if the execution of use cases such as cat/etc/passwd is monitored, and the parent process of executing the use case is found to be the dynamic script parsing process information started by the website webserver (web server), it can be determined that there is a loophole in the id parameter, that is, the URL interface exists. Vulnerability.

In this embodiment, a test case corresponding to the interface of the website to be tested is established, and the test case and the parameters to be tested of the interface of the website to be tested are integrated to obtain target parameters; netlink and the target parameter obtain all process events in the website host, and sequentially match each of the process events with the test case; if there is a target process event matching the test case in each of the process events, Then it is detected whether the process chain corresponding to the target process event satisfies the preset condition; if so, it is determined that there is a loophole in the interface of the website to be tested. By integrating the test case and the parameters to be tested of the website interface to be tested, the target parameters are obtained, and all the process events in the website host are obtained according to the netlink and target parameters, and the target process events are determined in all the process events, so that the It is necessary to determine whether the website host has a significant status response packet, and then the target process event can be obtained, which improves the efficiency of vulnerability detection of the website interface to be tested. In order to further improve the detection accuracy, it is also necessary to determine whether the target process event meets the requirements. If the preset conditions are satisfied, it is determined that there is a vulnerability in the interface of the website to be tested, thereby improving the accuracy of vulnerability detection.

Further, based on the first embodiment of the vulnerability detection method of the present invention, a second embodiment of the vulnerability detection method of the present invention is proposed. This embodiment is the step S20 of the first embodiment of the present invention, the refinement of the steps of acquiring all the process events in the website host according to the preset netlink and the target parameter, including:

In step a, a monitoring rule is configured on the website host based on the target parameter, and all process events in the website host are acquired through the monitoring rule and a preset netlink.

When the target parameters are obtained and sent to the website host, since the target parameters contain test cases, and the test cases contain command functions such as cat/etc/passwd and curl, it is necessary to monitor the system calls of native execve and socket. That is to say, it is necessary to configure monitoring rules for the management process of the application state in the website host according to the target parameters, and pass this monitoring rule to the kernel state of the website host through the preset netlink, so that the kernel state can obtain all applications in the website host according to this monitoring rule. The program records the event records when the system calls and network requests are returned, and passes them to the application state, so that these event records can be parsed in the application state, and the process events of network connections and command operations can be obtained.

In this embodiment, monitoring rules are configured for the website host according to target parameters, and all process events in the website host are acquired through the monitoring rules, thereby ensuring the accuracy of the acquired process events.

Specifically, the steps of configuring monitoring rules for the website host based on the target parameters, and acquiring all process events in the website host through the monitoring rules and a preset netlink, include:

Step b, based on the target parameter, configure monitoring rules for the application state in the website host, and transfer the monitoring rules to the kernel state in the website host through a preset netlink;

After configuring the monitoring rules for the application state in the website host according to the target parameters, it is also necessary to pass the monitoring rules to the kernel state in the website host by means of the preset netlink, so that the kernel state can obtain each process event in the website host according to the monitoring rules.

Step c, obtain system call events of all application programs running in the website host through the kernel thread in the kernel state and the monitoring rules, and obtain all process events in the website host based on each of the system call events .

After the kauditd (kernel thread) in the kernel state obtains the monitoring rules sent by the application state through netlink and completes the loading, since all applications in the website host are running (such as system calls, network request returns), they will pass kauditd. process, so the kauditd process can record the corresponding events according to the monitoring rules to obtain system call events, and pass these system call events to the application state through netlink, so that the application state can obtain all the website host in these system call events. Process events.

In this embodiment, the monitoring rules are configured in the application state in the website host, and the monitoring rules are transmitted to the kernel state in the website host, and all process events of the website host are obtained through the kernel state, so as to avoid missing some processes. events, ensuring the accuracy of the acquired process events.

Specifically, the steps of acquiring all process events in the website host based on each of the system call events include:

Step e, feedback each of the system call events from the kernel state to the application state, and analyze each of the system call events according to the network control protocol in the application state to determine each of the system call events Whether there is a system call event that meets the preset detection requirements in the call event;

After each system call event is fed back from the kernel state to the application state, that is, after the NCP application in the application state receives each system call user event, it parses these system call events to determine whether there are any system call events that meet the expectations. Set detection requirements (such as determining whether there is a network connection, system call events for command operations), and perform different operations according to different determination results.

In step f, if it exists, the system call event that meets the preset detection requirements is used as the process event.

When it is determined that there is a system call event that meets the preset detection requirement in each system call event, the system call event that meets the preset detection requirement is regarded as a process event. However, if there is no system call event that meets the preset requirements in each system call event, the detection is continued, and a new system call event is acquired.

In addition, in order to assist the understanding of the process event acquired in the network host in this embodiment, an example is given below.

For example, as shown in Figure 6, the host application mode and the kernel mode are divided to obtain the application user mode and the system kernel mode. The website business interface in the user mode executes the cat/etc/paswd, curl qq.com system functions, and Make a system call, and register the monitoring audit rules for the kauditd kernel process according to the audit netlink in the system kernel mode. Since the network, disk, and process execution process in the host all pass through the kauditd kernel process, you can obtain system calls according to the kauditd kernel process. / The network request returns the event, and feeds it back to the user mode, that is, the network control protocol application monitoring program in the application user mode obtains the process event through netlink, and returns the system call event corresponding to cat through netlink monitoring.

In this embodiment, each system call event is parsed according to the network control protocol in the application state to acquire the process event, thereby ensuring the accuracy of acquiring the process event.

Further, based on any one of the first to second embodiments of the vulnerability detection method of the present invention, a third embodiment of the vulnerability detection method of the present invention is proposed. This embodiment is step S30 of the first embodiment of the present invention, and the step of detecting whether the process chain corresponding to the target process event satisfies the preset condition is refined, including:

Step h, obtaining the parent process corresponding to the target process event, determining a process chain corresponding to the target process event based on the parent process, and detecting whether there is dynamic script parsing process information of the website host in the process chain;

Obtain the parent process corresponding to the target process event (that is, the previous process of the target process event), and then calculate the process chain corresponding to the target process event according to the parent process. At the same time, it is also necessary to obtain the dynamic script parsing process information of the website host. And detect whether there is dynamic script parsing process information of the website host in the process chain, and perform different operations based on different detection results.

In step k, if it does not exist, it is determined that the process chain corresponding to the target process event does not satisfy the preset condition.

When it is determined that there is a dynamic script parsing process information of the website host in the process chain, it is also necessary to determine whether the target process event is a member of the website host whitelist. If not, determine that the process chain corresponding to the target process event satisfies With preset conditions, it can be determined that there are loopholes in the interface of the website to be tested. However, if the dynamic script parsing process information of the website host does not exist in the process chain, it is determined that the process chain corresponding to the target process event does not meet the preset conditions, and it can also be determined that there is no loophole in the interface of the website to be tested.

In this embodiment, by obtaining the process chain corresponding to the target process event, and determining whether there is dynamic script parsing process information in the process chain, that is, determining whether the target process event is invoked by the website interface to be tested, the vulnerability is improved. detection accuracy.

Specifically, after the step of detecting whether there is a dynamic script parsing process information of the website host in the process chain, it includes:

Step m, if there is, then obtain the pre-stored whitelist in the website host, and sequentially match the target process event with all the historical records in the whitelist;

When it is judged that there is dynamic script parsing process information in the process chain, it is also necessary to obtain the whitelist pre-stored in the website host, because the whitelist contains the records of the normal function calls of the system by the historical website business, for example, there are calls in the business " cat/etc/passwd", so it is necessary to filter out this situation to avoid false positives. Only the records that do not hit the whitelist can be found to have command injection and code execution vulnerabilities in the interface of the website to be tested. That is, the target process event is matched with all the historical records in the whitelist (that is, the records of the historical website business on the normal function calling function of the system), and different operations are performed according to the matching results.

In step n, if there is no target history record matching the target process event in each of the history records, it is determined that the process chain corresponding to the target process event satisfies a preset condition.

When it is determined that there is no target history record matching the target process event in each history record, it can be determined that the process chain corresponding to the target process event satisfies the preset condition, that is, there is a loophole in the interface of the website to be tested. However, if there is a target history record matching the target process event in each history record, it can be determined that the process chain corresponding to the target process event does not meet the preset condition, that is, there is no loophole in the interface of the website to be tested.

In this embodiment, by determining whether the target process event matches the target history record in the whitelist, if not, it is determined that the process chain corresponding to the target process event satisfies the preset condition, thereby avoiding the occurrence of false positives in detection, Improves the accuracy of vulnerability detection.

Further, after the steps of sequentially matching each of the process events with the test cases, include:

Step x: If there is no target process event matching the test case in each of the process events, it is determined that there is no loophole in the interface of the website to be tested.

When it is determined that there is no target process event matching the test case in each process event, it can be determined that there is no loophole in the interface of the website to be tested, and the detection of the interface of the website to be tested is stopped.

In this embodiment, when it is determined that there is no target process event matching the test case in each process event, it is determined that there is no vulnerability in the interface of the website to be tested, thereby improving the accuracy of vulnerability detection.

The present invention also provides a vulnerability detection device, referring to FIG. 3 , the vulnerability detection device includes:

an acquisition module, used for establishing a test case corresponding to the interface of the website to be tested, and integrating the test case and the parameters to be tested of the interface of the website to be tested to obtain target parameters;

a matching module, configured to obtain all process events in the website host according to the preset socket netlink and the target parameters, and sequentially match each of the process events with the test case;

a detection module, configured to detect whether a process chain corresponding to the target process event satisfies a preset condition if there is a target process event matching the test case in each of the process events;

The determining module is used for determining that there is a loophole in the interface of the website to be tested if it is satisfied.

Optionally, the matching module is also used for:

A monitoring rule is configured on the website host based on the target parameter, and all process events in the website host are acquired through the monitoring rule and a preset netlink.

Optionally, the matching module is also used for:

Based on the target parameters, monitoring rules are configured for the application state in the website host, and the monitoring rules are transmitted to the kernel state in the website host through a preset netlink;

Obtain system call events of all application programs running in the website host through the kernel thread in the kernel state and the monitoring rules, and obtain all process events in the website host based on the system call events.

Optionally, the matching module is also used for:

Feedback each of the system call events from the kernel state to the application state, and parse each of the system call events according to the network control protocol in the application state, to determine the system call events in each of the system call events. Whether there is a system call event that meets the preset detection requirements;

If it exists, the system call event that meets the preset detection requirements will be regarded as the process event.

Optionally, the detection module is also used for:

Obtain the parent process corresponding to the target process event, determine the process chain corresponding to the target process event based on the parent process, and detect whether there is dynamic script parsing process information of the website host in the process chain;

If it does not exist, it is determined that the process chain corresponding to the target process event does not satisfy the preset condition.

Optionally, the detection module is also used for:

If it exists, obtain the whitelist pre-stored in the website host, and sequentially match the target process event with all the historical records in the whitelist;

If there is no target history record matching the target process event in each of the history records, it is determined that the process chain corresponding to the target process event satisfies a preset condition.

Optionally, the vulnerability detection device further includes:

If there is no target process event matching the test case in each of the process events, it is determined that there is no loophole in the interface of the website to be tested.

For the methods executed by the above program modules, reference may be made to the various embodiments of the vulnerability detection method of the present invention, which will not be repeated here.

The present invention also provides a computer storage medium.

A vulnerability detection program is stored on the computer storage medium of the present invention, and the vulnerability detection program implements the steps of the vulnerability detection method as described above when the vulnerability detection program is executed by the processor.

For the method implemented when the vulnerability detection program running on the processor is executed, reference may be made to the various embodiments of the vulnerability detection method of the present invention, which will not be repeated here.

It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on such understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as ROM/RAM) as described above. , magnetic disk, optical disk), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

Claims (10)

1. A vulnerability detection method is characterized by comprising the following steps:

establishing a test case corresponding to a website interface to be tested, and integrating the test case and parameters to be tested of the website interface to be tested to obtain target parameters;

acquiring all process events in a website host according to a preset socket netlink and the target parameters, and sequentially matching each process event with the test case;

if a target process event matched with the test case exists in each process event, detecting whether a process chain corresponding to the target process event meets a preset condition;

and if so, determining that the interface of the website to be tested has a bug.

2. The vulnerability detection method of claim 1, wherein the step of obtaining all process events in a website host according to a preset netlink and the target parameter comprises:

and configuring a monitoring rule for the website host based on the target parameter, and acquiring all process events in the website host through the monitoring rule and a preset netlink.

3. The vulnerability detection method of claim 2, wherein the step of configuring a monitoring rule for the website host based on the target parameter and acquiring all process events in the website host through the monitoring rule and a preset netlink comprises:

configuring a monitoring rule for an application state in the website host based on the target parameter, and transmitting the monitoring rule to a kernel state in the website host through a preset netlink;

and acquiring system calling events operated by all application programs in the website host through the kernel thread in the kernel state and the monitoring rule, and acquiring all process events in the website host based on the system calling events.

4. The vulnerability detection method of claim 3, wherein the step of obtaining all process events in the website host based on each of the system call events comprises:

feeding back each system calling event from the kernel state to the application state, and analyzing each system calling event according to a network control protocol in the application state to determine whether a system calling event meeting a preset detection requirement exists in each system calling event;

and if so, taking the system calling event meeting the preset detection requirement as a process event.

5. The vulnerability detection method of claim 1, wherein the step of detecting whether the process chain corresponding to the target process event meets a preset condition comprises:

acquiring a parent process corresponding to the target process event, determining a process chain corresponding to the target process event based on the parent process, and detecting whether dynamic script analysis process information of the website host exists in the process chain;

and if not, determining that the process chain corresponding to the target process event does not meet the preset condition.

6. The vulnerability detection method of claim 5, wherein after the step of detecting whether the dynamic script parsing process information of the website host exists in the process chain, the method comprises:

if yes, acquiring a white list prestored in the website host, and matching the target process event with all history records in the white list in sequence;

and if the target history record matched with the target process event does not exist in each history record, determining that the process chain corresponding to the target process event meets a preset condition.

7. The vulnerability detection method of any of claims 1-6, wherein the step of matching each of the process events to the test cases in sequence, after, comprises:

and if the target process event matched with the test case does not exist in the process events, determining that no vulnerability exists in the to-be-tested website interface.

8. A vulnerability detection apparatus, comprising:

the acquisition module is used for establishing a test case corresponding to a to-be-tested website interface and integrating the test case and to-be-tested parameters of the to-be-tested website interface to acquire target parameters;

the matching module is used for acquiring all process events in the website host according to a preset socket netlink and the target parameters and matching each process event with the test case in sequence;

the detection module is used for detecting whether a process chain corresponding to the target process event meets a preset condition or not if the target process event matched with the test case exists in each process event;

and the determining module is used for determining that the to-be-tested website interface has a bug if the to-be-tested website interface meets the requirement.

9. A vulnerability detection device, comprising: a memory, a processor and a vulnerability detection program stored on the memory and executable on the processor, the vulnerability detection program when executed by the processor implementing the steps of the vulnerability detection method according to any of claims 1 to 7.

10. A computer storage medium having stored thereon a vulnerability detection program which, when executed by a processor, implements the steps of the vulnerability detection method of any of claims 1-7.

Images