CN112446030B - Method and device for detecting file uploading vulnerability of webpage end - Google Patents

Abstract

The present invention discloses a method and device for detecting loopholes in file uploading on a web page. The method includes: obtaining a first file extension that meets the requirements of a file upload interface; generating a file with the first file extension so that the file can be uploaded to File upload interface, and use the packet capture tool to intercept the file upload request of the file upload interface; load the common file name extension library and select a second file extension different from the first file extension to replace the first file in the file upload request extension, re-upload the modified file upload request; in response to receiving the successful response information of the file upload request, send the file execution request based on the default file path corresponding to the file upload interface, and respond to the execution characteristics of the file execution request received information and determine that there is a file upload vulnerability. The invention can greatly improve the work efficiency of safety evaluation and the coverage of file upload interface.

Description

A method and device for detecting file upload vulnerabilities on a web page

technical field

The present invention relates to the field of security, and more specifically, to a method and device for detecting loopholes in file uploading on a web page.

Background technique

With the development of big data, cloud computing and artificial intelligence technology, the Web (web page) applications developed by major Internet companies have been continuously upgraded and updated, and their functions have been continuously improved. As a normal business requirement and the most basic function on the web side, the file upload function is increasingly used in user interaction interfaces of web applications. However, the file upload function has always had many security risks, usually because the type and content of uploaded files are not strictly filtered and checked, so that attackers can obtain server permissions by uploading malicious files, so the damage caused by file upload vulnerabilities Often devastating. There are restrictions on exploiting file upload vulnerabilities. First of all, malicious files must be able to be successfully uploaded, and secondly, uploaded files must be able to be executed.

Traditional file upload vulnerability detection methods have a low detection rate and cannot cover all file upload interfaces of web applications, and some file upload interfaces clearly indicate on the page that there is no type restriction on uploaded files.

Aiming at the problems of low vulnerability detection rate and less coverage of file upload interface in the prior art, there is no effective solution at present.

Contents of the invention

In view of this, the purpose of the embodiments of the present invention is to propose a file upload vulnerability detection method and device on the webpage, which can traverse all file upload interfaces for automatic inspection, and greatly improve the security evaluation work efficiency and the coverage of file upload interfaces.

Based on the above purpose, the first aspect of the embodiment of the present invention provides a web page file upload vulnerability detection method, including the following steps:

Based on the prompt information on the web page, use the page automation tool to determine the file upload interface that needs to perform file extension verification, and obtain the first file extension that meets the requirements of the file upload interface;

Generate a file with the first file extension to upload the file to the file upload interface using the page automation tool, and intercept the file upload request of the file upload interface using the packet capture tool;

Loading a common file name extension library and selecting a second file extension different from the first file extension to replace the first file extension in the file upload request, and re-uploading the modified file upload request;

In response to receiving the successful response information of the file upload request, the file execution request is sent based on the default file path corresponding to the file upload interface, and in response to receiving the execution feature information of the file execution request, it is determined that there is a file upload vulnerability.

In some implementations, acquiring the first file extensions that meet the requirements of the file upload interface includes: acquiring file types that meet the requirements of the file upload interface, and determining one or more first file extensions based on the file types.

In some embodiments, selecting a second file extension different from the first file extension from the commonly used file name extension library includes: removing one or more first file extensions from the common file name extension library, and selecting a second file extension from the common file name extension library. The remaining extensions are selected one at a time as the second file extension.

In some embodiments, the second file extension is used to replace the first file extension in the file upload request, and re-uploading the modified file upload request includes: replacing the file upload with the selected second file extension each time The first file extension in the request, and re-upload the modified file upload request for each selected second file extension, respectively, until the selected second file extension has traversed the remaining extensions.

In some implementations, generating the file with the first file extension includes: generating unique identification information based on a random number generator, and writing the unique identification information into the file; receiving the execution characteristic information of the file execution request includes: receiving the file The execution response information of the execution request is executed, and character matching is performed in the execution response information to obtain the unique identification information as the execution characteristic of the file.

In some embodiments, the random number generator is configured to generate true random numbers or pseudo-random numbers.

In some embodiments, both the file upload request and the file execution request are HTTP requests.

The second aspect of the embodiment of the present invention provides a file upload vulnerability detection device on the web page, including:

processor; and

The memory stores program code executable by the processor, and the program code performs the following steps when executed:

Based on the prompt information on the web page, use the page automation tool to determine the file upload interface that needs to perform file extension verification, and obtain the first file extension that meets the requirements of the file upload interface;

Generate a file with the first file extension to upload the file to the file upload interface using the page automation tool, and intercept the file upload request of the file upload interface using the packet capture tool;

Loading a common file name extension library and selecting a second file extension different from the first file extension to replace the first file extension in the file upload request, and re-uploading the modified file upload request;

In response to receiving the successful response information of the file upload request, the file execution request is sent based on the default file path corresponding to the file upload interface, and in response to receiving the execution feature information of the file execution request, it is determined that there is a file upload vulnerability.

In some embodiments, selecting a second file extension different from the first file extension from the commonly used file name extension library includes: removing one or more first file extensions from the common file name extension library, and selecting a second file extension from the common file name extension library. The remaining extensions are selected one at a time as the second file extension.

Replace the first file extension in the file upload request with a second file extension, re-uploading the modified file upload request includes replacing the first file in the file upload request with each selected second file extension extension, and re-upload the modified file upload request for each selected second file extension, respectively, until the selected second file extension has traversed the remaining extensions.

In some implementations, generating the file with the first file extension includes: generating unique identification information based on a random number generator, and writing the unique identification information into the file; receiving the execution characteristic information of the file execution request includes: receiving the file Execute the execution response information of the request, and perform character matching in the execution response information to obtain the unique identification information as the execution characteristic of the file; wherein the random number generator is configured to generate true random numbers or pseudo-random numbers.

The present invention has the following beneficial technical effects: the method and device for detecting file upload vulnerabilities at the webpage end provided by the embodiment of the present invention can determine the file upload interface that needs to perform file extension verification by using the page automation tool based on the prompt information on the webpage end, and obtain the The first file extension required by the file upload interface; generate a file with the first file extension to use the page automation tool to upload the file to the file upload interface, and use the packet capture tool to intercept the file upload request of the file upload interface; load common files name extension library and select a second file extension different from the first file extension therefrom to replace the first file extension in the file upload request, and re-upload the modified file upload request; in response to receiving the success of the file upload request The technical solution of sending a file execution request based on the default file path corresponding to the file upload interface in response to the information, and determining the existence of a file upload vulnerability in response to receiving the execution characteristic information of the file execution request, can traverse all file upload interfaces for automatic inspection, greatly greatly Improve security assessment work efficiency and coverage of file upload interface.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of a method for detecting file upload vulnerabilities at the webpage provided by the present invention;

FIG. 2 is a detailed flow chart of the method for detecting file upload vulnerabilities at the webpage provided by the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are to distinguish two entities with the same name but different parameters or parameters that are not the same, see "first" and "second" It is only for the convenience of expression, and should not be construed as a limitation on the embodiments of the present invention, which will not be described one by one in the subsequent embodiments.

Based on the above purpose, the first aspect of the embodiments of the present invention proposes an embodiment of a method for detecting file upload vulnerabilities on the webpage side through automatic inspection of all file upload interfaces. FIG. 1 shows a schematic flowchart of a method for detecting file upload vulnerabilities at the webpage provided by the present invention.

The file upload vulnerability detection method on the web page, as shown in Figure 1, includes the following steps:

Step S101, using the page automation tool to determine the file upload interface that needs to perform file extension verification based on the prompt information on the web page, and obtain the first file extension that meets the requirements of the file upload interface;

Step S103, generating a file with a first file extension to upload the file to the file upload interface using the page automation tool, and intercepting the file upload request of the file upload interface using the packet capture tool;

Step S105, loading the commonly used file name extension library and selecting a second file extension different from the first file extension to replace the first file extension in the file upload request, and re-uploading the modified file upload request;

Step S107, in response to receiving the successful response information of the file upload request, send the file execution request based on the default file path corresponding to the file upload interface, and determine that there is a file upload vulnerability in response to receiving the execution characteristic information of the file execution request.

The invention provides a detection tool based on Web application security, traverses and reads all file upload interfaces of Web application security, grabs the corresponding HTTP request, and replaces the file name in the request information with other unknown file names , send it again and check whether the HTTP response information is normal. If the file is successfully uploaded, it is necessary to further verify the vulnerability utilization, access the malicious file, and finally determine whether there is a file upload vulnerability in the tested web application.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct relevant hardware to complete. The program can be stored in a computer-readable storage medium, and the program can be executed when , may include the flow of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM) and the like. The computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

In some implementations, acquiring the first file extensions that meet the requirements of the file upload interface includes: acquiring file types that meet the requirements of the file upload interface, and determining one or more first file extensions based on the file types.

In some embodiments, selecting a second file extension different from the first file extension from the commonly used file name extension library includes: removing one or more first file extensions from the common file name extension library, and selecting a second file extension from the common file name extension library. The remaining extensions are selected one at a time as the second file extension.

In some embodiments, the second file extension is used to replace the first file extension in the file upload request, and re-uploading the modified file upload request includes: replacing the file upload with the selected second file extension each time The first file extension in the request, and re-upload the modified file upload request for each selected second file extension, respectively, until the selected second file extension has traversed the remaining extensions.

In some implementations, generating the file with the first file extension includes: generating unique identification information based on a random number generator, and writing the unique identification information into the file; receiving the execution characteristic information of the file execution request includes: receiving the file The execution response information of the execution request is executed, and character matching is performed in the execution response information to obtain the unique identification information as the execution characteristic of the file.

In some embodiments, the random number generator is configured to generate true random numbers or pseudo-random numbers.

In some embodiments, both the file upload request and the file execution request are HTTP requests.

The specific implementation manner of the present invention will be further described below according to the specific embodiment shown in FIG. 2 .

As shown in Figure 2, a device based on page automation tools is firstly designed, which can traverse all file upload interfaces of the tested Web application as a super administrator. Page automation is a tool that can read into test suites, execute tests and record test results, and simulate real user operations, including browsing pages, clicking links, entering text, submitting forms, triggering mouse events, etc. Perform various verifications. In other words, as long as the expected user behavior and results are described in the test case, a functional test suite that can be run automatically will be obtained.

According to the prompt information on the front end of the page, filter out the file upload interfaces that need to be verified by file type, and obtain the file type specified by each interface, that is, the file extension that meets the requirements of the interface. File extensions, also known as file extensions, are a mechanism used by the operating system to mark file types. Extensions are an integral part of every file. If a file doesn't have an extension, the operating system can't handle the file and can't figure out what to do with the file. Files in the operating system are divided into many types according to different formats and purposes. For the convenience of management and identification, when naming files, they are distinguished by extensions, that is, the format of file names is: "main file name. extension". In this way, the type of the file can be determined according to the extension of the file, so as to know its format and purpose.

Generate a file that meets the file type requirements of different file upload interfaces in the second step, and upload it to the corresponding file upload interface. Use the packet capture tool to capture the file upload HTTP request information of each file upload interface. A packet capture tool is a software that intercepts and views the content of network data packets. Useful information can be obtained by analyzing the captured data packets. The computer realizes the dissemination of data in the network by uploading and downloading some data packets to and from the network. Packet capture tools can help save these data packets. If these data packets are transmitted in plain text or their encryption method can be known, then the content of these data packets and their purpose can be analyzed.

Load the commonly used file extension library, according to the file type specified by each interface obtained in the second step, determine the file extensions in the commonly used file extension library that do not meet the requirements of the interface, and use the HTTP captured in the third step File extensions in the request information are replaced with those file extensions that do not meet the requirements of this interface. Every time it is replaced, try to resend the HTTP request until all file extensions that do not meet the requirements of the interface are traversed. The commonly used file extension library collects file extensions corresponding to all commonly used file types, and saves them in the database in a data structure recognizable by computer language, so as to be used in computer programs.

Judge the HTTP response information after resending the HTTP request in step 4. If the response information is normal, it means that a malicious file that does not meet the file type requirements has been successfully uploaded.

It is not enough to successfully upload a malicious file, further validation of the exploit is required. According to the default file path corresponding to each file upload interface, try to access the malicious file through HTTP request. Here, a random number generator is used in advance, and it is used as the unique identification information of the malicious file. After sending the file access request, the returned HTTP response information is matched. If the unique identification information is matched, it means that the access The malicious file is successful, and there is a file upload vulnerability.

Wherein, the random number generator outputs random numbers. Random numbers are used in different techniques of statistics. There are many different ways to generate random numbers. These methods are called random number generators. The most important feature of a random number is that the subsequent number has nothing to do with the previous number when it is generated. Random numbers are divided into true random numbers and pseudo-random numbers. True random numbers are generated using physical phenomena: such as throwing coins, dice, wheels, noise using electronic components, nuclear fission, etc. Such random number generators are called physical random number generator. Pseudo-random numbers are generated by a fixed, repeatable calculation method. Random numbers generated by computers or calculators have a long periodicity. They are not truly random, since they can actually be calculated, but they have statistical characteristics similar to random numbers, and such generators are called pseudo-random number generators.

The embodiment of the present invention utilizes a large number of automation technologies. Through the page automation tool, the operation of manual file upload is simulated, all file upload interfaces of the tested Web application are traversed, and according to the prompt information at the front end of the page, it is judged which interfaces are most suitable for the uploaded file. Types have restrictions on which interfaces need to be inspected. Then, the request information of the interface is automatically intercepted by the packet capture tool, and the request information is converted into a data type recognizable by the computer language. Then import the commonly used file extension library, and only need a simple computer cycle statement structure to replace all malicious file extensions and traverse all interfaces to be tested for automatic inspection. It greatly improves the work efficiency of the security evaluation personnel, and improves the coverage of the web application file upload interface.

It can be seen from the above embodiments that the file upload vulnerability detection method on the web page provided by the embodiment of the present invention uses page automation tools to determine the file upload interface that needs to perform file extension verification by using the page automation tool based on the prompt information on the web page, and obtains the files that meet the file upload requirements. The first file extension required by the interface; generate a file with the first file extension to use the page automation tool to upload the file to the file upload interface, and use the packet capture tool to intercept the file upload request of the file upload interface; load common file name extensions The library selects a second file extension different from the first file extension to replace the first file extension in the file upload request, and re-uploads the modified file upload request; in response to receiving a successful response message for the file upload request The technical solution for sending a file execution request based on the default file path corresponding to the file upload interface, and judging the existence of a file upload vulnerability in response to receiving the execution feature information of the file execution request, can traverse all file upload interfaces for automatic inspection, greatly improving security Evaluate work efficiency and coverage of file upload interface.

It should be pointed out that the various steps in the various embodiments of the method for detecting file upload vulnerabilities at the webpage end can be crossed, replaced, added, and deleted. Methods should also belong to the protection scope of the present invention, and the protection scope of the present invention should not be limited to the examples.

Based on the above purpose, the second aspect of the embodiments of the present invention proposes an embodiment of a file upload vulnerability detection device at the web page that traverses all file upload interfaces for automatic inspection. The file upload vulnerability detection device on the web page includes:

processor; and

The memory stores program code executable by the processor, and the program code performs the following steps when executed:

Based on the prompt information on the web page, use the page automation tool to determine the file upload interface that needs to perform file extension verification, and obtain the first file extension that meets the requirements of the file upload interface;

Generate a file with the first file extension to upload the file to the file upload interface using the page automation tool, and intercept the file upload request of the file upload interface using the packet capture tool;

Loading a common file name extension library and selecting a second file extension different from the first file extension to replace the first file extension in the file upload request, and re-uploading the modified file upload request;

In response to receiving the successful response information of the file upload request, the file execution request is sent based on the default file path corresponding to the file upload interface, and in response to receiving the execution feature information of the file execution request, it is determined that there is a file upload vulnerability.

In some embodiments, selecting a second file extension different from the first file extension from the commonly used file name extension library includes: removing one or more first file extensions from the common file name extension library, and selecting a second file extension from the common file name extension library. The remaining extensions are selected one at a time as the second file extension.

Replace the first file extension in the file upload request with a second file extension, re-uploading the modified file upload request includes replacing the first file in the file upload request with each selected second file extension extension, and re-upload the modified file upload request for each selected second file extension, respectively, until the selected second file extension has traversed the remaining extensions.

In some implementations, generating the file with the first file extension includes: generating unique identification information based on a random number generator, and writing the unique identification information into the file; receiving the execution characteristic information of the file execution request includes: receiving the file Execute the execution response information of the request, and perform character matching in the execution response information to obtain the unique identification information as the execution characteristic of the file; wherein the random number generator is configured to generate true random numbers or pseudo-random numbers.

It can be seen from the above embodiments that the file upload vulnerability detection device on the web page provided by the embodiment of the present invention uses page automation tools to determine the file upload interface that needs to perform file extension verification by using the page automation tool based on the prompt information on the web page, and obtains the files that meet the requirements of file upload. The first file extension required by the interface; generate a file with the first file extension to use the page automation tool to upload the file to the file upload interface, and use the packet capture tool to intercept the file upload request of the file upload interface; load common file name extensions The library selects a second file extension different from the first file extension to replace the first file extension in the file upload request, and re-uploads the modified file upload request; in response to receiving a successful response message for the file upload request The technical solution for sending a file execution request based on the default file path corresponding to the file upload interface, and judging the existence of a file upload vulnerability in response to receiving the execution feature information of the file execution request, can traverse all file upload interfaces for automatic inspection, greatly improving security Evaluate work efficiency and coverage of file upload interface.

It should be pointed out that the above-mentioned embodiment of the file upload vulnerability detection device on the web page uses the embodiment of the file upload vulnerability detection method on the web page to specifically illustrate the working process of each module. Those skilled in the art can easily think of the following: These modules are applied to other embodiments of the file upload vulnerability detection method at the web page. Certainly, since each step in the embodiment of the file upload vulnerability detection method on the webpage can be crossed, replaced, added, and deleted, these reasonable permutations and combinations are also applicable to the file upload vulnerability detection device on the webpage. It should belong to the protection scope of the present invention, and should not limit the protection scope of the present invention to the embodiments.

The above are the exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications can be made without departing from the scope of the disclosed embodiments of the present invention defined in the claims. The functions, steps and/or actions of the method claims in accordance with the disclosed embodiments described herein need not be performed in any particular order. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in an individual form, they may also be understood as a plurality unless explicitly limited to a singular number.

Those of ordinary skill in the art should understand that: the discussion of any of the above embodiments is exemplary only, and is not intended to imply that the scope (including claims) disclosed by the embodiments of the present invention is limited to these examples; under the idea of the embodiments of the present invention , technical features in the above embodiments or in different embodiments can also be combined, and there are many other changes in different aspects of the embodiments of the present invention as described above, which are not provided in details for the sake of brevity. Therefore, within the spirit and principle of the embodiments of the present invention, any omissions, modifications, equivalent replacements, improvements, etc., shall be included in the protection scope of the embodiments of the present invention.

Claims (9)

1. A method for detecting a file uploading vulnerability of a webpage end is characterized by comprising the following steps of:

determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;

generating a file with the first file extension to upload the file to the file uploading interface by using the page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;

loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and uploading the modified file uploading request again;

responding to successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and responding to execution characteristic information of the received file execution request to judge that a file uploading vulnerability exists;

wherein generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into the file;

the receiving of the execution characteristic information of the file execution request includes: execution response information of the file execution request is received, and performing character matching in the execution response information obtains the unique identification information that is an execution feature of the file.

2. The method of claim 1, wherein obtaining the first file extension meeting the requirements of the file upload interface comprises: and acquiring the file type meeting the requirements of the file uploading interface, and determining one or more first file extensions based on the file type.

3. The method of claim 1, wherein selecting a second file extension from the common filename extension repository that is different from the first file extension comprises: and removing one or more first file extensions from the common file name extension library, and selecting one of the rest of the file extensions as the second file extension at a time.

4. The method of claim 3, wherein replacing the first file extension in the file upload request with a second file extension, wherein re-uploading the modified file upload request comprises: and replacing the first file extension in the file uploading request with the second file extension selected each time respectively, and uploading the modified file uploading request again aiming at the second file extension selected each time respectively until the second file extension selected traverses the rest extensions.

5. The method of claim 1, wherein the random number generator is configured to generate true random numbers or pseudo random numbers.

6. The method of claim 1, wherein the file upload request and the file execution request are both HTTP requests.

7. The utility model provides a leak detection device is uploaded to file of webpage end which characterized in that includes:

a processor; and

a memory storing program code executable by the processor, the program code when executed performing the steps of:

determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;

generating a file with the first file extension to upload the file to the file uploading interface by using the page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;

loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and uploading the modified file uploading request again;

responding to successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and responding to execution characteristic information of the received file execution request to judge that a file uploading vulnerability exists;

wherein generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into the file;

the receiving of the execution characteristic information of the file execution request includes: execution response information of the file execution request is received, and performing character matching in the execution response information obtains the unique identification information as an execution feature of the file.

8. The apparatus of claim 7, wherein selecting a second file extension from the common filename extension library that is different from the first file extension comprises: removing one or more first file extensions from a common file name extension library, and selecting one of the remaining extensions as the second file extension at a time;

replacing the first file extension in the file upload request with a second file extension, the re-uploading the modified file upload request comprising: and replacing the first file extension in the file uploading request with the second file extension selected each time respectively, and uploading the modified file uploading request again aiming at the second file extension selected each time respectively until the second file extension selected traverses the rest extensions.

9. The apparatus of claim 7, wherein the random number generator is configured to generate a true random number or a pseudo random number.

Images