CN112738127B - Web-based website and host vulnerability detection system and method thereof - Google Patents

Abstract

The Web-based website and host vulnerability detection system comprises a target receiving module, a vulnerability detection module and a structure output module; the Web-based website and host vulnerability detection method comprises the following steps: step 1, selecting a vulnerability type to be detected; step 2, detecting the Sql injection vulnerability; step 3, XSS cross-site script attack detection; step 4, detecting a tomcat sample; step 5, shodan searching; 6, detecting unauthorized vulnerabilities of Redis; 7, detecting the Ftp unauthorized vulnerability; step 8, detecting an Ftp directory; step 9, detecting the unauthorized access vulnerability of the Docker; step 10, weblogic weak password scanning, and detection of the loophole can quickly find out threats existing in the system, prevent and repair the threats in time, so that the safety of the whole network is improved.

Description

Web-Based Web Site and Host Vulnerability Detection System and Its Method

technical field

The invention belongs to the technical field of computers, and in particular relates to a web-based website and host loophole detection system and a method thereof.

Background technique

The increasingly developed computer science and technology have brought great changes to people's lives, but at the same time of development, security issues are constantly emerging. Among them, the problem of security loopholes is relatively serious, and solving loophole detection is the top priority at present. In the process of computer development, the problem of security loopholes is a big obstacle. Once a security loophole occurs, it may cause irreparable losses. In recent years, attackers have exploited vulnerabilities to cause various harms to the society and have had a very bad impact. Among the security problems, the most prominent one is the problem of security loopholes. Therefore, solving loophole detection is the most important thing at present. In recent years, major Internet vulnerabilities have occurred frequently, causing great losses to society and companies. In the first half of 2018, Rising's "Cloud Security" system intercepted a total of 25.87 million virus samples, and the number of virus infections was 782 million times. Intercepted more than 380,000 attacks on websites linked to horses. Various loopholes and malicious code attacks have plagued the majority of users.

The main threats faced by websites and hosts include the following aspects: malicious attacks by hackers; defects in the configuration of websites and hosts themselves; deception by malicious websites; bad behavior of users and network staff.

At present, mainstream protection measures mainly focus on hardware security protection devices, and prevent attacks by setting security policies and configuring security rules in the devices. However, due to the limitations of policies and the ease of bypassing security policies, vulnerability detection becomes essential. The current mainstream vulnerability detection tools have disadvantages such as difficulty in expansion and resource consumption.

Contents of the invention

In order to overcome the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a Web-based website and host vulnerability detection system and method thereof. By detecting the loopholes, threats that exist in the system can be quickly discovered, prevented and repaired in time, thereby improving Security of the entire network.

In order to achieve the above object, the technical solution adopted in the present invention is: a Web-based website and host vulnerability detection system, including a target receiving module, a vulnerability detection module, and a structure output module;

The target receiving module inputs the target to be detected through the front-end page, selects the type of vulnerability to be detected, enters the vulnerability detection page, clicks on the vulnerability detection, and the detection target will be transmitted to the corresponding function code to enter the vulnerability detection module;

The vulnerability detection module, when the vulnerability detection module receives the vulnerability detection target transmitted by the front end, starts to perform vulnerability detection, first judges whether the detection target is a legitimate target, then performs vulnerability detection, and transmits the corresponding data according to the detection result to the result output module;

In the result output module, when the vulnerability detection is completed, the output module outputs the vulnerability situation and modification opinions on the page according to the received vulnerability detection result.

Web-based website and host vulnerability detection method, comprising the following steps:

Step 1, select the type of vulnerability to be detected, and enter the vulnerability detection page for detection;

Step 2, Sql injection vulnerability detection, enter the URL link to be detected, start the detection, and give the detected payload according to the detection result;

Step 3, XSS cross-site scripting attack detection, enter the detection page, enter the detection target URL, after the detection is completed, the result is output;

Step 4, Tomcat Example detection, input the detection target URL, after the detection is completed, the result is output;

Step 5, Shodan search, enter the service name, device name and other information to be searched, and start searching the corresponding information through Shodan;

Step 6, Redis unauthorized access vulnerability detection, by entering the IP address of the redis device according to the search results of Shodan, start detecting the Redis unauthorized access vulnerability;

Step 7, Ftp unauthorized vulnerability detection, first search the IP address of the network host with Ftp service through Shodan, according to the searched Ftp service host, detect whether there is an unauthorized access vulnerability, and output the detection result;

Step 8, Ftp directory detection, according to the Ftp unauthorized access detection results, scan its Ftp directory, you can get sensitive files;

Step 9, Docker unauthorized access vulnerability detection, enter the detection target, click Docker unauthorized access, and start the detection;

Step 10, Weblogic weak password scan, input detection target, through scanning, detect whether there is a weak password threat.

Described Sql injection vulnerability detection, when splicing is true statement after test target, page returns normally, is equal to original page; When splicing is false statement after test target, page returns error, therefore, suppose original page is page test, by splicing the true statement page test1 and the false statement test2 after the test target, if the spliced true statement page test1 is equal to the original page test, and not equal to the spliced false page test2, it can be determined that the URL has a SQL injection vulnerability.

The described Sql injection vulnerability detection comprises the following steps:

First, enter the detection target

Second, check whether the target URL is accessible, if not, then end, if so, go to the third step;

Third, splicing Payload in the detection target URL;

Fourth, judge whether the original webpage is equal to True, the webpage is not equal to Fail, whether the webpage test2 is, if not, there is no SQL vulnerability, and if so, there is an SQL vulnerability.

The described XSS cross-site scripting attack detection comprises the following steps:

Step 1, input detection target;

Step 2, check whether the target URL is accessible, if not, then end; if so, proceed to the next step;

Step 3, find parameters and replace Payload;

Step 4: Crawl the source code of the test page and search for the Payload. If not found, there is no XSS vulnerability. If found, there is an XSS vulnerability.

The Weblogic weak password scan described above, when detecting a Weblogic weak password, attempts to access the Weblogic background address and submit account password information in the form of POST. The default port number is: 7001, and the default background login address is: http://target IP address: 7001/console/j_security_check/ , the account information is the parameter: j_username , the password information is the parameter: j_password, traverse the user name and password by constructing the request, and access the page code information by crawling, if the code is found in the code:

'Oracle WebLogic Server Administration Console' and 'Home Page - base_domain - WLS Console'

Then it proves that the login page is found. If the login is successful, it means that the weak password exists, otherwise it means that no weak password information is found.

The Ftp unauthorized vulnerability detection described above uses the ftplib module of Python to create the ftp object FTP, uses the login method of FTP, uses the account number: anonymous, and the password is empty to detect anonymous login. If the login is successful, it indicates that there is an unauthorized login. Access vulnerability; otherwise, it proves that there is no FTP unauthorized access vulnerability on the host.

The above-mentioned Docker unauthorized access vulnerability detection is tested by using the docker module of Python. By creating an object client as docker.DockerClient(url), if the attempted access is successful, it indicates that there is a Docker unauthorized access vulnerability. Otherwise, the test target is This vulnerability does not exist.

The beneficial effects of the present invention are:

The invention establishes a safety testing method from multiple angles for testing, thereby quickly locating loopholes. Since vulnerabilities are the biggest threat in the development of the Internet, vulnerability detection has become quite important. Vulnerability detection is mainly divided into vulnerability detection for websites and vulnerability detection for hosts. The system of the present invention adopts the framework of B/S (browser/server) to design, according to the testing method of the loophole, simulates the attacker to test, if conforms to the vulnerability signature code, then it is identified as having the loophole. Use the method of black box testing to quickly discover the security vulnerabilities of websites and hosts. Through the detection of vulnerabilities, threats in the system can be quickly discovered, and timely prevention and repair can be performed, thereby improving the security of the entire network.

The system of the present invention is based on the B/S (browser/server) architecture, selects the MVC model design and develops it. Due to the adoption of the vulnerability detection module, it is easy to expand. The script unit test can be performed first. After the vulnerability detection function is successful, the system call can be added. The system is developed using Python language, which can quickly develop vulnerability detection scripts and easily expand the system vulnerability detection function; through actual testing, the detection function has been realized and the performance is good. From the overall point of view, it fully meets the design requirements. Due to the separation of front-end and back-end, the scalability is very high.

The invention detects the loopholes of the website and the host computer, and excavates the common loopholes existing in the website and the host computer. According to the detection results, relevant security repair suggestions are proposed to help improve the security of websites and hosts, and ensure that websites and hosts are free from attacks. By detecting the vulnerabilities of websites and hosts, the security awareness of relevant staff can be improved, so that they can avoid defects in the process of website construction and host configuration, which may lead to the possibility of websites and hosts being compromised. Common website vulnerabilities detected include: SQL injection attacks, XSS cross-site scripting attacks, CMS scanning, Weblogic weak password scanning, Tomcat Example scanning, etc. Common host vulnerabilities detected include: FTP unauthorized access, Docker unauthorized access, SSH weak password blasting, etc. Through the vulnerability detection of websites and hosts, prevent problems before they happen, and improve the system security level as a whole.

The system of the present invention mainly detects common website and host loopholes, and should ensure the diversity of loopholes, and comprehensively detect the security of websites and hosts; the system of the present invention adopts a B/S architecture, a graphical interface based on a Web interface, and has The operation is simple, the result is directly displayed on the page, intuitive and clear, and easy to use; the method of the invention has the characteristics of high efficiency and convenience. Vulnerability detection can effectively help repair the security problems of websites and hosts.

The invention solves the problem of loophole detection of the website and the host computer, discovers the vulnerability of the website and the host computer in advance, and makes a related repair plan to repair the loopholes, so as to ensure the safe operation of the website and the host computer.

Description of drawings

Fig. 1 is the functional block diagram of the system of the present invention.

Fig. 2 is a flow chart of the method of the present invention.

Fig. 3 is the flow chart of SQL injection vulnerability detection of the present invention.

Fig. 4 is a flow chart of XSS vulnerability detection in the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

Referring to Fig. 1, the web-based website and host vulnerability detection system includes a target receiving module, a vulnerability detection module, and a structure output module;

The target receiving module inputs the target to be detected through the front-end page, selects the type of vulnerability to be detected, enters the vulnerability detection page, clicks on the vulnerability detection, and the detection target will be transmitted to the corresponding function code to enter the vulnerability detection module;

The vulnerability detection module, when the vulnerability detection module receives the vulnerability detection target transmitted by the front end, starts to perform vulnerability detection, first judges whether the detection target is a legitimate target, then performs vulnerability detection, and transmits the corresponding data according to the detection result to the result output module;

In the result output module, when the vulnerability detection is completed, the output module outputs the vulnerability situation and modification opinions on the page according to the received vulnerability detection result.

Referring to Fig. 2, the web-based website and host vulnerability detection method includes the following steps:

Step 1, select the type of vulnerability to be detected, and enter the vulnerability detection page for detection;

Step 2, Sql injection vulnerability detection, enter the URL link to be detected, start the detection, and give the detected payload according to the detection result;

Step 3, XSS cross-site scripting attack detection, enter the detection page, enter the detection target URL, after the detection is completed, the result is output;

Step 4, Tomcat Example detection, input the detection target URL, after the detection is completed, the result is output;

Step 5, Shodan search, enter the service name, device name and other information to be searched, and start searching the corresponding information through Shodan;

Step 6, Redis unauthorized access vulnerability detection, by entering the IP address of the redis device according to the search results of Shodan, start detecting the Redis unauthorized access vulnerability;

Step 7, Ftp unauthorized vulnerability detection, similar to redis unauthorized detection , first search the IP address of the network host with Ftp service through Shodan, check whether there is an unauthorized access vulnerability according to the searched Ftp service host, and output the detection result ;

Step 8, Ftp directory detection, according to the Ftp unauthorized access detection results, scan its Ftp directory, you can get sensitive files;

Step 9, Docker unauthorized access vulnerability detection, enter the detection target, click Docker unauthorized access, and start the detection;

Step 10, Weblogic weak password scan, enter the detection target, and scan to detect whether there is a weak password threat.

Described Sql injection vulnerability detection, when splicing is true statement after test target, page returns normally, is equal to original page; When splicing is false statement after test target, page returns error, therefore, suppose original page is page test, by splicing the true statement page test1 and the false statement test2 after the test target, if the spliced true statement page test1 is equal to the original page test and not equal to the spliced false page test2, it can be determined that the URL has a SQL injection vulnerability.

Referring to Fig. 3, the described Sql injection vulnerability detection includes the following steps:

First, enter the detection target

Second, check whether the target URL is accessible, if not, then end, if so, go to the third step;

Third, splicing Payload in the detection target URL;

Fourth, judge whether the original webpage is equal to True, the webpage is not equal to Fail, whether the webpage test2 is, if not, there is no SQL vulnerability, and if so, there is an SQL vulnerability.

Referring to Figure 4, the described XSS cross-site scripting attack detection includes the following steps:

Step 1, input detection target;

Step 2, check whether the target URL is accessible, if not, then end; if so, proceed to the next step;

Step 3, find parameters and replace Payload;

Step 4: Crawl the source code of the test page and search for the Payload. If not found, there is no XSS vulnerability. If found, there is an XSS vulnerability.

The Weblogic weak password scan described above, when detecting a Weblogic weak password, attempts to access the Weblogic background address and submit account password information in the form of POST. The default port number is: 7001, and the default background login address is: http://target IP address: 7001/console/j_security_check/ , the account information is the parameter: j_username , the password information is the parameter: j_password, traverse the user name and password by constructing the request, and access the page code information by crawling, if the code is found in the code: 'Oracle WebLogic Server Administration Console' and 'HomePage - base_domain - WLS Console' prove that the login page is found. If the login is successful, it means that the weak password exists, otherwise it means that no weak password information is found.

The Ftp unauthorized vulnerability detection described above uses the ftplib module of Python to create the ftp object FTP, uses the login method of FTP, uses the account number: anonymous, and the password is empty to detect anonymous login. If the login is successful, it indicates that there is an unauthorized login. Access vulnerability; otherwise, it proves that there is no FTP unauthorized access vulnerability on the host.

The above-mentioned Docker unauthorized access vulnerability detection is tested by using the docker module of Python. By creating an object client as docker.DockerClient(url), if the attempted access is successful, it indicates that there is a Docker unauthorized access vulnerability. Otherwise, the test target is This vulnerability does not exist.

Claims (2)

1. The method for detecting the vulnerability of the website and the host based on the Web is characterized by comprising the following steps:

step 1, selecting a vulnerability type to be detected, and entering vulnerability detection page detection;

step 2, sql is injected into vulnerability detection, a URL link needing to be detected is input, the detection is started, and the detected payload is given according to the detection result;

the Sql injection vulnerability detection method comprises the following steps:

firstly, inputting a detection target;

secondly, detecting whether the target URL can be accessed, if not, ending, and if so, performing a third step;

thirdly, splicing Payload at the detection target URL;

fourthly, judging whether the original webpage is equal to True, the webpage is not equal to Fail, whether the webpage test2 is True, if not, no SQL loophole exists, and if yes, the SQL loophole exists;

the Sql injection vulnerability detection is carried out, when true sentences are spliced after the target is tested, the page returns to be normal and is equal to the original page; when the true statement page test1 is equal to the original page test and is not equal to the true statement page test2, judging that the URL has SQL injection vulnerability;

step 3, XSS cross-site script attack detection, entering a detection page, inputting a detection target URL, and outputting a result after the detection is finished;

the XSS cross-site scripting attack detection comprises the following steps:

inputting a detection target;

step two, detecting whether the target URL can be accessed, if not, ending; if yes, carrying out the next step;

step three, searching parameters to replace Payload;

crawling a test page source code, searching Payload, if not found, not having an XSS vulnerability, and if found, having an XSS vulnerability;

step 4, tomcat Example detection, inputting a detection target URL, and outputting a result after the detection is finished;

step 5, shodan searching, inputting the service name and equipment name information to be searched, and starting to search corresponding information through Shodan;

step 6, detecting the unauthorized vulnerability of Redis, inputting the IP address of the Redis equipment according to the Shodan searching result, and starting to detect the unauthorized vulnerability of Redis access;

7, detecting the Ftp unauthorized vulnerability, namely searching the IP address of the network host with the Ftp service through Shodan, detecting whether the searched Ftp service host has the unauthorized access vulnerability or not according to the searched Ftp service host, and outputting a detection result;

and (3) detecting the Ftp unauthorized vulnerability, establishing an Ftp object FTP by using an Ftp module of Python, and using an account number by using a logic method of the FTP: anonymous, the password is null, anonymous login is detected, if successful login, unauthorized access vulnerability exists; otherwise, proving that the host does not have FTP unauthorized access vulnerability;

step 8, detecting the Ftp directory, scanning the Ftp directory according to the detection result of unauthorized access of the Ftp, and acquiring a sensitive file;

9, detecting the Docker unauthorized access vulnerability, inputting a detection target, clicking Docker unauthorized access, and starting to detect the chuck degree;

detecting the Docker unauthorized access vulnerability, testing by using a Docker module of Python, and if the attempted access is successful, indicating that the Docker unauthorized access vulnerability exists, otherwise, indicating that the vulnerability does not exist in the test target;

step 10, weblogic weak password scanning, inputting a detection target, and detecting whether weak password threat exists or not through scanning;

the Weblogic weak password scanning is that when the Weblogic weak password is detected, account password information is submitted in a POST mode by trying to access a Weblogic background address, and the default port number is as follows: 7001, the default backstage supporter login address is: http:// target IP address 7001/console/j _ security _ check/, account information is parameter: j _ username, the password information is a parameter: j _ password, traversing user name and password by constructing request, accessing page code information by crawling, if the code is found in the code: the 'Oracle WebLogic Server Administration System' and the 'Home Page-base _ domain-WLS System' prove that a login Page is found, if the login is successful, the weak password exists, and otherwise, the weak password information is not found.

2. The special detection system for the Web-based website and host vulnerability detection method according to claim 1, comprising a target receiving module, a vulnerability detection module, a structure output module;

the target receiving module inputs a target to be detected through a front-end page, selects a vulnerability type to be detected, enters a vulnerability detection page, clicks vulnerability detection, and transmits the detection target to a corresponding function code to enter a vulnerability detection module;

the vulnerability detection module starts vulnerability detection after receiving a vulnerability detection target transmitted from the front end, firstly judges whether the detection target is a legal target, then detects the vulnerability, and transmits corresponding data to the result output module according to a detection result;

and the result output module outputs the vulnerability condition on the page and modifies the opinion according to the received vulnerability detection result after vulnerability detection is completed.

Images