JP5274401B2 - Management apparatus, management method, and program - Google Patents

Description

  The present invention relates to management of web applications, and more particularly to management of web applications in which a web application framework is used.

A web application is software that runs on a web server or application server. The web application is called from a web browser through the HTTP (HyperText Transfer Protocol) protocol, and the processing result is returned to the browser as HTML (HyperText Markup Language) to the user. Is to provide.
Invoking a Web application is performed by storing parameters at the time of calling, such as data input to a form by a user, in addition to a URL (Uniform Resource Locator) in an HTTP request and transmitting the parameters to a Web server.
In recent years, attacks that exploit security flaws (security holes or vulnerabilities) by storing illegal data in parameters and calling Web applications have increased.
As one of countermeasure techniques for such a security hole of a Web application, there is a Web application diagnosis technique for finding a security hole before being abused by performing a pseudo attack on the Web application.
In the Web application diagnosis technology, an HTTP request in which illegal data simulating an attack is set for each parameter is transmitted, and the presence or absence of a security hole is determined from the response.
At that time, in order to avoid parameter checking at the entrance of the Web application, it is common to perform inspection using illegal data of various character types and formats.
In order to increase the efficiency of the inspection, a method is known in which several patterns of data are transmitted in advance, a character set that passes the parameter check is specified, and only invalid data that passes the parameter check is transmitted (for example, patents). Reference 1).

JP 2008-135029 A

In recent years, development using a web application framework (hereinafter also simply referred to as “framework”) has become mainstream in order to improve the efficiency of web application development.
In development using a framework, the framework performs functions common to a plurality of Web applications, such as session management and control of page transition, so that there is an advantage that the developer can concentrate on the implementation of the processing that is originally desired.
In a web application using such a framework, a large amount of parameters necessary for the framework to operate are added to the HTTP request transmitted from the browser in addition to the parameters originally required by the web application. There is.
For example, FIG. 10 shows parameters (a total of nine parameters) transmitted by an HTTP request from a web page generated on a framework called DWR (Direct Web Remoting).
However, among these parameters, the only parameter that is actually passed to the program implemented by the developer is “Joe” in c0-param, and all the rest are processed in the framework.
Conventionally, all of these parameters are targeted for diagnosis, and a diagnosis is performed by applying a pseudo attack to each parameter.
However, the security holes of the framework are well verified by the vendors and security communities that provide the framework, and the diagnosis of the parameters consumed by the framework only wastes the diagnosis time.
In other words, conventionally, since the parameters of the framework and the parameters unique to the Web application are not distinguished, the diagnosis of the framework parameters that are originally unnecessary is performed. There is a problem in that useless computer resources are consumed.

  One of the main objects of the present invention is to solve the above-described problems, and one of the main objects is to improve the efficiency of diagnosis for Web applications.

The management device according to the present invention is:
A management device that communicates with a web application using a web application framework and manages the web application,
A discrimination information acquisition unit that acquires discrimination information from a discrimination information storage area that stores discrimination information used for discrimination of a web application framework;
A communication recording unit for recording communication with the Web application;
A framework determination unit that determines which Web application framework is used in the Web application using the communication record by the communication recording unit and the determination information acquired by the determination information acquisition unit; It is characterized by.

  In the present invention, it is possible to improve the efficiency of diagnosis for a Web application by determining the Web application framework used in the Web application and omitting the diagnosis for the determined Web application framework.

FIG. 3 is a diagram illustrating an example of a system configuration according to the first to fourth embodiments. The flowchart figure which shows the outline of operation | movement of the Web application diagnostic apparatus which concerns on Embodiment 1-4. The flowchart figure which shows the detail of operation | movement of the Web application diagnostic apparatus which concerns on Embodiment 1-4. The flowchart figure which shows the detail of operation | movement of the Web application diagnostic apparatus which concerns on Embodiment 1-4. FIG. 4 is a diagram showing an example of framework identification information according to the first embodiment. The figure which shows the example of the framework identification information which concerns on Embodiment 2. FIG. FIG. 10 shows an example of framework identification information according to the third embodiment. FIG. 10 is a diagram illustrating an example of framework identification information according to the fourth embodiment. The figure which shows the hardware structural example of the Web application diagnostic apparatus which concerns on Embodiment 1-4. The figure explaining a prior art.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a functional configuration of a Web application diagnostic apparatus 101 according to the present embodiment.
The web application diagnostic apparatus 101 is connected to the web server 110 on which the diagnostic target web application 111 is operating via the Internet (or IP network) 108.
The web application diagnostic apparatus 101 is an example of a management apparatus.

The diagnosis target Web application 111 uses any one of the Web application frameworks (hereinafter also referred to as a framework).
The web application diagnostic apparatus 101 manages the diagnostic target web application 111.
More specifically, the Web application diagnostic apparatus 101 determines which Web application framework is used in the diagnosis target Web application 111, and performs a pseudo attack on the Web application in correspondence with the determined Web application framework. To diagnose a security hole in the Web application.

  The Web application diagnosis apparatus 101 includes a conventional HTTP request transmission unit 105, an HTTP response reception unit 106, a template HTTP request generation unit 107, a pseudo attack generation unit 103, a security hole determination unit 102, a diagnosis result display unit 104, and a communication recording unit 114. In addition to the functions provided in the Web application diagnosis apparatus, a framework determination unit 112 and a framework identification information storage unit 113 are provided.

  The HTTP request transmission unit 105 has a function of transmitting an HTTP request to a server specified by the same address, with the server address on which the diagnosis target Web application 111 is operating and the HTTP request being input.

  Similarly, the HTTP response receiving unit 106 has a function of receiving an HTTP response from the diagnosis target Web application.

  The template HTTP request generation unit 107 has a function of generating an HTTP request that can be normally processed by a Web application.

The pseudo-attack generation unit 103 omits a pseudo-attack for diagnosing a security hole specific to the framework specified by the framework determination unit 112, which will be described later, and simulates a security hole in the diagnosis target Web application 111. Perform an attack.
As mentioned above, the security holes of the framework are fully verified by the vendors and security communities that provide the framework, and the diagnosis of parameters consumed by the framework only wastes diagnostic time. The generation unit 103 omits the pseudo attack on the parameters of the framework used in the diagnosis target Web application 111, and performs only the pseudo attack on the parameters unique to the diagnosis target Web application 111.

  The security hole determination unit 102 determines a security hole in the diagnosis target Web application 111 through a pseudo attack by the pseudo attack generation unit 103.

  The pseudo attack generation unit 103 and the security hole determination unit 102 are examples of a Web application diagnosis unit.

  The diagnosis result display unit 104 displays the security hole determination result by the security hole determination unit 102.

The framework determination unit 112 is a function that analyzes the text of an HTML or JavaScript (registered trademark) file acquired from the diagnosis target Web application 111 and identifies the framework used in the diagnosis target Web application 111.
The framework determination unit 112 is an example of a framework determination unit and a discrimination information acquisition unit.

The framework identification information accumulating unit 113 is a function for accumulating framework identification information (signature) for specifying a framework used in a Web application.
The framework identification information is information used for discrimination of the framework, and is an example of discrimination information.
The framework identification information storage unit 113 is an example of a discrimination information storage area.

The communication recording unit 114 records communication with the diagnosis target Web application 111.
Specifically, the communication between the diagnosis target Web application 111 and the HTTP request transmission unit 105 and the communication between the diagnosis target Web application 111 and the HTTP response reception unit 106 are recorded.

A schematic operation of the Web application diagnostic apparatus 101 will be described with reference to FIG.
First, the Web application diagnosis apparatus 101 causes the diagnosis practitioner to input the top page URL of the diagnosis target site (S202) and moves to the designated URL (S203).
Further, the Web application diagnosis apparatus 101 causes the diagnosis operator to move to the diagnosis target page, and records communication with the Web server from the top page to the diagnosis target page in the communication recording unit 114 (S204). .

Next, the Web application diagnosis apparatus 101 causes the diagnosis practitioner to designate a diagnosis target page (S205), and then operates the diagnosis target Web application 111.
The Web application diagnostic apparatus 101 records the communication with the Web server 110 generated by the operation of the diagnosis target Web application 111 by the diagnosis practitioner as the diagnosis target communication in the communication recording unit 114 (S206) (communication recording step).

The Web application diagnosis apparatus 101 instructs the diagnosis target to issue a diagnosis start instruction after the operation of the diagnosis target Web application 111 is finished (S207), and performs security diagnosis for the diagnosis target communication when the diagnosis start instruction is issued. To start.
In the security diagnosis, the Web application diagnosis apparatus 101 acquires the Web page received from the diagnosis target Web application 111 from the communication record with the Web server 110 generated by the operation of the diagnosis target Web application 111 (S208). The determination unit 112 acquires the frame identification information and collates it with the Web page to identify the framework used in the diagnosis target Web application 111 (S209) (discrimination information acquisition step) (framework determination step).
The operation for specifying the framework will be described in detail later.

When the specification of the framework is completed, the template HTTP request generation unit 107 generates an HTTP request as a template for generating an HTTP request for a pseudo attack to be transmitted to the diagnosis target Web application 111 (S210).
This HTTP request is normally processed by the Web application.
Next, the pseudo attack generation unit 103 specifies parameters to be diagnosed based on the specified framework information, and generates pseudo attack data from the generated HTTP request template (S211). This pseudo attack data is data for performing a pseudo attack on the parameters unique to the diagnosis target Web application 111 excluding the framework parameters.
Then, the security hole determination unit 102 diagnoses the diagnosis target Web application 111 using the created pseudo attack data (S212).
The details of the processing operation for specifying the parameter to be diagnosed, creating pseudo-attack data, and performing diagnosis are not mentioned in this specification.

Hereinafter, the operation for specifying the framework will be described.
FIG. 5 is a diagram illustrating an example of the framework identification information stored in the framework identification information storage unit 113.
The framework identification information storage unit 113 stores zero or more pieces of framework identification information.
Each framework identification information includes a framework name 402, a file type 404, a detailed designation 405, and a pattern character string 406.

As shown in FIG. 5, when the file type 404 is “HTML”, the detailed designation 405 is a collation target node condition and collation location in the HTML document represented by a syntax (such as XPath) designating a specific part. It is information for specifying
That is, the detailed designation 405 indicates a character string arrangement position in a Web page where a pattern character string 406 described later is arranged.

The pattern character string 406 is a regular expression character string for specifying a framework. The pattern character string is a character string used for discrimination of the framework, and is an example of a discrimination character string.
The framework name 402 represents the name of the framework being used.

The operation of the framework determination unit 112 specifying the framework will be described with reference to FIGS. 3 and 4.
The framework determination unit 112 extracts framework identification information from the framework identification information storage unit 113 (S302).
If there is no framework identification information to be extracted, the framework determination unit 112 determines that there is no corresponding framework, outputs “not applicable” (S313), and ends the processing (S314).
The framework determination unit 112 checks whether the file type 404 of the extracted framework identification information is the same as the file type to be diagnosed (S303). If the file type is the same, the file type is “HTML”. This is confirmed (S304).
In the present embodiment, the file type is always “HTML”.
If the file type 404 of the extracted framework identification information is different from the file type to be diagnosed, the framework determination unit 112 extracts the next framework identification information.

Next, the framework determination unit 112 confirms that the detailed specification 405 of the framework identification information is not empty (S305), and uses the detailed specification 405 described in the syntax for specifying a specific part in the XPath, and uses the detailed specification 405 The collation target part is extracted from (S306).
Then, the framework determination unit 112 performs matching with the pattern character string 406 of the framework identification information for each extracted portion (S307) (S308).
When the extracted part and the pattern character of the framework identification information match (YES in S309), the framework determination unit 112 outputs the framework name 402 of the framework identification information (S315) and ends the process. (S314).

When a plurality of verification locations are extracted, the framework determination unit 112 performs pattern matching on each of the extracted verification locations (S307 to S310).
If none of the extracted collation points matches the pattern, the framework determination unit 112 uses the following detailed designation.
In other words, when a plurality of detailed designations of the framework identification information are designated, the framework determination unit 112 extracts a collation location for each designated detailed designation, and for all the extracted collation locations. Pattern matching is performed (S306 to S311).
If none of the designated detailed designations matches the pattern, the framework determination unit 112 uses the next framework identification information.
The framework determination unit 112 individually collates a plurality of pieces of framework identification information (S302 to S312), and regards the first matching framework as the diagnosis target framework.

  As described above, in response to a response (web page file) from the diagnosis target web application, the collation in the HTML document represented by the syntax (such as XPath) that determines the file type of the web page and specifies a specific part. Based on the information that identifies the target node condition and the matching location, the matching location is extracted, and by determining whether it matches a specific pattern, the framework is identified and the pseudo attack data based on the framework information is created The effect is that it is possible to do.

  In other words, in the present embodiment, the framework used in the web application is determined using the communication record and the framework identification information, the diagnosis of the framework that has already been sufficiently verified is omitted, and the web It is possible to improve the efficiency of diagnosis for a Web application by performing a pseudo attack only on the parameters unique to the application.

In this embodiment, it is assumed that the framework identification information storage unit 113 functions in the same apparatus as the Web application diagnostic apparatus 101. However, the framework identification information storage unit 113 is a remote database server. Of course, it does not matter if it is stored.
Further, it is possible to obtain the framework identification information in the framework identification information storage unit 113 periodically from a remote distribution server so as to always correspond to the latest framework.

As described above, in the present embodiment,
In a Web application diagnostic apparatus that determines whether there is a security hole on the Web application by transmitting an HTTP request including pseudo attack data to a Web application to be diagnosed and analyzing an HTTP response that is a response to the HTTP request.
A web application diagnostic apparatus having a framework determination unit that identifies a framework name used by a web application from text included in a response from the web application has been described.

  In the present embodiment, a framework identification information storage unit that stores framework identification information that is referred to by the framework determination unit and that includes a framework name, one or a plurality of verification locations, and a pattern character string is stored. The web application diagnostic apparatus having the above has been described.

  Further, in the present embodiment, the Web application diagnosis apparatus has been described in which the collation part has a framework identification information storage unit in which framework identification information configured by a file type and detailed specification information unique to the file type is stored.

  In the present embodiment, the Web application diagnosis apparatus has been described in which the file type is HTML, and in the detailed specification, the collation target node condition and the collation location in the HTML document can be identified by the syntax for designating a specific part. .

Embodiment 2. FIG.
In the first embodiment, the operation of the framework determination unit when the framework identification information is composed of the framework name, file type, detailed designation, and pattern character string, and the file type is “HTML” has been described. .
In this embodiment, the framework identification information is composed of a framework name, a file type, and a pattern character string, and the file type is “HTML” (when the detailed setting 405 in FIG. 5 is omitted). ) Will be described.

FIG. 6 is a diagram showing an example of the framework identification information stored in the framework identification information storage unit 113 according to the present embodiment.
The framework identification information storage unit 113 stores zero or more pieces of framework identification information.
Each framework identification information includes a framework name 502, a file type 504, and a pattern character string 505.
The pattern character string 505 is a regular expression character string for specifying a framework, and is an example of a character string for determination.
The framework name 502 represents the name of the framework being used.

The operation of the framework determination unit 112 specifying the framework will be described with reference to FIGS. 3 and 4.
The framework determination unit 112 extracts framework identification information from the framework identification information storage unit 113 (S302).
If there is no framework identification information to be extracted, the framework determination unit 112 determines that there is no corresponding framework, outputs “not applicable” (S313), and ends the processing (S314).
The framework determination unit 112 checks whether the file type 504 of the extracted framework identification information is the same as the file type to be diagnosed (S303). If the file type is the same, the file type is “HTML”. This is confirmed (S304).
In the present embodiment, the file type is always “HTML”.
When the file type of the extracted framework identification information is different from the file type to be diagnosed, the framework determination unit 112 extracts the next framework identification information.

Next, the framework determination unit 112 confirms that the detailed designation of the framework identification information is empty (no detailed designation exists) (S305), and the pattern characters of the framework identification information for all the diagnosis target page files. Matching with the column 505 is performed (S316).
If the page file to be diagnosed matches the pattern character string 505 of the framework identification information, the framework determination unit 112 outputs the framework name 502 of the framework identification information (S315) and ends the process. (S314).

When there is no portion that matches the pattern character string 505 in the diagnosis target page file, the framework determination unit 112 uses the following framework identification information.
The framework determination unit individually collates a plurality of pieces of framework identification information (S302 to S312), and regards the first matched framework as the diagnosis target framework.

  As described above, the file type of the Web page is determined with respect to the response (Web page file) from the diagnosis target Web application, and it is determined whether there is a portion matching the specific pattern in the entire HTML file including the tag. Thus, there is an effect that it becomes possible to specify a framework and create pseudo attack data based on the framework information.

In this embodiment, it is assumed that the framework identification information storage unit 113 functions in the same apparatus as the Web application diagnostic apparatus 101. However, the framework identification information storage unit 113 is stored in a remote database server. Of course it does not matter.
Further, it is possible to obtain the framework identification information in the framework identification information storage unit 113 periodically from a remote distribution server so as to always correspond to the latest framework.

In addition, the framework identification information storage unit 113 shown in the present embodiment may be unified with the framework identification information storage unit 113 shown in the first embodiment.
In this case, the framework identification information used in the second embodiment is composed of the framework name, file type, empty detailed designation, and pattern character string.

  As described above, in the present embodiment, the Web application diagnosis apparatus has been described in which the collation portion includes the framework identification information storage unit in which the framework identification information configured by the file type is stored.

  Further, in the present embodiment, the Web application diagnosis apparatus has been described in which the file type is HTML and the entire HTML document including the tag is a collation target.

Embodiment 3 FIG.
In the first embodiment, the operation of the framework determination unit when the file type is “HTML” has been described. In the present embodiment, the operation of the framework determination unit when the file type is “JavaScript” (registered trademark) will be described.

In recent years, a Web application using a screen update technique based on asynchronous communication from a JavaScript (registered trademark) to a Web application called Ajax (Asynchronous JavaScript (registered trademark) And XML) is becoming widespread.
In Ajax, the format of parameters transmitted from JavaScript (registered trademark) to the Web application is not fixed, and the conventional Web diagnostic technology uses a unique format to send parameters using a unique attack (HTTP request) ) Cannot be generated.
In the present embodiment, a Web application diagnostic apparatus 101 corresponding to such a problem will be described.

FIG. 7 is a diagram showing an example of the framework identification information stored in the framework identification information storage unit 113 according to the present embodiment.
The framework identification information storage unit 113 stores zero or more pieces of framework identification information.
Each framework identification information includes a framework name 602, a file type 604, detailed designation 605, and a pattern character string 606.
As shown in FIG. 7, when the file type is “JavaScript” (registered trademark), the detailed designation 605 is a collation start line and a collation end line.
If the collation start line is omitted, the beginning of the file is designated. If the collation end line is omitted, the end of the file is designated.
The pattern character string 606 is a regular expression character string for specifying a framework, and is an example of a character string for determination.
The framework name 602 represents the name of the framework being used.

The operation of the framework determination unit 112 specifying the framework will be described with reference to FIGS. 3 and 4.
The framework determination unit 112 extracts framework identification information from the framework identification information storage unit 113 (S302).
If there is no framework identification information to be extracted, the framework determination unit 112 determines that there is no corresponding framework, outputs “not applicable” (S313), and ends the processing (S314).
The framework determination unit 112 checks whether the file type 604 of the extracted framework identification information is the same as the file type to be diagnosed (S303). If the file type is the same, the file type is “JavaScript” (registered). Trademark) (S318).
In the present embodiment, the file type is always “Java Script” (registered trademark).
If the file type 604 of the extracted framework identification information is different from the file type to be diagnosed, the framework determination unit 112 extracts the next framework identification information.

Next, the framework determination unit 112 confirms that the detailed designation of the framework identification information is not empty (S319), and collates from the diagnosis target page file in order from the collation start line designated by the detailed designation 605 of the framework identification information. A target row is extracted (S320).
Then, the framework determination unit 112 performs matching with the pattern character string 606 of the framework identification information for each extracted matching target line (S321).
When the matching target line and the pattern character string 606 of the framework identification information match, the framework determination unit 112 outputs the framework name 602 of the framework identification information (S315), and ends the process (S314). .
When the matching target line and the pattern character string 606 of the framework identification information do not match, the framework determination unit 112 designates the matching between the verification target line and the pattern character string 606 of the framework identification information by the detailed designation 605. The verification is completed until the matching end line (S320 to S323).
If it does not match the pattern character string 606 from the collation start line to the collation end line, the framework determination unit 112 uses the next framework identification information.
The framework determination unit 112 individually collates a plurality of pieces of framework identification information (S302 to S312), and regards the first matching framework as the diagnosis target framework.

  As described above, in response to a response (web page file) from the diagnosis target web application, the file type of the web page is discriminated, the lines from the collation start line to the collation end line are extracted, and whether or not a specific pattern is matched. By determining, it is possible to identify the framework and create pseudo attack data based on the framework information.

Although it is assumed that the framework identification information storage unit 113 in this embodiment functions in the same apparatus as the Web application diagnostic apparatus 101, the framework identification information storage unit 113 is stored in a remote database server. Of course.
Further, it is possible to obtain the framework identification information in the framework identification information storage unit 113 periodically from a remote distribution server so as to always correspond to the latest framework.
In addition, the framework identification information storage unit 113 shown in the present embodiment may be unified with the framework identification information storage unit 113 shown in the first embodiment.

  As described above, in the present embodiment, a Web application diagnosis apparatus having a framework identification information accumulation unit that is referred to by a framework determination unit and stores framework identification information composed of a framework name, a collation location, and a pattern character string. Explained.

  Further, in the present embodiment, the Web application diagnosis apparatus has been described in which the collation part has a framework identification information storage unit in which framework identification information configured by a file type and detailed specification information unique to the file type is stored.

  In the present embodiment, the Web application diagnosis apparatus has been described in which the file type is JavaScript (registered trademark) and the collation start line and the collation end line can be specified.

Embodiment 4 FIG.
In the third embodiment, the framework identification unit is configured when the framework identification information includes a framework name, a file type, detailed designation information, and a pattern character string, and the file type is “JavaScript” (registered trademark). The operation of was explained.
In the present embodiment, the framework identification information includes a framework name, a file type, and a pattern character string, and the file type is “JavaScript” (registered trademark) (detailed designation 605 in FIG. 7 is omitted). The operation of the framework determination unit will be described.

FIG. 8 is a diagram showing an example of the framework identification information stored in the framework identification information storage unit 113 according to the present embodiment.
The framework identification information storage unit 113 stores zero or more pieces of framework identification information.
Each framework identification information includes a framework name 702, a file type 704, and a pattern character string 705.
The pattern character string 705 is a regular expression character string for specifying a framework, and is an example of a character string for determination.
Framework name 702 represents the name of the framework being used.

The operation of the framework determination unit 112 specifying the framework will be described with reference to FIGS. 3 and 4.
The framework determination unit 112 extracts framework identification information from the framework identification information storage unit 113 (S302).
If there is no framework identification information to be extracted, the framework determination unit 112 determines that there is no corresponding framework, outputs “not applicable” (S313), and ends the processing (S314).
The framework determination unit 112 confirms whether the file type 704 of the extracted framework identification information is the same as the file type to be diagnosed (S303), and if it is the same, the file type is “JavaScript” (registered) Trademark) (S318).
In the present embodiment, the file type is always “Java Script” (registered trademark).
When the file type 704 of the extracted framework identification information is different from the file type to be diagnosed, the framework determination unit 112 extracts the next framework identification information.

Next, the framework determination unit 112 confirms that the detailed specification of the framework identification information is empty (no detailed specification exists) (S319), and the pattern characters of the framework identification information for all the diagnosis target page files. Matching with the column 705 is performed (S316).
When the diagnosis target page file matches the pattern character string 705 of the framework identification information, the framework name 702 of the framework identification information is output (S315), and the process ends (S314).

When there is no portion that matches the pattern character string 705 in the diagnosis target page file, the framework determination unit 112 uses the following framework identification information.
The framework determination unit 112 individually collates a plurality of pieces of framework identification information (S302 to S312), and regards the first matching framework as the diagnosis target framework.

  As described above, the file type of the Web page is determined with respect to the response (Web page file) from the diagnosis target Web application, and it is determined whether there is a portion that matches the specific pattern in the entire JavaScript (registered trademark) file. Thus, there is an effect that it becomes possible to specify a framework and create pseudo attack data based on the framework information.

Although it is assumed that the framework identification information storage unit 113 in this embodiment functions in the same apparatus as the Web application diagnostic apparatus 101, the framework identification information storage unit 113 is stored in a remote database server. Of course.
Further, it is possible to obtain the framework identification information in the framework identification information storage unit 113 periodically from a remote distribution server so as to always correspond to the latest framework.

In addition, the framework identification information storage unit 113 shown in the present embodiment may of course be unified with the framework identification information storage unit 113 shown in the first and third embodiments.
In this case, the framework identification information used in the fourth embodiment is composed of the framework name, file type, empty detailed designation, and pattern character string.

  As described above, in the present embodiment, the Web application diagnosis apparatus has been described in which the collation portion includes the framework identification information storage unit in which the framework identification information configured by the file type is stored.

  Further, in the present embodiment, the Web application diagnosis apparatus has been described in which the file type is JavaScript (registered trademark) and the entire script file is the target of collation.

Finally, a hardware configuration example of the Web application diagnostic apparatus 101 shown in the first to fourth embodiments will be described.
FIG. 9 is a diagram illustrating an example of hardware resources of the Web application diagnostic apparatus 101 illustrated in the first to fourth embodiments.
Note that the configuration of FIG. 9 is merely an example of the hardware configuration of the Web application diagnostic apparatus 101, and the hardware configuration of the Web application diagnostic apparatus 101 is not limited to the configuration illustrated in FIG. There may be.

In FIG. 9, the Web application diagnostic apparatus 101 includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, a processing unit, a microprocessor, a microcomputer, and a processor) that executes a program.
The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices.
Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of the storage device.
The “framework identification information storage unit 113” and the “communication recording unit 114” described in the first to fourth embodiments are realized by the RAM 914, the magnetic disk device 920, and the like.
A communication board 915, a keyboard 902, a mouse 903, a scanner device 907, an FDD 904, and the like are examples of input devices.
The communication board 915, the display device 901, the printer device 906, and the like are examples of output devices.

  As shown in FIG. 1, the communication board 915 is connected to a network. For example, the communication board 915 may be connected to a LAN (Local Area Network), a WAN (Wide Area Network), a SAN (Storage Area Network), etc. in addition to the Internet.

The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924.
The programs in the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least part of the operating system 921 program and application programs to be executed by the CPU 911.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 920 stores a boot program.
When the Web application diagnostic apparatus 101 is activated, the BIOS program in the ROM 913 and the boot program in the magnetic disk device 920 are executed, and the operating system 921 is activated by the BIOS program and the boot program.

  The program group 923 executes the function described as “˜part” in the description of the first to fourth embodiments (other than “framework identification information storage unit 113” and “communication recording unit 114”). Program to be stored. The program is read and executed by the CPU 911.

In the file group 924, in the description of the first to fourth embodiments, “determination of”, “determination of”, “calculation of”, “comparison of”, “collation of”, and “diagnosis of”. ”,“ Update of ”,“ setting of ”,“ registration of ”,“ selection of ”, etc. It is stored as each item of "~ file" and "~ database".
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, arrows in the flowcharts described in the first to fourth embodiments mainly indicate input / output of data and signals, and the data and signal values are the RAM 914 memory, the FDD 904 flexible disk, the CDD 905 compact disk, and the magnetic field. Recording is performed on a recording medium such as a magnetic disk of the disk device 920, other optical disks, mini disks, DVDs, and the like. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, what is described as “to part” in the description of the first to fourth embodiments may be “to circuit”, “to device”, “to device”, and “to step”, It may be “˜procedure” or “˜processing”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “to part” in the first to fourth embodiments. Alternatively, the computer executes the procedure and method of “to unit” in the first to fourth embodiments.

  As described above, the Web application diagnosis apparatus 101 shown in the first to fourth embodiments includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, and a display device as an output device, A computer including a communication board or the like, and implements the functions indicated as “˜units” as described above using these processing devices, storage devices, input devices, and output devices.

  DESCRIPTION OF SYMBOLS 101 Web application diagnostic apparatus, 102 Security hole determination part, 103 Pseudo-attack generation part, 104 Diagnosis result display part, 105 HTTP request transmission part, 106 HTTP response reception part, 107 Model HTTP request generation part, 108 Internet, 110 Web server, 111 Diagnosis target Web application, 112 Framework determination unit, 113 Framework identification information storage unit, 114 Communication recording unit

Claims (8)

A management device that communicates with a web application using a web application framework and manages the web application,
A communication recording unit for recording communication with the Web application;
A discrimination information acquisition unit that acquires discrimination information from a discrimination information storage area that stores discrimination information used for discrimination of a web application framework;
A framework determination unit that determines which Web application framework is used in the Web application using the communication record by the communication recording unit and the determination information acquired by the determination information acquisition unit; Management device characterized by. The discrimination information acquisition unit
From the discrimination information storage area, obtain discrimination information indicating a unique discrimination character string for each Web application framework,
The framework determination unit
Extracting a web page received from the web application from the communication record by the communication recording unit, determining whether the extracted web page includes a character string for determination of any web application framework; The management apparatus according to claim 1, wherein the management apparatus determines that a Web application framework corresponding to a determination character string included in the Web page is used in the Web application. The discrimination information acquisition unit
From the determination information storage area, the determination information indicating the character string arrangement position in the Web page where the character string for determination and the character string for determination is arranged,
The framework determination unit
The management apparatus according to claim 2, wherein it is determined whether or not a character string for determination is included in a character string arrangement position in the extracted Web page. The management device further includes:
4. The Web application diagnosis unit according to claim 1, further comprising a Web application diagnosis unit that diagnoses a security hole in the Web application in correspondence with the Web application framework determined by the framework determination unit. Management device. The web application diagnosis unit
5. The management apparatus according to claim 4, wherein a security hole in the web application is diagnosed by performing a pseudo attack on the web application in correspondence with the web application framework determined by the framework determination unit. . The web application diagnosis unit
6. The management apparatus according to claim 5, wherein a pseudo attack for diagnosing a security hole unique to the web application framework determined by the framework determination unit is omitted and the pseudo attack is performed on the web application. . A method of managing the web application, performed by a computer that communicates with a web application using a web application framework,
A communication recording step in which the computer records communication with the Web application;
A determination information acquisition step in which the computer acquires determination information from a determination information storage area storing determination information used for determination of a Web application framework;
Framework determination step in which the computer determines which Web application framework is used in the Web application using the communication record in the communication recording step and the determination information acquired in the determination information acquisition step. The management method characterized by having. On a computer that communicates with a web application that uses the web application framework,
A communication recording process for recording communication with the Web application;
Discrimination information acquisition processing for acquiring discrimination information from a discrimination information storage area storing discrimination information used for discrimination of a web application framework;
A framework determination process for determining which Web application framework is used in the Web application is executed using the communication record by the communication recording process and the determination information acquired by the determination information acquisition process. A program characterized by that.

Images