KR102254197B1 - Method, apparatus and computer program for processing URL collected in web site - Google Patents

Abstract

The present invention relates to a method, an apparatus and a computer program for diagnosing a vulnerability of a web page, and more specifically, in a method for diagnosing a vulnerability of a first web page of a first website, the apparatus for diagnosing a vulnerability of a web page, one or An input data generation step of generating one or more input data (payload) having a diagnostic phrase including two or more types of quarter marks as a parameter; A response data receiving step of receiving one or more response data for the first web page by transmitting the one or more input data to the first website; And a vulnerability determination step of determining whether the first web page is vulnerable based on the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data. Introduces a vulnerability diagnosis method.

Description

Web page vulnerability diagnosis method, apparatus and computer program {Method, apparatus and computer program for processing URL collected in web site}

The present invention relates to a method, an apparatus, and a computer program for diagnosing vulnerabilities of a web page, and more specifically, a cross site (XSS) in which an attack phrase is executed outside a specific area of a web page by input data including an attack phrase. It relates to a web page vulnerability diagnosis method, device, and computer program that can more effectively diagnose vulnerabilities such as (scripting).

Recently, with the development of information and communication technologies such as wired and wireless communication technologies, various services based on the web are widely used.

The development of such web-based services provides more benefits to users, but attacks on the web-based services are also steadily increasing.

There are many types of attacks against web-based services, and one of the representative attack techniques is XSS (Cross Site Scripting) attack technique. In XSS, an attack statement such as a script is included in a string input as a parameter, and the attack statement is executed outside the string area in a web page having a vulnerability, thereby performing an attack.

However, although the XSS is one of the most commonly found vulnerabilities in the current web service environment, conventional XSS vulnerability scanners frequently falsely detect or fail to detect XSS vulnerabilities. This is because the conventional XSS vulnerability scanner inputs a complete attack phrase and determines the vulnerability based on whether the attack phrase is present in the response data as it is.

More specifically, there may be a problem in which the attack phrase entered to detect the web page to be diagnosed in the conventional XSS vulnerability scanner is detected and blocked by a firewall, etc., so even if the web page to be diagnosed has a vulnerability, it may be undetected or falsely detected. Furthermore, in the conventional XSS vulnerability scanner, the XSS vulnerability is detected only when the input attack phrase is completely included in the response data.However, a specific character in the attack phrase is removed or changed by filtering or a web firewall. As a result, the vulnerability of the web page to be diagnosed could be undetected or falsely detected.

Furthermore, this problem is not limited to the XSS vulnerability diagnosis, but also occurs in various attack techniques that use a vulnerability that can execute an input including an attack phrase to a website and the attack phrase can be executed outside a specific area of a web page. I can.

Accordingly, there is a continuing demand for a method for delivering input data including an attack phrase such as XSS to a website and diagnosing a vulnerability that may be executed outside a specific area of the web page. An effective solution to this has not been suggested.

Republic of Korea Patent Publication No. 10-2008-0004904 (published on January 10, 2008)

The present invention was devised to solve the problems of the prior art as described above, and the attack code is executed outside a specific area of the web page by transmitting input data including an attack phrase such as XSS (Cross Site Scripting) to a website. The purpose of this study is to provide a web page vulnerability diagnosis method, device, and computer program that can more accurately diagnose the vulnerability.

In addition, an object of the present invention is to provide a web page vulnerability diagnosis method, apparatus, and computer program capable of effectively diagnosing variously modified vulnerabilities such as multiple times of attack code being included in a specific area of a web page to be diagnosed.

In addition, detailed objects of the present invention will be clearly understood and understood by experts or researchers in this technical field through specific contents described below.

In the method for diagnosing vulnerability of a web page according to an aspect of the present invention for solving the above problem, in the method for diagnosing a vulnerability of a first web page of a first web site, the apparatus for diagnosing a vulnerability of a web page may include one or two types. An input data generation step of generating one or more input data (payload) having a diagnostic phrase including the above quota mark as a parameter; A response data receiving step of receiving one or more response data for the first web page by transmitting the one or more input data to the first website; And a vulnerability determination step of determining whether the first web page is vulnerable based on the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data.

In addition, the computer program according to another aspect of the present invention is characterized in that it is a computer program stored in a computer-readable medium for executing each step of the method for diagnosing vulnerability of a web page described above in a computer.

In addition, an apparatus for diagnosing web page vulnerability according to another aspect of the present invention includes: an input data generating unit that generates one or more input data (payload) having a diagnostic phrase including one or more types of quota marks as a parameter; A response data receiver configured to receive one or more response data for the first web page by transmitting the one or more input data to the first website; And a vulnerability determination unit that determines whether the first web page is vulnerable based on the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data.

In the webpage vulnerability diagnosis method, apparatus, and computer program according to an embodiment of the present invention, input data including an attack phrase such as XSS (Cross Site Scripting) is transmitted to a website so that the attack code can detect a specific area of the webpage. Vulnerabilities that are executed outside can be diagnosed more accurately.

In addition, in the webpage vulnerability diagnosis method, apparatus, and computer program according to an embodiment of the present invention, variously modified vulnerabilities such as multiple times of attack code being included in a specific area of the web page to be diagnosed can be effectively diagnosed. .

The accompanying drawings, which are included as part of the detailed description to aid in understanding of the present invention, provide embodiments for the present invention, and describe the technical idea of the present invention together with the detailed description.
1 is a block diagram of a web page vulnerability diagnosis system according to an embodiment of the present invention.
2 is a flowchart of a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
3 is a diagram for explaining a case in which a variable value of a parameter is replaced with a diagnostic syntax in a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
4 is a diagram illustrating calculation of a first area corresponding to a diagnosis phrase in a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
5 is a diagram illustrating a detailed flowchart of a vulnerability determination step (S130) in a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
6A and 6B are diagrams illustrating a process of diagnosing a vulnerability of a web page in a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
7 is a diagram illustrating a case in which a variable value of a parameter is replaced with a diagnostic syntax in a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
8 is a detailed flowchart of a method for diagnosing vulnerability of a web page according to an embodiment of the present invention.
9 is a block diagram of an apparatus for diagnosing vulnerability of a web page according to an embodiment of the present invention.

The present invention may apply various transformations and may have various embodiments. Hereinafter, specific embodiments will be described in detail based on the accompanying drawings.

In describing the present invention, when it is determined that a detailed description of a related known technology may obscure the subject matter of the present invention, a detailed description thereof will be omitted.

Terms such as first and second may be used to describe various components, but the components are not limited by the terms, and the terms are only for the purpose of distinguishing one component from other components. Is used.

Hereinafter, exemplary embodiments of a method, apparatus, and computer program for diagnosing web page vulnerability according to the present invention will be described in detail with reference to the accompanying drawings.

First, FIG. 1 shows a configuration diagram of a web page vulnerability diagnosis system 100 according to an embodiment of the present invention. As can be seen in FIG. 1, the webpage vulnerability diagnosis system 100 according to an embodiment of the present invention includes one or more web servers 120 that provide web services to devices connected through the communication network 130, It may be configured to include a web page vulnerability diagnosis device 110 for diagnosing a vulnerability of a web page of a web site serviced by the web server 120.

At this time, the web page vulnerability diagnosis device 110 may be implemented using a server, but the present invention is not necessarily limited thereto, and may be implemented as a separate device for collecting URLs, or further, a smartphone, a tablet PC, or a PDA. , It can be implemented in various forms, such as being implemented as an application driven by a mobile terminal such as a mobile phone or a wired/wireless terminal such as a personal computer (PC).

In addition, the web server 120 may also be implemented using a server, but the present invention is not necessarily limited thereto, and is implemented as a separate device for providing a web service, or further, a smartphone, a tablet PC, a PDA, or a portable device. It may be implemented as an application driven by a mobile terminal such as a phone or a wired/wireless terminal such as a personal computer (PC).

Further, the communication network 130 connecting the web page vulnerability diagnosis device 110 and the web server 120 may include a wired network and a wireless network, and specifically, a local area network (LAN), It may include various communication networks such as a Metropolitan Area Network (MAN) and a Wide Area Network (WAN). In addition, the communication network 130 may include a known World Wide Web (WWW). However, the communication network 130 according to the present invention is not limited to the above-listed networks, and may include at least part of a known wireless data network, a known telephone network, or a known wired/wireless television network.

2 is a flowchart illustrating a method for diagnosing vulnerability of a web page according to an embodiment of the present invention. As can be seen in FIG. 2, the method for diagnosing a vulnerability of a web page according to an embodiment of the present invention is a method of diagnosing a vulnerability of a first web page of a first website, and the apparatus 110 for diagnosing a vulnerability of a web page A, input data generation step (S110) of generating one or more input data (payload) having a diagnostic phrase including one or two or more types of quota marks as a parameter, by transmitting the one or more input data to the first website A response data receiving step (S120) of receiving one or more response data for the first web page and the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data A vulnerability determination step (S130) of determining whether the first web page is vulnerable may be included.

In the following, a method for diagnosing a vulnerability of a web page according to an embodiment of the present invention will be reviewed in detail by dividing each step with reference to FIG. 2.

First, in the input data generation step (S110), the webpage vulnerability diagnosis apparatus 110 generates one or more input data (payload) having a diagnostic phrase including one or more types of quota marks as a parameter.

That is, in the present invention, the web page vulnerability diagnosis apparatus 110 generates input data (payload) using a diagnosis phrase for diagnosing a vulnerability of a web page to be diagnosed as a parameter.

In this case, in the present invention, the quotation mark means a double quotation mark ("), a single quotation mark (')), or a back quotation mark (`)).

Accordingly, in the present invention, the diagnostic phrase includes one or two or more of a double quotation mark ("), a single quotation mark (')), or a back quotation mark (`)). I can.

Further, in the web page vulnerability diagnosis method according to an embodiment of the present invention, in the input data generation step (S110), a parameter variable name and a variable value are calculated from the URL for the first web page, and the variable value is The input data may be generated by replacing it with a diagnostic phrase.

That is, as can be seen in FIG. 3, in the URL (Uniform Resource Locator) (FIG. 3A) of the first web page, the protocol type 310, the path-page information 320a excluding the parameter part, and The parameter 320b may be included.

At this time, the web page vulnerability diagnosis apparatus 110 calculates one or more parameter variable names and variable values through parsing or the like for the parameter 320b area.

For a more specific example, as can be seen in FIG. 3(b), the web page vulnerability diagnosis device 110 parses the parameter 320b area to provide parameter variable names 330a and 340a and variable values therefor. (330b, 340b) is calculated.

Accordingly, in the present invention, the web page vulnerability diagnosis apparatus 110 generates input data (payload) for the web page to be diagnosed by substituting the variable values 330b and 340b in the parameter 320b with the diagnosis syntax. It is done.

In this case, in generating input data for a web page to be diagnosed by replacing the variable value with the diagnostic phrase, one type of phrase predetermined as the diagnostic phrase may be used, but the present invention is not necessarily limited thereto. A plurality of predetermined syntaxes may be selectively used according to the characteristics of the web page to be diagnosed or the characteristics of the parameters.

In addition, it is also possible to generate a plurality of input data using a plurality of types of diagnostic syntax for one parameter variable value.

Further, in the web page vulnerability diagnosis method according to an embodiment of the present invention, in the input data generation step (S110), when there are two or more variable values, one or two or more of the two or more variable values are diagnosed. You can create more than one input data by replacing it with a phrase.

For a more specific example, as shown in Fig. 3(a), when two or more variable values exist in the parameter area (330b, 340b), one of the two or more variable values is selectively selected as the diagnostic syntax. Input data may be generated by substituting 350a and 350b (Figs. 3(c1) and 3(c2)), and further, input data may be generated by substituting a plurality of values of the two or more variables with the diagnostic syntax. .

Subsequently, in the response data receiving step (S120), the web page vulnerability diagnosis apparatus 110 transmits the one or more input data (payload) to the first website to receive one or more responses to the first web page. You will receive the data (response).

For example, the web page vulnerability diagnosis device 110 transmits the input data (payload) of FIG. 3 (C1) generated in the input data generation step (S110) to the web server 120 through the communication network 130. By transmitting to the first website, response data including information on the header and body of the first web page is received.

Further, the webpage vulnerability diagnosis apparatus 110 sequentially transmits the plurality of input data to the first website when there are a plurality of input data (payload) generated in the input data generation step (S110) It is also possible to receive response data (response).

Next, in the vulnerability determination step (S130), it is determined whether the first web page is vulnerable based on the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data.

Here, the first region refers to a region in which all or part of the diagnostic phrase substituted for the variable value is included in several tag (or variable) regions included in the response data of the first web page.

For a more specific example, as can be seen in FIG. 4, the webpage vulnerability diagnosis device 110 receives response data for input data (FIG. 4(a1 )) including a diagnosis phrase 410. In this case, the response data includes a plurality of tag (or variable) areas as illustrated in FIGS. 4(b1), 4(b2), and 4(b3).

In this case, the first region is the variable value in one or more tag (or variable) regions (Fig. 4(b1), Fig. 4(b2), Fig. 4(b3)) included in the response data of the first web page. It refers to a region in which some or all of the substituted diagnostic phrases are included 420 (FIG. 4(b2)).

Further, the vulnerability determination step (S130) includes a first area calculation step (S131) of calculating a first area corresponding to the diagnosis phrase from the one or more response data, as shown in FIG. 5, and the first And determining whether the first web page is vulnerable based on the number of the quarter mark in the region (S132).

Accordingly, in the present invention, in the step of calculating the first region (S131), a first region corresponding to the diagnosis phrase may be first calculated from the response data.

More specifically, in the step of calculating the first region (S131), the first region may be calculated using a regular expression, and the first region may be calculated in various ways.

Further, in the webpage vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis syntax may include a predetermined identification syntax. Accordingly, in the first area calculation step (S131), the first webpage By calculating the first area based on the identification phrase, the first area can be more efficiently calculated. In this case, it is preferable to use a phrase that is not normally used in a web page as the identification phrase.

Subsequently, in the step of determining the vulnerability based on the quarter mark (S132), it is determined whether the first web page is vulnerable based on the number of the quarter mark in the first area.

More specifically, as can be seen in FIG. 6A, when input data (FIG. 6(a1)) including a string variable value 610a that is not replaced with a diagnostic syntax is input, the response data of the first web page corresponding thereto is As shown in FIG. 6(a2), the variable value is configured in a normal web page syntax format without leaving the character string area (610b), and accordingly, it is normally driven as shown in FIG. 6(b).

However, as can be seen in FIG. 6B, when the variable value of the parameter is replaced with a syntax (= diagnosis syntax) including a quarter mark (630a) to configure input data (FIG. 6(c1)), 1 As for the response data of the web page, as shown in Fig. 6(c2), some of the diagnostic phrases operate abnormally while some 630c of the replaced diagnostic phrases are out of the normal character string area (=first area). You can do it. Accordingly, as shown in FIG. 6(d), some of the diagnostic codes 640b can be driven as attack codes outside the normal character string area.

Accordingly, in the method for diagnosing vulnerability of a web page according to an embodiment of the present invention, by analyzing response data (response) to input data (payload) having a diagnostic phrase configured including one or more quota marks as a parameter, the Based on the number of the quota mark in the first area corresponding to the diagnosis syntax, it is possible to determine whether the diagnosis syntax or the attacker's attack syntax in the first web page can be operated as an attack code or the like outside the normal area.

Further, in the webpage vulnerability diagnosis method according to an embodiment of the present invention, whether the first webpage is vulnerable based on the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data. In this case, the diagnostic phrase does not need to include words such as scripts that can be blocked by a firewall, or special characters such as "<", ">", "(", ")", etc. It can be configured with a quarter mark.

More specifically, in the web page vulnerability diagnosis method according to an embodiment of the present invention, an odd number of quarter marks may be included in the diagnosis phrase. Accordingly, in the vulnerability determination step (S130), the diagnosis is performed in the first area. When there are an odd number of quota marks included in the diagnostic syntax in an area preceding the syntax, the tag of the first area is terminated by the odd number of quota marks included in the diagnosis syntax, and some syntax of the diagnostic syntax is abnormal. As the first web page can be operated, it is possible to diagnose the first web page as being vulnerable.

Furthermore, in the webpage vulnerability diagnosis method according to an embodiment of the present invention, as shown in FIG. 7(a), the input data may include a plurality of diagnosis phrases 710a and 710b, and in this case, the vulnerability In the determining step (S130), after calculating the number of the quarter mark included in a region preceding the first diagnostic phrase 720a among the diagnostic phrases in the first region (Fig. 7(b)), the calculated quota By diagnosing whether the first web page is vulnerable in consideration of the number of marks and the number of diagnostic phrases, errors that may appear while a plurality of diagnostic phrases are included can be prevented.

In addition, in the webpage vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis syntax may include a script termination string (=</script>). In this case, in the vulnerability determination step (S130), the diagnosis syntax is When located in the script area, the vulnerability can be diagnosed based on whether the script is terminated due to the script termination string.

Further, in the webpage vulnerability diagnosis method according to an embodiment of the present invention, in the vulnerability determination step (S10), the same vulnerability is prevented from being duplicated multiple times by removing input data that is calculated redundantly among the calculated vulnerability. You may.

In addition, FIG. 8 illustrates a more specific flow chart of a method for diagnosing vulnerability of a web page according to an embodiment of the present invention. Hereinafter, a web page vulnerability diagnosis method according to an embodiment of the present invention will be examined in more detail with reference to FIG. 8.

First, in step S810, the web page vulnerability diagnosis apparatus 110 prepares for accessing the first website. Accordingly. The web page vulnerability diagnosis apparatus 110 may set a user environment for access. Accordingly, the URL for the first web page may be collected, a user-agent may be set in consideration of the type and usage environment of the web browser, or a cookie may be set to set login information such as administrator setting.

Subsequently, in step S820, it is determined whether a parameter area exists in the URL for the first web page.

Subsequently, in step S821, when a parameter area exists in the URL for the first web page, input data (payload) is generated by substituting one variable value among the parameters with a diagnostic statement, and further variable values are present. In this case, each variable value is replaced with a diagnostic statement and each is generated as input data.

Next, in step S830, a list of generated input data (payload) is checked.

Accordingly, if the input data (payload) remains, after transmission (S840), a first area including the diagnostic phrase is found from the response data (response) (S850).

Subsequently, in step S860, when the first area is calculated, the number of quarter marks existing in the first area is calculated.

In this case, if the number of quarter marks calculated in the first area is an odd number (S870a), and if the number of quarter marks present in the diagnostic syntax of the input data is also an odd number (SS870b), the first web page is considered to be vulnerable. It is determined (S880a), and in other cases, it is determined that the first web page is not vulnerable (S880b).

Subsequently, the process returns to step S830 and the list of the generated input data (payload) is checked, and if input data that has not been used for vulnerability diagnosis remains, steps S840 and below are repeated again.

Furthermore, in step S890, a duplicate list is identified and removed from the list determined as a vulnerability.

In addition, the computer program according to another aspect of the present invention is characterized in that it is a computer program stored in a computer-readable medium in order to execute each step of the method for diagnosing vulnerability of a webpage vulnerability in a salpin web page. The computer program may be a computer program including not only a computer program including machine code generated by a compiler, but also a computer program including a high-level language code that can be executed on a computer using an interpreter or the like. At this time, the computer is not limited to a personal computer (PC) or a notebook computer, and is equipped with a central processing unit (CPU) such as a server, a smart phone, a tablet PC, a PDA, and a mobile phone to execute a computer program. Including the device. In addition, the computer-readable medium includes an electronic recording medium (e.g., ROM, flash memory, etc.), a magnetic storage medium (e.g., a floppy disk, a hard disk, etc.), an optical reading medium (e.g., It includes all computer-readable storage media such as CD-ROM, DVD, etc.) and carrier wave (for example, transmission through the Internet).

In addition, FIG. 9 illustrates a configuration diagram of a web page vulnerability diagnosis apparatus 110 according to an embodiment of the present invention.

As can be seen in FIG. 9, the webpage vulnerability diagnosis apparatus 110 according to an embodiment of the present invention includes an input data generation unit 111, a response data receiving unit 112, and a vulnerability determination unit 113. Can be.

In the following, the web page vulnerability diagnosis apparatus 110 according to an embodiment of the present invention is divided and examined for each component. For more detailed information about the apparatus 110 for diagnosing webpage vulnerability according to an embodiment of the present invention, refer to various embodiments similar to the method for diagnosing webpage vulnerability according to an embodiment of the present invention of FIGS. 2 to 8 described above. As it may be implemented, repeated detailed descriptions are omitted.

First, the input data generating unit 111 generates one or more input data (payload) having a diagnostic statement including one or two or more types of quota marks as a parameter.

Accordingly, the response data receiving unit 112 transmits the one or more input data to the first website to receive one or more response data for the first web page.

Finally, the vulnerability determination unit 113 determines whether the first web page is vulnerable based on the number of the quarter mark in a first area corresponding to the diagnosis phrase among the one or more response data.

In addition, the input data generation unit 111 may generate the input data by calculating a parameter variable name and a variable value from the URL for the first web page, and replacing the variable value with the diagnostic syntax.

Further, the input data generation unit 111 may generate two or more input data by replacing one or two or more of the two or more variable values with the diagnostic syntax when there are two or more variable values.

In addition, the vulnerability determination unit 113, a first area calculator (not shown) that calculates a first area corresponding to the diagnosis phrase from the one or more response data, and the number of the quarter mark in the first area It may be configured to include a quarter mark criterion vulnerability determination unit (not shown) that determines whether the first web page is vulnerable as a reference.

Further, the diagnosis phrase may include a predetermined identification phrase, and in this case, the first region calculator (not shown) may calculate the first region based on the identification phrase in the first web page. .

In addition, the diagnostic phrase may include an odd number of quota marks, and in this case, the vulnerability determination unit 113 has an odd number of quota marks included in the diagnostic phrase in an area preceding the diagnostic phrase in the first area. If so, it can be diagnosed that the first web page is vulnerable.

In addition, the diagnostic syntax may include a script termination string (=</script>). In this case, the vulnerability determination unit 113, when the diagnostic syntax is located in the script area, the script is executed due to the script termination string. Vulnerability can be diagnosed based on whether it is terminated.

In addition, the input data may include a plurality of diagnostic phrases. In this case, the vulnerability determination unit 113 determines the number of the quarter mark included in a region preceding the first diagnostic phrase among the diagnostic phrases in the first region. After calculation, it is possible to diagnose whether the first web page is vulnerable in consideration of the calculated number of quartermarks and the number of diagnostic phrases.

Furthermore, the vulnerability determination unit 113 may remove duplicated input data among the calculated vulnerabilities.

Accordingly, in the webpage vulnerability diagnosis method, apparatus, and computer program according to an embodiment of the present invention, input data including an attack phrase such as XSS (Cross Site Scripting) is transmitted to a website so that the attack code is Not only can vulnerabilities executed outside a specific area be diagnosed more accurately, but also variously modified vulnerabilities such as multiple times of attack code being included in a specific area of the web page to be diagnosed can be effectively diagnosed.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains will be able to make various modifications and variations without departing from the essential characteristics of the present invention. Therefore, the embodiments described in the present invention are not intended to limit the technical idea of the present invention, but to explain, and are not limited to these embodiments. The scope of protection of the present invention should be interpreted by the claims below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: Web page vulnerability diagnosis system
110: Web page vulnerability diagnosis device
111: input data generation unit
112: response data receiving unit
113: Vulnerability determination unit
120, 120a, 120b: web server
130: communication network

Claims (11)

In a method for diagnosing a cross site script (XSS) vulnerability for a first web page of a first website,
An input data generation step of generating, by the web page vulnerability diagnosis apparatus, one or more input data (payload) having a diagnosis phrase including one or two or more types of quota marks as a parameter;
A response data receiving step of receiving one or more response data for the first web page by transmitting the one or more input data to the first website; And
Quarter mark in which the quota mark existing in the first area of the first web page is included in the diagnosis syntax based on the number of the quota mark in the first area corresponding to the diagnosis syntax among the one or more response data A vulnerability determination step of determining whether an XSS vulnerability occurs when the tag is terminated by;
Web page vulnerability diagnosis method comprising a. The method of claim 1,
In the step of generating the input data,
And generating the input data by calculating a parameter variable name and a variable value from a URL for the first web page, and replacing the variable value with the diagnostic syntax. The method of claim 2,
In the step of generating the input data,
When there are two or more variable values, two or more input data are generated by replacing one or two or more of the two or more variable values with the diagnostic syntax. The method of claim 1,
The vulnerability determination step,
A first area calculation step of calculating a first area corresponding to the diagnosis phrase from the one or more response data; And
A quarter mark criterion vulnerability determining step of determining whether the first web page is vulnerable based on the number of the quarter mark in the first area;
Web page vulnerability diagnosis method comprising a. The method of claim 4,
The diagnostic phrase includes a predetermined identification phrase,
In the step of calculating the first area,
And calculating the first area in the first web page based on the identification phrase. The method of claim 1,
The diagnostic phrase includes an odd number of quarter marks,
In the vulnerability determination step,
And diagnosing the first web page as being vulnerable when there are an odd number of quota marks included in the diagnosis phrase in a region preceding the diagnostic phrase in the first region. The method of claim 1,
The above diagnostic syntax includes the script terminating string (=</script>),
In the vulnerability determination step,
When the diagnostic syntax is located in a script area, the vulnerability diagnosis method is characterized by diagnosing the vulnerability based on whether the script is terminated due to the script termination string. The method of claim 1,
The input data includes a plurality of diagnostic phrases,
In the vulnerability determination step,
After calculating the number of the quarter mark included in a region preceding the first diagnostic phrase among the diagnostic phrases in the first region,
And diagnosing whether the first web page is vulnerable in consideration of the calculated number of quota marks and the number of diagnostic phrases. The method of claim 1,
In the vulnerability determination step,
A method for diagnosing web page vulnerabilities, comprising removing duplicated input data among calculated vulnerabilities. A computer program stored in a computer-readable medium for executing each step of the method for diagnosing webpage vulnerability according to any one of claims 1 to 9. An input data generator for generating one or more input data (payload) using a diagnostic phrase including one or two or more types of quarter marks as a parameter;
A response data receiver configured to receive one or more response data for a first web page by transmitting the one or more input data to a first website; And
Quarter mark in which the quota mark existing in the first area of the first web page is included in the diagnosis syntax based on the number of the quota mark in the first area corresponding to the diagnosis syntax among the one or more response data A vulnerability determination unit that determines whether or not a cross site script (XSS) vulnerability occurs when the tag is terminated by the tag;
Web page vulnerability diagnosis apparatus comprising a.

Images