KR102433386B1 - Apparatus and method for analyzing vulnerabilities - Google Patents

Abstract

The present application relates to a method for diagnosing a vulnerability for diagnosing a vulnerability and a diagnostic apparatus for the same. The method for diagnosing a vulnerability according to an embodiment of the present invention comprises the steps of receiving a URL (Uniform Resource Locator) address for diagnosis extracted from a server for diagnosis. ; requesting a response to the diagnosis target URL address from the diagnosis target server and storing it as reference response data; generating a first modulated URL address in the form of a relative path indicating the same path by modulating parameters included in the diagnosis target URL address; requesting a response to the first forged URL address from the server to be diagnosed and storing it as first response data; and when the reference response data and the first response data do not match, determining that the server to be diagnosed does not have the LFI vulnerability.

Description

{Apparatus and method for analyzing vulnerabilities}

The present application relates to a method for diagnosing a vulnerability capable of diagnosing a Local File Inclusion (LFI) vulnerability, and a diagnostic apparatus for the same.

With the recent proliferation of web services and user-friendly web interfaces, the integration of traditional applications into web-based systems is accelerating. In the development of web services, the problems of web applications themselves, programmers' ignorance of security, inability to block in firewalls, intrusion detection evasion, and adverse functions such as diversification of hacking tools are emerging as serious problems.

In order to prevent various types of attacks on web applications, it is necessary to block the intrusion of the attack code by each parameter included in the URL (Uniform Resource Locator). For all parameters included in each URL, it is necessary to first determine whether vulnerabilities exist for each attack type.

An object of the present application is to provide a method for diagnosing a vulnerability capable of diagnosing an LFI vulnerability by converting a diagnostic target URL address into a forged URL address including substantially the same relative path, and a diagnostic apparatus for the same.

An object of the present application is to provide a method for diagnosing a vulnerability capable of diagnosing an LFI vulnerability by bypassing an existing security solution, and a diagnostic apparatus for the same.

A vulnerability diagnosis method according to an embodiment of the present invention relates to a vulnerability diagnosis method of a diagnosis apparatus for diagnosing LFI (Local File Inclusion) vulnerabilities, and comprises receiving a diagnosis target URL (Uniform Resource Locator) address extracted from a diagnosis target server. step; requesting a response to the diagnosis target URL address from the diagnosis target server and storing it as reference response data; generating a first modulated URL address in the form of a relative path indicating the same path by modulating parameters included in the diagnosis target URL address; requesting a response to the first forged URL address from the server to be diagnosed and storing it as first response data; and when the reference response data and the first response data do not match, determining that the server to be diagnosed does not have the LFI vulnerability.

A diagnostic apparatus according to an embodiment of the present invention relates to a diagnostic apparatus for diagnosing LFI (Local File Inclusion) vulnerabilities for a diagnostic target server, and is configured to receive a diagnostic target URL (Uniform Resource Locator) address extracted from a diagnostic target server. URL collection unit; a URL modulator for generating a first modulated URL address in a relative path format indicating the same path by modulating parameters included in the diagnosis target URL address; and a diagnosis unit that requests a response to the diagnosis target URL address and the first forged URL address from the diagnosis target server, and determines that the diagnosis target server does not have the LFI vulnerability if the responses do not match can

Incidentally, the means for solving the above problems do not enumerate all the features of the present invention. Various features of the present invention and its advantages and effects may be understood in more detail with reference to the following specific embodiments.

Since the method for diagnosing vulnerabilities and the diagnostic apparatus therefor according to an embodiment of the present invention does not perform a separate path movement during diagnosis, it is possible to bypass the filtering of the character string indicating the path movement and affect blocking of the web root path. You can diagnose LFI vulnerabilities without receiving

In the case of an attack for diagnosing an LFI vulnerability, the method for diagnosing a vulnerability and a diagnostic device for the same according to an embodiment of the present invention request a page substantially identical to the URL address to be diagnosed, so that the attack is easy by the security solution of the server to be diagnosed. blockage can be prevented. Therefore, it is possible to more effectively perform the diagnosis of the LFI vulnerability.

However, the effects that can be achieved by the method for diagnosing vulnerabilities and the diagnostic apparatus therefor according to the embodiments of the present invention are not limited to those mentioned above, and other effects not mentioned above are derived from the description below. It will be clearly understood by those of ordinary skill in the art.

1 is a schematic diagram illustrating a vulnerability diagnosis system according to an embodiment of the present invention.
2 is a block diagram illustrating a diagnostic apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating a vulnerability diagnosis method according to an embodiment of the present invention.
4 to 6 are flowcharts illustrating a method of verifying whether an LFI vulnerability is scouted in the vulnerability diagnosis method according to an embodiment of the present invention.

Hereinafter, the embodiments disclosed in the present specification will be described in detail with reference to the accompanying drawings, but the same or similar components are assigned the same reference numbers regardless of reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "part" for components used in the following description are given or mixed in consideration of only the ease of writing the specification, and do not have distinct meanings or roles by themselves. That is, the term 'unit' used in the present invention means a hardware component such as software, FPGA, or ASIC, and 'unit' performs certain roles. However, 'part' is not limited to software or hardware. The 'unit' may be configured to reside on an addressable storage medium or it may be configured to refresh one or more processors. Thus, as an example, 'part' refers to components such as software components, object-oriented software components, class components and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. Functions provided within components and 'units' may be combined into a smaller number of components and 'units' or further divided into additional components and 'units'.

In addition, in describing the embodiments disclosed in the present specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in the present specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical spirit disclosed herein is not limited by the accompanying drawings, and all changes included in the spirit and scope of the present invention , should be understood to include equivalents or substitutes.

1 is a schematic diagram illustrating a vulnerability diagnosis system according to an embodiment of the present invention.

Referring to FIG. 1 , the vulnerability diagnosis system according to an embodiment of the present invention may include a diagnosis apparatus 100 and a diagnosis target server 200 .

Hereinafter, a vulnerability diagnosis system according to an embodiment of the present invention will be described with reference to FIG. 1 .

The diagnosis apparatus 100 may diagnose the diagnosis target server 200 and extract vulnerabilities such as web pages and web applications provided by the diagnosis target server 200 . That is, due to defects in hardware or software of the diagnosis target server 200 or flaws in design, the user of the terminal device 1 operates more than the permitted authority, or a weakness that enables the reading, falsification, and leakage of information beyond the permitted range. can be checked for.

The diagnostic apparatus 100 may include a plurality of diagnostic modules, and through each diagnostic module, LFI (Local File Inclusion), SQL (Structured Query Language) Injection, XSS (Cross Site Scripting), SSRF (Server Side Request Forgery) ) and other types of vulnerabilities can be diagnosed. Here, each of the diagnostic modules may perform a simulated attack on the server 200 to be diagnosed, and the like to diagnose the vulnerability of the server 200 to be diagnosed.

The diagnosis target server 200 may be connected to various types of terminal devices 1 through a network, and may be a web server that provides a web service to each terminal device 1 . The diagnosis target server 200 may include a plurality of web pages for providing web services, and the diagnosis target server 10 may include a plurality of URL (Uniform Resource Locator) addresses for providing each web page. .

The diagnosis target server 200 may be implemented as a separate physical configuration including hardware and software configurations as shown in FIG. 1 . However, depending on the embodiment, it is also possible to implement as a virtual machine in the cloud server.

The cloud server may be a server that provides cloud computing. Cloud computing is a computing technology that provides IT resources as a service by utilizing Internet technology. It borrows and uses IT resources such as software, storage, servers, and network equipment as much as necessary, and supports real-time scalability according to the service load. It is the technology that pays for it. That is, cloud computing can run a plurality of virtual machines (VMs) on a physical server using virtualization technology, and each virtual machine is a virtual desktop, storage, and server that provide different operating systems and services, respectively. can be implemented

The cloud server may include a plurality of servers for diagnosis target server 100 therein, and each server for diagnosis target 100 may operate as a web server that provides different web services and the like. Furthermore, according to an embodiment, the diagnosis apparatus 100 may be implemented as a virtual machine in a cloud server.

On the other hand, the LFI vulnerability corresponds to a vulnerability that allows an unauthorized user to arbitrarily load and execute a file in the web server. That is, the LFI vulnerability can occur in the process of loading each page developed by a web page developer into one page and displaying the corresponding page to the user. For example, various pages such as board.php, menu.php, rank.php, etc. may exist in the path of /web/ inside the web server, and the developer puts each page in the page called main.php in the path of /web/ You can load them and expose them to users. However, if a separate file inside the web server is passed as a parameter argument, not the page intended by the developer, the file may be exposed, and in this case, it can be considered that an LFI vulnerability has occurred.

For example, if the normal URL address is "http://domian.com/main.php?page=board.php", "board.php" is exposed to the user. However, attackers can change the parameters and request the "/etc/passwd" file like "http://domian.com/main.php?page=/etc/passwd". Attackers can use "/etc/passwd" located in the parent directory, such as "http://domian.com/main.php?page=../../../../etc/passwd". You can also request in the form of a relative path to access the file. Here, "/etc/passwd" corresponds to an important file that stores sensitive information such as user ID and password, so in the case of a web server with LFI vulnerability, it loads the "/etc/passwd" file and exposes it to attackers, etc. problems may arise.

Conventionally, in order to detect an LFI vulnerability for a diagnosis target, an attack URL address is generated, a response is requested from the diagnosis target server 200, and the existence of an LFI vulnerability is determined from the response result. Here, the attack URL address includes the names of important files that are essential when the OS (Operating System) of the web server is installed, and “../../.. Relative paths such as /" may be included.

However, the URL addresses for attack including the name or relative path of an important file can be easily patterned and detected in an existing security solution or a security firewall. That is, since an attack for diagnosing the LFI vulnerability can be easily blocked, there is a problem in that it is difficult to effectively diagnose the LFI vulnerability for the server 200 to be diagnosed.

On the other hand, according to the diagnosis apparatus 100 according to an embodiment of the present invention, it is possible to effectively diagnose an LFI vulnerability by bypassing a blocking method such as an existing security solution or a security firewall. Hereinafter, a diagnosis apparatus 100 according to an embodiment of the present invention will be described.

2 is a block diagram illustrating a diagnostic apparatus according to an embodiment of the present invention.

Referring to FIG. 2 , the diagnosis apparatus according to an embodiment of the present invention may include a URL collection unit 110 , a URL modulator 120 , and a diagnosis unit 130 .

The URL collection unit 110 may receive a diagnosis target uniform resource locator (URL) address extracted from the diagnosis target server 200 . The diagnosis target server 200 may include a plurality of diagnosis target URL addresses, and the URL collection unit 110 may collect respective diagnosis target URL addresses from the diagnosis target server 200 . According to an embodiment, it is also possible to collect the diagnosis target URL address using a web crawler.

The URL modulator 120 may modulate a parameter included in the diagnosis target URL address to generate a first modulated URL address in the form of a relative path indicating the same path. That is, the URL modulator 120 may set the relative path by adding an identifier indicating the current directory in which the corresponding parameter is located in order to diagnose the LFI vulnerability of the server 200 to be diagnosed.

Specifically, the URL modulator 120 may parse the diagnosis target URL address, and through this, extract a key value and a value value of a parameter included in the diagnosis target URL address, respectively. The key value and value value of the corresponding parameter extracted here can be stored as a key-value pair. For example, when the diagnosis target URL address is "http://test.com/test.php?menu=board", the key value of the parameter is "menu" and the value corresponds to "board". Therefore, you can create and store a key-value pair like {"menu":"board"}.

Thereafter, the URL modulator 120 may generate the first modulation key-value pair by adding an identifier indicating the current directory to the value of the key-value pair. That is, as in the previous example, when {"menu":"board"} is created as a key-value pair, "./", an identifier indicating the current directory, may be added to the value "board". In this case, the first modulation key-value pair may be generated as {"menu":"./board"}.

When the first modulation key-value pair is generated, the URL modulator 120 may generate the first modulation URL address by substituting a parameter in the diagnosis target URL address with the first modulation key-value pair. In other words, in "http://test.com/test.php?menu=board", which is the URL address for diagnosis, {"menu":"board"} is replaced with {"menu":"./board"} Therefore, the first tampered URL address may be generated as "http://test.com/test.php?menu=./board".

In general, the URL address may be configured to load the page by directly passing the file name of the page to be loaded as a parameter value. In the same directory, it is possible to load only by writing the file name, so there is no need to input a separate relative path.

However, the URL modulator 120 may generate the first modulated URL address by modulating it to include a relative path rather than a file name of a page to be loaded. In other words, by adding "./", which is an identifier that designates the current directory, it is modified in a relative path form. In this case, it is practically the same in that it loads a page located in the same directory, but there is a difference in that it is modified in the form of a relative path.

In this case, the diagnosis target server 200 may provide the same response result as the diagnosis target URL address even in the case of the first forged URL address. It appears to be undetectable. That is, in order to prevent the LFI vulnerability, it is not allowed to change the URL address to be diagnosed to a relative path format, etc., so it is used to determine the existence of the LFI vulnerability.

When diagnosing an LFI vulnerability in this way, there is no actual path movement, so it is possible to bypass the filtering of the server to be diagnosed for the string "../", which is an identifier indicating path movement. In addition, since there is no path movement, it may not be affected by blocking the webroot path. Furthermore, since the first forged URL address loads the same page as the diagnostic target URL address, the file corresponding to the page always exists in the directory, and since each file cannot be generalized in the detection solution, the Detectability by detection solutions can be lowered. Therefore, according to the LFI vulnerability diagnosis according to the present invention, it is possible to more effectively perform the LFI vulnerability diagnosis.

Meanwhile, depending on the embodiment, there may be a case where the parameter is not included in the diagnosis target URL address. In this case, the URL modulator 120 may determine whether the diagnosis target URL address corresponds to the POST method, and if the POST method corresponds to the POST method, the URL modulator 120 may determine whether data exists in the body. That is, if the parameter does not directly exist in the URL address to be diagnosed, it is possible to check whether the POST body data exists. can be extracted and stored as a key-value pair. Thereafter, the generation of the first forged URL address using the generated key-value pair is the same as described above.

However, when the parameter does not exist in the corresponding diagnostic target URL address but is not the POST method, or when the POST method but no data exists in the body part, the LFI vulnerability diagnosis for the diagnostic target URL address can be terminated.

The diagnosis unit 130 may request the diagnosis target server 200 for responses to the diagnosis target URL address and the first forged URL address, respectively, and may check whether the responses match. Thereafter, it may be determined whether the LFI vulnerability exists in the server 200 to be diagnosed according to whether the responses match.

Specifically, the diagnosis unit 130 may request a response to each diagnosis target URL address from the diagnosis target server 200 in advance and store it as reference response data. Also, when the first forged URL address is generated, a response may be requested from the diagnosis target server 200 and stored as the first response data. Thereafter, by comparing the reference response data and the first response data, it is possible to check whether they match.

Here, when the reference response data and the first response data match, it can be seen that the diagnosis target server 200 does not recognize that the diagnosis target URL address has been altered into the first forged URL address. That is, since the diagnosis target server 200 did not detect an attack by changing the parameter to a different relative path, the diagnosis unit 130 may determine that the diagnosis target server 200 has an LFI vulnerability.

On the other hand, when the reference response data and the first response data are different, the diagnosis target server 200 recognizes that the first forged URL address has been tampered with, and outputs or blocks a warning page. can Accordingly, when the reference response data and the first response data are different from each other, it may be determined that the LFI vulnerability does not exist in the diagnosis target server 200 .

Here, the diagnosis unit 130 may determine whether an LFI vulnerability exists for each diagnosis target URL address.

Meanwhile, according to an embodiment, even when there is no actual LFI vulnerability, there may exist a case in which the reference response data and the first response data match. Accordingly, the diagnosis unit 130 may further perform additional verification in order to increase the reconnaissance rate for the LFI vulnerability.

Specifically, when the reference response data and the first response data match, the diagnosis unit 130 may generate a second modulation key-value pair by adding at least two identifiers to the value values included in the key-value pair. have. For example, if the key-value pair is {"menu":"board"}, a second modulation key-value pair may be generated as {"menu":"./bo./ard"}. In the case of the first tampered key-value pair, an identifier such as "./" was added in front of the string while maintaining the string of the value value included in the diagnosis target URL address, but in the case of the second tampered key-value pair It can be formed in a format that further includes "./" identifiers between strings included in the value value. That is, the diagnosis unit 130 may generate a second modulation key-value pair to cause the diagnosis target server 200 to cause an error by requesting a value value that does not exist in the corresponding page.

Thereafter, the diagnostic unit 130 may generate a second forged URL address by substituting a parameter in the diagnostic target URL address with the second forged key-value pair, and returns a response to the second forged URL address to the diagnostic target server 200 ) can be requested. For example, replace the second tampered key-value pair {"menu":"./bo./ard"} with "http://test.com/test.php?menu=board", which is the URL address for diagnosis. In this case, the second forged URL address may be generated as "http://test.com/test.php?menu=./bo./ard". A response may be requested by transmitting the generated second forged URL address to the diagnosis target server 200 , and thereafter, the response received from the diagnosis target server 200 may be stored as second response data.

The diagnosis unit 130 may check whether the first response data and the second response data match, and when they match, the diagnosis target server 200 may determine that there is no LFI vulnerability. That is, in the case of the second forged URL address, since it corresponds to an operation of requesting a file that is not in the actual diagnosis target server 200 , the diagnosis target server 200 is expected to output an error page including an error message. For example, you may see error messages such as "The file does not exist" or "Failed to invoke the web page".

However, if the first response data and the second response data match, it can be seen that the diagnosis target server 200 recognizes the identifier (“./”) added to the diagnosis target URL address and removes them altogether. That is, since it corresponds to a case where the server 200 to be diagnosed removes the identifier and provides the same response data, it can be determined that the server 200 to be diagnosed does not have an LFI vulnerability.

On the other hand, when the first response data and the second response data do not match, the diagnosis target server 200 does not detect the tampering of the diagnosis target URL address, and the first and second tampered URL addresses It can be seen that the following operation was performed. That is, when a response of outputting a page corresponding to "board" is performed for the first forged URL address, and an error page is output because there is no file corresponding to "bo" in the current directory for the second forged URL address corresponds to In this case, since the first response data and the second response data do not match, it can be determined that the LFI vulnerability exists.

However, in order to increase the reconnaissance rate for the LFI vulnerability, an embodiment in which additional verification is further performed for a case where the first response data and the second response data do not match is also possible.

Specifically, when the first response data and the second response data do not match, the diagnosis unit 130 replaces the value included in the key-value pair with the first string combined with the identifier, and the third modulation key-value You can create pairs. Here, the first character string may include arbitrary letters, numbers, symbols, and the like, and may be preset to a specific character string according to an embodiment. Also, an identifier such as “./” indicating the current directory may be added to the first string. For example, the first string can be set arbitrarily, such as "WebSecurityChecker7979", etc., including the identifier "./" to generate a third tampered key-value pair with {"menu":"./ WebSecurityChecker7979"}. can Here, the third modulation key-value pair corresponds to requesting a value value that does not exist in the corresponding page to cause the diagnosis target server 200 to cause an error. That is, you can request to refer to an arbitrary value that is not included in the current directory.

Thereafter, the diagnostic unit 130 may generate a third forged URL address by substituting a parameter in the diagnostic target URL address with the third forged key-value pair, and returns a response to the third forged URL address to the diagnostic target server 200 ) and can be saved as the third response data. In this case, the third forged URL address may be generated as "http://test.com/test.php?menu=./WebSecurityChecker7979".

Here, when the first response data and the third response data match, it may be determined that there is no LFI vulnerability in the server to be diagnosed. When the first response data and the third response data match, the first response data can be regarded as outputting a warning message according to the addition of the identifier, rather than responding to the file actually requested. For example, when an identifier ("./") is added to the value, the server 200 to be diagnosed may be set to output a warning page. In this case, the server 200 to be diagnosed does not have an LFI vulnerability. can be identified as

On the other hand, when the first response data and the third response data do not match, it can be considered that the diagnosis target server 200 moves to a relative path according to the addition of the identifier and executes it. That is, a page corresponding to the value "board" is output to the first response data of the server 200 to be diagnosed, and an error page indicating an incorrect variable reference according to the value "WebSecurityChecker7979" can be output to the third response data. have. In this case, since the first response data and the third response data do not match, the diagnosis unit 130 may determine that the LFI vulnerability exists in the diagnosis target server 200 .

Furthermore, in order to increase the reconnaissance rate for LFI vulnerabilities, it is possible to further perform additional verification for a case where the first response data and the third response data do not match. Specifically, when the first response data and the third response data do not match, the diagnosis unit 130 replaces the value included in the key-value pair with a second string combined with the identifier to modulate the fourth key-value pair. can create Here, the second character string is different from the first character string, and may include arbitrary letters, numbers, symbols, or the like. For example, the second string can be set arbitrarily, such as "WebSecurityChecker1234", etc., further including an identifier "./" to generate a fourth tampered key-value pair with {"menu":"./ WebSecurityChecker1234"} can do.

Thereafter, the diagnostic unit 130 may generate a fourth forged URL address by substituting a parameter in the diagnostic target URL address with the fourth forged key-value pair, and returns a response to the fourth forged URL address to the diagnostic target server 200 ) can be requested. In this case, the fourth forged URL address may be generated as "http://test.com/test.php?menu=./WebSecurityChecker1234".

Here, the case where the third response data and the fourth response data match corresponds to a case in which the diagnosis target server moves to a relative path by adding an identifier and executes it. That is, the third response data and the fourth response data of the server 200 for diagnosis have the same error page according to the wrong variable reference, respectively, so that the third response data and the fourth response data match. Accordingly, in this case, the diagnosis unit 130 may determine that the LFI vulnerability exists in the diagnosis target server 200 .

On the other hand, when the third response data and the fourth response data do not match, it can be seen that the diagnosis target server 200 detects tampering with respect to each and takes a separate action. That is, when the first response data and the third response data do not match, the LFI vulnerability exists in the diagnosis target server 200, and the first response data includes a page corresponding to the value “board”, and the third response data It was determined that an error page indicating an invalid variable reference according to the value "WebSecurityChecker7979" appeared in the response data. However, here, the fact that the third response data and the fourth response data are also inconsistent means that the diagnosis target server 200 does not move and execute the relative path according to the actual identifier, but rather the third response data such as its own firewall, settings, and development code. It corresponds to the case of blocking in a different way by the element of . Accordingly, when the third response data and the fourth response data do not match, it may be determined that the LFI vulnerability does not exist in the diagnosis target server 200 .

3 is a flowchart illustrating a vulnerability diagnosis method according to an embodiment of the present invention. Here, the vulnerability diagnosis method may be performed by a diagnosis apparatus for diagnosing the LFI vulnerability.

The diagnosis apparatus may receive the diagnosis target URL address extracted from the diagnosis target server (S110). Since the diagnosis target server may include a plurality of diagnosis target URL addresses, the diagnosis apparatus may collect respective diagnosis target URL addresses from the diagnosis target server. According to an embodiment, it is also possible to collect the diagnosis target URL address using a web crawler.

Thereafter, the diagnosis apparatus may check whether a parameter is included in the diagnosis target URL address (S121). Since the parameter is altered to diagnose the LFI vulnerability, it can be checked in advance whether the parameter exists in the URL address to be diagnosed. Here, if the parameter is not included in the diagnostic target URL address, the diagnostic apparatus may check whether the diagnostic target URL address corresponds to the POST method, and if the diagnostic target URL address corresponds to the POST method, it may check whether data exists in the body ( S122). That is, in the case of a URL address of the POST method, parameters may be included in the body part, so it is possible to check whether the diagnostic target URL address corresponds to the POST method and whether data exists in the body part if it corresponds to the POST method.

However, if the parameter does not exist in the target URL address for diagnosis but is not the POST method, or if there is no data in the body part despite the POST method, the LFI vulnerability diagnosis for the diagnosis target URL address can be terminated ( S122).

When a parameter is included in the diagnosis target URL address or there is POST body data, the diagnosis apparatus may request a response to the diagnosis target URL address from the diagnosis target server and store it as reference response data ( S130 ). Thereafter, for comparison with the response data for the forged URL address, the response to each diagnostic target URL address may be stored as reference response data in advance.

After storing the reference response data, the diagnostic apparatus modulates parameters included in the diagnostic target URL address to generate a first modified URL address in the form of a relative path indicating the same path (S140). Here, the relative path can be set by adding an identifier indicating the current directory in which the parameter is located.

Specifically, the diagnosis apparatus may parse the diagnosis target URL address, extract a key value and a value value of a parameter included in the diagnosis target URL address, respectively, and store the extracted key value and value value as a key-value pair. Here, when the diagnostic target URL address corresponds to the POST method and data exists in the body part, the parameters included in the body part can be parsed to extract the key value and the value value, respectively, and the extracted key value and value value can be used as a key -Can be stored as value pairs.

Thereafter, the value included in the key-value pair may be extracted, and an identifier indicating the current directory may be added to the corresponding value to generate the first modulation key-value pair. When the first tampered key-value pair is generated, the diagnostic apparatus may generate the first tampered URL address by substituting the diagnostic target URL address or a parameter in the body unit with the first tampered key-value pair.

The diagnosis apparatus may request a response to the first forged URL address from the diagnosis target server, and may store the response as the first response data (S150). That is, the diagnosis target server may be attacked with the first forged URL address, and the attack result may be stored as the first response data.

Thereafter, the diagnosis apparatus may compare whether the reference response data and the first response data match (S161), and when the reference response data and the first response data do not match, it may determine that the server to be diagnosed has no LFI vulnerability (S162). ). That is, in the case of inconsistency, it can be considered that the diagnosis target server recognizes that the first forged URL address has been tampered with, and performs separate processing such as outputting a warning page for the LFI vulnerability. Accordingly, when the reference response data and the first response data are different from each other, it may be determined that the LFI vulnerability does not exist in the diagnosis target server 200 .

On the other hand, when the reference response data and the first response data match, it may be considered that the diagnosis target server does not recognize that the diagnosis target URL has been altered into the first forged URL address. That is, since the target server did not detect an attack by changing the parameter to a different relative path, it can be determined that the LFI vulnerability exists in the target server.

However, even if there is no actual LFI vulnerability, there may exist a case where the reference response data and the first response data match. Therefore, depending on the embodiment, proceeding to “A” in FIG. 3 , further verifying the existence of the LFI vulnerability. can do.

Specifically, referring to FIG. 4 , when the reference response data and the first response data match, the second modulation key-value pair can be generated by adding at least two identifiers to the value values included in the key-value pair. There is (S210). That is, the diagnosis apparatus may generate the second tampered key-value pair to cause the diagnosis target server to cause an error by requesting a value value that does not exist in the corresponding page.

Thereafter, a second forged URL address may be generated by substituting a parameter in the diagnostic target URL address with the second forged key-value pair, and a response to the second forged URL address may be requested from the diagnostic target server as second response data. It can be stored (S220).

The diagnosis apparatus may determine whether the first response data and the second response data match (S230), and if they match, it may determine that there is no LFI vulnerability in the server to be diagnosed (S240). That is, in the case of the second forged URL address, since it corresponds to an operation of requesting a file that is not in the actual server to be diagnosed, the server to be diagnosed is expected to output an error page including an error message. However, if the first response data and the second response data match, it can be seen that the diagnosis target server recognizes the identifier (“./”) added to the diagnosis target URL address and removes them altogether. Accordingly, when the first response data and the second response data match, the diagnostic apparatus may determine that there is no LFI vulnerability.

On the other hand, if the first response data and the second response data do not match, it may be determined that the LFI vulnerability exists in the server to be diagnosed. That is, it can be seen that the diagnosis target server did not detect any tampering with the diagnosis target URL address and performed an operation accordingly. Specifically, it corresponds to a case in which a response of normally loading a page is performed for the first forged URL address and an error page is output for the second forged URL address. In this case, since the first response data and the second response data do not match, it can be determined that the LFI vulnerability exists. However, even when the first response data and the second response data do not match, there may be a case where the LFI vulnerability does not exist. Accordingly, in order to increase the reconnaissance rate for the LFI vulnerability, it is possible to additionally verify the existence of the LFI vulnerability by proceeding to “B” of FIG. 4 .

Specifically, referring to FIG. 5 , when the first response data and the second response data do not match, the value included in the key-value pair is replaced with the first string combined with the identifier, and the third modulation key-value pair can be generated (S310). Here, the first character string may include arbitrary letters, numbers, symbols, and the like, and may be preset to a specific character string according to an embodiment. That is, the first string is used to modulate to refer to an arbitrary value not included in the current directory, and the third forged URL address generated by the third forged key-value pair causes the diagnosis target server to error can do it

Thereafter, the diagnostic device generates a third forged URL address by substituting a parameter in the diagnostic target URL address with the third forged key-value pair, and requests a response to the third forged URL address from the diagnostic target server to obtain the third response data It can be stored as (S320).

Here, the diagnosis apparatus may determine whether the first response data and the third response data match ( S330 ), and if they match, it may determine that there is no LFI vulnerability in the diagnosis target server. That is, when the first response data and the third response data match, the first response data can be regarded as outputting a warning message according to the addition of the identifier, rather than responding to the actually requested file. For example, when an identifier ("./") is added to the value, the server for diagnosis may be preset to output a warning page, and in this case, the server for diagnosis does not allow forgery of the URL address for diagnosis. Therefore, it can be determined that there is no LFI vulnerability.

On the other hand, when the first response data and the third response data do not match, it can be considered that the diagnosis target server moves and executes the relative path according to the addition of the identifier. That is, the diagnosis target server responds to loading a page normally to the first forged URL address and outputs an error page to the third forged URL address. In this case, since the first response data and the third response data do not match, it can be determined that the LFI vulnerability exists in the server to be diagnosed. Here, depending on the embodiment, by proceeding to “C” of FIG. 5 , it is possible to additionally verify whether the LFI vulnerability exists in the server to be diagnosed.

Specifically, referring to FIG. 6 , when the first response data and the third response data do not match, the value included in the key-value pair is replaced with a second string combined with the identifier, and the fourth modulation key-value A pair may be created (S410). Here, the second character string is different from the first character string, and may include arbitrary letters, numbers, symbols, or the like.

Thereafter, a fourth forged URL address is generated by substituting a parameter in the diagnostic target URL address with the fourth forged key-value pair, and a response to the fourth forged URL address is requested from the diagnostic target server and stored as the fourth response data. There is (S420).

Here, after checking whether the third response data and the fourth response data match (S430), if they match, it may be determined that the LFI vulnerability exists in the server to be diagnosed (S450). That is, the case where the third response data and the fourth response data match corresponds to a case in which the diagnosis target server moves to a relative path by adding an identifier and executes it. Specifically, since an error page according to an incorrect variable reference appears in the third and fourth response data of the server to be diagnosed, the diagnostic apparatus can determine that the server to be diagnosed has an LFI vulnerability.

On the other hand, when the third response data and the fourth response data do not match ( S430 ), the diagnosis target server detects tampering with respect to each and takes a separate action to treat it differently. That is, in the same way that the first response data and the third response data do not match, the third response data and the fourth response data also do not match. . As a result, it can be seen that the diagnosis target server is blocked by its own firewall, settings, development code, etc., so it can be determined that the diagnosis target server does not have an LFI vulnerability (S440).

The present invention described above can be implemented as computer-readable code on a medium in which a program is recorded. The computer-readable medium may continuously store a computer-executable program, or may be temporarily stored for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or several hardware combined, it is not limited to a medium directly connected to any computer system, and may exist distributed on a network. Examples of the medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as CD-ROM and DVD, a magneto-optical medium such as a floppy disk, and those configured to store program instructions, including ROM, RAM, flash memory, and the like. In addition, examples of other media may include recording media or storage media managed by an app store that distributes applications, sites that supply or distribute various other software, or servers. Accordingly, the above detailed description should not be construed as restrictive in all respects but as exemplary. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all modifications within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the above embodiments and the accompanying drawings. For those of ordinary skill in the art to which the present invention pertains, it will be apparent that components according to the present invention can be substituted, modified and changed without departing from the technical spirit of the present invention.

1: terminal device 100: diagnostic device
110: URL collection unit 120: URL modulator
130: diagnosis unit 200: diagnosis target server

Claims (12)

A method for diagnosing vulnerabilities of a diagnostic device for diagnosing LFI (Local File Inclusion) vulnerabilities, the method comprising:
Receiving a diagnosis target URL (Uniform Resource Locator) address extracted from the diagnosis target server;
requesting a response to the diagnosis target URL address from the diagnosis target server and storing it as reference response data;
generating a first modulated URL address in the form of a relative path indicating the same path by modulating parameters included in the diagnosis target URL address;
requesting a response to the first forged URL address from the server to be diagnosed and storing it as first response data; and
If the reference response data and the first response data do not match, the server to be diagnosed includes the step of determining that there is no LFI vulnerability,
The step of generating the first forged URL address is
Vulnerability diagnosis method, characterized in that the relative path is set by adding an identifier indicating the current directory in which the parameter is located.
delete A method for diagnosing vulnerabilities of a diagnostic device for diagnosing LFI (Local File Inclusion) vulnerabilities, the method comprising:
Receiving a diagnosis target URL (Uniform Resource Locator) address extracted from the diagnosis target server;
requesting a response to the diagnosis target URL address from the diagnosis target server and storing it as reference response data;
generating a first modulated URL address in the form of a relative path indicating the same path by modulating parameters included in the diagnosis target URL address;
requesting a response to the first forged URL address from the server to be diagnosed and storing it as first response data; and
If the reference response data and the first response data do not match, the server to be diagnosed includes the step of determining that there is no LFI vulnerability,
The step of generating the first forged URL address is
A method for diagnosing a vulnerability, characterized in that by parsing the diagnosis target URL address, extracting a key value and a value value of a parameter included in the diagnosis target URL address, respectively, and storing the key value and the value value as a key-value pair.
The method of claim 3, wherein the generating of the first forged URL address comprises:
In the key-value pair, an identifier indicating a current directory is added to the value value to generate a first tampered key-value pair, and a parameter in the diagnosis target URL address is substituted with the first tampered key-value pair, Vulnerability diagnosis method, characterized in that generating the first forged URL address.
4. The method of claim 3,
if the parameter is not included in the diagnostic target URL address, checking whether the diagnostic target URL address corresponds to the POST method, and checking whether data exists in a body portion if the diagnostic target URL address corresponds to the POST method; and
If the diagnosis target URL address corresponds to the POST method and data exists in the body part, parsing the parameters included in the body part, extracting each key value and value value, and storing the key-value pair as the key-value pair; Vulnerability diagnosis method, characterized in that it further comprises.
5. The method of claim 4,
If the reference response data and the first response data match, verifying whether the LFI vulnerability exists in the server to be diagnosed.
The method of claim 6, wherein the verifying comprises:
generating a second modulation key-value pair by adding at least two identifiers to the value included in the key-value pair;
A second forged URL address is generated by substituting a parameter in the diagnostic target URL address with the second forged key-value pair, and a response to the second forged URL address is requested from the diagnostic target server as second response data saving; and
If the first response data and the second response data match, the diagnosis target server further comprising the step of determining that there is no LFI vulnerability
8. The method of claim 7,
generating a third modulation key-value pair by replacing the value included in the key-value pair with a first string combined with the identifier when the first response data and the second response data do not match;
A third forged URL address is generated by substituting parameters in the diagnostic target URL address with the third forged key-value pair, and a response to the third forged URL address is requested from the diagnostic target server as third response data saving; and
When the first response data and the third response data match, the method of diagnosing the vulnerability further comprising the step of determining that the server to be diagnosed does not have the LFI vulnerability.
9. The method of claim 8,
generating a fourth modulation key-value pair by replacing the value included in the key-value pair with a second string combined with the identifier when the first response data and the third response data do not match;
A fourth forged URL address is generated by substituting a parameter in the diagnostic target URL address with the fourth forged key-value pair, and a response to the fourth forged URL address is requested from the diagnostic target server as fourth response data saving; and
If the third response data and the fourth response data do not match, determining, by the server to be diagnosed, that there is no LFI vulnerability.
10. The method of claim 9,
When the third response data and the fourth response data match, the method further comprising determining, by the server to be diagnosed, that the LFI vulnerability is included.
A computer program stored in a medium in combination with hardware to perform the method for diagnosing the vulnerability of any one of claims 1 and 3 to 10.
A diagnostic device for diagnosing LFI (Local File Inclusion) vulnerabilities for a server to be diagnosed, comprising:
a URL collection unit for receiving a diagnosis target URL (Uniform Resource Locator) address extracted from a diagnosis target server;
a URL modulator for generating a first modulated URL address in a relative path format indicating the same path by modulating parameters included in the diagnosis target URL address; and
A diagnosis unit that requests a response to the diagnosis target URL address and the first forged URL address from the diagnosis target server, and determines that the diagnosis target server does not have the LFI vulnerability if the responses do not match each other ,
The URL modulator
The diagnosis apparatus according to claim 1, wherein the relative path is set by adding an identifier indicating a current directory in which the parameter is located.

Images