TW201401095A - Weakness scanning system for network, scanning method and computer-readable storage media thereof - Google Patents

Abstract

A weakness scanning system for network is applied to target server, wherein the target server at least stores a web page for building a website. The weakness scanning system a control module and a transmission/ receiving module. The control module loads and executes a detection instruction and stores a weakness. The control generates a detecting string by executing the detection software. The transmission/ receiving module receives the detecting string and transfer the detecting string to the target server. The target server receives and executes the detecting string, executes for the web page of the website and generates an execution result corresponding to the execution. The target server transfers the execution result back to the control module of the detection host, the control compares the execution result with the weakness chart and determines at least a weakness is detected in the webpage of the website accordingly.

Description

Network vulnerability detection system, detection method and computer readable storage medium thereof

The invention relates to a network vulnerability detection system, a detection method and a computer readable storage medium thereof, and particularly relates to a network vulnerability detection system, a detection method and a computer thereof for detecting a specific website by using a remote detection method Readable storage media.

With the rapid development of network technology and cloud technology, the Internet has become an indispensable communication tool and interactive medium for interaction between people. Due to the immediacy of information transmission and the spread of information on the Internet, Any information can be quickly spread to every corner of the world through the Internet. Because of the characteristics of the Internet, the application of related network technologies is no longer limited to pure message transmission or data exchange. Further extending to different levels of leisure and entertainment, commodity trading, and even gold trade, the information transmitted or exchanged is not limited to simple text content, but also includes multimedia pictures, videos and the latest developments of interactive information. However, in response to the aforementioned types of information, the websites that present the above information content must also integrate different functions and program types.

As mentioned above, since the application of the current network has been extended to various fields, relatively, the maintenance of the confidentiality and security of the transmitted or exchanged information content is increasingly important, specifically for financial transactions, business. Information such as trade or personal privacy is the target of unscrupulous people. In addition, since most websites currently have to integrate and link different functions and program types to cope with various types of information, different web pages of the website may include different program types and be written in different kinds of programming languages. This also makes it difficult to maintain the security of the website. Relatively improved, the types of common website attacks currently include three main types: (1) website information side-recording; (2) website information tampering; and (3) website 瘫痪, and common attacks include: (1) Cross-site intrusion string (XSS, also known as cross-site scripting attack), the web application directly sends the execution request from the user back to the browser for execution, so that the attacker can retrieve the user's Small text file (Cookie) or session (Session) data can be faked and directly logged into a legitimate user; (2) Injection Flaw: The web application executes malicious instructions from the external including the database, structured Attacks such as Query Language Injection (SQL Injection) and Command Implicit Attack (Command Injection) are included; (3) Malicious File Execution: Web applications are introduced from outside Malicious files and executable file content; (4) Insecure Direct Object Reference: The attacker uses the file of the web application itself Read function to access files or important data; (5) Cross-Site Request Forgery (CSRF): legitimate users who have logged into the web application execute malicious instructions, but web applications However, it is treated as a legitimate requirement, so that malicious instructions are executed normally; (6) Information Leakage and Improper Error Handling: the execution error message of the web application contains sensitive information; (7) the damaged information Broken Authentication and Session Management: Defective identity verification functions written in web applications; (8) Insecure Cryptographic Storage: Web applications are not sensitive Sexual data using encryption, using weaker encryption algorithms or storing keys where they are easily accessible; (9) unsafe communication (Insecure Communication): The encryption method is not used when transmitting sensitive data; (10) Failure to Restrict URL Access: Some web pages have direct access to the website because they do not have permission control. Different types of attack methods. In the face of an endless stream of cyber attacks, in order to prevent specific websites from being attacked by various types and means, how can website administrators and information security vendors predict in advance the specific website's possible weaknesses, and then analyze how to correct them? Specific websites, in order to overcome weaknesses, to avoid the fact that specific websites are being shackled or stored information being side-recorded or tampered with, thereby achieving the goal of maintaining network security, is an urgent task that must be solved at present.

However, looking at the website security maintenance software currently available on the market, it only passively reminds website administrators to block possible website vulnerabilities after the website detects the attack, or passively receives general website weaknesses issued by information security vendors. Updates do not immediately and effectively detect potential weaknesses or vulnerabilities specific to a particular site, and provide actionable fixes to improve the security of a particular site and prevent it from happening.

In view of the above problems, the present invention provides a network vulnerability detection system, a detection method, and a computer readable storage medium for detecting a specific website by using a remote detection method, so as to solve the problem that the used website and related information are susceptible to The problem of cyber attacks, while overcoming the practice of webmasters can only negatively prevent the weaknesses of websites that have been attacked, provide vulnerability analysis reports and correction suggestions specific to specific websites, thereby improving the security and privacy of specific websites. .

The invention discloses a network vulnerability detection system, which is suitable for a target server. The target server stores at least one network page for constructing a website; the network vulnerability detection system includes a control module and a transmission/reception module. The control module stores a detection software and a weak point comparison table, and the control module generates a detection string through the detection software. The transmission/reception module receives the detection string and transmits the detection string to the target server. The target server receives the detection string, performs a detection string on the webpage of the website, and generates an execution result correspondingly, and the target server transmits the execution result to the transmission/reception module of the detection host and returns to the control module, and controls The module compares the execution result and the vulnerability comparison table, and correspondingly determines that the website page has at least one weakness.

Corresponding to the foregoing network vulnerability detection system, the present invention further discloses a network vulnerability detection method, which is applicable to a target server, wherein the target server stores at least one network page for constructing a website; network weakness The detection method includes the following steps: generating a detection string through a detection software by a control module; transmitting the detection string to a transmission/reception module by the control module; and transmitting by the transmission/reception module Transmitting the detection string to a target server; wherein after receiving the detection string, the target server executes the detection string for a web page of the website and correspondingly generates an execution result; receiving by the transmission/reception module The execution result is returned to the control module; and the control module compares the execution result and the vulnerability comparison table, and correspondingly determines that the page of the website has at least one weakness.

Corresponding to the foregoing network vulnerability detection method, the present invention further discloses a computer readable storage medium, which stores a detection software, and the detection software is used in a network vulnerability detection system and is implemented by the following steps: a control module generates a detection string through the detection software; the control module transmits the detection string to a transmission/reception module; and transmits the detection by the transmission/reception module Testing the string to a target server; wherein after receiving the detection string, the target server executes the detection string for a web page of the website and correspondingly generates an execution result; receiving the execution by the transmission/reception module The result is returned to the control module; and the control module compares the execution result and the vulnerability comparison table, and correspondingly determines that the page of the website has at least one weakness.

The function of the invention is that the detecting host actively generates a detection string through the detection software and transmits the detection string to the target server storing the specific website, and performs according to the execution result of the target server backhaul and the weak point comparison table in the detection host. The comparison, in turn, determines whether the website has potential weaknesses, and then provides a dedicated vulnerability analysis report and improvement suggestions for the specific website for the network administrator to use as a reference for maintaining the website, thereby improving the specific website. Safety and reliability.

The features, implementations, and utilities of the present invention are described in detail below with reference to the drawings.

The network vulnerability detection system, the detection method and the computer readable storage medium of the present invention comprise two different embodiments, which are respectively described by the inventors.

In the first embodiment, referring to FIG. 1 and FIG. 2, the present invention discloses a network vulnerability detection system 10, which is applicable to a target server 200, wherein the target server stores at least one website. A web page. It is worth noting that the web pages of the websites described herein include, but are not limited to, pages written in HyperText Markup Language (HTML), pages written in Structured Query Language (SQL). , dynamic server pages (Active Server Pages, ASP) pages, or in the extended markup language (Extensible Different types of web pages, such as pages written by Markup Language, XML). In addition, the number of pages and the links and structures between the pages are not limited by the content disclosed in the present invention, and those skilled in the art have to follow the website. The type and usage requirements are subject to change or adjustment without departing from the spirit of the invention.

As shown in FIG. 1 and FIG. 2, the network vulnerability detection system 10 includes a detection host 10, and the detection host 10 includes a control module 101 and a transmission/reception module 102. The control module 101 and the transmission/reception module 102 can be independently configured computer hosts connected to each other by a signal line or a network. The control module 101 and the transmission/reception module 102 can also be integrated into a single detection host 100 and electrically connected to the target server 200.

The control module 101 stores a detection software and a vulnerability comparison table 500. The control module 101 loads and executes the detection software to generate a detection string through the detection software. The control module 101 analyzes the execution result according to the execution result to determine whether the specific website has potential weaknesses. The vulnerability comparison table 500 lists the types of execution results returned by the target server 200 and potential weaknesses that may be attributed to the corresponding execution results for the control module 101 to perform comparison and analysis.

The transmission/reception module 102 is connected to the control module 101 and the target server 200. The transmission/reception module 102 is configured to receive a detection string generated by the control module 101 through the detection software. The transmission/reception module 102 transmits the detection packet to the target server 200 corresponding to the detection detection string. At the same time, the transmission/reception module 102 also receives the packet corresponding to the execution result of the target server 200, and converts it into a signal type that can be read by the control module 101, and transmits it back to the control module 101 for analysis and Judging.

Referring to FIG. 3 and FIG. 4, in the embodiment, when the network vulnerability detection system 10 performs vulnerability detection for a specific website, the control module 101 generates a detection string 300 through the detection software. S101).

In one embodiment, the detection string 300 detects a dynamic execution script in the page of the website, and the control module 101 detects a Structured Query Language (SQL) instruction in the dynamic execution script. In another embodiment, the detection string 300 detects pages written in the Extensible Markup Language (XML) on the website.

It should be noted that the foregoing detection string 300 is merely an example, and the detection string 300 includes, but is not limited to, an application error message for different types of specific websites or pages written in different programming languages. , Code execution, Cookie manipulation, CRLF injection, Cross Frame Scripting, Cross Site Scripting, Directory traversal , File inclusion, Full path disclosure, LDAP injection, PHP code injection, Remote XSL inclusion, Script source code disclosure, structured SQL injection, URL redirection, XPath injection, Backup Files, URIs exist across sites Cross Site Scripting in URI, script error, path exists across the network Scripting (Cross Site Scripting in path), the directory permissions (Directory permissions), hypertext agreement refers to A detection string for different detection methods such as HTTP Verb Tampering, Possibile Sensitive Directories, or Possibile Sensitive File.

After the generation of the detection string 300 is completed, the control module 101 transmits the detection string 300 to the detection transmission/reception module 102 (S105). The transmission/reception module 102 converts the detection string 300 into a form of a packet, and transmits the detection string 300 to the target server 200 (S110).

As described above, after the target server 200 receives the detection string 300 (S115), the target server 200 executes the detection string 300 for a web page of the website, and correspondingly generates an execution result 400 (S120).

The target server 200 converts the execution result 400 into a form of a network packet, and the target server 200 transmits the execution result 400 to the transmission/reception module 102 in the form of a network packet (S125).

The transmission/reception module 102 converts the execution result 400 in the form of a packet into an identifiable signal form and transmits it back to the control module 101 (S130).

The control module 101 compares the execution result 400 with the vulnerability comparison table 500 (S135).

If the execution result 400 matches the vulnerability comparison table 500, the control module 101 correspondingly determines that the page of the specific website has at least one weakness (S140); if the execution result 400 does not match the vulnerability comparison table 500, the control module 101 correspondingly determines The page of a particular website has no such weakness (S145). The detection of the target server 200 by the different types of detection strings 300 is performed in this manner, and the control module 101 can detect the potential weaknesses of the specific website and analyze the feasible correction suggestions.

In the second embodiment, the network vulnerability detection system 10 of the present invention has a module composition and an electrical connection relationship similar to those of the first embodiment, but the difference is, in this embodiment, the control In addition to detecting the weakness of a specific website, the control module 100 also generates a detection signal through the detection software, and analyzes the page of the specific website according to the network mapping signal returned by the target server 200. The distribution structure and location (Uniform Resource Locator, URL) status to find all network pages, and obtain the distribution structure and address of the network pages. The distribution structure and addressing described in this section include, but are not limited to, the information of each page that constitutes the website, the type and details of the information, the site map of the website, and the location status of each page.

In this embodiment, the steps (S230-S275) of performing the vulnerability detection for the specific website by the control module 101 of the network vulnerability detection system 10 are similar to those of the first embodiment (S101~S145), please refer to 1 to 4 and the description of the first embodiment, the inventors will not repeat here.

Please refer to FIG. 5 and FIG. 6 , and refer to FIG. 1 and FIG. 2 simultaneously. When the control module 101 performs the weakness detection of a specific website (S230-S275), the control module 101 transmits the detection software. A detection signal 600 is generated to the transmission/reception module 102 (S201).

After receiving the detection signal 600, the transmission/reception module 102 converts the network into a network packet, and the transmission/reception module 102 transmits the detection signal 600 in the form of a packet to the target server 200 (S205), and the target server 200 receives The detection signal 600 is detected (S210), and a network mapping signal 700 of the website is generated according to the content of the page of the stored website (S215).

Then, the target server 200 transmits a network mapping signal 700 to the transmission/reception module 102 of the detection host 100 and transmits it back to the control module 101 (S220). The control module 101 according to the network structure image The signal 700 determines the distribution structure and address (Uniform Resource Locator, URL) status of the website (175), whereby the control module 101 can analyze the website information of the specific website and find all the website pages constituting the website (S225).

Next, the control module 101 performs the steps of detecting the weaknesses one by one for each website page (S230~S275), so as to analyze the pages with weak points among all the pages of the website, and analyze the weakness patterns of each page.

In this embodiment, finally, after the control module 101 determines the distribution structure and address (Uniform Resource Locator, URL) status of the website and determines that the page of the website has a weakness, the control module 101 according to the distribution structure and address of the page. And the vulnerability generates a network vulnerability detection report (S280) corresponding to the website.

The Network Vulnerability Detection Report integrates the aforementioned website analysis and provides corresponding correction suggestions for this website as a reference for website maintenance or network security maintainers to maintain or correct the website to avoid Internet access. Different means of attack to improve the security, stability and privacy of this website. It is worth noting that the timing of the network vulnerability detection report is not limited to the completion of vulnerability detection and website analysis. The website administrator can also choose to generate network vulnerability detection immediately after executing any of the above detection items. Reporting, this will help reduce the time and efficiency of the detection process.

Corresponding to the network vulnerability detection system and the detection method of the foregoing first embodiment and the second embodiment, the present invention further discloses a computer readable storage medium, which stores a detection For the steps of the software and the detection software for the network vulnerability detection system and the implementation thereof, please refer to the disclosures of the first embodiment and the second embodiment, and the inventors will not repeat them here.

The network vulnerability detection system of the present invention, through the network vulnerability detection method and the computer readable storage medium, detects that the host can periodically connect to the target server for storing a specific website by using a remote connection manner. Detecting the weaknesses of the website and the content of the webpage, and comparing it with the vulnerability table built into the detection host to determine whether the website has potential weaknesses, and collecting the content corresponding to the website to generate the exclusive content of the website. The network vulnerability detection report and correction suggestions are used as a reference for website administrators or network security maintainers, and further suggestions for website correction or maintenance are provided to avoid different attacks from the Internet, thereby enhancing the website. Safety, stability and privacy.

In addition, in the present invention, the target server does not need to install any interface software, and the detection host can directly detect and judge the target server, which helps the network security maintainer to detect different servers at the same time. And management, and reduce the maintenance of client site administrators, thereby reducing maintenance costs.

Furthermore, the network vulnerability detection system of the present invention can simultaneously detect the specific website with the latest global information, so as to provide a dedicated network vulnerability detection report and correction suggestions, so that the website administrators of each website The latest and most complete information can be obtained, and the potential weaknesses or vulnerabilities of the website can be known in advance before the website is maliciously attacked, and the anti-blocking and repairing of the website can be effectively done to avoid malicious attacks or information browsing. In order to improve the security, stability and privacy of each website, prevent it from happening.

Although the embodiments of the present invention are disclosed above, it is not intended to limit the present invention, and those skilled in the art, regardless of the spirit and scope of the present invention, the shapes, structures, and features described in the scope of the present application. And the number of modifications may be made, and the scope of patent protection of the present invention shall be determined by the scope of the patent application attached to the specification.

10‧‧‧Network Weakness Detection System

100‧‧‧Detecting host

101‧‧‧Control Module

102‧‧‧Transmission/reception module

200‧‧‧target server

300‧‧‧detection string

400‧‧‧Execution results

500‧‧‧ Weakness comparison table

600‧‧‧Detection signal

700‧‧‧Network structure image signal

FIG. 1 is a schematic diagram showing the connection of the network vulnerability detection system according to the first embodiment and the second embodiment of the present invention.

FIG. 2 is a block diagram showing the components of the network vulnerability detection system according to the first embodiment and the second embodiment of the present invention.

FIG. 3 is a flow chart showing the steps of the network vulnerability detection method according to the first embodiment of the present invention.

FIG. 4 is a schematic diagram of a network vulnerability detection method according to a first embodiment of the present invention.

FIG. 5 is a flow chart showing the steps of the network vulnerability detection method according to the second embodiment of the present invention.

FIG. 6 is a schematic diagram of a network vulnerability detection method according to a second embodiment of the present invention.

10‧‧‧Network Weakness Detection System

100‧‧‧Detecting host

200‧‧‧target server

500‧‧‧ Weakness comparison table

Claims (11)

A network vulnerability detection system is applicable to a target server, wherein the target server stores at least one network page for constructing a website; the network vulnerability detection system includes: a detection host, including a control module storing a detection software and a weak point comparison table, the control module generating a detection string through the detection software; and a transmission/reception module connected to the control module and the target servo And receiving the detection string from the control module, and transmitting the detection string to the target server; wherein the target server receives the detection string, and executing the detection word for the webpage of the website And the target server generates an execution result, and the target server transmits the execution result to the transmission/reception module and returns the control module to the control module, and the control module compares the execution result and the vulnerability comparison table, and correspondingly determines The page of the website has at least one weakness. The network vulnerability detection system of claim 1, wherein the control module generates a detection signal to the transmission/reception module through the detection software, and the transmission/reception module transmits the detection. Signaling to the target server, wherein the target server receives the detection signal, and correspondingly transmits a network mapping signal of the website to the transmission/reception module of the detection host and transmits back to The control module determines the distribution structure and the location of the page (Uniform Resource Locator, URL) of the website according to the network distribution status signal. The network vulnerability detection system of claim 1, wherein the detection string detects a dynamic execution script in the page of the website. The network vulnerability detection system of claim 3, wherein the control module detects a Structured Query Language (SQL) instruction in the dynamic execution script. The network vulnerability detection system of claim 1, wherein the detection string detects the page in the website written in Extensible Markup Language (XML). A network vulnerability detection method is applicable to a target server, wherein the target server stores at least one network page for constructing a website; the network vulnerability detection method includes the following steps: detecting a host by using a method One of the control modules generates a detection string through a detection software; the control module transmits the detection string to a transmission/reception module; and transmits the detection word to the transmission/reception module of the detection host Serializing to a target server; wherein the target server receives the detection string, executing the detection string for a web page of the website and correspondingly generating an execution result; receiving the execution result by the transmission/reception module And returning to the control module; and comparing the execution result and the vulnerability comparison table with the control module, and correspondingly determining that the page of the website has at least one weakness. The network vulnerability detection method of claim 6 further includes the following steps: the control module generates a detection signal through the detection software to the transmission/connection Receiving a module; the transmitting/receiving module transmits the detecting signal to the target server; the target server receives the detecting signal and correspondingly transmitting a network mapping signal of the website to the transmission And receiving the module and transmitting it back to the control module; the control module determines the distribution structure and the location (Uniform Resource Locator, URL) status of the page of the website according to the network structure image signal. The network vulnerability detection method according to claim 6, wherein the control module determines a distribution structure and a location (Uniform Resource Locator, URL) status of the page of the website, and determines that the page of the website has the weakness. Afterwards, the control module generates a network vulnerability detection report according to the distribution structure and address of the page and the vulnerability corresponding to the website. A computer-readable storage medium for storing a detection software, the detection software being used in a network vulnerability detection system and implementing the steps includes the following steps: one of the detection host controls the module to pass the detection The software generates a detection string; the control module transmits the detection string to a transmission/reception module; and the transmission/reception module of the detection host transmits the detection string to a target server; wherein the target After receiving the detection string, the server executes the detection string for a web page of the website and correspondingly generates an execution result; receiving the execution result by the transmission/reception module and transmitting the result to the control module; The control module compares the execution result and the weak point comparison table, and correspondingly judges Breaking the page of the site has at least one weakness. The computer-readable storage medium of claim 9, wherein the detecting software is used in the network vulnerability detecting system and the method comprises: the detecting module of the detecting host transmits the detecting The software generates a detection signal to the transmission/reception module; the transmission/reception module of the detection host transmits the detection signal to the target server; the target server receives the detection signal and transmits the corresponding detection signal A network mapping signal of the website is sent to the transmission/reception module of the detection host and transmitted back to the control module; the control module determines the page of the website according to the network structure image signal The distribution structure and location (Uniform Resource Locator, URL) status. The computer readable storage medium of claim 9, wherein the detection software is used in the network vulnerability detection system and the control module is implemented to determine the distribution structure and address of the page of the website (Uniform) Resource Locator, URL) status and after determining that the page of the website has the weakness, the control module generates a network vulnerability detection report according to the distribution structure and address of the page and the vulnerability corresponding to the website.