CN106230837A - A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device - Google Patents

A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device Download PDF

Info

Publication number
CN106230837A
CN106230837A CN201610632012.5A CN201610632012A CN106230837A CN 106230837 A CN106230837 A CN 106230837A CN 201610632012 A CN201610632012 A CN 201610632012A CN 106230837 A CN106230837 A CN 106230837A
Authority
CN
China
Prior art keywords
scanning
vulnerability
module
leak
vulnerability scanning
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201610632012.5A
Other languages
Chinese (zh)
Inventor
贺思炜
刘耀
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hunan Suck-Egg Science And Technology Ltd
Original Assignee
Hunan Suck-Egg Science And Technology Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hunan Suck-Egg Science And Technology Ltd filed Critical Hunan Suck-Egg Science And Technology Ltd
Priority to CN201610632012.5A priority Critical patent/CN106230837A/en
Publication of CN106230837A publication Critical patent/CN106230837A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433Vulnerability analysis
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/16Implementing security features at a particular protocol layer
    • H04L63/168Implementing security features at a particular protocol layer above the transport layer

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)

Abstract

The present invention relates to technical field of network information safety, a kind of WEB vulnerability scanning method supporting Dynamic expansion, comprise the following steps, step S101: vulnerability scanning initializes;Step S102: vulnerability scanning task responds;Step S103: vulnerability information loads;Step S104: vulnerability information connects;Step S105: vulnerability scanning result returns.After using said method and structure, the present invention scans just for some leak every time, adds the accuracy of scanning, decreases invalid scanning times;It addition, the present invention additionally uses multi-thread concurrent technology, it is possible to leak multiple to multiple targets scans, and improves the efficiency of scanning simultaneously simultaneously.

Description

A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device
Technical field
The present invention relates to technical field of network information safety, a kind of WEB vulnerability scanning side supporting Dynamic expansion Method and scanning device.
Background technology
WEB leak typically refers to the leak on procedure site, it may be possible to owing to written in code person considers when writing code The former leak thus resulted in of inconsiderate congruence, common WEB leak has Sql injection, Xss leak, uploads leak etc..
Along with the development of network, as far back as 2014, the Number of websites in the whole world has had more than 1,000,000,000, and by In December, 2015, only China's website sum has reached 4,230,000.Corresponding is that web portal security problem is the tightest Weight, as global Openssl heart is bled leak, domestic multiple website user's data leaks etc. event all makes web portal security Problem is increasingly subject to people's attention.
General WEB vulnerability scanners, it is understood that there may be such problem a: once target can only be carried out leak inspection Surveying, scan efficiency is low;A target being carried out all of Hole Detection, scanning speed is slow, and invalid scanning is many simultaneously;Vulnerability database quilt Being integrated in scanning device, vulnerability database information to be increased, scanning device needs to restart, update and even reinstall and could realize, The system expandability is poor.Therefore, when website is carried out vulnerability scanning, complete vulnerability scanning the most faster, more effectively increase The extensibility of vulnerability database is one needs the urgent problem solved.
Application for a patent for invention CN 104320400A discloses a kind of web vulnerability scanning method and device, described vulnerability scanning Method, including: according to receiving time series, it is one group by continuous print K corresponding cluster;Obtain the reality of K the response often organized Average response time and prediction average response time;Average according to the actual average response time often organized in N continuous group and prediction Response time, it is determined whether adjust scanning number of concurrent.Although this invention utilizes the resources such as bandwidth substantially, simultaneously the most not to quilt Scanning movement point load causes excessive impact;But this invention is not for Dynamic expansion.
Summary of the invention
The technical issues that need to address of the present invention are to provide a kind of WEB vulnerability scanning method supporting Dynamic expansion and WEB Vulnerability scanners.
For solving above-mentioned technical problem, the present invention includes a kind of WEB vulnerability scanning method supporting Dynamic expansion, including Following steps,
Step S101: vulnerability scanning initializes, and the software management module of scanning engine carries out vulnerability scanning initialization;
Step S102: vulnerability scanning task responds, by the task respond module responding scanning task of vulnerability scanning module, resolves Scan task, obtains the plugin name that scanning destination address is corresponding with leak;
Step S103: vulnerability information loads, by the Hole Detection module loading Hole Detection plug-in unit of vulnerability scanning module, it is thus achieved that Vulnerability information, detection method and reparation suggestion;
Step S104: vulnerability information connects, by the network communication module of vulnerability scanning module, inserts according to leak scanning target The detection method that part provides is set up HTTP and is connected, and carries out leak existing characteristics the matching analysis to returning data;
Step S105: vulnerability scanning result returns.
Further, in described step S101, vulnerability scanning initialization includes that the software management module by scanning engine opens Dynamic scanning device, loading software arrangements, startup scanning sub-line journey also start to supervise scanning device state.
Further, the described scanning sub-line journey that starts uses multi-thread concurrent.
Further, in described step S103, vulnerability information includes title and the harm of leak, and detection method includes scanning Concrete mode, path, request data and the leak characteristic matching rule used.
Further, in described step S104, vulnerability scanning module is first according in detection method the HTTP request provided Type, sets up the HTTP packet header and message needed according to data therein, is transferred to scan target by network communication module Some path address concrete;Network communication module is sent to vulnerability scanning mould the HTTP request result of the return of scanning target Block, vulnerability scanning module carries out leak existence judgement according to the leak characteristic matching rule in detection method.
Further, in described step S105, vulnerability scanning result includes that leak exists expression, and vulnerability information and leak are repaiied Rebuild view.
Present invention additionally comprises a kind of WEB vulnerability scanners supporting Dynamic expansion, including scanning engine and leak plugin library, Described scanning engine include software management module and vulnerability scanning module, described vulnerability scanning module include task respond module, Network communication module and Hole Detection module;Described software management module is connected with task respond module, and described task responds Module is connected with Hole Detection module, and described Hole Detection module is connected with leak plugin library and network communication module respectively Connect.
After using said method and structure, the present invention scans just for some leak every time, adds the accurate of scanning Property, decrease invalid scanning times;It addition, the present invention additionally uses multi-thread concurrent technology, it is possible to simultaneously many to multiple targets Plant leak to scan simultaneously, improve the efficiency of scanning.
Accompanying drawing explanation
The present invention is further detailed explanation with detailed description of the invention below in conjunction with the accompanying drawings.
Fig. 1 is the flow chart of a kind of WEB vulnerability scanning method supporting Dynamic expansion of the present invention.
Fig. 2 is the structured flowchart of a kind of WEB vulnerability scanners supporting Dynamic expansion of the present invention.
In figure: 1 is software management module, 2 is vulnerability scanning module, and 3 is leak plugin library, and 201 is task respond module, 202 is Hole Detection module, and 203 is network communication module.
Detailed description of the invention
As it is shown in figure 1, a kind of WEB vulnerability scanning method supporting Dynamic expansion of the present invention, comprise the following steps,
Step S101: vulnerability scanning initializes, and the software management module of scanning engine carries out vulnerability scanning initialization;Mainly add Carry configuration, generate management daily record and startup and supervise multiple scanning sub-line journey, call the response of vulnerability scanning module the most simultaneously Multiple different scan task, the biggest improves scan efficiency.
Step S102: vulnerability scanning task responds, by the task respond module responding scanning task of vulnerability scanning module, Resolve scan task, obtain the plugin name that scanning destination address is corresponding with leak;After initialization completes, scanning sub-line journey is passed through Task respond module responding scanning task, resolves scan task parameter, obtains scanning destination address and leak plugin name, then Notice vulnerability scanning module begins preparing for scanning.
Step S103: vulnerability information loads, by the Hole Detection module loading Hole Detection plug-in unit of vulnerability scanning module, Obtain vulnerability information, detection method and reparation suggestion;Wherein vulnerability information includes title and the harm of leak, and detection method includes Concrete mode, path, request data and the leak characteristic matching rule that scanning uses, repairs and advises that being then to provide some repairs The method of this leak and suggestion.
Step S104: vulnerability information connects, by the network communication module of vulnerability scanning module, to scanning target according to leakage The detection method that hole plug-in unit provides is set up HTTP and is connected, and carries out leak existing characteristics the matching analysis to returning data;Leak is swept Retouch the HTTP request type (GET/POST) that module is first according in detection method provide, set up needs according to data therein HTTP packet header and message, be transferred to scan some path address concrete of target by network communication module.
Step S105: vulnerability scanning result returns.Wherein vulnerability scanning result includes that leak exists mark, leak is believed substantially Breath and leak reparation are advised.Wherein, leak exists whether identifier declaration scanning target exists this leak;Leak essential information explanation The information such as leak title, type, harm;Leak reparation suggestion provides the method suggestion of simple this leak of reparation.Middle leak There is mark and represent the concrete condition of this vulnerability scanning, be generally divided into three kinds, leaky, there is no leak and access time-out.When When this vulnerability scanning result is leaky, scanning device can show that vulnerability information and leak reparation are proposed to user, otherwise then carries Show that leak does not exists.
Further, in described step S101, vulnerability scanning initialization includes that the software management module by scanning engine opens Dynamic scanning device, loading software arrangements, startup scanning sub-line journey also start to supervise scanning device state.
Further, the described scanning sub-line journey that starts uses multi-thread concurrent.
Further, in described step S103, vulnerability information includes title and the harm of leak, and detection method includes scanning Concrete mode, path, request data and the leak characteristic matching rule used.
As in figure 2 it is shown, present invention additionally comprises a kind of WEB vulnerability scanners supporting Dynamic expansion, including scanning engine and Leak plugin library 3, it is possible to Dynamic expansion leak plugin library 3, i.e. for the scanning device being currently running, it is possible to automatically identifies that leak is inserted Plug-in unit newly added in part storehouse 3, it is not necessary to scanning device is restarted, updated operations such as even reinstalling.Described scanning engine includes Software management module 1 and vulnerability scanning module 2, described vulnerability scanning module 2 includes task respond module 201, network service mould Block 203 and Hole Detection module 202.Described software management module 1 is connected with task respond module 201, and described task responds Module 201 is connected with Hole Detection module 202, described Hole Detection module 202 respectively with leak plugin library 3 and network service Module 203 is connected.
Described leak plugin library 3 separates with scanning engine, provides leak plug-in unit with the form of plug-in unit for scanning engine, inserts Containing leak title, harm in part, leak detection method and leak reparation suggestion.Described scanning engine includes software management module 1 and vulnerability scanning module 2.Wherein the responsible software that controls of software management module 1 starts/exits, loads configuration information, management scanning Thread and record Operation Log etc.;Vulnerability scanning module 2 includes task respond module 201, network communication module 203 and leak inspection Surveying module 202, wherein task respond module 201 is responsible for responding scanning task, it is provided that destination address to be scanned and leak plug-in unit Name, Hole Detection module 202 loads corresponding Hole Detection plug-in unit from leak plugin library, according to the detection side in leak plug-in unit Method, is set up HTTP by network communication module 203 is connected with scanning target, then according to the data analysis of scanning target return its There is situation in leak, finally returns to Hole Detection result.
Although the foregoing describing the detailed description of the invention of the present invention, but those skilled in the art should be appreciated that this It is merely illustrative of, present embodiment can be made various changes or modifications, without departing from principle and the essence of invention, this The protection domain of invention is only limited by the claims that follow.

Claims (7)

1. the WEB vulnerability scanning method supporting Dynamic expansion, it is characterised in that comprise the following steps,
Step S101: vulnerability scanning initializes, and the software management module of scanning engine carries out vulnerability scanning initialization;
Step S102: vulnerability scanning task responds, by the task respond module responding scanning task of vulnerability scanning module, resolves Scan task, obtains the plugin name that scanning destination address is corresponding with leak;
Step S103: vulnerability information loads, by the Hole Detection module loading Hole Detection plug-in unit of vulnerability scanning module, it is thus achieved that Vulnerability information, detection method and reparation suggestion;
Step S104: vulnerability information connects, by the network communication module of vulnerability scanning module, inserts according to leak scanning target The detection method that part provides is set up HTTP and is connected, and carries out leak existing characteristics the matching analysis to returning data;
Step S105: vulnerability scanning result returns.
2. according to a kind of WEB vulnerability scanning method supporting Dynamic expansion described in claim 1, it is characterised in that: described step In rapid S101 vulnerability scanning initialize include by the software management module of scanning engine start scanning device, load software arrangements, Start scanning sub-line journey and start to supervise scanning device state.
3. according to a kind of WEB vulnerability scanning method supporting Dynamic expansion described in claim 2, it is characterised in that open described in: Dynamic scanning sub-line journey uses multi-thread concurrent.
4. according to a kind of WEB vulnerability scanning method supporting Dynamic expansion described in claim 1, it is characterised in that: described step In rapid S103, vulnerability information includes title and the harm of leak, and detection method includes the concrete mode of scanning use, path, request Data and leak characteristic matching rule.
5. according to a kind of WEB vulnerability scanning method supporting Dynamic expansion described in claim 4, it is characterised in that:
In described step S104, vulnerability scanning module is first according in detection method the HTTP request type provided, according to therein Data set up the HTTP packet header and message needed, and are transferred to scan some ground, path concrete of target by network communication module Location;Network communication module is sent to vulnerability scanning module, vulnerability scanning module the HTTP request result of the return of scanning target Leak existence judgement is carried out according to the leak characteristic matching rule in detection method.
6. according to a kind of WEB vulnerability scanning method supporting Dynamic expansion described in claim 1, it is characterised in that: described step In rapid S105, vulnerability scanning result includes that leak exists expression, vulnerability information and leak reparation suggestion.
7. the WEB vulnerability scanners supporting Dynamic expansion, it is characterised in that: include scanning engine and leak plugin library, institute State scanning engine and include that software management module and vulnerability scanning module, described vulnerability scanning module include task respond module, net Network communication module and Hole Detection module;Described software management module is connected with task respond module, described task response mould Block is connected with Hole Detection module, and described Hole Detection module is connected with leak plugin library and network communication module respectively.
CN201610632012.5A 2016-08-04 2016-08-04 A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device Pending CN106230837A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610632012.5A CN106230837A (en) 2016-08-04 2016-08-04 A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610632012.5A CN106230837A (en) 2016-08-04 2016-08-04 A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device

Publications (1)

Publication Number Publication Date
CN106230837A true CN106230837A (en) 2016-12-14

Family

ID=57547617

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610632012.5A Pending CN106230837A (en) 2016-08-04 2016-08-04 A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device

Country Status (1)

Country Link
CN (1) CN106230837A (en)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106843933A (en) * 2016-12-27 2017-06-13 北京五八信息技术有限公司 A kind of leak restorative procedure of application program, mobile terminal and patch server
CN107423624A (en) * 2017-04-12 2017-12-01 北京奇虎科技有限公司 terminal system vulnerability scanning method and device
CN107528860A (en) * 2017-10-12 2017-12-29 中国科学院计算机网络信息中心 Network security method of testing, system and storage medium
CN108334784A (en) * 2018-02-02 2018-07-27 杭州迪普科技股份有限公司 A kind of vulnerability scanning method and apparatus
CN109409093A (en) * 2018-10-19 2019-03-01 杭州安恒信息技术股份有限公司 A kind of system vulnerability scan schedule method
CN109656634A (en) * 2018-11-29 2019-04-19 西安四叶草信息技术有限公司 Plug-in unit call method and equipment
CN109714371A (en) * 2019-03-12 2019-05-03 国网新疆电力有限公司电力科学研究院 A kind of industry control network safety detecting system
CN109818972A (en) * 2019-03-12 2019-05-28 国网新疆电力有限公司电力科学研究院 A kind of industrial control system information security management method, device and electronic equipment
CN109936576A (en) * 2019-03-12 2019-06-25 国网新疆电力有限公司电力科学研究院 A kind of vulnerability mining device
CN109933990A (en) * 2019-03-12 2019-06-25 国网新疆电力有限公司电力科学研究院 Security breaches discovery method, apparatus and electronic equipment based on multi-mode matching
CN110460571A (en) * 2019-07-05 2019-11-15 深圳壹账通智能科技有限公司 Operation system loophole processing method, device, computer equipment and storage medium
CN112182590A (en) * 2020-11-16 2021-01-05 中国银联股份有限公司 Vulnerability updating method and device for Web application
CN114726607A (en) * 2022-03-30 2022-07-08 深圳市迈腾电子有限公司 Network security monitoring system based on switch monitoring network data

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030212779A1 (en) * 2002-04-30 2003-11-13 Boyter Brian A. System and Method for Network Security Scanning
CN104506541A (en) * 2014-12-29 2015-04-08 北京奇虎科技有限公司 Website loophole alarming method and device
CN105429955A (en) * 2015-10-30 2016-03-23 西安四叶草信息技术有限公司 Remote vulnerability detection method
CN105430002A (en) * 2015-12-18 2016-03-23 北京奇虎科技有限公司 Vulnerability detection method and device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030212779A1 (en) * 2002-04-30 2003-11-13 Boyter Brian A. System and Method for Network Security Scanning
CN104506541A (en) * 2014-12-29 2015-04-08 北京奇虎科技有限公司 Website loophole alarming method and device
CN105429955A (en) * 2015-10-30 2016-03-23 西安四叶草信息技术有限公司 Remote vulnerability detection method
CN105430002A (en) * 2015-12-18 2016-03-23 北京奇虎科技有限公司 Vulnerability detection method and device

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
刘明明: "Web应用漏洞扫描器的设计与实现", 《万方数据知识服务平台》 *

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106843933A (en) * 2016-12-27 2017-06-13 北京五八信息技术有限公司 A kind of leak restorative procedure of application program, mobile terminal and patch server
CN107423624A (en) * 2017-04-12 2017-12-01 北京奇虎科技有限公司 terminal system vulnerability scanning method and device
CN107423624B (en) * 2017-04-12 2021-06-01 北京奇虎科技有限公司 Terminal system vulnerability scanning method and device
CN107528860A (en) * 2017-10-12 2017-12-29 中国科学院计算机网络信息中心 Network security method of testing, system and storage medium
CN108334784A (en) * 2018-02-02 2018-07-27 杭州迪普科技股份有限公司 A kind of vulnerability scanning method and apparatus
CN109409093A (en) * 2018-10-19 2019-03-01 杭州安恒信息技术股份有限公司 A kind of system vulnerability scan schedule method
CN109656634A (en) * 2018-11-29 2019-04-19 西安四叶草信息技术有限公司 Plug-in unit call method and equipment
CN109936576A (en) * 2019-03-12 2019-06-25 国网新疆电力有限公司电力科学研究院 A kind of vulnerability mining device
CN109818972A (en) * 2019-03-12 2019-05-28 国网新疆电力有限公司电力科学研究院 A kind of industrial control system information security management method, device and electronic equipment
CN109933990A (en) * 2019-03-12 2019-06-25 国网新疆电力有限公司电力科学研究院 Security breaches discovery method, apparatus and electronic equipment based on multi-mode matching
CN109933990B (en) * 2019-03-12 2020-12-29 国网新疆电力有限公司电力科学研究院 Multi-mode matching-based security vulnerability discovery method and device and electronic equipment
CN109714371A (en) * 2019-03-12 2019-05-03 国网新疆电力有限公司电力科学研究院 A kind of industry control network safety detecting system
CN109818972B (en) * 2019-03-12 2021-07-09 国网新疆电力有限公司电力科学研究院 Information security management method and device for industrial control system and electronic equipment
CN110460571A (en) * 2019-07-05 2019-11-15 深圳壹账通智能科技有限公司 Operation system loophole processing method, device, computer equipment and storage medium
CN110460571B (en) * 2019-07-05 2022-11-04 深圳壹账通智能科技有限公司 Business system vulnerability processing method and device, computer equipment and storage medium
CN112182590A (en) * 2020-11-16 2021-01-05 中国银联股份有限公司 Vulnerability updating method and device for Web application
CN114726607A (en) * 2022-03-30 2022-07-08 深圳市迈腾电子有限公司 Network security monitoring system based on switch monitoring network data
CN114726607B (en) * 2022-03-30 2024-04-09 深圳市迈腾电子有限公司 Network security monitoring system based on switch monitoring network data

Similar Documents

Publication Publication Date Title
CN106230837A (en) A kind of WEB vulnerability scanning method supporting Dynamic expansion and scanning device
CN103297475B (en) Mock service system and the processing method of Mock service
KR102024694B1 (en) Decentralized service platform using multiple service nodes based on block chain
CN101667230B (en) Method and device for monitoring script execution
CN109688097A (en) Website protection method, website protective device, website safeguard and storage medium
CN107678776A (en) Multimode version dependence construction method, device, server and storage medium
CN106203120A (en) A kind of multiple spot Hook reverse method for Android reinforcement application
CN104102358A (en) Privacy information protecting method and privacy information protecting device
CN105607935A (en) Application updating method and terminal and server
CN103634315A (en) Front end control method and system of domain name server (DNS)
CN103136478B (en) A kind of method for managing security of terminal applies and system
CN101408899A (en) Method and apparatus for switching website multiple data sources
CN110083391A (en) Call request monitoring method, device, equipment and storage medium
CN102821137A (en) Website safety detection method and website safety detection system
CN105162768A (en) Method and device for detecting phishing Wi-Fi hotspots
CN107026871A (en) Web vulnerability scanning method based on cloud computing
CN107145784A (en) A kind of method of vulnerability scanning, device and computer-readable medium
CN105808702A (en) Page content refreshing method and system, and page content synchronous refreshing management system
CN110381101A (en) API gateway control system, control method, equipment and medium
CN101184103A (en) Method for accessing wireless service server through mobile terminal equipment
CN102088477A (en) Website content anti-acquisition system and method thereof
CN106302515B (en) A kind of method and apparatus of web portal security protection
CN101950339B (en) Security protection method and system of computer
JP2017117354A (en) Information leakage prevention system and method
CN105933467A (en) Periodic detection method for information change of client host

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20161214