CN109657472A - SQL injection leak detection method, device, equipment and readable storage medium storing program for executing - Google Patents
SQL injection leak detection method, device, equipment and readable storage medium storing program for executing Download PDFInfo
- Publication number
- CN109657472A CN109657472A CN201811188829.3A CN201811188829A CN109657472A CN 109657472 A CN109657472 A CN 109657472A CN 201811188829 A CN201811188829 A CN 201811188829A CN 109657472 A CN109657472 A CN 109657472A
- Authority
- CN
- China
- Prior art keywords
- request
- response page
- sequence
- sql injection
- requests
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer And Data Communications (AREA)
- Debugging And Monitoring (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a kind of SQL injection leak detection method, device, equipment and readable storage medium storing program for executing, the method comprising the steps of: after the uniform resource position mark URL for getting website to be tested is requested, it determines the test point of the URL request, and constructs the sequence of requests that the test point corresponds to Boolean logic parameter；The response page for executing and obtaining after the URL request and the sequence of requests is obtained, similarity analysis is carried out to the response page, the URL request is obtained and corresponds to similarity value between response page response page corresponding with request each in the sequence of requests；If the similarity value meets preset condition, it is determined that there are SQL injection loopholes for the URL request.The present invention judges that URL request with the presence or absence of SQL injection loophole, improves the accuracy rate of detection SQL injection loophole by the similarity between the page according to response.
Description
Technical field
The present invention relates to field of communication technology more particularly to a kind of SQL injection leak detection method, device, equipment and can
Read storage medium.
Background technique
At present to the detection method of SQL (Structured Query Language, structured query language) injection loophole
Pass through the detection method judged based on boolean.Currently based on the SQL injection leak detection method that boolean judges, in detection sequence
Request aspect, usually original URL request is primary, reconstructs the SQL statement parameter value an of logical truth, logical falsehood
The request of SQL statement parameter value, totally 3 requests.In the websites response page that comparison judgement is repeatedly requested, usually according to net
The message length (Content-Length) responded stand to determine whether there are SQL injection loopholes.But due to network fluctuation, clothes
The appearance of the unstability factors such as business device load condition variation and the dynamic web page under the Web2.0 epoch, causes to pass through boolean
Judge low with the presence or absence of the accuracy rate of SQL injection loophole to detect URL request.
Summary of the invention
The main purpose of the present invention is to provide a kind of SQL injection leak detection method, device, equipment and readable storage mediums
Matter, it is intended to solve the low technical problem of the accuracy rate of existing detection SQL injection loophole.
To achieve the above object, the present invention provides a kind of SQL injection leak detection method, the SQL injection Hole Detection
Method comprising steps of
After the uniform resource position mark URL for getting website to be tested is requested, the test point of the URL request is determined,
And construct the sequence of requests that the test point corresponds to Boolean logic parameter；
The response page for executing and obtaining after the URL request and the sequence of requests is obtained, the response page is carried out
Similarity analysis, obtain the URL request correspond to response page response page corresponding with request each in the sequence of requests it
Between similarity value；
If the similarity value meets preset condition, it is determined that there are SQL injection loopholes for the URL request.
Preferably, the step of construction test point corresponds to the sequence of requests of Boolean logic parameter include:
The request that a logical truth condition is constructed for each test point in the URL request is denoted as the first true request；
The request that a logic false condition is constructed for each test point in the URL request is denoted as the first false request, with
Being formed includes the described first true sequence of requests requested with the first false request.
Preferably, each test point in the URL request constructs the request of a logic false condition, is denoted as the
One false request includes the steps that the described first very sequence of requests of request and the first false request includes: to be formed
The request that a logic false condition is constructed for each test point in the URL request is denoted as the first false request, and
For the confirmation request of the described first true request true condition of constitutive logic, it is denoted as the second true request；
For the confirmation request of the described first false request constitutive logic false condition, it is denoted as the second false request, includes institute to be formed
State the sequence of requests of the first true request, the first false request, the second true request and the second false request.
Preferably, if the similarity value meets preset condition, it is determined that there are SQL injection leakages for the URL request
The step of hole includes:
If it is determined that corresponding first response page of the URL request really requests corresponding second response page with described first
Between first it is outstanding block German number and be greater than first threshold, then judge that first response page is corresponding with the first vacation request
Whether the second outstanding German number of card between third response page is less than second threshold；
If the described second outstanding German number of card is less than the second threshold, it is determined that there are SQL injection leakages for the URL request
Hole.
Preferably, if the similarity value meets preset condition, it is determined that there are SQL injection leakages for the URL request
The step of hole includes:
If it is determined that corresponding first response page of the URL request really requests corresponding second response page with described first
Between first it is outstanding block German number and be greater than first threshold, then judge that first response page is corresponding with the first vacation request
Whether the second outstanding German number of card between third response page is less than second threshold；
If the described second outstanding German number of card is less than the second threshold, it is determined that first response page and described second
It really requests third outstanding person between corresponding 4th response page to block German number, and calculates the third outstanding person and block German number and described the
One outstanding the first difference blocked between German number；
If first difference is less than third threshold value, it is determined that first response page is corresponding with the described second false request
The 5th response page between the 4th it is outstanding block German number, and calculate the described 4th it is outstanding block German number and it is described second it is outstanding block it is German
The second difference between number；
If second difference is less than the 4th threshold value, it is determined that there are SQL injection loopholes for the URL request.
Preferably, described to obtain the response page for executing and obtaining after the URL request and the sequence of requests, to the sound
The page is answered to carry out similarity analysis, obtaining the URL request, to correspond to response page corresponding with request each in the sequence of requests
The step of similarity value between response page includes:
Corresponding obtained response page after executing the URL request and the sequence of requests is obtained, and calculates the URL and asks
The outstanding person between corresponding first response page each sequence response page corresponding with the sequence of requests is asked to block German number；
The outstanding card is German several to should be used as between first response page and each sequence response page
Similarity value.
Preferably, described to obtain the response page for executing and obtaining after sequence of requests, and it is corresponding to calculate the URL request
The first response page each sequence response page corresponding with the sequence of requests between outstanding person block the step of German number and include:
Corresponding obtained response page after executing the URL request and the sequence of requests is obtained, according to preset line feed
Symbol is by first response page and the corresponding text segmentation of the sequence response page at character field；
The character field is divided into character string according to preset separator, correspondence obtains first response page and institute
State the corresponding element of sequence response page；
The intersection and union of element between first response page and each sequence response page are calculated, it will be described
Intersection obtains the corresponding outstanding German number of card divided by the corresponding union.
In addition, to achieve the above object, the present invention also provides a kind of SQL injection Hole Detection device, the SQL injection leakage
Hole detection device includes:
Determining module, for determining the URL after uniform resource position mark URL for getting website to be tested is requested
The test point of request；
Constructing module corresponds to the sequence of requests of Boolean logic parameter for constructing the test point；
Module is obtained, for obtaining the response page for executing and obtaining after the URL request and the sequence of requests；
Analysis module obtains the URL request and corresponds to response page for carrying out similarity analysis to the response page
Similarity value between response page corresponding with request each in the sequence of requests；
If the determining module, which is also used to the similarity value, meets preset condition, it is determined that there are SQL for the URL request
Injection loophole.
In addition, to achieve the above object, the present invention also provides a kind of SQL injection vulnerability detection equipment, the SQL injection leakage
Hole detection device includes the SQL note that memory, processor and being stored in can be run on the memory and on the processor
Enter Hole Detection program, the SQL injection Hole Detection program realizes SQL injection as described above when being executed by the processor
The step of leak detection method.
In addition, to achieve the above object, it is described computer-readable the present invention also provides a kind of computer readable storage medium
SQL injection Hole Detection program, realization when the SQL injection Hole Detection program is executed by processor are stored on storage medium
The step of SQL injection leak detection method as described above.
The present invention corresponds to the sequence of requests of Boolean logic parameter by constructing URL request test point, executes URL request and sequence
Column request corresponding URL request, obtain the response page for executing and obtaining after URL request and sequence of requests, carry out to response page
Similarity analysis, obtain URL request correspond to it is similar between response page response page corresponding with request each in sequence of requests
Angle value；If similarity value meets preset condition, it is determined that there are SQL injection loopholes for URL request, by between the page according to response
Similarity judge URL request with the presence or absence of SQL injection loophole, improve the accuracy rate of detection SQL injection loophole.
Detailed description of the invention
Fig. 1 is the flow diagram of SQL injection leak detection method preferred embodiment of the present invention；
Fig. 2 is the functional schematic module map of SQL injection Hole Detection device preferred embodiment of the present invention；
Fig. 3 is the structural schematic diagram for the hardware running environment that the embodiment of the present invention is related to.
The embodiments will be further described with reference to the accompanying drawings for the realization, the function and the advantages of the object of the present invention.
Specific embodiment
It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, it is not intended to limit the present invention.
The present invention provides a kind of SQL injection leak detection method, and referring to Fig.1, Fig. 1 is SQL injection Hole Detection of the present invention
The flow diagram of method preferred embodiment.
The embodiment of the invention provides the embodiments of SQL injection leak detection method, it should be noted that although in process
Logical order is shown in figure, but in some cases, it can be to be different from shown or described by sequence execution herein
Step.
SQL injection leak detection method is applied in server or terminal, and terminal may include such as mobile phone, plate electricity
Brain, laptop, palm PC, personal digital assistant (Personal Digital Assistant, PDA) etc. are mobile eventually
End, and the fixed terminals such as number TV, desktop computer.In each embodiment of SQL injection leak detection method, it is
Convenient for description, omits executing subject and be illustrated each embodiment.SQL injection leak detection method includes:
Step S10 determines the URL request after uniform resource position mark URL for getting website to be tested is requested
Test point, and construct the sequence of requests that the test point corresponds to Boolean logic parameter.
After getting the URL request of website to be tested, the test point in URL request is determined, and construct the test point pair
The sequence of requests for the Boolean logic parameter answered.Wherein, a URL request at least corresponds to a test point.URL test point is to visit
When asking that a URL initiates to request to website, and the HTTP that is initiated to website (Hyper Text Transfer Protocol, it is super literary
This transport protocol) all users of agreement Request can construct the place of input.Such as GET parameter, the form list ginseng of POST
Number, JSON (JavaScript Object Notation, JavaScript object numbered musical notation) formatted data value of POST,
Header fields of Request etc..Such as some URL request are as follows: http://www.test.com/test? param_a=1, that
GET parameter param_a is exactly a test point.The URL request is entered by modes such as web crawlers or network flows
Initial request in website.
It should be noted that including at least a logical truth item in the sequence of requests of the Boolean logic parameter constructed
The URL request of the URL request of part and a logic false condition.If there are multiple test points in URL request, need respectively each
Test point constructs the sequence of requests of corresponding Boolean logic parameter.Such as above-mentioned described URL request, in URL test point
The request of the parameter value of a logical truth, the i.e. URL request of the true condition of constitutive logic are constructed at the parameter value of param_a, are such as patrolled
The URL request for collecting true condition may be expressed as: http://www.test.com/test? param_a=1and 1=1, wherein
" and 1=1 " is the genuine SQL of Boolean logic (Structured Query Language, structured query language) of construction
Sentence；The request of the parameter value of a logical falsehood, i.e. constitutive logic leave request are constructed at the parameter value of URL test point param_a
The URL request of part, as the URL request of logic false condition may be expressed as: http://www.test.com/test? param_a=
1and 1=2, wherein " and 1=2 " is the SQL statement of the Boolean logic vacation of construction.
Step S20 obtains the response page for executing and obtaining after the URL request and the sequence of requests, to the response
The page carries out similarity analysis, obtains the URL request and corresponds to response page sound corresponding with request each in the sequence of requests
Answer the similarity value between the page.
After the test point for constructing URL request corresponds to the sequence of requests of Boolean logic parameter, executed in website to be tested
The URL request, and the corresponding each URL request of the sequence of requests is executed in website to be tested, obtain corresponding response page
Face, and to obtained response page carry out similarity analysis, obtain URL request correspond to response page with it is each in sequence of requests
Request the similarity value between corresponding response page.It should be noted that each request all corresponds to a response page, therefore,
Response page obtained in the embodiment of the present invention is at least three, the respectively corresponding response page of URL request, logical truth condition
The corresponding response page of URL request, the corresponding response page of the URL request of logic false condition.Wherein, similarity analysis is adopted
Algorithm includes but is not limited to COS distance, Euclidean distance and the German number of Jie Ka.
Further, step S20 includes:
Step a obtains corresponding obtained response page after executing the URL request and the sequence of requests, and calculates institute
The outstanding person's card stated between corresponding first response page of URL request each sequence response page corresponding with the sequence of requests is German
Number.
Specifically, resulting response page after executing URL request is obtained, is denoted as the first response page, and obtain and execute
Resulting response page after each request in sequence of requests, is denoted as sequence response page, and calculates the first response page and each
Outstanding person between sequence response page blocks German number.Jaccard (Jie Kade) coefficient is defined as the intersection between set A and set B
The ratio of union between set A and set B, is defined as follows:
Wherein, when set A and set B are empty set, outstanding person blocks German several J (A, B) and is defined as 1, i.e. the value of J (A, B) is
The value of 1, J (A, B) ∈ [0,1], J (A, B) indicate the corresponding response page of set A response page corresponding with set B closer to 1
Face is more similar, as J (A, B)=1, shows that the corresponding response page of set A response page corresponding with set B is identical.
Further, step a includes:
Step a1 obtains corresponding obtained response page after executing the URL request and the sequence of requests, according to default
Newline by first response page and the corresponding text segmentation of the sequence response page at character field.
Specifically, resulting first response page after executing URL request is obtained, and is obtained each in execution sequence of requests
Resulting sequence response page after request obtains the text in the first response page and sequence response page, and according in text
Newline by the first response page and the corresponding text segmentation of sequence response page at character field.It should be noted that in life
During response page, corresponding newline can be automatically generated in the corresponding text of response page.When the first response page
When different with sequence response page type, corresponding newline is also different.Such as HTML (Hyper Text Markup
Language, HyperText Markup Language) the corresponding newline of document is<br>,<br>it can be inserted into a simple newline,<
Br>label be sky label (mean that it is not over label, therefore this is wrong:<br></br>).In XHTML
In (eXtensible Hyper Text Markup Language, extensible HyperText Markup Language), end-tag is placed on
Start in label, that is,<br/>.The newline of word document is a kind of line feed symbol, its effect is line feed display, still
It is not real paragraph marks, its line feed is not the text for restarting one section, therefore being divided by newline truly
In fact still or in a paragraph, all operations in word document based on paragraph are all that will not identify that newline is paragraph
Ending.
Further, it in order to improve to obtain the efficiency of the first response page and sequence response page corresponding element, is obtaining
After first response page and sequence response page, judge whether the first response page and sequence response page are html document.When
Some response page is determined to carry out DOM parsing (Document Object Model, document to html document after html document
Object model), to generate the corresponding dom tree of the response page, text is extracted from the DOM node of dom tree, to obtain the response
The page corresponds to text, and the text is then divided into character field further according to newline.When determining that some response page is not HTML
It is not directly that the response page of html document corresponds to text segmentation into multiple words by this according to corresponding default newline after document
Accord with section.
Specifically, detection response page whether be html document process are as follows: detection response page in whether carry HTML
Label, wherein HTML DOM defines access and operates the standard method of html document；Html document is expressed as tree knot by DOM
Structure.It should be noted that html tag is to preset storage according to the html document of the tree construction form of expression.If detection
Html tag is carried into response page, it is determined that response page is html document；It is not carried if detecting in response page
Html tag, it is determined that response page is not html document.
The character field is divided into character string according to preset separator by step a2, corresponding to obtain first response
The page and the corresponding element of the sequence response page.
After obtaining the first response page and sequence response page corresponding character field, according to preset separator by character
Section is divided into corresponding character string, the corresponding element obtained in the corresponding set of the first response page and the corresponding collection of sequence response page
Element in conjunction.Wherein, separator includes but is not limited to the space in character field, comma, branch, fullstop, exclamation and question mark.It can
With understanding, the corresponding character string of the first response page is the element in the corresponding set of the first response page, sequence response
The corresponding character string of the page is the element in the corresponding set of sequence response page, in the first response page and sequence response page
In, a character string is first element.
Step a3 calculates between first response page and each sequence response page the intersection of element and simultaneously
Collection obtains the corresponding outstanding German number of card by the intersection divided by the corresponding union.
After obtaining the element of the corresponding set of the first response page and sequence response page, the first response page and every is calculated
The intersection and union of one sequence response page element, and calculated intersection is obtained into corresponding outstanding card divided by corresponding union
German number.It defines as the above-mentioned outstanding German number of card is corresponding it is found that A can indicate the set of the first response page corresponding element composition, B
It can indicate the set of one of sequence response page corresponding element composition.
Step b is German several to should be used as first response page and each sequence response page by the outstanding card
Between similarity value.
It is after the outstanding person being calculated between the first response page and each sequence response page blocks German number, outstanding person's card is German
It is several to the similarity value that should be used as between the first response page and each sequence response page.It is understood that working as Jie Kade
When the value of coefficient more approaches 1, show that the first response page gets over similarity with corresponding sequence response page；When the outstanding German number of card
When value more approaches 0, show the first response page and the corresponding more dissimilar degree of sequence response page.
Step S30, if the similarity value meets preset condition, it is determined that there are SQL injection loopholes for the URL request.
In embodiments of the present invention, sequence of requests corresponds to URL request number difference, and corresponding preset condition is also different, i.e.,
Sequence response page number is different, and corresponding preset condition is different.When determining that similarity value meets preset condition, URL is determined
There are SQL injection loopholes for request, that is, determine that there are SQL injection loopholes for website to be tested.SQL injection loophole is due to WEB application
There are problems to input validation for program, cause attacker that can inject the SQL statement of malice construction by the input point of WEB application
It is executed into back-end data base, and achievees the purpose that form malicious attack to database.WEB entitled World Wide Web entirely,
That is global wide area network, also referred to as WWW, popular address are website；It is it is a kind of based on hypertext and HTTP, it is global,
Dynamic interaction, cross-platform distributed graphic information system.
The present embodiment correspond to the sequence of requests of Boolean logic parameter by constructing URL request test point, execute URL request with
The corresponding URL request of sequence of requests obtains the response page for executing and obtaining after URL request and sequence of requests, to response page into
Row similarity analysis obtains URL request and corresponds to phase between response page response page corresponding with request each in sequence of requests
Like angle value；If similarity value meets preset condition, it is determined that URL request there are SQL injection loophole, by the page according to response it
Between similarity judge URL request with the presence or absence of SQL injection loophole, improve the accuracy rate of detection SQL injection loophole.
Further, SQL injection leak detection method second embodiment of the present invention is proposed.
The SQL injection leak detection method second embodiment and the SQL injection leak detection method first embodiment
Difference be, SQL injection leak detection method further include:
Step c is the request of each test point one logical truth condition of construction in the URL request, it is true to be denoted as first
Request.
It is each in URL request during construction URL request test point corresponds to the sequence of requests of Boolean logic parameter
Test point constructs the URL request of a logical truth condition, is denoted as the first true request.
Step d is the request of each test point one logic false condition of construction in the URL request, is denoted as the first vacation
Request, to form the sequence of requests for including the described first true request and the first false request.
The URL request that a logic false condition is constructed for each test point in URL request is denoted as the first false request.Its
In, the first true request and first false requests to constitute the corresponding sequence of requests of URL request test point.
Step S30 includes:
Step e, however, it is determined that corresponding first response page of the URL request really requests corresponding second sound with described first
It answers the between the page first outstanding German number of card to be greater than first threshold, then judges that first response page and first vacation are requested
Whether the second outstanding German number of card between corresponding third response page is less than second threshold.
After obtaining the first true request and the first false request, executed in website to be tested URL request, the first true request and
First false request, obtains resulting first response page after execution URL request, executes resulting second response after the first true request
The page, and resulting third response page after the first false request is executed, and calculate the first response page and the second response page
Between outstanding person block German number, be denoted as first it is outstanding block German number, and calculate between the first response page and third response page
Outstanding person blocks German number, is denoted as the second outstanding German number of card.
It is understood that the first outstanding German number and the second outstanding German number of card of blocking is similar between corresponding response page
Angle value.After obtaining the German number of first outstanding person's card and the second outstanding card German number, judge that the German number of first outstanding person's card and second outstanding person's card are German
Whether number meets preset condition.Specifically, judge whether the first outstanding German number of card is greater than first threshold.If it is determined that mono- Jie Kade
Coefficient is greater than first threshold, then judges whether the second outstanding German number of card is less than second threshold.If it is determined that the first outstanding German number of card is small
In or equal to first threshold, then showing the corresponding test point of the URL request, there is no SQL injection loopholes, judge that URL is asked at this time
It asks with the presence or absence of the test point not detected also, the test point not detected also if it exists, then whether is deposited using the above-mentioned test point of detection
In the identical method of SQL injection loophole, the test point not detected also in the URL request is continued to test, until the institute of the URL request
When having test point that SQL injection loophole is all not present, determining the URL request, there is no SQL injection loopholes.
Wherein, first threshold and second threshold are arranged according to specific needs, and first threshold and second threshold can phases
Deng can also be unequal.Such as first threshold and second threshold can be both configured to 0.99, or set first threshold to
0.99, second threshold is set as 0.98 etc..
It should be noted that response page may be dynamic change, the reason of variation may be that website to be tested is current
Caused by the change of time, current weather state etc.；Either due to network fluctuation, lead to the partial content in response page
Caused by also non-loaded.But under normal circumstances, the content that response page changes is very little, so the first response page
Similarity between face and the second response page can be very high.
Step f, if the described second outstanding German number of card is less than the second threshold, it is determined that there are SQL notes for the URL request
Enter loophole.
If it is determined that the second outstanding German number of card is less than second threshold, it is determined that the URL request corresponds to test point, and there are SQL injections
There are SQL injection loopholes for loophole, the i.e. URL request；If it is determined that the second outstanding German number of card is more than or equal to second threshold, then really
Corresponding to test point in the fixed URL request, there is no SQL injection loopholes.
It should be noted that by doing similarity analysis to the first response page and the second response page, it is current to judge
Whether stable test environment, wherein test environment includes network environment and server environment etc..It is understood that the second sound
Answering the corresponding URL request of the page is really to request, if test ambient stable, the phase between the first response page and the second response page
1 should be leveled off to like degree, or is equal to 1, and therefore, first threshold should be set as leveling off to 1, or the numerical value equal to 1.By to
One response page and third response page do similarity analysis, to judge that whether corresponding test point is because performing in URL request
SQL statement and there may be SQL injection loopholes.It is understood that if the SQL statement of the Boolean logic vacation of construction is to be tested
Website server backstage is performed, the response page between that URL request and the first false request should difference, or even completely
Not identical, therefore, second threshold should be set as leveling off to 1, or the numerical value equal to 1.
Then the present embodiment analyzes the corresponding response page of URL request by construction one true request and a false request
The first outstanding relationship blocked between German number and first threshold between response page corresponding with the first true request, and analysis URL
The second outstanding person between corresponding response page response page corresponding with the first vacation request is requested to block between German number and second threshold
Relationship, when first it is outstanding block German number and be greater than first threshold, and second outstanding when blocking German number and being less than second threshold, determine that URL is asked
Seek the accuracy rate that detection SQL injection loophole is improved there are SQL injection loophole.
Further, SQL injection leak detection method 3rd embodiment of the present invention is proposed.
The SQL injection leak detection method 3rd embodiment and the SQL injection leak detection method first or second
The difference of embodiment is that step d includes:
Step d1 is the request of each test point one logic false condition of construction in the URL request, is denoted as the first vacation
Request, and be the confirmation request of the described first true request true condition of constitutive logic, it is denoted as the second true request.
The URL request that a logic false condition is constructed for each of URL request test point is denoted as the first false request,
And be the URL confirmation request of the first true request true condition of constitutive logic, it is denoted as the second true request.
Step d2 is denoted as the second false request, for the confirmation request of the described first false request constitutive logic false condition to be formed
Sequence of requests including the described first true request, the first false request, the second true request and the second false request.
After constructing the first false request, for the URL confirmation request of the first false request constitutive logic false condition, it is denoted as the
Two false requests, by the first true request, the first false request, the second true request and the second false request composition sequence request.It needs to illustrate
, limit structure first is not requested really, between the first false request, the second true request and the second vacation request in the present embodiment
Sequencing.The URL request referring to described in first embodiment, the corresponding first true request can be http: //
Www.test.com/test? param_a=1and 1=1, wherein " and 1=1 " is the genuine SQL of Boolean logic of construction
Sentence；Can first false request be http://www.test.com/test? param_a=1and 1=2, wherein " and 1=2 "
It is the genuine SQL statement of Boolean logic of construction；Can second true request be http://www.test.com/test? param_a
=1and 3*3=9, wherein " and 3*3=9 " is the genuine SQL statement of Boolean logic of construction, it is constructed with first time
Logical truth " and 1=1 " is not identical；Can second false request be http://www.test.com/test? param_a=1and
3*3=8, wherein " and 3*3=8 " is the SQL statement of the Boolean logic vacation of construction, the logical falsehood of it and first time construction
" and 1=2 " be not identical.It follows that it is not identical that the first true request, which really requests corresponding Boolean logic SQL statement with second,
, the first false request and the corresponding Boolean logic SQL statement of the second vacation request are also different.
Step S30 further include:
Step g, however, it is determined that corresponding first response page of the URL request really requests corresponding second sound with described first
It answers the between the page first outstanding German number of card to be greater than first threshold, then judges that first response page and first vacation are requested
Whether the second outstanding German number of card between corresponding third response page is less than second threshold.
After constructing the first true request, the second true request, the first false request and the second false request, in website to be tested
URL request, the first true request, the first false request, the second true request and the second false request are executed, obtains executing institute after URL request
The first response page, execute the first resulting second response page very after request, execute resulting the after the first false request
Three response pages execute resulting 4th response page after the second true request, and execute the resulting 5th after the second false request
Response page, and calculate the outstanding person calculated between the first response page and the second response page and block German number, it is denoted as mono- Jie Kade
Coefficient, and the outstanding person calculated between the first response page and third response page block German number, are denoted as the second outstanding German number of card.If
It determines that the first outstanding German number of card is greater than first threshold, then judges whether the second outstanding German number of card is less than second threshold.
Step h, if the described second outstanding German number of card is less than the second threshold, it is determined that first response page and institute
Stating second really requests third outstanding person between corresponding 4th response page to block German number, and calculate the third outstanding person block German number with
Described first outstanding the first difference blocked between German number.
If it is determined that the second outstanding German number of card is less than second threshold, then calculate between the first response page and the 4th response page
Third outstanding person block German number, and calculate third outstanding person and block German number and the first outstanding difference blocked between German number, be denoted as the first difference,
Judge whether the first difference is less than third threshold value.Wherein, third threshold value can be arranged according to just specific need, and such as may be configured as
0.01.It should be noted that the first difference is poor between the German number of third outstanding person card and the first outstanding German number of card for the ease of comparing
The absolute value of value.
Step i, if first difference is less than third threshold value, it is determined that first response page is asked with second vacation
It asks the 4th outstanding person between corresponding 5th response page to block German number, and calculates the described 4th outstanding German number of card and second outstanding person
Block the second difference between German number.
If it is determined that the first difference is less than third threshold value, then the first response page the 5th sound corresponding with the second vacation request is calculated
The between the page the 4th outstanding German number of card is answered, and the 4th outstanding German number of card is subtracted into the second outstanding person and blocks German number, to calculate the 4th
Outstanding person blocks German number and the second outstanding difference blocked between German number, is denoted as the second difference.It should be noted that for the ease of comparison,
Second difference is the 4th outstanding absolute value for blocking difference between German number and the second outstanding German number of card.
After calculating the second difference, judge the second difference whether less than the 4th threshold value.Wherein, the 4th threshold value can be with third
Threshold value is equal, can also be unequal with third threshold value.Further, if the first difference is more than or equal to third threshold value, it is determined that
Test point is corresponded in URL request, and there is no SQL injection loopholes.
Step j, if second difference is less than the 4th threshold value, it is determined that there are SQL injection loopholes for the URL request.
If it is determined that the second difference is less than the 4th threshold value, it is determined that there are SQL injection leakages for corresponding test point in URL request
There are SQL injection loopholes for hole, the i.e. website to be tested.Further, however, it is determined that the second difference is more than or equal to the 4th threshold value,
Then determine that SQL injection loophole is not present in corresponding test point in URL request.
It is described in detail in the first embodiment it should be noted that calculating the outstanding German several processes of card, in the present embodiment
No longer it is described in detail.By doing similarity analysis to the first response page and the 4th response page, to confirm preset test environment
Stability, and the SQL injection implementing result of secondary-confirmation logical truth condition.By to the first response page and the 5th response page
Similarity analysis is done in face, come reaffirm in URL request corresponding test point whether due to performing SQL statement there are SQL notes
Enter loophole.
In order to prove the stability for testing environment of SQL injection Hole Detection, guarantee last time (the first true request) construction
The validity of the detection of logical truth, so initiating the secondary-confirmation request of logical truth.If this (the second true request) SQL injection
The test ambient stable of Hole Detection, and it is implicitly present in SQL injection loophole, then third outstanding person blocks German number and mono- Jie Deka system
Number be certain to very close to or it is equal；Therefore third outstanding person blocks the absolute value of the difference between German number and mono- Jie Deka coefficient
Can be one close to 0 even equal to 0 numerical value, it follows that third threshold value should be equal to 0, or level off to 0 number
Value.
In order to prove the stability for testing environment of SQL injection Hole Detection, guarantee last time (the first false request) construction
The validity of the detection of logical falsehood, so initiating the secondary-confirmation request of logical falsehood.If this (the second false request) SQL injection
The test ambient stable of Hole Detection, and it is implicitly present in SQL injection loophole, then the 4th Jie Deka coefficient and bis- Jie Deka system
Number be certain to very close to or it is equal；Therefore the absolute value of difference is agreed between the 4th Jie Deka coefficient and bis- Jie Deka coefficient
Surely can be one close to 0, even equal to 0 numerical value, therefore, the 4th threshold value should be equal to 0, or level off to 0 numerical value.
The present embodiment is really asked by constructing two true requests and two false requests by the second true request confirmation first
It asks, guarantees the validity for the detection that first really requests corresponding logical truth, and request by the way that the second false request confirmation first is false,
The validity for guaranteeing the first false detection for requesting corresponding logical falsehood, further increases the accurate of detection SQL injection loophole
Rate, and reduce the rate of false alarm and rate of failing to report of SQL injection Hole Detection.Wherein, fail to report is in the detection of WEB security breaches, such as
Originally there is loophole in one URL request of fruit, but be not detected among out, be known as failing to report.Wrong report is detected in WEB security breaches
In, if loophole is not present in a URL request originally, but it is mistakenly detected as that there are loopholes, referred to as reports by mistake.
In addition, referring to Fig. 2, the present invention also provides a kind of SQL injection Hole Detection device, the SQL injection Hole Detection
Device includes:
Determining module 10, described in determining after the uniform resource position mark URL for getting website to be tested is requested
The test point of URL request；
Constructing module 20 corresponds to the sequence of requests of Boolean logic parameter for constructing the test point；
Module 30 is obtained, for obtaining the response page for executing and obtaining after the URL request and the sequence of requests；
Analysis module 40 obtains the corresponding response page of the URL request for carrying out similarity analysis to the response page
Similarity value between the response page corresponding with request each in the sequence of requests of face；
If the determining module 10, which is also used to the similarity value, meets preset condition, it is determined that the URL request exists
SQL injection loophole.
Further, the constructing module 20 is also used to construct a logic for each test point in the URL request
The request of true condition is denoted as the first true request；Asking for a logic false condition is constructed for each test point in the URL request
It asks, is denoted as the first false request, to form the sequence of requests for including the described first true request and the first false request.
Further, the constructing module 20 is also used to construct a logic for each test point in the URL request
The request of false condition is denoted as the first false request, and is the confirmation request of the described first true request true condition of constitutive logic, is denoted as the
Two true requests；For the confirmation request of the described first false request constitutive logic false condition, it is denoted as the second false request, includes institute to be formed
State the sequence of requests of the first true request, the first false request, the second true request and the second false request.
Further, the determining module 10 further include:
First judging unit is used for if it is determined that corresponding first response page of the URL request and the described first true request
The first outstanding German number of card between corresponding second response page is greater than first threshold, then judges first response page and institute
State whether the first false the second outstanding German number of card requested between corresponding third response page is less than second threshold；
First determination unit, if being less than the second threshold for the described second outstanding German number of card, it is determined that the URL is asked
Ask that there are SQL injection loopholes.
Further, the determining module 10 further include:
Second judgment unit, it is used for if it is determined that corresponding first response page of the URL request and the described first true request
The first outstanding German number of card between corresponding second response page is greater than first threshold, then judges first response page and institute
State whether the first false the second outstanding German number of card requested between corresponding third response page is less than second threshold；
Second determination unit, if being less than the second threshold for the described second outstanding German number of card, it is determined that described first
Response page really requests the third outstanding person between corresponding 4th response page to block German number with described second；
First computing unit blocks German number and first outstanding first blocked between German number for calculating the third outstanding person
Difference；
If second determination unit is also used to first difference less than third threshold value, it is determined that the first response page
The 4th outstanding German number of card between the 5th response page corresponding with the second vacation request of face；
First computing unit is also used to calculate between the described 4th outstanding German number of card and the second outstanding German number of card
The second difference；
If second determination unit is also used to second difference less than the 4th threshold value, it is determined that the URL request is deposited
In SQL injection loophole.
Further, the analysis module 40 includes:
Second computing unit, it is corresponding with the sequence of requests for calculating corresponding first response page of the URL request
Each sequence response page between outstanding person block German number；
Third determination unit, for the outstanding card is German several to should be used as first response page and each sequence
Similarity value between column response page.
Further, second computing unit includes:
Divide subelement, for according to preset newline by first response page and the sequence response page pair
The text segmentation answered is at character field；The character field is divided into character string according to preset separator, it is corresponding to obtain described the
One response page and the corresponding element of the sequence response page；
Computation subunit, for calculating the friendship of element between first response page and each sequence response page
Collection and union obtain the corresponding outstanding German number of card by the intersection divided by the corresponding union.
It should be noted that each embodiment of SQL injection Hole Detection device and above-mentioned SQL injection leak detection method
Each embodiment it is essentially identical, in this not go into detail.
In addition, the present invention also provides a kind of SQL injection vulnerability detection equipments.As shown in figure 3, Fig. 3 is the embodiment of the present invention
The structural schematic diagram for the hardware running environment that scheme is related to.
It should be noted that Fig. 3 can be the structural schematic diagram of the hardware running environment of SQL injection vulnerability detection equipment.
SQL injection vulnerability detection equipment of the embodiment of the present invention can be PC, the terminal devices such as portable computer.
As shown in figure 3, the SQL injection vulnerability detection equipment may include: processor 1001, such as CPU, memory
1005, user interface 1003, network interface 1004, communication bus 1002.Wherein, communication bus 1002 is for realizing these components
Between connection communication.User interface 1003 may include display screen (Display), input unit such as keyboard
(Keyboard), optional user interface 1003 can also include standard wireline interface and wireless interface.Network interface 1004 is optional
May include standard wireline interface and wireless interface (such as WI-FI interface).Memory 1005 can be high speed RAM memory,
It is also possible to stable memory (non-volatile memory), such as magnetic disk storage.Memory 1005 optionally may be used also
To be independently of the storage device of aforementioned processor 1001.
Optionally, SQL injection vulnerability detection equipment can also include camera, RF (Radio Frequency, radio frequency) electricity
Road, sensor, voicefrequency circuit, WiFi module etc..
It will be understood by those skilled in the art that SQL injection vulnerability detection equipment structure shown in Fig. 3 is not constituted pair
The restriction of SQL injection vulnerability detection equipment may include components more more or fewer than diagram, or combine certain components, or
The different component layout of person.
As shown in figure 3, as may include that operating system, network are logical in a kind of memory 1005 of computer storage medium
Believe module, Subscriber Interface Module SIM and SQL injection Hole Detection program.Wherein, operating system is to manage and control SQL injection leakage
The program of hole detection device hardware and software resource supports the fortune of SQL injection Hole Detection program and other softwares or program
Row.
In SQL injection vulnerability detection equipment shown in Fig. 3, user interface 1003 can be used for the held terminal of user, with
The held terminal in family carries out data communication；Network interface 1004 is mainly used for connecting background server, is counted with background server
According to communication；Processor 1001 can be used for calling the SQL injection Hole Detection program stored in memory 1005, and execute as above
The step of described SQL injection leak detection method.
SQL injection vulnerability detection equipment specific embodiment of the present invention is respectively implemented with above-mentioned SQL injection leak detection method
Example is essentially identical, and details are not described herein.
In addition, the embodiment of the present invention also proposes a kind of computer readable storage medium, the computer readable storage medium
On be stored with SQL injection Hole Detection program, realized when the SQL injection Hole Detection program is executed by processor as described above
SQL injection leak detection method the step of.
Computer readable storage medium specific embodiment of the present invention and above-mentioned each embodiment of SQL injection leak detection method
Essentially identical, details are not described herein.
It should be noted that, in this document, the terms "include", "comprise" or its any other variant are intended to non-row
His property includes, so that the process, method, article or the device that include a series of elements not only include those elements, and
And further include other elements that are not explicitly listed, or further include for this process, method, article or device institute it is intrinsic
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including being somebody's turn to do
There is also other identical elements in the process, method of element, article or device.
The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.
Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment side
Method can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but in many cases
The former is more preferably embodiment.Based on this understanding, technical solution of the present invention substantially in other words does the prior art
The part contributed out can be embodied in the form of software products, which is stored in a storage medium
In (such as ROM/RAM, magnetic disk, CD), including some instructions are used so that a terminal device (can be mobile phone, computer, clothes
Business device, air conditioner or the network equipment etc.) execute method described in each embodiment of the present invention.
The above is only a preferred embodiment of the present invention, is not intended to limit the scope of the invention, all to utilize this hair
Equivalent structure or equivalent flow shift made by bright specification and accompanying drawing content is applied directly or indirectly in other relevant skills
Art field, is included within the scope of the present invention.
Claims (10)
1. a kind of structured query language SQL injection leak detection method, which is characterized in that the SQL injection Hole Detection side
Method the following steps are included:
After the uniform resource position mark URL for getting website to be tested is requested, the test point of the URL request, and structure are determined
Make the sequence of requests that the test point corresponds to Boolean logic parameter；
The response page for executing and obtaining after the URL request and the sequence of requests is obtained, the response page is carried out similar
Degree analysis, obtains the URL request and corresponds between response page response page corresponding with request each in the sequence of requests
Similarity value；
If the similarity value meets preset condition, it is determined that there are SQL injection loopholes for the URL request.
2. SQL injection leak detection method as described in claim 1, which is characterized in that the construction test point is corresponding
The step of sequence of requests of Boolean logic parameter includes:
The request that a logical truth condition is constructed for each test point in the URL request is denoted as the first true request；
The request that a logic false condition is constructed for each test point in the URL request is denoted as the first false request, to be formed
Sequence of requests including the described first true request and the first false request.
3. SQL injection leak detection method as claimed in claim 2, which is characterized in that described is every in the URL request
One test point constructs the request of a logic false condition, is denoted as the first false request, includes the described first true request and the to be formed
The step of sequence of requests of one false request includes:
The request that a logic false condition is constructed for each test point in the URL request is denoted as the first false request, and is institute
The confirmation request for stating the first true request true condition of constitutive logic, is denoted as the second true request；
For the confirmation request of the described first false request constitutive logic false condition, it is denoted as the second false request, includes described the to be formed
The sequence of requests of one true request, the first false request, the second true request and the second false request.
4. SQL injection leak detection method as claimed in claim 2, which is characterized in that if the similarity value meets
Preset condition, it is determined that there are the step of SQL injection loophole to include: for the URL request
If it is determined that corresponding first response page of the URL request is really requested between corresponding second response page with described first
First it is outstanding block German number and be greater than first threshold, then judge first response page third corresponding with the first vacation request
Whether the second outstanding German number of card between response page is less than second threshold；
If the described second outstanding German number of card is less than the second threshold, it is determined that there are SQL injection loopholes for the URL request.
5. SQL injection leak detection method as claimed in claim 3, which is characterized in that if the similarity value meets
Preset condition, it is determined that there are the step of SQL injection loophole to include: for the URL request
If it is determined that corresponding first response page of the URL request is really requested between corresponding second response page with described first
First it is outstanding block German number and be greater than first threshold, then judge first response page third corresponding with the first vacation request
Whether the second outstanding German number of card between response page is less than second threshold；
If the described second outstanding German number of card is less than the second threshold, it is determined that first response page is really asked with described second
It asks the third outstanding person between corresponding 4th response page to block German number, and calculates the third outstanding person and block German number and first outstanding person
Block the first difference between German number；
If first difference is less than third threshold value, it is determined that first response page and the second vacation request corresponding the
Between five response pages the 4th it is outstanding block German number, and calculate the described 4th it is outstanding block German number and the second outstanding card it is German it is several it
Between the second difference；
If second difference is less than the 4th threshold value, it is determined that there are SQL injection loopholes for the URL request.
6. such as SQL injection leak detection method described in any one of claim 1 to 5, which is characterized in that the acquisition executes institute
The response page obtained after URL request and the sequence of requests is stated, similarity analysis is carried out to the response page, is obtained described
URL request corresponds to the step of similarity value between response page response page corresponding with request each in the sequence of requests and wraps
It includes:
Corresponding obtained response page after executing the URL request and the sequence of requests is obtained, and calculates the URL request pair
Outstanding person between the first response page answered each sequence response page corresponding with the sequence of requests blocks German number；
The outstanding card is German several similar between first response page and each sequence response page to should be used as
Angle value.
7. SQL injection leak detection method as claimed in claim 6, which is characterized in that the acquisition execution sequence is asked
The response page obtained after asking, and it is corresponding with the sequence of requests every to calculate corresponding first response page of the URL request
The step that outstanding person between one sequence response page blocks German number includes:
Corresponding obtained response page after executing the URL request and the sequence of requests is obtained, it will according to preset newline
First response page and the corresponding text segmentation of the sequence response page are at character field；
The character field is divided into character string according to preset separator, correspondence obtains first response page and the sequence
The corresponding element of column response page；
The intersection and union for calculating element between first response page and each sequence response page, by the intersection
Divided by the corresponding union, the corresponding outstanding German number of card is obtained.
8. a kind of SQL injection Hole Detection device, which is characterized in that the SQL injection Hole Detection device includes:
Determining module, for determining the URL request after uniform resource position mark URL for getting website to be tested is requested
Test point；
Constructing module corresponds to the sequence of requests of Boolean logic parameter for constructing the test point；
Module is obtained, for obtaining the response page for executing and obtaining after the URL request and the sequence of requests；
Analysis module obtains the URL request and corresponds to response page and institute for carrying out similarity analysis to the response page
State each similarity value requested between corresponding response page in sequence of requests；
If the determining module, which is also used to the similarity value, meets preset condition, it is determined that there are SQL injections for the URL request
Loophole.
9. a kind of SQL injection vulnerability detection equipment, which is characterized in that the SQL injection vulnerability detection equipment includes memory, place
Reason device and the SQL injection Hole Detection program that is stored on the memory and can run on the processor, the SQL note
Enter the SQL injection loophole inspection realized as described in any one of claims 1 to 7 when Hole Detection program is executed by the processor
The step of survey method.
10. a kind of computer readable storage medium, which is characterized in that be stored with SQL note on the computer readable storage medium
Enter Hole Detection program, is realized when the SQL injection Hole Detection program is executed by processor as any in claim 1 to 7
The step of SQL injection leak detection method described in item.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811188829.3A CN109657472B (en) | 2018-10-11 | 2018-10-11 | SQL injection vulnerability detection method, device, equipment and readable storage medium |
| PCT/CN2018/122811 WO2020073493A1 (en) | 2018-10-11 | 2018-12-21 | Sql injection vulnerability detection method, apparatus and device, and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811188829.3A CN109657472B (en) | 2018-10-11 | 2018-10-11 | SQL injection vulnerability detection method, device, equipment and readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109657472A true CN109657472A (en) | 2019-04-19 |
| CN109657472B CN109657472B (en) | 2023-09-22 |
Family
ID=66110693
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811188829.3A Active CN109657472B (en) | 2018-10-11 | 2018-10-11 | SQL injection vulnerability detection method, device, equipment and readable storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN109657472B (en) |
| WO (1) | WO2020073493A1 (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111404937A (en) * | 2020-03-16 | 2020-07-10 | 腾讯科技（深圳）有限公司 | Method and device for detecting server vulnerability |
| CN111581637A (en) * | 2020-05-20 | 2020-08-25 | 深圳前海微众银行股份有限公司 | SQL injection detection method, device, equipment and computer storage medium |
| US11562095B2 (en) | 2021-01-28 | 2023-01-24 | International Business Machines Corporation | Reinforcing SQL transactions dynamically to prevent injection attacks |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070196015A1 (en) * | 2006-02-23 | 2007-08-23 | Jean-Luc Meunier | Table of contents extraction with improved robustness |
| US20080065671A1 (en) * | 2006-09-07 | 2008-03-13 | Xerox Corporation | Methods and apparatuses for detecting and labeling organizational tables in a document |
| CN102799830A (en) * | 2012-08-06 | 2012-11-28 | 厦门市美亚柏科信息股份有限公司 | Improved SQL (Structured Query Language) injection flaw detection method |
| CN103077348A (en) * | 2012-12-28 | 2013-05-01 | 华为技术有限公司 | Method and device for vulnerability scanning of Web site |
| CN104965784A (en) * | 2015-06-16 | 2015-10-07 | 广州华多网络科技有限公司 | Automatic test method and apparatus |
| CN105072095A (en) * | 2015-07-20 | 2015-11-18 | 北京神州绿盟信息安全科技股份有限公司 | Method of detecting SQL (Structured Query Language) injection vulnerability and device |
| CN106411578A (en) * | 2016-09-12 | 2017-02-15 | 国网山东省电力公司电力科学研究院 | Website monitoring system and method applicable to power industry |
| CN108616527A (en) * | 2018-04-16 | 2018-10-02 | 贵州大学 | One kind is towards SQL injection bug excavation method and device |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101416712B1 (en) * | 2012-07-12 | 2014-07-09 | 김영근 | Method For Implementation Of XML Document With Formal Data and Informal Data |
| CN106407803B (en) * | 2016-08-30 | 2019-06-14 | 北京奇虎科技有限公司 | The detection method and device of SQL injection loophole |
-
2018
- 2018-10-11 CN CN201811188829.3A patent/CN109657472B/en active Active
- 2018-12-21 WO PCT/CN2018/122811 patent/WO2020073493A1/en active Application Filing
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070196015A1 (en) * | 2006-02-23 | 2007-08-23 | Jean-Luc Meunier | Table of contents extraction with improved robustness |
| US20080065671A1 (en) * | 2006-09-07 | 2008-03-13 | Xerox Corporation | Methods and apparatuses for detecting and labeling organizational tables in a document |
| CN102799830A (en) * | 2012-08-06 | 2012-11-28 | 厦门市美亚柏科信息股份有限公司 | Improved SQL (Structured Query Language) injection flaw detection method |
| CN103077348A (en) * | 2012-12-28 | 2013-05-01 | 华为技术有限公司 | Method and device for vulnerability scanning of Web site |
| CN104965784A (en) * | 2015-06-16 | 2015-10-07 | 广州华多网络科技有限公司 | Automatic test method and apparatus |
| CN105072095A (en) * | 2015-07-20 | 2015-11-18 | 北京神州绿盟信息安全科技股份有限公司 | Method of detecting SQL (Structured Query Language) injection vulnerability and device |
| CN106411578A (en) * | 2016-09-12 | 2017-02-15 | 国网山东省电力公司电力科学研究院 | Website monitoring system and method applicable to power industry |
| CN108616527A (en) * | 2018-04-16 | 2018-10-02 | 贵州大学 | One kind is towards SQL injection bug excavation method and device |
Non-Patent Citations (3)
| Title |
|---|
| LEI LIU ETAL.: "Exposing SQL Injection Vulnerability through Penetration Test Based on Finite State Machine", 《2016 2ND IEEE INTERNATIONAL CONFERENCE ON COMPUTER AND COMMUNICATIONS》, pages 1171 - 1176 * |
| 张晨;汪永益;王雄;施凡;: "基于网页DOM树比对的SQL注入漏洞检测", 计算机工程, no. 18, pages 117 - 121 * |
| 罗明宇;凌捷;: "基于DOM树序列值比对的SQL注入漏洞检测", 计算机工程与设计, no. 02, pages 78 - 82 * |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111404937A (en) * | 2020-03-16 | 2020-07-10 | 腾讯科技（深圳）有限公司 | Method and device for detecting server vulnerability |
| CN111581637A (en) * | 2020-05-20 | 2020-08-25 | 深圳前海微众银行股份有限公司 | SQL injection detection method, device, equipment and computer storage medium |
| US11562095B2 (en) | 2021-01-28 | 2023-01-24 | International Business Machines Corporation | Reinforcing SQL transactions dynamically to prevent injection attacks |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2020073493A1 (en) | 2020-04-16 |
| CN109657472B (en) | 2023-09-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9910992B2 (en) | Presentation of user interface elements based on rules | |
| CN104956362A (en) | Analyzing structure of web application | |
| CN109657472A (en) | SQL injection leak detection method, device, equipment and readable storage medium storing program for executing | |
| CN112948035A (en) | Method and device for controlling micro front-end page, terminal equipment and storage medium | |
| CN110717121A (en) | Method and device for determining first screen time of page | |
| US9571514B2 (en) | Notification of security question compromise level based on social network interactions | |
| CN106339380A (en) | Method and device for recommending frequently asked question information | |
| US20160359989A1 (en) | Recording And Triggering Web And Native Mobile Application Events With Mapped Data Fields | |
| CN107016282A (en) | A kind of information processing method and device | |
| CN109672658A (en) | Detection method, device, equipment and the storage medium of JSON abduction loophole | |
| CN108846286A (en) | Cross site scripting leak detection method and device | |
| CN114866358A (en) | Automatic penetration testing method and system based on knowledge graph | |
| CN107784107B (en) | Dark chain detection method and device based on escape behavior analysis | |
| KR100867306B1 (en) | Method and system for check of modulate hompage by the image spectrometer | |
| CN111224923A (en) | Detection method, device and system for counterfeit websites | |
| CN114157568B (en) | Browser secure access method, device, equipment and storage medium | |
| CN107016043A (en) | A kind of information processing method and device | |
| CN108809896A (en) | A kind of information calibration method, device and electronic equipment | |
| CN104573486A (en) | Vulnerability detection method and device | |
| CN115221033A (en) | Interface protocol testing method and device, computer readable medium and electronic equipment | |
| CN107220260A (en) | The method and device that a kind of page is shown | |
| US20100131542A1 (en) | Suggested websites | |
| CN105243134B (en) | A kind of method and apparatus handling browser of being held as a hostage | |
| CN109150842B (en) | Injection vulnerability detection method and device | |
| Zhou et al. | An analysis of urls generated from javascript code |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |