CN112446030B - Method and device for detecting file uploading vulnerability of webpage end - Google Patents
Method and device for detecting file uploading vulnerability of webpage end Download PDFInfo
- Publication number
- CN112446030B CN112446030B CN202011148876.2A CN202011148876A CN112446030B CN 112446030 B CN112446030 B CN 112446030B CN 202011148876 A CN202011148876 A CN 202011148876A CN 112446030 B CN112446030 B CN 112446030B
- Authority
- CN
- China
- Prior art keywords
- file
- extension
- uploading
- request
- execution
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 38
- 230000004044 response Effects 0.000 claims abstract description 42
- 238000012795 verification Methods 0.000 claims description 13
- 238000001514 detection method Methods 0.000 claims description 7
- 238000011156 evaluation Methods 0.000 abstract description 5
- 238000007689 inspection Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 230000008569 process Effects 0.000 description 5
- 238000012360 testing method Methods 0.000 description 4
- 238000004590 computer program Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000001066 destructive effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000004992 fission Effects 0.000 description 1
- 238000011990 functional testing Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a method and a device for detecting a file uploading vulnerability of a webpage end, wherein the method comprises the following steps: acquiring a first file extension meeting the requirement of a file uploading interface; generating a file with a first file extension name to upload the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool; loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request; and in response to the successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and in response to the execution characteristic information of the received file execution request, judging that a file uploading bug exists. The invention can greatly improve the safety evaluation working efficiency and the coverage of the file uploading interface.
Description
Technical Field
The present invention relates to the field of security, and in particular, to a method and an apparatus for detecting a vulnerability of a file upload at a web page.
Background
With the development of big data, cloud computing and artificial intelligence technologies, the Web (webpage) applications developed by various big internet enterprises are continuously upgraded and updated, and the functions are continuously improved. The file uploading function is used as a normal service requirement and a most basic function of a Web end, and is also increasingly used for a user interaction interface of a Web application. However, there are many security risks in the file uploading function all the time, and generally, since the types and contents of the uploaded files are not strictly filtered and checked, an attacker can acquire the server right by uploading malicious files, and therefore, the damage caused by the file uploading vulnerability is often destructive. Exploitation of file upload vulnerabilities is conditional, firstly of course to be able to successfully upload malicious files, and secondly to be able to execute the uploaded files.
The traditional file uploading vulnerability detection method is low in detection rate and cannot cover all file uploading interfaces of Web application, and some file uploading interfaces clearly show that the types of uploaded files are not limited on pages.
Aiming at the problems of low vulnerability detection rate and less file uploading interface coverage in the prior art, no effective solution is available at present.
Disclosure of Invention
In view of this, an object of the embodiments of the present invention is to provide a method and an apparatus for detecting a file upload vulnerability of a web page, which can traverse all file upload interfaces for automatic inspection, and greatly improve the security evaluation efficiency and the coverage of the file upload interfaces.
Based on the above object, a first aspect of the embodiments of the present invention provides a method for detecting a file upload vulnerability of a web page, including the following steps:
determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;
generating a file with a first file extension name, uploading the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;
loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request;
and in response to the successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and in response to the execution characteristic information of the received file execution request, judging that a file uploading vulnerability exists.
In some embodiments, obtaining the first file extension that meets the requirements of the file upload interface comprises: the file type meeting the requirements of the file uploading interface is obtained, and one or more first file extensions are determined based on the file type.
In some embodiments, selecting a second file extension from the common filename extension library that is different from the first file extension comprises: one or more first file extensions are removed from the common file name extension library and a second file extension is selected from the remaining extensions one at a time.
In some embodiments, replacing the first file extension in the file upload request with the second file extension, re-uploading the modified file upload request comprises: and respectively replacing the first file extension in the file uploading request with the second file extension selected each time, and respectively uploading the modified file uploading request aiming at the second file extension selected each time until the second file extension selected traverses the rest extensions.
In some embodiments, generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into a file; the execution characteristic information of the received file execution request includes: execution response information of the file execution request is received, and performing character matching in the execution response information obtains unique identification information that is an execution feature of the file.
In some embodiments, the random number generator is configured to generate true random numbers or pseudo random numbers.
In some embodiments, the file upload request and the file execution request are both HTTP requests.
A second aspect of the embodiments of the present invention provides a device for detecting a file upload vulnerability of a web page, including:
a processor; and
a memory storing program code executable by the processor, the program code when executed performing the steps of:
determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;
generating a file with a first file extension name, uploading the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;
loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request;
and in response to the successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and in response to the execution characteristic information of the received file execution request, judging that a file uploading bug exists.
In some embodiments, selecting a second file extension from the common filename extension library that is different from the first file extension comprises: one or more first file extensions are removed from the common file name extension library and a second file extension is selected from the remaining extensions one at a time.
Replacing the first file extension in the file upload request with the second file extension, the re-uploading the modified file upload request comprising: and respectively replacing the first file extension in the file uploading request with the second file extension selected each time, and respectively uploading the modified file uploading request again aiming at the second file extension selected each time until the second file extension selected traverses the rest extensions.
In some embodiments, generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into a file; the execution characteristic information of the received file execution request includes: receiving execution response information of the file execution request, and performing character matching in the execution response information obtains unique identification information as an execution feature of the file; wherein the random number generator is configured to generate true random numbers or pseudo random numbers.
The invention has the following beneficial technical effects: according to the method and the device for detecting the file uploading vulnerability of the webpage end, a file uploading interface needing to be subjected to file extension verification is determined by using a page automation tool based on the prompt information of the webpage end, and a first file extension meeting the requirements of the file uploading interface is obtained; generating a file with a first file extension name to upload the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool; loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request; the technical scheme that the file execution request is sent based on the default file path corresponding to the file uploading interface in response to the successful response information of the received file uploading request, and the existence of the file uploading loophole is judged in response to the execution characteristic information of the received file execution request can traverse all the file uploading interfaces for automatic inspection, so that the safety evaluation working efficiency and the coverage of the file uploading interfaces are greatly improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a schematic flowchart of a method for detecting a file upload vulnerability of a web page end according to the present invention;
fig. 2 is a detailed flowchart of the method for detecting a file upload vulnerability of a web page side according to the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the following embodiments of the present invention are described in further detail with reference to the accompanying drawings.
It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are used for distinguishing two entities with the same name but different names or different parameters, and it should be noted that "first" and "second" are merely for convenience of description and should not be construed as limitations of the embodiments of the present invention, and they are not described in any more detail in the following embodiments.
Based on the above purpose, a first aspect of the embodiments of the present invention provides an embodiment of a method for detecting a file upload vulnerability of a web page end, which traverses all automatic verification of file upload interfaces. Fig. 1 is a schematic flowchart illustrating a method for detecting a file upload vulnerability of a web page end provided by the present invention.
As shown in fig. 1, the method for detecting a file upload vulnerability of a web page includes the following steps:
step S101, determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;
step S103, generating a file with a first file extension name, uploading the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;
step S105, loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request;
step S107, in response to receiving the successful response information of the file upload request, sending a file execution request based on a default file path corresponding to the file upload interface, and in response to receiving the execution characteristic information of the file execution request, determining that a file upload vulnerability exists.
The invention provides a detection tool based on Web application security, which traverses and reads all file uploading interfaces of the Web application security, captures a corresponding HTTP request, replaces file names in request information with other unknown file names, sends and checks whether HTTP response information is normal or not, if the file is successfully uploaded, further vulnerability verification is needed to access the malicious file, and finally judges whether the detected Web application has file uploading vulnerability or not.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above may be implemented by instructing relevant hardware by a computer program, and the program may be stored in a computer-readable storage medium, and when executed, may include the processes of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), a Random Access Memory (RAM), or the like. Embodiments of the computer program may achieve the same or similar effects as any of the preceding method embodiments to which it corresponds.
In some embodiments, obtaining the first file extension that meets the requirements of the file upload interface comprises: the method comprises the steps of obtaining a file type meeting the requirements of a file uploading interface, and determining one or more first file extensions based on the file type.
In some embodiments, selecting a second file extension from the common file name extension repository that is different from the first file extension comprises: one or more first file extensions are removed from the common file name extension library and a second file extension is selected from the remaining extensions one at a time.
In some embodiments, replacing the first file extension in the file upload request with the second file extension, re-uploading the modified file upload request comprises: and respectively replacing the first file extension in the file uploading request with the second file extension selected each time, and respectively uploading the modified file uploading request again aiming at the second file extension selected each time until the second file extension selected traverses the rest extensions.
In some embodiments, generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into a file; the execution characteristic information of the received file execution request includes: execution response information of the file execution request is received, and performing character matching in the execution response information obtains unique identification information that is an execution feature of the file.
In some embodiments, the random number generator is configured to generate true random numbers or pseudo random numbers.
In some embodiments, the file upload request and the file execution request are both HTTP requests.
The following further illustrates embodiments of the invention in accordance with the specific example shown in fig. 2.
As shown in fig. 2, a device based on a page automation tool is first designed, which can traverse all file uploading interfaces of a tested Web application with the identity of a super administrator. The page automation is a tool which can read in a test suite, execute a test, record a test result and simulate real user operation, comprises operations of browsing a page, clicking a link, inputting characters, submitting a form, triggering a mouse event and the like, and can carry out various verifications on the page result. That is, as long as the expected user behavior and result are described in the test case, a functional test suite capable of automatically running is obtained.
And screening out file uploading interfaces needing to be subjected to file type verification according to prompt information at the front end of the page, and acquiring a file type specified by each interface, namely a file extension meeting the interface requirement. File extensions, also known as suffix names for files, are a mechanism used by operating systems to mark file types. The extension is an indispensable part of each file. If a file does not have an extension, the operating system cannot process the file and cannot tell exactly how to process the file. Files in the operating system are divided into a plurality of types according to different formats and purposes, and for convenience of management and identification, the files are distinguished by extension names when named, namely the file name format is as follows: "Main File name. Extension". Thus, the type of the file can be judged according to the extension name of the file, and the format and the application of the file can be known.
And generating files meeting the file type requirements of different file uploading interfaces in the second step, and uploading the files to corresponding file uploading interfaces. And capturing file uploading HTTP request information of each file uploading interface through a packet capturing tool. The packet capturing tool is software for intercepting and viewing the content of the network data packet. By analyzing the captured data packets, useful information can be obtained. The computer of (a) achieves the dissemination of data in the network by uploading and downloading a number of data packets to and from the network. The capture tool can help to keep the packets, and if the packets are transmitted in clear text or the encryption method is known, the contents of the packets and the purposes of the packets can be analyzed.
And loading a common file extension library, judging file extensions which do not accord with the interface requirement in the common file extension library according to the file type specified by each interface acquired in the second step, and replacing the file extensions in the HTTP request information captured in the third step with the file extensions which do not accord with the interface requirement. Every time the HTTP request is replaced, it is attempted to resend the HTTP request until all file extensions that do not conform to the requirements of the interface have been traversed. The common file extension library collects file extensions corresponding to all common file types, and stores the file extensions in a database in a data structure recognizable by computer languages so as to be used in computer programs.
And judging the HTTP response information after the HTTP request is retransmitted in the fourth step, and if the response information is normal, indicating that the malicious file which does not meet the file type requirement is successfully uploaded.
It is not enough to successfully upload only malicious files and further exploit verification is required. And according to a default file path corresponding to each file uploading interface, trying to access the malicious file through an HTTP request. The random number generator is used in advance and serves as the unique identification information of the malicious file, the returned HTTP response information is matched after the file access request is sent, and if the unique identification information is matched, the malicious file is successfully accessed, and a file uploading vulnerability exists.
Wherein the random number generator outputs a random number. The use of random numbers is required in different techniques of statistics. There are many different ways to generate random numbers. These methods are called random number generators. The most important property of a random number is that it is generated with the number following it having no relation to the number preceding it. Random numbers are divided into true random numbers and pseudo random numbers, the true random numbers being generated using physical phenomena: such as throwing money, dice, wheels, noise using electronic components, nuclear fission, etc., and are called physical random number generators. The pseudo random number is generated by a fixed, repeatable calculation method. The random numbers generated by the computer or calculator have a long periodicity. They are not truly random because they are actually computable, but they have statistical characteristics similar to random numbers, and such generators are called pseudo-random number generators.
The embodiment of the invention largely applies an automation technology, simulates the operation of manual file uploading through a page automation tool, traverses all file uploading interfaces of the tested Web application, and judges which interfaces have limitation on the types of the uploaded files according to the prompt information at the front end of the page, namely which interfaces need to be detected. And then automatically intercepting request information of the interface through a packet capturing tool, and converting the request information into a data type which can be recognized by a computer language. And then, a common file extension library is imported, all the malicious file extensions can be replaced and all the interfaces to be tested can be traversed for automatic inspection only by a simple computer loop statement structure. The work efficiency of safety assessment personnel is greatly improved, and the coverage of the uploading interface of the Web application file is improved.
It can be seen from the foregoing embodiment that, in the method for detecting a file upload vulnerability of a web page end provided in the embodiment of the present invention, a file upload interface on which a file extension check needs to be performed is determined by using a page automation tool based on a prompt message of the web page end, and a first file extension meeting a file upload interface requirement is obtained; generating a file with a first file extension name, uploading the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool; loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request; the technical scheme that the file execution request is sent based on the default file path corresponding to the file uploading interface in response to the successful response information of the received file uploading request, and the file uploading loophole is judged to exist in response to the execution characteristic information of the received file execution request can traverse all the file uploading interfaces for automatic inspection, so that the safety evaluation working efficiency and the coverage of the file uploading interfaces are greatly improved.
It should be particularly noted that, in each embodiment of the foregoing method for detecting a file upload vulnerability of a web page end, each step may be intersected, replaced, added, and deleted, so that the method for detecting a file upload vulnerability of a web page end, which is transformed by reasonable permutation and combination, also belongs to the protection scope of the present invention, and the protection scope of the present invention should not be limited to the above embodiment.
In view of the foregoing, a second aspect of the embodiments of the present invention provides an embodiment of a device for detecting a file upload vulnerability of a web page end, which traverses all file upload interfaces for automatic inspection. The file uploading vulnerability detection device of the webpage end comprises:
a processor; and
a memory storing program code executable by the processor, the program code when executed performing the steps of:
determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;
generating a file with a first file extension name, uploading the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;
loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request;
and in response to the successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and in response to the execution characteristic information of the received file execution request, judging that a file uploading bug exists.
In some embodiments, selecting a second file extension from the common filename extension library that is different from the first file extension comprises: one or more first file extensions are removed from the common file name extension library and a second file extension is selected from the remaining extensions one at a time.
Replacing the first file extension in the file upload request with the second file extension, the re-uploading the modified file upload request comprising: and respectively replacing the first file extension in the file uploading request with the second file extension selected each time, and respectively uploading the modified file uploading request again aiming at the second file extension selected each time until the second file extension selected traverses the rest extensions.
In some embodiments, generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into a file; the execution characteristic information of the received file execution request includes: receiving execution response information of the file execution request, and performing character matching in the execution response information to obtain unique identification information as an execution feature of the file; wherein the random number generator is configured to generate a true random number or a pseudo random number.
It can be seen from the foregoing embodiment that, in the file upload vulnerability detection apparatus of the web page end provided in the embodiment of the present invention, a file upload interface on which file extension verification needs to be performed is determined by using a page automation tool based on the prompt information of the web page end, and a first file extension meeting the file upload interface requirement is obtained; generating a file with a first file extension name, uploading the file to a file uploading interface by using a page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool; loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and re-uploading the modified file uploading request; the technical scheme that the file execution request is sent based on the default file path corresponding to the file uploading interface in response to the successful response information of the received file uploading request, and the file uploading loophole is judged to exist in response to the execution characteristic information of the received file execution request can traverse all the file uploading interfaces for automatic inspection, so that the safety evaluation working efficiency and the coverage of the file uploading interfaces are greatly improved.
It should be particularly noted that, in the embodiment of the device for detecting a file upload vulnerability of a web page end, the embodiment of the method for detecting a file upload vulnerability of a web page end is used to specifically describe the working process of each module, and those skilled in the art can easily think that these modules are applied to other embodiments of the method for detecting a file upload vulnerability of a web page end. Of course, since the steps in the embodiment of the method for detecting a file upload vulnerability of a web page end can be mutually intersected, replaced, added, and deleted, the device for detecting a file upload vulnerability of a web page end, which is transformed by reasonable permutation and combination, should also belong to the protection scope of the present invention, and the protection scope of the present invention should not be limited to the embodiment.
The foregoing are exemplary embodiments of the present disclosure, but it should be noted that various changes and modifications could be made herein without departing from the scope of the present disclosure as defined by the appended claims. The functions, steps and/or actions of the method claims in accordance with the disclosed embodiments described herein need not be performed in any particular order. Furthermore, although elements of the disclosed embodiments of the invention may be described or claimed in the singular, the plural is contemplated unless limitation to the singular is explicitly stated.
Those of ordinary skill in the art will understand that: the discussion of any embodiment above is meant to be exemplary only, and is not intended to intimate that the scope of the disclosure, including the claims, of embodiments of the invention is limited to these examples; within the framework of embodiments of the invention, also combinations between technical features of the above embodiments or different embodiments are possible, and there are many other variations of the different aspects of the embodiments of the invention described above, which are not provided in detail for the sake of brevity. Therefore, any omissions, modifications, substitutions, improvements, and the like that may be made without departing from the spirit and principles of the embodiments of the present invention are intended to be included within the scope of the embodiments of the present invention.
Claims (9)
1. A method for detecting a file uploading vulnerability of a webpage end is characterized by comprising the following steps of:
determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;
generating a file with the first file extension to upload the file to the file uploading interface by using the page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;
loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and uploading the modified file uploading request again;
responding to successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and responding to execution characteristic information of the received file execution request to judge that a file uploading vulnerability exists;
wherein generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into the file;
the receiving of the execution characteristic information of the file execution request includes: execution response information of the file execution request is received, and performing character matching in the execution response information obtains the unique identification information that is an execution feature of the file.
2. The method of claim 1, wherein obtaining the first file extension meeting the requirements of the file upload interface comprises: and acquiring the file type meeting the requirements of the file uploading interface, and determining one or more first file extensions based on the file type.
3. The method of claim 1, wherein selecting a second file extension from the common filename extension repository that is different from the first file extension comprises: and removing one or more first file extensions from the common file name extension library, and selecting one of the rest of the file extensions as the second file extension at a time.
4. The method of claim 3, wherein replacing the first file extension in the file upload request with a second file extension, wherein re-uploading the modified file upload request comprises: and replacing the first file extension in the file uploading request with the second file extension selected each time respectively, and uploading the modified file uploading request again aiming at the second file extension selected each time respectively until the second file extension selected traverses the rest extensions.
5. The method of claim 1, wherein the random number generator is configured to generate true random numbers or pseudo random numbers.
6. The method of claim 1, wherein the file upload request and the file execution request are both HTTP requests.
7. The utility model provides a leak detection device is uploaded to file of webpage end which characterized in that includes:
a processor; and
a memory storing program code executable by the processor, the program code when executed performing the steps of:
determining a file uploading interface needing to execute file extension verification by using a page automation tool based on prompt information of a webpage end, and acquiring a first file extension meeting the requirements of the file uploading interface;
generating a file with the first file extension to upload the file to the file uploading interface by using the page automation tool, and intercepting a file uploading request of the file uploading interface by using a packet capturing tool;
loading a common file name extension library, selecting a second file extension different from the first file extension from the common file name extension library to replace the first file extension in the file uploading request, and uploading the modified file uploading request again;
responding to successful response information of the received file uploading request, sending a file execution request based on a default file path corresponding to the file uploading interface, and responding to execution characteristic information of the received file execution request to judge that a file uploading vulnerability exists;
wherein generating the file having the first file extension comprises: generating unique identification information based on a random number generator, and writing the unique identification information into the file;
the receiving of the execution characteristic information of the file execution request includes: execution response information of the file execution request is received, and performing character matching in the execution response information obtains the unique identification information as an execution feature of the file.
8. The apparatus of claim 7, wherein selecting a second file extension from the common filename extension library that is different from the first file extension comprises: removing one or more first file extensions from a common file name extension library, and selecting one of the remaining extensions as the second file extension at a time;
replacing the first file extension in the file upload request with a second file extension, the re-uploading the modified file upload request comprising: and replacing the first file extension in the file uploading request with the second file extension selected each time respectively, and uploading the modified file uploading request again aiming at the second file extension selected each time respectively until the second file extension selected traverses the rest extensions.
9. The apparatus of claim 7, wherein the random number generator is configured to generate a true random number or a pseudo random number.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011148876.2A CN112446030B (en) | 2020-10-23 | 2020-10-23 | Method and device for detecting file uploading vulnerability of webpage end |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011148876.2A CN112446030B (en) | 2020-10-23 | 2020-10-23 | Method and device for detecting file uploading vulnerability of webpage end |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112446030A CN112446030A (en) | 2021-03-05 |
| CN112446030B true CN112446030B (en) | 2023-01-06 |
Family
ID=74736649
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011148876.2A Active CN112446030B (en) | 2020-10-23 | 2020-10-23 | Method and device for detecting file uploading vulnerability of webpage end |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112446030B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113114680B (en) * | 2021-04-13 | 2023-04-07 | 中国工商银行股份有限公司 | Detection method and detection device for file uploading vulnerability |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105227387A (en) * | 2014-06-16 | 2016-01-06 | 腾讯科技（深圳）有限公司 | The detection method of webpage leak, Apparatus and system |
| CN108696488A (en) * | 2017-04-11 | 2018-10-23 | 腾讯科技（深圳）有限公司 | A kind of upload interface identification method, identification server and system |
| CN109412896A (en) * | 2018-11-14 | 2019-03-01 | 中国平安人寿保险股份有限公司 | Test method, device, computer equipment and the storage medium of upload function |
-
2020
- 2020-10-23 CN CN202011148876.2A patent/CN112446030B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105227387A (en) * | 2014-06-16 | 2016-01-06 | 腾讯科技（深圳）有限公司 | The detection method of webpage leak, Apparatus and system |
| CN108696488A (en) * | 2017-04-11 | 2018-10-23 | 腾讯科技（深圳）有限公司 | A kind of upload interface identification method, identification server and system |
| CN109412896A (en) * | 2018-11-14 | 2019-03-01 | 中国平安人寿保险股份有限公司 | Test method, device, computer equipment and the storage medium of upload function |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112446030A (en) | 2021-03-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Gupta et al. | PHP-sensor: a prototype method to discover workflow violation and XSS vulnerabilities in PHP web applications | |
| Melicher et al. | Riding out domsday: Towards detecting and preventing dom cross-site scripting | |
| Le Goues et al. | Genprog: A generic method for automatic software repair | |
| CA2777434C (en) | Verifying application security vulnerabilities | |
| Austin et al. | A comparison of the efficiency and effectiveness of vulnerability discovery techniques | |
| US7594142B1 (en) | Architecture for automated detection and analysis of security issues | |
| US10855717B1 (en) | Systems and methods of intelligent and directed dynamic application security testing | |
| US8621613B1 (en) | Detecting malware in content items | |
| Antunes et al. | Designing vulnerability testing tools for web services: approach, components, and tools | |
| Li et al. | Sentinel: securing database from logic flaws in web applications | |
| Golmohammadi et al. | Testing restful apis: A survey | |
| Fell | A review of fuzzing tools and methods | |
| Li et al. | LogicScope: Automatic discovery of logic vulnerabilities within web applications | |
| Mitropoulos et al. | Time present and time past: analyzing the evolution of JavaScript code in the wild | |
| CN112653709A (en) | Vulnerability detection method and device, electronic equipment and readable storage medium | |
| CN110287700B (en) | iOS application security analysis method and device | |
| CN110502892A (en) | A kind of the determination method, apparatus and system of abnormality test process | |
| CN112446030B (en) | Method and device for detecting file uploading vulnerability of webpage end | |
| CN114491560A (en) | Vulnerability detection method and device, storage medium and electronic equipment | |
| Sun et al. | A feasibility study of autonomically detecting in-process cyber-attacks | |
| Shahriar et al. | Early detection of SQL injection attacks | |
| CN116361793A (en) | Code detection method, device, electronic equipment and storage medium | |
| Mostafa et al. | Netdroid: Summarizing network behavior of android apps for network code maintenance | |
| US10002253B2 (en) | Execution of test inputs with applications in computer security assessment | |
| CN115378655A (en) | Vulnerability detection method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |