JP2023094338A - Vulnerability diagnosing device, control method of vulnerability diagnosing device, and vulnerability diagnosing program - Google Patents

Abstract

To provide a vulnerability diagnosing device configured to allow a user who has no special knowledge or experience to diagnose vulnerability of a webpage or an application.SOLUTION: A vulnerability diagnosing device (100) includes: a vulnerability diagnosis processing information generation unit (121) which generates vulnerability diagnosis processing information that specifies vulnerability diagnosis processing for diagnosing vulnerability of a webpage or an application on the basis of a user operation; and a vulnerability diagnosis processing unit (122) which executes vulnerability diagnosis processing on the basis of the vulnerability diagnosis processing information.SELECTED DRAWING: Figure 1

Description

The present invention relates to a vulnerability diagnosis device, a vulnerability diagnosis device control method, and a vulnerability diagnosis program.

Techniques for diagnosing vulnerabilities of web pages or applications to prevent various attacks on web pages or applications are known in the prior art.

For example, Patent Literature 1 describes a web application that includes an inspection means that generates inspection data including input parameters used for inputting to input items of a web application and macros indicating instructions to replace the input parameters with predetermined values. An inspection device is described.

JP 2005-250945 A

Conventional techniques such as Patent Literature 1 cannot diagnose the vulnerability of web pages or applications unless the user has specialized knowledge and experience, such as knowledge about vulnerabilities and experience in programming development.

A primary object of one aspect of the present invention is to realize a vulnerability diagnosis device and related technology that can diagnose vulnerabilities in web pages or applications without requiring a user to have specialized knowledge or experience.

In order to solve the above problems, a vulnerability diagnosis device according to an aspect of the present invention provides vulnerability diagnosis processing that defines vulnerability diagnosis processing for diagnosing vulnerabilities of a web page or an application based on a user's operation. a vulnerability diagnosis processing information generation unit that generates information; and a vulnerability diagnosis processing unit that executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit. .

A control method for a vulnerability diagnosis device according to an aspect of the present invention is a vulnerability diagnosis process in which a vulnerability diagnosis device defines vulnerability diagnosis processing for diagnosing a vulnerability of a web page or an application based on a user's operation. Vulnerability diagnosis processing information generation processing for generating information; and vulnerability diagnosis device executing the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit. and diagnostic processing.

The vulnerability diagnosis device according to each aspect of the present invention may be implemented by a computer. In this case, the vulnerability diagnosis device is operated by operating the computer as each part (software element) included in the vulnerability diagnosis device. A vulnerability diagnosis program for a vulnerability diagnosis device that implements by a computer, and a computer-readable recording medium recording it are also included in the scope of the present invention.

ADVANTAGE OF THE INVENTION According to one aspect of the present invention, it is possible to realize a vulnerability diagnosis device and related technology that can diagnose the vulnerability of a web page or an application even if the user does not have specialized knowledge or experience.

1 is a block diagram showing an example of a configuration of a vulnerability diagnosis device according to Embodiment 1; FIG. 4 is a flow chart showing an example of a control method of the vulnerability diagnosis device according to Embodiment 1; FIG. It is a figure which shows an example of a vulnerability-diagnosis process information generation image. It is a figure which shows an example of a vulnerability-diagnosis process execution image. It is a figure which shows an example of insertion of the attack character string with respect to the HTTP request of vulnerability-diagnosis object. It is a figure which shows an example of the insertion place of the attack character string with respect to the HTTP request of vulnerability-diagnosis object. It is a figure which shows an example of a vulnerability-diagnosis process result image. FIG. 7 is a block diagram showing an example of the configuration of a vulnerability diagnosis device according to Embodiment 2; FIG. 11 is a flow chart showing an example of a control method of the vulnerability diagnosis device according to the second embodiment; FIG. 11 is a flow diagram showing an example of transition information generation processing by the vulnerability diagnosis device according to the second embodiment; It is a figure which shows an example of transition information. FIG. 11 is a block diagram showing an example of the configuration of a vulnerability diagnosis system according to Embodiment 3; FIG. 11 is a flow chart showing an example of a control method of a vulnerability diagnosis device according to Embodiment 3; It is a figure which shows an example of shared vulnerability-diagnosis processing information. It is a figure which shows an example of shared vulnerability-diagnosis processing information.

<Embodiment 1>
Embodiment 1 will be described with reference to FIGS. 1 to 7. FIG. FIG. 1 is a block diagram showing an example of configuration of a vulnerability diagnosis device 100 according to the first embodiment.

[Vulnerability diagnosis device 100]
The vulnerability diagnosis device 100 diagnoses vulnerabilities of web pages or applications. As shown in FIG. 1 , the vulnerability diagnosis device 100 includes an operation reception section 110 , a main control section 120 and an output section 130 . Examples of the vulnerability diagnosis device 100 include a computer such as a proxy server.

[Operation accepting unit 110]
The operation reception unit 110 receives input of user's operation to the vulnerability diagnosis processing information generation unit 121 in the main control unit 120 .

For example, the operation accepting unit 110 accepts input of a user's operation to components of a graphical user interface (GUI), such as clicking a button for clicking or selecting and clicking a combo box.

The operation reception unit 110 includes, for example, a user interface (UI: graphical user interface) such as a keyboard, mouse, touch panel, and switch.

[Main control unit 120]
The main control unit 120 controls the vulnerability diagnosis device 100 . As shown in FIG. 1 , the main control unit 120 includes a vulnerability diagnosis processing information generation unit 121 and a vulnerability diagnosis processing unit 122 .

(Vulnerability diagnosis processing information generation unit 121)
Vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing vulnerabilities of web pages or applications based on user operations input to operation reception unit 110 . . When the vulnerability diagnosis processing information is composed of a plurality of items, the vulnerability diagnosis processing information generator 121 may change each item of the vulnerability diagnosis processing information according to the user's operation. The details of the vulnerability diagnosis processing information generation process by the vulnerability diagnosis processing information generation unit 121 will be described later.

(Vulnerability diagnosis processing unit 122)
The vulnerability diagnosis processing unit 122 executes vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated or changed by the vulnerability diagnosis processing information generation unit 121 . For example, the vulnerability diagnosis processing unit 122 generates or changes an attack character string based on the vulnerability diagnosis processing information, and sends an attack HTTP request in which the attack character string is inserted into the HTTP request to the server targeted for vulnerability diagnosis. By sending it, vulnerability diagnosis processing is executed. Details of the vulnerability diagnosis processing by the vulnerability diagnosis processing unit 122 will be described later.

[Output unit 130]
The output unit 130 outputs an image (vulnerability diagnosis processing information generation image) for the user to specify during the vulnerability diagnosis processing information generation processing, an image for executing the vulnerability diagnosis processing (vulnerability diagnosis processing execution image), and an image showing the vulnerability diagnosis processing result (vulnerability diagnosis processing result image). As shown in FIG. 1 , the output section 130 has a display section 131 .

(Display unit 131)
The display unit 131 displays a vulnerability diagnosis processing information generation image, a vulnerability diagnosis processing execution image, a vulnerability diagnosis processing result image, and the like.

[Control Method S1 of Vulnerability Diagnosis Device 100]
Next, the control method (control method of the vulnerability diagnosis device) S1 of the vulnerability diagnosis device 100 according to the first embodiment will be described with reference to FIGS. FIG. 2 is a flow chart showing an example of the control method S1 of the vulnerability diagnosis device 100 according to the first embodiment.

As shown in FIG. 2, the control method S1 of the vulnerability diagnosis device 100 includes an operation acceptance process S11, a vulnerability diagnosis process information generation process S12, a vulnerability diagnosis process S13, and an output process S14. The diagnostic device 100 executes in this order.

[Operation reception processing S11]
The operation reception unit 110 of the vulnerability diagnosis device 100 receives a user's operation input to the vulnerability diagnosis processing information generation unit 121 in the main control unit 120 .

The operation reception processing S11 by the operation reception unit 110 will be described below with reference to FIG. FIG. 3 is a diagram showing an example of a vulnerability diagnosis processing information generation image. Specifically, FIG. 3 is a diagram showing an example of a first vulnerability diagnosis processing information generation image I1 and a second vulnerability diagnosis processing information generation image I2.

When the operation reception unit 110 executes the operation reception process S11, first, the first vulnerability diagnosis processing information generation image I1 is displayed on the display unit 131 .

In the example shown in FIG. 3, the first vulnerability diagnosis processing information generation image I1 includes the following vulnerability diagnosis processing information.
・Vulnerability diagnosis information that can attack a server that uses SQL (Structured Query Language) (“SQL injection” in the example shown in FIG. 3)
・Vulnerability diagnosis information on vulnerabilities that can attack the OS using shell commands of the OS (Operation System) (“OS command injection” in the example shown in FIG. 3)
・Vulnerability diagnosis information related to the vulnerability of files being viewed by specifying the file path of the server ("path traversal" in the example shown in Figure 3)
・By inserting an attack script (for example, an attack character string) into a parameter of an HTTP request, vulnerability diagnosis information (in the example shown in Fig. 3, "cross site scripting")

In the example shown in FIG. 3, the vulnerability diagnosis processing information D ("XSS (Params)" in the example shown in FIG. 3) included in "cross-site scripting" in the first vulnerability diagnosis processing information generation image I1 is Shows information about vulnerability diagnosis processing for vulnerabilities in a web page or application when a user inserts an attack script into the web page or application.

As shown in FIG. 3, the vulnerability diagnosis processing information D may consist of a plurality of items including at least one of the following items.
- Vulnerability diagnosis processing execution condition D1 ("Event Conditions" in the example shown in FIG. 3)
- Vulnerability diagnosis processing execution information D2 ("Attack Methods" in the example shown in FIG. 3)
- Vulnerability diagnosis processing result evaluation condition D3 ("Match Conditions" in the example shown in FIG. 3)

The vulnerability diagnosis processing execution condition D1 indicates a condition for the vulnerability diagnosis processing unit 122 to execute the vulnerability diagnosis processing S13. The vulnerability diagnosis processing execution information D2 indicates information used when executing the vulnerability diagnosis processing S13, such as attack character strings, parameters, and HTTP responses. The vulnerability diagnosis processing result evaluation condition D3 indicates a condition for evaluating the vulnerability diagnosis processing result. For example, the vulnerability diagnosis processing result evaluation condition D3 indicates a condition for evaluating the vulnerability diagnosis processing result by evaluating how well the condition to be satisfied is met when a vulnerability exists.

By including the vulnerability diagnosis processing execution condition D1 in the vulnerability diagnosis processing information D, the vulnerability diagnosis processing unit 122 can determine communication conditions for vulnerability diagnosis. Since the vulnerability diagnosis processing information D includes the vulnerability diagnosis processing execution information D2, the vulnerability diagnosis processing unit 122 executes the vulnerability diagnosis processing S13 by a method desired by the user based on the vulnerability diagnosis processing execution information D2. can be executed. By including the vulnerability diagnosis processing result evaluation condition D3 in the vulnerability diagnosis processing information D, the vulnerability diagnosis processing unit 122 can determine the condition for pointing out the vulnerability based on the vulnerability diagnosis processing result evaluation condition D3. .

In the example shown in FIG. 3, the operation reception unit 110 receives a click of the vulnerability diagnosis process execution condition D1 from the user. Further, the main control unit 120 causes the display unit 131 to display the second vulnerability diagnosis processing information generation image I2 for setting the vulnerability diagnosis processing execution condition D1 based on the click of the vulnerability diagnosis processing execution condition D1. ing.

The second vulnerability diagnosis processing information generation image I2 is an image for setting the vulnerability diagnosis processing execution condition D1, and includes the following components. Vulnerability diagnosis processing execution conditions D1 are those shown in options related to conditions for executing vulnerability diagnosis processing ("Common" in combo box C1, "Header of specific response" in combo box C2 in the example shown in FIG. 3). meets the condition" and component C5 "The HTTP response header string contains the string."). The operation reception unit 110 receives input from the user for at least one of the following components.
- A component that displays options for the vulnerability diagnosis process execution condition D1 ("combo box C1", "combo box C2" and "component C5" in the example shown in FIG. 3)
・Component for determining vulnerability diagnosis processing execution information D2 ("click button C3" in the example shown in FIG. 3)
- A component that cancels the vulnerability diagnosis process execution condition D1 ("click button C4" in the example shown in FIG. 3)

[Vulnerability diagnosis processing information generation processing S12]
The vulnerability diagnosis processing information generation unit 121 in the main control unit 120 of the vulnerability diagnosis device 100 generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing vulnerabilities of web pages or applications based on user operations. to generate

An example of the vulnerability diagnosis processing information generation processing S12 by the vulnerability diagnosis processing information generation unit 121 will be described below with reference to FIG. In particular, the generation and modification of the vulnerability diagnosis processing execution condition D1 among the plurality of items constituting the vulnerability diagnosis processing information D, which is information related to the vulnerability diagnosis processing, will be described in detail.

Of the plurality of items that make up the vulnerability diagnosis processing information D, the vulnerability diagnosis processing execution information D2 and the vulnerability diagnosis processing result evaluation condition D3 are determined by the user's operation in the same manner as the vulnerability diagnosis processing execution condition D1. Since the vulnerability diagnosis processing information generation unit 121 can independently generate and change based on, the description is omitted.

For example, in a state where the second vulnerability diagnosis processing information generation image I2 shown in FIG. The diagnostic processing information generation unit 121 generates vulnerability diagnostic processing information based on the operation.

In the example shown in FIG. 3, the operation reception unit 110 clicks the combo boxes C1 and C2 from the state where the second vulnerability diagnosis processing information generation image I2 is displayed on the display unit 131, and displays the image by clicking these. Clicking on the options displayed in section 131 is not accepted. In this case, the vulnerability diagnosis processing information generation unit 121 generates the vulnerability diagnosis processing information without changing the preset vulnerability diagnosis processing information.

In the example shown in FIG. 3, "Common" in the combo box C1 indicates conditions that do not have remarkable characteristics when each condition is grouped. "If header of specific response meets condition" in combo box C2 indicates a case where the header of the header and body, which are data constituting the specific HTTP response, matches "some condition".

In this case, "some condition" indicates what is set by the vulnerability diagnosis processing information generation unit 121 based on the selection of details received by the operation reception unit 110 from the user. For example, "some conditions" include the presence of a "Set-Cookie" header in the HTTP response.

When the operation accepting unit 110 accepts an operation from the user to select an option other than "Common" in the combo box C1 or "When the header of a specific response meets the condition" in C2, the vulnerability diagnosis processing information generating unit 121 changes the vulnerability diagnosis process execution condition D1.

Using the example shown in FIG. 3, when the operation reception unit 110 receives the following operation from the user, the vulnerability diagnosis processing information generation unit 121 changes the vulnerability diagnosis processing execution condition D1.
・An operation to select an option indicating a condition with remarkable characteristics other than “Common” in the combo box C1 ・An option other than “If the header of a specific HTTP response meets the condition” in the combo box C2 (for example, Operation to select the option indicating when the body, which is the data that constitutes a specific HTTP response, matches "some conditions") ・By clicking "Character string is included" in component C5, a separate screen appears. Operation to select a displayed option (e.g., "Number of strings matches X", "Specific header exists", etc.)

The vulnerability diagnosis processing information generator 121 changes the vulnerability diagnosis processing information including the vulnerability diagnosis processing execution condition by changing the vulnerability diagnosis processing execution condition D1. In this way, when the vulnerability diagnosis processing information D is composed of a plurality of items in advance, and the operation reception unit 110 receives an operation to change the plurality of items from the user, the vulnerability diagnosis processing information generation unit 121 Execute vulnerability diagnosis processing information generation processing accompanied by change processing for changing vulnerability diagnosis processing information.

For example, when the vulnerability diagnosis processing information generation unit 121 changes the vulnerability diagnosis processing execution condition D1, the condition for the vulnerability diagnosis processing unit 122 to execute the vulnerability diagnosis processing S13 (for example, communication conditions) are changed. In addition, when the vulnerability diagnosis process information generation unit 121 changes the vulnerability diagnosis process execution information D2, information used when executing the vulnerability diagnosis process S13 (for example, attack information inserted into an HTTP request for a web page or an application) string) is changed.

As a result, even if the user does not have knowledge of vulnerabilities or specialized knowledge or experience such as experience in programming development, the vulnerability diagnosis processing unit 122 can detect vulnerabilities of web pages or applications with attack strings desired by the user. sex can be diagnosed.

In addition, even if each item of the preconfigured vulnerability diagnosis processing information D includes an item that is not desired by the user due to development circumstances, etc., the vulnerability diagnosis processing information generation unit 121 Each item can be changed as desired by the user.

Further, when the operation receiving unit 110 receives an operation to add an item to the vulnerability diagnosis processing information D from the user, the vulnerability diagnosis processing information generation unit 121 can perform change processing to add the item.

The vulnerability diagnosis processing information generation unit 121 selects the item by a method in which the operation reception unit 110 receives a click of an option regarding addition of an item from a pop-up menu displayed when the vulnerability diagnosis processing information D is right-clicked by the user. A change process to add can be performed.

For example, when the item of the vulnerability diagnosis processing information D consists of only the vulnerability diagnosis processing execution condition D1, the vulnerability diagnosis processing information generation unit 121 generates the vulnerability diagnosis processing execution information D2 and the vulnerability diagnosis processing result evaluation. Condition D3 may be added as an item, or items other than these may be added.

Vulnerability diagnosis processing information generation unit 121 generates items of vulnerability diagnosis processing information D having a function of supporting at least one of user's selection operation and input operation for GUI components based on the user's operation on operation reception unit 110. may be added. This makes it easier for the user to operate the operation receiving unit 110, and as a result, the vulnerability diagnosis processing information generating unit 121 can generate vulnerability diagnosis processing information more efficiently.

The vulnerability diagnosis processing information generation unit 121 may add vulnerability diagnosis processing information specifying a vulnerability diagnosis method different from the vulnerability diagnosis processing information D based on the user's operation on the operation reception unit 110 . When FIG. 3 is used as an example, the vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing information other than the vulnerability diagnosis processing information D (in the example shown in FIG. 3, “XSS (Path)”, “XSS ( DOM Based)” and “SQL Injection”) may be added.

In addition, the vulnerability diagnosis processing information generation unit 121 also generates the following vulnerability diagnosis information in addition to cross-site scripting vulnerability diagnosis processing information such as XSS (Params), XSS (Path), and XSS (DOM Based). , can be independently added, generated and changed in the same manner as the vulnerability diagnosis processing information D.
・Vulnerability diagnosis information that can attack servers that use SQL (“SQL injection” in the example shown in FIG. 3)
・Vulnerability diagnostic information about vulnerabilities that can attack the OS using OS shell commands (“OS command injection” in the example shown in FIG. 3)
・Vulnerability diagnosis information related to the vulnerability of files being viewed by specifying the file path of the server ("path traversal" in the example shown in Figure 3)

In this way, the vulnerability diagnosis processing information generation unit 121 can generate the items of the vulnerability diagnosis processing information D and the vulnerability diagnosis processing even if the user does not have knowledge about vulnerabilities or specialized knowledge or experience such as experience in programming development. Vulnerability diagnosis processing information other than information D can be added.

[Vulnerability Diagnosis Processing S13]
The vulnerability diagnosis processing unit 122 of the vulnerability diagnosis device 100 executes vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated or changed by the vulnerability diagnosis processing information generation unit 121 .

An example of the vulnerability diagnosis processing S13 by the vulnerability diagnosis processing unit 122 will be described below with reference to FIG. FIG. 4 is a diagram showing an example of a vulnerability diagnosis processing execution image.

Specifically, FIG. 4 shows a case where the vulnerability diagnosis processing information generation unit 121 executes vulnerability diagnosis processing based on all the vulnerability diagnosis processing information generated or changed by the vulnerability diagnosis processing information generation unit 121. 2 shows a vulnerability diagnosis processing execution image I3 related to the communication list information and the vulnerability diagnosis processing result thereof.

When the vulnerability diagnosis processing unit 122 executes the vulnerability diagnosis processing S13, the display unit 131 may display a vulnerability diagnosis processing execution image I3. As shown in FIG. 4, the vulnerability diagnosis process execution image I3 may include the following components.
・Domain DM (“Host” in the example shown in FIG. 4)
・URL (“URL” in the example shown in FIG. 4)
- Attack character string insertion point number IP ("Insert Point" in the example shown in FIG. 4)
- Request transmission count RC ("Request Count" in the example shown in FIG. 4)
- Request failure count FR ("Failed Request" in the example shown in FIG. 4)
- Vulnerability diagnosis processing status ST ("Status" in the example shown in FIG. 4)
- Vulnerability diagnosis processing result R ("Results" in the example shown in FIG. 4)
・Click button C4

A domain DM indicates domain information of a server targeted for vulnerability diagnosis. In the example shown in FIG. 4, domain DM includes domains DM1 to DM4. All of the domains DM1 to DM4 are the same vulnerability diagnosis target domain information "www.....com".

URL indicates the URL of the vulnerability diagnosis target. In the example shown in FIG. 4, the URLs include the following URLs.
- URL 1 ("https://www.....com/contact" in the example shown in FIG. 4)
・URL2 ("https://www.....com/contact/contact" in the example shown in FIG. 4)
- URL 3 ("https://www.....com/contact/contact/confirm_contact" in the example shown in FIG. 4)
- URL 4 ("https://www.....com/contact/contact/confirm_contact/complete_contact" in the example shown in FIG. 4)

The attack character string insertion point number IP indicates the number of points where an attack character string can be inserted into an HTTP request, which is linked one-to-one with each URL targeted for vulnerability diagnosis. include. The attack character string insertion point number IP is an integer equal to or greater than 0, and in the example shown in FIG. , "18", "18", "22", "0".

The request transmission count RC indicates the number of times an attacking HTTP request, in which an attack character string is inserted into an HTTP request targeted for vulnerability diagnosis, is transmitted, and includes request transmission counts RC1 to RC4. In the example shown in FIG. 4, the request transmission times RC1 to RC4 are "18", "18", "22" and "0", respectively.

The request transmission counts RC1 to RC4 are associated with HTTP requests of URLs 1 to 4 targeted for vulnerability diagnosis, respectively. In the above example, the attack character string insertion locations IP1 to IP4 match the request transmission counts RC1 to RC4, but in the present embodiment, they do not necessarily have to match.

For example, in the present embodiment, the number of request transmissions RC1 to RC4 may be greater than the numbers of attack character string insertion locations IP1 to IP4. In this case, the number of request transmissions RC1 to RC4 includes the number of times the vulnerability diagnosis processing unit 122 transmits an HTTP request to attack the vulnerability diagnosis target in addition to inserting the attack character string. may contain. Similarly, the number of request transmissions RC1 to RC4 may include the number of times that the vulnerability diagnosis processing unit 122 does not insert an attack character string into a place where an attack character string can be inserted, and that a normal HTTP request is sent. .

5 and 6, the details of inserting an attack character string into an HTTP request targeted for vulnerability diagnosis will be described below. FIG. 5 is a diagram showing an example of inserting an attack character string into an HTTP request targeted for vulnerability diagnosis. Specifically, FIG. 5 is also a diagram showing an example of generation of an offensive HTTP request for diagnosing whether or not a user ID targeted for vulnerability diagnosis has a cross-site scripting vulnerability.

In the example shown in FIG. 5, the attacking HTTP requests ATRE1 to ATRE4 are generated by the vulnerability diagnosis processing unit 122 for the parameter value "test_id" which is the value of the "user id" of the HTTP request before the attacking character string is inserted. It inserts the attack string "'"><hr>xss" indicated by italics.

Note that in the example shown in FIG. 5, the HTTP request has two parameters. In the example shown in FIG. 5, the first parameter consists of the parameter name "user id" and the parameter value "test_id" before the character string "&" that delimits the parameters. The second parameter consists of the string "&" followed by the parameter name "user pw" and the parameter value "testtesttest".

FIG. 6 is a diagram showing an example of an attack character string insertion location for an HTTP request targeted for vulnerability diagnosis. In the example shown in FIG. 6, the parameter value, parameter name, body, query, filename, cookie, cookie name, cookie value, and user-specified header value are shown in italics in the HTTP request below each item. ing. For example, in the example shown in FIG. 6, the parameter exists in the query parameter (the part after "?") of the HTTP request, the parameter name is "url", and the parameter value is "test".

In the example shown in FIG. 5, the vulnerability diagnosis processing unit 122 generates an attack HTTP request for diagnosing whether or not the user ID is vulnerable to cross-site scripting. is inserting an attack string into the . However, in this embodiment, the vulnerability diagnosis processing unit 122 inserts attack characters into locations corresponding to parameter values, parameter names, bodies, queries, file names, cookies, cookie names, cookie values, and header values shown in FIG. You can insert columns.

The number of request failures FR indicates the number of failures in which the attacking HTTP request was not processed normally due to some error, and includes the number of request failures FR1 to FR4. In the example shown in FIG. 4, the request failure counts FR1 to FR4 correspond to No. 1 in FIG. Indicates the number of failures of attack HTTP requests for each vulnerability diagnosis target from 0 to 3, all of which must be "0". Therefore, the example shown in FIG. 4 indicates that an error HTTP response is not returned in response to the sent attacking HTTP request.

Vulnerability diagnosis processing status ST indicates whether the vulnerability diagnosis process is waiting for vulnerability diagnosis processing, is in progress of vulnerability diagnosis processing, or has been processed. include.

In the example shown in FIG. 4, the vulnerability diagnosis processing statuses ST1 to ST4 correspond to No. 1 in FIG. It corresponds to each of 0 to 3 vulnerability diagnosis targets. Vulnerability diagnosis processing statuses ST1 and ST2 indicate "finished" indicating that vulnerability diagnosis processing has been completed. The vulnerability diagnosis processing status ST3 indicates "scanning" indicating that the vulnerability diagnosis is being processed. Vulnerability diagnosis processing status ST4 indicates "waiting", which means waiting for vulnerability diagnosis processing.

The vulnerability diagnosis processing result R is the vulnerability of the vulnerability diagnosis target obtained from the HTTP response returned from the vulnerability diagnosis target by transmitting the attack HTTP request in which the attack character string is inserted. number and includes vulnerability diagnosis processing results R1 and R2.

In the example shown in FIG. 4, the vulnerability diagnosis processing result R indicates the number of detected vulnerabilities targeted for vulnerability diagnosis. Vulnerability diagnosis processing results R1 and R2 are shown in No. 4 of FIG. It corresponds to vulnerability diagnosis targets of 0 and 1, respectively, and indicates that the number of detected vulnerabilities of vulnerability diagnosis targets is both "4".

In the vulnerability diagnosis processing result R, the presence or absence of a vulnerability is determined each time an attacking HTTP request is sent to a vulnerability diagnosis target, and if there is a vulnerability in the vulnerability diagnosis target, the number of vulnerabilities is added by one. and not added if there is no vulnerability.

Therefore, No. in FIG. 2, even if the vulnerability diagnosis process S13 has not been completed and is in the process of "Scanning", the vulnerability diagnosis process result R is changed to "0" each time an attacking HTTP request is transmitted to the vulnerability diagnosis target. ” and will be updated.

From this, No. in FIG. The fact that there is no vulnerability diagnosis processing result R corresponding to vulnerability diagnosis targets 2 and 3 indicates that an attacking HTTP request has not yet been sent to these vulnerability diagnosis targets.

The click button C4 is a GUI component for transitioning to the vulnerability diagnosis processing result image I4 shown in FIG. The vulnerability diagnosis processing result image I4 will be described together with the output processing S14.

[Output processing S14]
The output unit 130 of the vulnerability diagnosis device 100 outputs the vulnerability diagnosis processing result in the vulnerability diagnosis processing S13. As an example, the output unit 130 causes the display unit 131 to display a vulnerability diagnosis processing result image.

An example of the output processing S14 by the output unit 130 will be described below with reference to FIG. FIG. 7 is a diagram illustrating an example of a vulnerability diagnosis processing result image. Specifically, FIG. 7 shows a vulnerability diagnosis processing result image I4 in which the output unit 130 causes the display unit 131 to display the vulnerability diagnosis processing result of the vulnerability diagnosis processing S13 related to cross-site scripting by the vulnerability diagnosis processing unit 122. indicates

When the output unit 130 executes the output process S14, the output unit 130 may cause the display unit 131 to display the vulnerability diagnosis process result image I4. As in the example shown in FIG. 7, the vulnerability diagnosis processing result image I4 may include the following components.
- Vulnerability diagnosis processing result R'
・Attack character string AT
・HTTP request RE (Request)
- Domain DM (Host)'
・URL (URL)'
・Vulnerability diagnosis processing execution information D2''
・Risk R'''
・Vulnerability diagnosis processing information D''

In the example shown in FIG. 7, the vulnerability diagnosis processing result R' includes vulnerability diagnosis processing information D'a (cross-site scripting), vulnerability diagnosis processing result R''1 (risk), vulnerability diagnosis processing It includes execution information D2'a (vulnerability diagnosis method), parameter P (Parameter), and summary SU. This makes it possible to inform the user of the vulnerability diagnosis processing result of the web page or application in more detail.

In the example shown in FIG. 7, the vulnerability diagnosis processing information D'a is a cross tree node above the vulnerability diagnosis processing information D (XSS (Params)), XSS (Path), and XSS (DOMBased) shown in FIG. Shows information about vulnerability diagnosis processing by site scripting.

The vulnerability diagnosis processing result R''1 is an HTTP request for attack in which the attack character string AT is inserted into the parameter P included in the HTTP request RE, and transmits to the vulnerability diagnosis target an HTTP response returned from the vulnerability diagnosis target. indicates the degree of risk of the vulnerability diagnosis target obtained from

In the example shown in FIG. 7, the risk is indicated by "HIGH" indicating high risk, "MEDIUM" indicating medium risk, and "LOW" indicating low risk. It is For example, the risk level of the cross-site scripting vulnerability targeted for vulnerability diagnosis indicated by the vulnerability diagnosis process result R''1 is "MEDIUM" indicating that it is medium.

Thus, in the example shown in FIG. 7, the vulnerability diagnosis processing result R''1 indicates the degree of risk of vulnerability to be subjected to vulnerability diagnosis, for example, for each of the following vulnerability diagnosis processing information.
・Vulnerability diagnosis information that can attack servers that use SQL (for example, “SQL injection”)
・Vulnerability diagnosis information on vulnerabilities that can attack the OS using OS shell commands (for example, “OS command injection”)
・Vulnerability diagnosis information related to vulnerabilities that allow files to be viewed by specifying the file path of the server (for example, "path traversal")
・Vulnerability diagnosis information (e.g., "cross-site scripting") related to vulnerabilities that insert an attacking script into the HTML of a web page by inserting an attacking script (e.g., an attack character string) into the parameters of an HTTP request

For example, in the example shown in FIG. 7, the cross-site scripting vulnerability is "MEDIUM", the SQL injection vulnerability is "HIGH", and the path traversal is "HIGH". The degree of sexual risk is indicated.

In addition, in the example shown in FIG. 7, No. of FIG. Each time a vulnerability is detected in the target of vulnerability diagnosis in 0, an item related to cross-site scripting vulnerability is added one line at a time. For example, No. in FIG. 0, four cross-site scripting vulnerabilities are detected, so in FIG. 7, four lines of items related to cross-site scripting vulnerabilities are added.

Thus, the vulnerability diagnosis processing result R''1 of "MEDIUM" shown in FIG. 7 does not correspond to the vulnerability diagnosis processing result R of "4" shown in FIG. On the other hand, the vulnerability diagnosis processing result R''1 included in the vulnerability diagnosis processing result R' is the vulnerability diagnosis processing result R'' in the vulnerability diagnosis processing result R''' (Risk) in the table of FIG. '1.

The vulnerability diagnosis process execution information D2'a indicates information on a vulnerability diagnosis method for executing the vulnerability diagnosis process. In the example shown in FIG. 7, the vulnerability diagnosis process execution information D2'a inserts the attack character string AT into the parameter P and modifies the parameter value P, thereby diagnosing the vulnerability targeted for the vulnerability diagnosis. Provides information on diagnostic methods. The vulnerability diagnosis process execution information D2'a corresponds to the vulnerability diagnosis process execution information D2''a in the vulnerability diagnosis process execution information D2'' (Issue Point) in the table of FIG.

The parameter P is information included in the HTTP request RE that is the source of the attacking HTTP request sent by the application to the vulnerability diagnosis target, and is composed of a name and a value. Here, the parameter P is a parameter named "contact" and indicates information whose value is modified by inserting the attack character string AT, otherwise the value is constant.

A summary SU indicates a summary of the result of vulnerability diagnosis processing. As a result, if there is a risk even if there is no vulnerability, it is possible to specifically inform the user of the point of risk.

The attack string AT is inserted into the parameter P to generate an HTTP request with modified parameter values for vulnerability diagnosis.

Domain DM' indicates domain information of a server targeted for vulnerability diagnosis. In the example shown in FIG. 7, domain DM' includes domains DM'1 to DM'4. Domains DM'1 to DM'4 all have the same vulnerability diagnosis target domain information "www.....com".

URL' indicates the URL to be subjected to vulnerability diagnosis. In the example shown in FIG. 7, the URLs include URL'1 to URL'4 ("https://www.....com/contact" in the example shown in FIG. 4), and URL'1 to URL'4 are , corresponds to URL1 in FIG.

The vulnerability diagnosis process execution information D2'' indicates information on a vulnerability diagnosis method for executing the vulnerability diagnosis process. In the example shown in FIG. 7, the vulnerability diagnosis processing execution information D2'' includes vulnerability diagnosis processing execution information D2''a to D2''d. Vulnerability diagnosis processing execution information D2''a to D2''d all indicate parameter value modification.

The risk R''' is obtained from the HTTP response returned from the vulnerability diagnosis target by transmitting an attack HTTP request in which the attack character string AT is inserted into the parameter P included in the HTTP request RE to the vulnerability diagnosis target. indicates the degree of risk of the vulnerability diagnosis target. In the example shown in FIG. 7, the risk R''' includes risk R'''1 to D'''4. All of the risk levels R'''1 to 4 are "MEDIUM" indicating that the risk level of cross-site scripting vulnerability is medium, similar to the risk level R''1 "MEDIUM" described above. is.

Vulnerability diagnosis processing information D'' indicates information related to vulnerability diagnosis processing. In the example shown in FIG. 7, the vulnerability diagnosis processing information D'' includes vulnerability diagnosis processing information D''a to D''d. Vulnerability diagnosis processing information D''a to D''d indicates information on vulnerability diagnosis processing by cross-site scripting.

<Modification>
[Modification 1]
Although the vulnerability diagnosis device 100 includes the operation reception unit 110 in the above example, the vulnerability diagnosis device 100 does not have to include the operation reception unit 110 in this embodiment.

For example, in the present embodiment, in the vulnerability diagnosis device 100, an operation reception unit (not shown) external to the vulnerability diagnosis device 100 receives input of a user's operation, and the vulnerability diagnosis processing information generation unit 121 receives a vulnerability The user's operation information may be obtained from an external operation reception unit of the diagnostic device 100 via a communication unit (not shown). Thereby, the processing amount and load of the entire vulnerability diagnosis device 100 can be reduced.

[Modification 2]
Although the vulnerability diagnosis device 100 includes the output unit 130 in the above example, the vulnerability diagnosis device 100 does not need to include the output unit 130 in this embodiment.

For example, the vulnerability diagnosis device 100 outputs a vulnerability diagnosis processing information generation image, a vulnerability diagnosis processing execution image, a vulnerability diagnosis processing result image, and the like to an output unit (not shown) of an external computer via a communication unit. may be output. Thereby, the processing amount and load of the entire vulnerability diagnosis device 100 can be reduced.

[Modification 3]
In the above example, the vulnerability diagnosis processing information generating unit 121 integrally generates the vulnerability diagnosis processing information and changes each item of the vulnerability diagnosis processing information. You can go separately.

For example, the vulnerability diagnosis processing information generation unit 11 sets each item from a state in which no vulnerability diagnosis processing information is set, based on the user's operation (for example, customization) received by the operation reception unit 110. may generate vulnerability diagnosis processing information. Also, a vulnerability diagnosis processing information changing unit (not shown) different from the vulnerability diagnosis processing information generating unit 121 may independently change the vulnerability diagnosis processing information.

<Embodiment 2>
A vulnerability diagnosis device according to an embodiment of the present invention, like the vulnerability diagnosis device 100X according to the second embodiment, displays between a plurality of web pages, between communication states of a plurality of applications, or between a plurality of applications. Transition information indicating the transition relationship between images may be generated and the transition information may be displayed.

Embodiment 2 will be described below with reference to FIGS. 8 to 11. FIG. For convenience of description, members having the same functions as those of the members described in the above-described embodiments are denoted by the same reference numerals, and their descriptions are omitted.

[Vulnerability diagnosis device 100X]
FIG. 8 is a block diagram showing an example of the configuration of the vulnerability diagnosis device 100X according to the second embodiment. As shown in FIG. 8, the vulnerability diagnosis device 100X includes a main control unit 120X and an output unit 130X instead of the main control unit 120 and the output unit 130 in the first embodiment. Except for this point, the vulnerability diagnosis device 100X has the same configuration as the vulnerability diagnosis device 100 according to the first embodiment.

[Main control unit 120X]
The main controller 120X further includes a transition information generator 123 and a reproducer 124 . Other than this point, the main controller 120X has the same configuration as the main controller 120 in the first embodiment.

(Transition information generation unit 123)
The transition information generation unit 123 generates transition information indicating transition relationships between a plurality of web pages, between communication states of a plurality of applications, or between images displayed by the applications. The transition information may include information for implementing transitions between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications.

(Reproduction unit 124)
Based on the transition information, the reproduction unit 124 (i) converts the web page displayed by the browser to an arbitrary web page designated by the user, and (ii) converts the communication state of the application into an arbitrary communication designated by the user. or (iii) cause the display unit 131X to reproduce the image displayed by the application as an arbitrary image specified by the user.

[Output unit 130X]
The output unit 130X includes a display unit 131X instead of the display unit 131 in the first embodiment. Other than this point, the output section 130X has the same configuration as the output section 130 in the first embodiment.

(Display unit 131X)
The display unit 131X further displays the transition information generated by the transition information generation unit 123. FIG. Except for this point, the display unit 131X has the same configuration as the display unit 131 in the first embodiment.

[Control Method S2 of Vulnerability Diagnosis Device 100X]
Next, the control method (control method of the vulnerability diagnosis device) S2 of the vulnerability diagnosis device 100X according to the second embodiment will be described with reference to FIGS. FIG. 9 is a flow chart showing an example of the control method S2 of the vulnerability diagnosis device 100X according to the second embodiment.

As shown in FIG. 9, the control method S2 of the vulnerability diagnosis device 100X includes a transition information generation process S21, a display process S22, a reproduction process S23, and a display process S24. is executed in

[Transition information generation processing S21]
The transition information generation unit 123 in the main control unit 120X of the vulnerability diagnosis device 100X generates transition information indicating transition relationships between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications. Generate. The image of the application here is, for example, a screen shot of the image of the application displayed on the display unit 131X.

Conventionally, in order to investigate the transition relationship between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications, a It was necessary to investigate the number of parameters present in the communications (eg HTTP requests and HTTP responses) that resulted in transitions between images.

In addition, in the conventional method, the user counts the parameters in HTTP requests and responses between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications. I've been doing it the way

For this reason, analyzing transition relationships between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications requires specialized knowledge and experience, and requires a lot of man-hours when conducting investigations. I needed it.

On the other hand, as described above, the transition information generation unit 123 automatically generates transition information, so that communication between a plurality of web pages or a plurality of applications can be performed without specialized knowledge or experience. It is possible to investigate transition relationships between states or between images displayed by multiple applications.

In addition, the transition information generation unit 123 automatically generates the transition information, thereby significantly reducing the man-hours required for the conventional high-cost investigation. Conventionally, information such as a URL was also manually entered by the user. , the man-hours can be reduced.

The transition information generation unit 123 may generate transition information based on the user's operation received by the operation reception unit 110, for example. Thereby, the transition information generation unit 123 can generate the transition information desired by the user.

The transition information may include information for implementing transitions between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications. By including such transition information, the transition information generation unit 123 can generate transition information suitable for smartphone applications and game client launchers.

The transition information indicates transition relationships between a plurality of web pages, and the transition information generation unit 123 may generate transition information based on communication content of the browser displaying each web page. That is, the transition information generating unit 123 may refer to the HTTP requests and HTTP responses acquired by the local proxy server that relays the HTTP requests and HTTP responses, and generate transition information indicating transition relationships between a plurality of web pages. . Thereby, the transition information generation unit 123 can generate, with high accuracy, transition information indicating the transition relationship between web pages displayed based on the communication content of the browser.

The transition information indicating transition relationships between communication states or between images of a plurality of applications may include transition information indicating at least one transition relationship between communication states and between images of a plurality of applications using HTTP communication. . Thereby, the transition information generation unit 123 can generate transition information suitable for applications using HTTP communication.

The transition information indicates a transition relationship between communication states of a plurality of applications or between images, and the transition information generation unit 123 generates transition information based on the communication content of the browser that displays the image of each application using HTTP communication. You may That is, the transition information generating unit 123 refers to the HTTP requests and HTTP responses acquired by the local proxy server that relays the HTTP requests and HTTP responses, and generates transition information indicating transition relationships between communication states or between images of a plurality of applications. may be generated.

Thereby, the transition information generation unit 123 can generate transition information suitable for an application using HTTP communication, which is displayed based on the communication content of the browser.

(Details of transition information generation processing S21)
10, in the transition information generation process S21, the transition information generation unit 123 generates transition information based on the communication content of the browser that displays the image of each web page or each application using HTTP communication. Processing will be described in more detail.

FIG. 10 is a flowchart showing an example of transition information generation processing S21 by the vulnerability diagnosis device 100X according to the second embodiment. It is assumed that the transition information generation unit 123 has set the starting URL of the vulnerability diagnosis target and the target domain from which the HTTP response is to be acquired before executing step S211. Also, the transition information generating unit 123 refers to the HTTP request and HTTP response acquired by the local proxy server that relays the HTTP request and HTTP response. Subsequently, the transition information generation unit 123 transmits an HTTP request to a web page or an application that uses HTTP communication at any time, and acquires an HTTP response.

Note that the vulnerability diagnosis device 100X accumulates in a storage medium (not shown) a set of already acquired HTTP responses and HTTP requests used to acquire the HTTP responses. In addition, below, the vulnerability diagnosis device 100X generates transition information as tree structure information. However, the data structure of transition information is not limited to a tree structure. The vulnerability diagnosis device 100X stores the generated transition information in a recording medium (not shown).

(Step S211)
The transition information generator 123 determines whether the status of the HTTP response to the HTTP request sent to the web page is 2xx or 3xx.

When the transition information generation unit 123 determines that the HTTP response status is 2xx or 3xx (YES in step S211), the transition information generation unit 123 proceeds to step S212. When the transition information generating unit 123 determines that the HTTP response status is not 2xx or 3xx (NO in step S211), the transition information generating process S21 ends.

Thereby, the transition information generation unit 123 can filter (remove) the HTTP response in which the error occurred.

(Step S212)
The transition information generation unit 123 determines whether the HTTP response is included in the target domain. If the transition information generation unit 123 determines that the HTTP response is included in the target domain (YES in step S212), the transition information generation unit 123 proceeds to step S213. When the transition information generating unit 123 determines that the HTTP response is not included in the target domain (NO in step S212), the transition information generating process S21 ends.

Thereby, the transition information generation unit 123 can filter HTTP responses and HTTP requests that are not included in the target domain.

(Step S213)
The transition information generation unit 123 determines whether or not the communication of the target domain has already been collected. For example, the transition information generation unit 123 can determine whether or not the communication of the target domain has already been collected by determining whether or not the root tree node related to the target domain exists in the storage medium. When the transition information generation unit 123 determines that the communication of the target domain is collected (YES in step S213), the transition information generation unit 123 proceeds to step S214. When the transition information generation unit 123 determines that the communication of the target domain is not collected (NO in step S213), the transition information generation unit 123 omits step S214 and proceeds to step S215.

(Step S214)
The transition information generation unit 123 creates a root tree node of the acquisition domain of the HTTP response.

(Step S215)
The transition information generation unit 123 determines whether or not a response equivalent to the acquired HTTP response has been acquired before. When the transition information generation unit 123 determines that the HTTP response has not been obtained before (YES in step S215), the transition information generation unit 123 proceeds to step S216. If the transition information generating unit 123 determines that the HTTP response has been obtained before (NO in step S215), the transition information generating process S21 ends.

In one aspect, the transition information generation unit 123 generates an HTTP response that matches the URL, method, parameters, and MIMETYPE included in the HTTP request sent to acquire the HTTP response, instead of the HTTP response, to the storage medium. It may be determined whether an HTTP response has been previously obtained by determining whether it has been stored in the . Since the HTTP response changes according to the parameter values of the HTTP request, the transition information generation unit 123 determines whether or not the same HTTP request as before has been transmitted, thereby obtaining the previously acquired HTTP response. can be filtered.

(Step S216)
The transition information generation unit 123 determines whether or not there is a candidate tree node linked to the acquired HTTP response.

If the transition information generation unit 123 determines that there is a candidate tree node linked to the acquired HTTP response (YES in step S216), the transition information generation unit 123 proceeds to step S217. The candidate tree node associated with the acquired HTTP response will be described later in the description of step S222.

If the transition information generating unit 123 determines that there is no tree node linked to the acquired HTTP response (NO in step S216), the transition information generating unit 123 proceeds to step S218.

(Step S217)
The transition information generating unit 123 overwrites the HTTP response data of the candidate tree node, which is a candidate tree node to be linked to the acquired HTTP response, with the acquired HTTP response. As a result, from this point on, the candidate tree node changes from a candidate tree node in which no actual HTTP response is stored to a tree node in which an actual HTTP response is stored.

When overwriting the data of the HTTP response of the candidate tree node, the transition information generation unit 123 generates the HTTP request used to acquire the HTTP response and the image of the web page displayed based on the HTTP response. etc. may be further stored in the candidate tree node.

(Step S218)
If there is no candidate tree node corresponding to the acquired HTTP response, the transition information generation unit 123 creates a tree node for storing the acquired HTTP response, and assigns the tree node of the created HTTP response to the root tree node. tie it together.

(Step S219)
The transition information generation unit 123 determines whether or not there is a tree node (parent tree node) corresponding to the web page including the tag or the like that is the source of communication for obtaining the obtained HTTP response. When the tree node of the acquired HTTP response is a candidate tree node, the transition information generation unit 123 determines whether or not there is a tree node linked as a parent node of the candidate tree node. If the transition information generator 123 determines that there is a parent tree node (YES in step S219), the process proceeds to step S220. Note that the case where there is a parent tree node will be described in detail in the description of step S222, which will be described later.

When the transition information generation unit 123 determines that there is no parent tree node (NO in step S219), the transition information generation unit 123 proceeds to step S221.

(Step S220)
The transition information generation unit 123 associates the acquired tree node of the HTTP response with the child node of the parent tree node.

(Step S221)
The transition information generation unit 123 associates the acquired tree node of the HTTP response with the child node of the root tree node.

(Step S222)
The transition information generation unit 123 analyzes the acquired HTTP response and collects tags that cause communication. For example, the transition information generation unit 123 refers to the URL of the location or action of the tag, but not the URL, but the function name of the script, collects the corresponding Javascript (registered trademark) from the HTTP communication record, and determines the communication destination. may generate URLs and parameters for If the acquired HTTP response contains a tag that causes communication, the transition information generation unit 123 creates a candidate tree that is associated with the HTTP request corresponding to the communication as a child node of the tree node of the acquired HTTP response. Generate a node. At this point, the HTTP response of the candidate tree node is empty because the content of communication has not actually been acquired yet.

Note that when the transition information generation unit 123 acquires an HTTP response using the HTTP request linked to the candidate tree node generated this time and newly performs the transition information generation processing S21, the candidate tree node generated this time is a candidate tree node linked to the HTTP response in S216 of the new transition information generation processing S21. Also, the tree node of the acquired HTTP response becomes the parent tree node in S219 of the new transition information generation processing S21.

The transition information generation unit 123 may repeat the transition information generation process S21 until the user generates desired transition information. In this case, the transition information generation unit 1123 acquires an HTTP response using the HTTP request linked to the candidate tree node generated in the transition information generation processing S21 of a predetermined time, and performs the next transition information generation processing S21. may be executed.

The transition information generation unit 123 can use the tree information of the target domain generated by the above procedure as the transition information.

[Display processing S22]
A display unit 131X in the output unit 130X of the vulnerability diagnosis device 100X displays the transition information generated by the transition information generation unit 123. FIG.

The display processing S22 will be described in more detail below with reference to FIG. FIG. 11 is a diagram illustrating an example of transition information. In the example shown in FIG. 11, the transition information is the transition diagram I10 displayed on the display unit 131X. It suffices to indicate the transition relation between images. For example, the transition information may be a table instead of an image like the transition diagram I10.

In the example shown in FIG. 11, the transition diagram I10 includes images I11 (top), I12 (notice), I13 (inquiry), I14 (inquiry confirmation), I15 (inquiry completed), I16 (top), I17 ( search results), I18 (login) and I19 (membership registration). In addition, the transition diagram I10 includes various information of communication between web pages to be investigated, such as arrows indicating the transition relationship of these images, the URL of each web page, and its HTTP request and HTTP response.

Images I11, I13, I14 and I15 are respectively No. 1 in FIG. It is an image corresponding to 0 to 3 vulnerability diagnosis targets.

Conventionally, for example, No. 4 in FIG. 3 in FIG. 4 corresponding to the image I15. No. 3 in FIG. 4 corresponding to vulnerability diagnosis targets of No. 3 and images I11, I13 and I14 before transition of image I15, respectively. The contents of communication with 0 to 2 vulnerability diagnosis targets were acquired one by one.

On the other hand, when the user clicks on the image I15, the vulnerability diagnosis processing information generating unit 121 selects No. 1 in FIG. 4 corresponding to the image I15. 3, the transition diagram I10 to No. 4 in FIG. 3 vulnerability diagnosis target and No. 3 in FIG. The contents of communication with 0 to 2 vulnerability diagnosis targets can be acquired.

This communication content includes HTTP requests and HTTP responses between the images I11, I13, I14, and I15. Therefore, the vulnerability diagnosis processing information generating unit 121 uses No. 1 in FIG. It is possible to acquire an HTTP request for acquiring an HTTP response of the vulnerability diagnosis target of No. 3.

The vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing information based on the above-described HTTP request, and the vulnerability diagnosis processing unit 122 receives the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit 121. Vulnerability diagnosis processing can be automatically executed based on

In this way, the display unit 131X displays the transition information such as the transition diagram I10, so that the transition information is linked with the vulnerability diagnosis tool of the vulnerability diagnosis device 100 to investigate the transition relationship, refer to the transition relationship, and identify the vulnerability. It becomes possible to automate the flow of sex diagnosis.

In addition, when the vulnerability diagnosis processing unit 122 diagnoses the vulnerability of the vulnerability diagnosis target included in the transition information, the vulnerability diagnosis target is associated with the transition information in advance. Therefore, a token for communicating with a web page or application that has a transition relationship with a vulnerability diagnosis target is automatically guessed.

Therefore, the vulnerability diagnosis processing unit 122 does not need to specify a token and set a transition relationship for performing the communication. As a result, after the transition information generation unit 123 and the reproduction unit 124 investigate the transition relationship of the web page or application, the vulnerability diagnosis processing unit 122 immediately performs the vulnerability diagnosis target vulnerability included in the transition information. It is possible to perform highly accurate vulnerability diagnosis that ensures transition relationships.

Reproduction processing S23]
When the transition information includes information for realizing transition between a plurality of web pages, between communication states of a plurality of applications, or between images displayed by a plurality of applications, the reproduction unit 124, based on the transition information, causes the user Any web page designated by , or the communication state or image of the application may be reproduced on the display unit 131X.

When reproducing the web page or the communication state or the image of the application on the display unit 131X, the reproduction unit 124 does not draw the web page or the application image on the display unit 131X. Ultimately, the reproduction unit 124 only reproduces the communication state or image of the web page or application on the display unit 131X.

Conventionally, for example, No. 1 in FIG. 3, the images I11, I13, I14, and I15 are displayed one by one on the display unit 131X, and these images are transitioned. had to let

On the other hand, when the user designates the image I15 by clicking or the like, the reproducing unit 124 can directly display the image I15 on the display unit 131X without going through the images I11, I13, and I14.

<Embodiment 3>
A vulnerability diagnosis device according to an embodiment of the present invention is connected to a plurality of vulnerability diagnosis devices, such as the vulnerability diagnosis device 100Y according to the third embodiment, may be transmitted to a plurality of vulnerability diagnosis devices.

The third embodiment will be described below with reference to FIGS. 12 to 15. FIG. For convenience of description, members having the same functions as those of the members described in the above-described embodiments are denoted by the same reference numerals, and their descriptions are omitted.

[Vulnerability diagnosis system 1]
FIG. 12 is a block diagram showing an example configuration of the vulnerability diagnosis system 1 according to the third embodiment. As shown in FIG. 12, the vulnerability diagnosis system 1 includes a vulnerability diagnosis device 100Y, a vulnerability diagnosis device 200, and a vulnerability diagnosis device 300. FIG.

[Vulnerability diagnosis device 100Y]
The vulnerability diagnosis device 100Y is a host server computer connected to the plurality of vulnerability diagnosis devices 200 and 300 via the network N. FIG.

Vulnerability diagnosis device 100Y shares vulnerability diagnosis processing information based on vulnerability diagnosis processing information generated in its own device or vulnerability diagnosis processing information received from at least one of vulnerability diagnosis device 200 and vulnerability diagnosis device 300. It is updated and transmitted to the vulnerability diagnosis devices 200 and 300 .

As shown in FIG. 12, the vulnerability diagnosis device 100Y further includes a communication unit 140, and includes a main control unit 120Y and an output unit 130Y instead of the main control unit 120X and the output unit 130X in the second embodiment. Except for this point, the vulnerability diagnosis device 100Y has the same configuration as the vulnerability diagnosis device 100X according to the second embodiment.

[Communication unit 140]
The communication unit 140 communicates with the communication unit 240 of the vulnerability diagnosis device 200 and the communication unit 340 of the vulnerability diagnosis device 300 connected via a network N based on a predetermined communication protocol such as HTTP and TCP/IP. . As shown in FIG. 12 , the communication section 140 has a receiving section 141 and a transmitting section 142 .

(Receiver 141)
The receiving unit 141 receives, from at least one of the plurality of vulnerability diagnosis devices 200 and 300, vulnerability diagnosis processing information generated or changed in the vulnerability diagnosis device.

(Sending unit 142)
The transmission unit 142 transmits the shared vulnerability diagnosis processing information updated by the update unit 125 to the plurality of vulnerability diagnosis devices 200 and 300 .

[Main control unit 120Y]
The main control section 120Y further includes an update section 125 . Except for this point, the main controller 120Y has the same configuration as the main controller 125X in the second embodiment.

(Update unit 125)
The updating unit 125 updates the shared vulnerability diagnosis processing information based on at least one of the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device.

[Output unit 130Y]
The output unit 130Y includes a display unit 131Y instead of the display unit 131X in the second embodiment. Except for this point, the output section 130Y has the same configuration as the output section 130X in the second embodiment.

(Display unit 131Y)
The display unit 131Y further displays the shared vulnerability diagnosis processing information updated by the update unit 125. FIG. Except for this point, the display unit 131Y has the same configuration as the display unit 131X in the second embodiment.

[Vulnerability diagnosis device 200]
The vulnerability diagnosis device 200 is a guest computer including an operation reception unit 210, a main control unit 220, an output unit 230, and a communication unit 240, and includes, for example, a client server.

The operation reception unit 210 has the same configuration as the operation reception unit 110 in the second embodiment. The main controller 220 has the same configuration as the main controller 120X in the second embodiment. The output unit 230 has the same configuration as the output unit 130Y. That is, the vulnerability diagnosis device 200 further includes a communication unit 240, and instead of the output unit 130X in the second embodiment, includes an output unit 230 having the same configuration as the output unit 130Y. It has the same configuration as the vulnerability diagnosis device 100X.

[Communication unit 240]
The communication unit 240 communicates with the communication unit 140 of the vulnerability diagnosis device 100Y connected via a network N based on a predetermined communication protocol such as HTTP and TCP/IP. As shown in FIG. 12 , the communication section 240 has a receiving section 241 and a transmitting section 242 .

(Receiver 241)
The receiving unit 241 receives shared vulnerability diagnosis processing information updated by the update unit 125 of the vulnerability diagnosis device 100Y from the vulnerability diagnosis device 100Y.

(transmitting unit 242)
The transmission unit 242 transmits the vulnerability diagnosis processing information generated or changed in its own device to the vulnerability diagnosis device 100Y.

[Vulnerability diagnosis device 300]
The vulnerability diagnosis device 300 is a guest computer including an operation reception unit 310, a main control unit 320, an output unit 330, and a communication unit 340, and includes, for example, a client server.

The operation reception unit 310 has the same configuration as the operation reception unit 110 in the second embodiment. The main controller 320 has the same configuration as the main controller 120X in the second embodiment. The output unit 330 has the same configuration as the output unit 130X in the second embodiment. That is, the vulnerability diagnosis device 300 further includes a communication unit 340, and instead of the output unit 130X in the second embodiment, includes an output unit 330 having the same configuration as the output unit 130Y. It has the same configuration as the vulnerability diagnosis device 100X.

[Communication unit 340]
The communication unit 340 communicates with the communication unit 140 of the vulnerability diagnosis device 100Y connected via the network N based on a predetermined communication protocol such as HTTP and TCP/IP. As shown in FIG. 12 , the communication section 340 has a receiving section 341 and a transmitting section 342 .

(Receiver 341)
The receiving unit 341 receives shared vulnerability diagnosis processing information updated by the update unit 125 of the vulnerability diagnosis device 100Y from the vulnerability diagnosis device 100Y.

(Sending unit 342)
The transmission unit 342 transmits the vulnerability diagnosis processing information generated or changed in its own device to the vulnerability diagnosis device 100Y.

[Control Method S3 of Vulnerability Diagnosis Device 100Y]
Next, the control method (control method of the vulnerability diagnosis device) S3 of the vulnerability diagnosis device 100Y according to the third embodiment will be described with reference to FIGS. 13 to 15. FIG. FIG. 13 is a flowchart showing an example of the control method S3 of the vulnerability diagnosis device 100Y according to the third embodiment.

As shown in FIG. 13, the control method S3 of the vulnerability diagnosis device 100Y includes a reception process S31, an update process S32, and a transmission process S33, which are executed in this order by the vulnerability diagnosis device 100Y.

[Receiving process S31]
The receiving unit 141 in the communication unit 140 of the vulnerability diagnosis device 100Y receives vulnerability diagnosis processing information generated or changed in the vulnerability diagnosis device from at least one of the plurality of vulnerability diagnosis devices 200 and 300 .

The receiving unit 141 receives, from at least one of the plurality of vulnerability diagnosis devices 200 and 300, vulnerability diagnosis processing progress information indicating the progress of the vulnerability diagnosis processing included in the vulnerability diagnosis processing information by the vulnerability diagnosis device. may receive.

[Update processing S32]
The updating unit 125 in the main control unit 120Y of the vulnerability diagnosis device 100Y updates the shared vulnerability based on at least one of the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device. Update diagnostic processing information.

Hereinafter, updating of shared vulnerability diagnosis processing information will be described in detail with reference to FIGS. 14 and 15. FIG. 14 and 15 are diagrams showing an example of shared vulnerability diagnosis processing information. In the example shown in FIG. 14, the shared vulnerability diagnosis processing information includes a transition diagram I10Y as transition information.

As shown in FIG. 14, the transition diagram I10Y includes vulnerability diagnosis processing progress information such as vulnerability diagnosis processing progress information PA11, vulnerability diagnosis processing progress information PA13, and vulnerability diagnosis processing progress information PA14. Vulnerability diagnosis processing progress information PA11, vulnerability diagnosis processing progress information PA13, and vulnerability diagnosis processing progress information PA14 are displayed as text information under images I11, I13, and I14, respectively.

Vulnerability diagnosis processing progress information PA11 is No. of FIG. A vulnerability diagnosis target of 0 indicates that the vulnerability diagnosis is in progress. In addition, the vulnerability diagnosis processing progress information PA11 indicates that the vulnerability diagnosis possible date and time is from 8:10 on November 17, which is later than the vulnerability diagnosis possible date and time of the images I12 and I15 to I19 by the vulnerability diagnosis processing period. is shown.

The vulnerability diagnosis processing progress information PA13 is the vulnerability diagnosis device 200 corresponding to the image I13, No. 4 in FIG. 1 indicates that the vulnerability diagnosis target is under vulnerability diagnosis. In addition, the vulnerability diagnosis processing progress information PA13 indicates that the vulnerability diagnosis possible date and time is from 8:10 on November 17, which is later than the vulnerability diagnosis possible date and time of the images I12 and I15 to I19 by the vulnerability diagnosis processing period. is indicated by letters.

Vulnerability diagnosis processing progress information PA14 is stored in No. 4 of FIG. 2 indicates that the vulnerability diagnosis target is under vulnerability diagnosis. In addition, the vulnerability diagnosis processing progress information PA14 indicates that the vulnerability diagnosis possible date and time is from 8:10 on November 17, which is later than the vulnerability diagnosis possible date and time of the images I12 and I15 to I19 by the vulnerability diagnosis processing period. is indicated by letters.

The updating unit 125 updates the shared vulnerability diagnosis processing information based on at least one of the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device. As an example, the update unit 125 based on at least one of the vulnerability diagnosis processing progress information received by the reception unit 141 in the vulnerability diagnosis device 100Y and the vulnerability diagnosis processing progress information indicating the progress of the vulnerability diagnosis processing by the own device. The shared vulnerability diagnosis processing information may be updated.

For example, the receiving unit 141 receives the following vulnerability diagnosis processing progress information, and No. in FIG. 2, the update unit 125 updates the transition diagram I10Y based on the vulnerability diagnosis process completion information. .
4 corresponding to the image I11 by the vulnerability diagnosis device 200. 4 corresponding to the image I13 by the vulnerability diagnosis device 300, vulnerability diagnosis processing progress information indicating that the vulnerability diagnosis processing for the vulnerability diagnosis target of No. 0 has been completed. Vulnerability diagnosis process progress information indicating that the vulnerability diagnosis process for the vulnerability diagnosis target of 1 has been completed

In this case, the update unit 125 changes the vulnerability diagnosis processing progress information PA11 indicating the information "vulnerability diagnosis device 100Y vulnerability diagnosis is in progress" to "vulnerability diagnosis device 100Y vulnerability diagnosis updated to vulnerability diagnosis processing progress information PA11' indicating information "completed". The updating unit 125 changes the vulnerability diagnosis processing progress information PA13 indicating the information "vulnerability diagnosis by the vulnerability diagnosis device 200 underway" to the information "vulnerability diagnosis by the vulnerability diagnosis device 200 completed" as shown in FIG. Update to vulnerability diagnosis process progress information PA13'. The updating unit 125 changes the vulnerability diagnosis processing progress information PA14 indicating "vulnerability diagnosis by the vulnerability diagnosis device 300 underway" to information "vulnerability diagnosis by the vulnerability diagnosis device 300 completed" as shown in FIG. Update to vulnerability diagnosis processing progress information PA14'.

[Display processing S33]
The display unit 131Y in the output unit 130Y of the vulnerability diagnosis device 100Y displays the shared vulnerability diagnosis processing information updated by the update unit 125. FIG. For example, the display unit 131Y displays a transition diagram I10Y' shown in FIG. 15 on the display unit 131Y.

[Transmission processing S34]
The transmission unit 142 in the communication unit 140 of the vulnerability diagnosis device 100Y transmits the shared vulnerability diagnosis processing information updated by the update unit 125 to the multiple vulnerability diagnosis devices 200 and 300 . For example, the transmission unit 142 transmits the transition diagram I10Y' to the plurality of vulnerability diagnosis devices 200 and 300. FIG.

As a result, a large number of people such as the user of the vulnerability diagnosis device 100Y, the user of the vulnerability diagnosis device 200, and the user of the vulnerability diagnosis device 300 can share vulnerabilities such as the transition diagram I10Y' related to the project of one vulnerability diagnosis process. Diagnostic processing information can be shared.

In addition, since updated shared vulnerability diagnosis processing information can be shared among these users, these users do not have to update to the latest vulnerability diagnosis processing information, and new users can be vulnerable. Even if it participates in the vulnerability diagnosis process, it is not necessary to separately set the vulnerability diagnosis process information.

In addition, even if these users are located far from each other, they can communicate with each other smoothly, so that the vulnerability diagnosis process can be executed efficiently.

Furthermore, since the shared vulnerability diagnosis processing information includes transition information such as the transition diagram I10Y', the user of the vulnerability diagnosis device 100Y, the user of the vulnerability diagnosis device 200, and the user of the vulnerability diagnosis device 300 can perform the vulnerability diagnosis. It becomes possible to grasp the progress of the entire process. This improves the quality of information shared between these users.

<Modification>
[Modification 1]
In the above example, the main control unit 120Y of the vulnerability diagnosis device 100Y includes the transition information generation unit 123 and the reproduction unit 124. FIG. The main controller 220 of the vulnerability diagnosis device 200 includes a transition information generator 223 and a reproducer 224 . The main control unit 320 of the vulnerability diagnosis device 300 also includes a transition information generation unit 323 and a reproduction unit 324 .

However, in this embodiment, the vulnerability diagnosis devices 100Y, 200 and 300 do not have these members, and the shared vulnerability diagnosis processing information does not need to include transition information.

Even in such a case, a large number of people such as the user of the vulnerability diagnosis device 100Y, the user of the vulnerability diagnosis device 200, and the user of the vulnerability diagnosis device 300 share vulnerability diagnosis processing information related to a project of one vulnerability diagnosis processing. can be shared.

In addition, since updated shared vulnerability diagnosis processing information can be shared among these users, these users do not have to update to the latest vulnerability diagnosis processing information, and new users can be vulnerable. Even if it participates in the vulnerability diagnosis process, it is not necessary to separately set the vulnerability diagnosis process information.

Furthermore, even if these users are located far from each other, they can communicate with each other smoothly, so that the vulnerability diagnosis process can be executed efficiently.

[Modification 2]
In the above example, the update unit 125 updates at least one of the vulnerability diagnosis processing progress information received by the reception unit 141 in the vulnerability diagnosis device 100Y and the vulnerability diagnosis processing progress information indicating the progress of vulnerability diagnosis processing by the own device. update the shared vulnerability assessment process information based on However, in the present embodiment, the updating unit 125 is not limited to the vulnerability diagnosis processing progress information, and at least the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device The shared vulnerability diagnosis processing information may be updated based on one of them.

For example, the updating unit 125 updates the vulnerability diagnosis processing execution condition, the vulnerability diagnosis processing execution information, or the vulnerability diagnosis processing result evaluation condition received by the receiving unit 141, and the vulnerability diagnosis processing execution generated or changed in the own device. The shared vulnerability diagnosis processing information may be updated based on at least one of the conditions, vulnerability diagnosis processing execution information, and vulnerability diagnosis processing result evaluation conditions.

[Example of realization by software]
The function of the vulnerability diagnosis devices 100, 100X and 100Y (hereinafter referred to as "devices") is a vulnerability diagnosis program for causing a computer to function as the device, and each control block (especially the main control unit 120, 120X, and 120Y) can be realized by a vulnerability diagnosis program for causing the computer to function.

In this case, the device comprises a computer having at least one control device (eg processor) and at least one storage device (eg memory) as hardware for executing the vulnerability diagnosis program. Each function described in each of the above embodiments is realized by executing the vulnerability diagnosis program using the control device and the storage device.

The vulnerability diagnosis program may be recorded in one or more computer-readable recording media, not temporary. The recording medium may or may not be included in the device. In the latter case, the vulnerability diagnostic program may be supplied to the device via any transmission medium, wired or wireless.

Also, part or all of the functions of the above control blocks can be realized by logic circuits. For example, integrated circuits in which logic circuits functioning as the control blocks described above are formed are also included in the scope of the present invention. In addition, it is also possible to implement the functions of the control blocks described above by, for example, a quantum computer.

Further, each process described in each of the above embodiments may be executed by AI (Artificial Intelligence). In this case, the AI may operate on the control device, or may operate on another device (for example, an edge computer or a cloud server).

<Additional notes>
The present invention is not limited to the above-described embodiments, but can be modified in various ways within the scope of the claims, and can be obtained by appropriately combining technical means disclosed in different embodiments. is also included in the technical scope of the present invention.

In addition, since the vulnerability diagnosis device according to each embodiment can diagnose the vulnerability of a web page or application even if the user does not have specialized knowledge or experience, the Sustainable Development Goals (SDGs) Goal 9 " We can contribute to the achievement of "Let's build a foundation for industry and technological innovation."

100, 100X, 100Y, 200, 300 vulnerability diagnosis device 121 vulnerability diagnosis processing information generation unit 122 vulnerability diagnosis processing units 123, 223, 323 transition information generation units 124, 224, 324 reproduction unit 125 update units 131, 131X, 131Y Display units 141, 241, 341 Receivers 142, 242, 342 Transmitters D, D'a, D'', D''a, D''b, D''c, D''d Vulnerability diagnosis processing Information D1 Vulnerability diagnosis process execution condition D2 Vulnerability diagnosis process execution information D3 Vulnerability diagnosis process result evaluation condition I10, I10Y, I10Y' Transition diagram I11, I12, I13, I14, I15, I16, I17, I18, I19 Image PA11 , PA11′, PA13, PA13′, PA14, PA14′ Vulnerability diagnosis processing progress information S1, S2, S3 Control method (control method of vulnerability diagnosis device)
S12 vulnerability diagnosis processing information generation processing S13 vulnerability diagnosis processing S14 output processing S21 transition information generation processing S22, S24, S33 display processing S23 reproduction processing S31 reception processing S32 update processing S33 transmission processing

Claims (13)

a vulnerability diagnosis processing information generation unit that generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing vulnerabilities of a web page or an application based on a user's operation;
and a vulnerability diagnosis processing unit that executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit. The vulnerability diagnosis processing information is composed of a plurality of items,
2. The vulnerability diagnosis apparatus according to claim 1, wherein the vulnerability diagnosis processing information generating unit changes each item of the vulnerability diagnosis processing information according to the user's operation. The plurality of items include vulnerability diagnosis processing execution conditions for the vulnerability diagnosis processing unit to execute the vulnerability diagnosis processing, vulnerability diagnosis processing execution information used when executing the vulnerability diagnosis processing, and 3. The vulnerability diagnosis device according to claim 2, further comprising at least one vulnerability diagnosis processing result evaluation condition for evaluating the result of said vulnerability diagnosis processing. a transition information generation unit that generates transition information indicating a transition relationship between a plurality of web pages, between communication states of a plurality of applications, or between images displayed by a plurality of applications;
The vulnerability diagnosis device according to any one of claims 1 to 3, further comprising a display unit for displaying the transition information generated by the transition information generation unit. The transition information includes information for implementing transitions between the plurality of web pages, between communication states of the plurality of applications, or between images displayed by the plurality of applications,
Based on the transition information, any web page specified by the user, any communication state specified by the user for the communication state of the application, or any image specified by the user for the image displayed by the application 5. The vulnerability diagnosis device according to claim 4, further comprising a reproduction unit that causes the display unit to reproduce such that . The transition information indicates a transition relationship between multiple web pages,
6. The vulnerability diagnosis device according to claim 4, wherein the transition information generation unit generates the transition information based on communication content of a browser displaying each web page. The transition information indicating the transition relation between communication states or between images of the plurality of applications includes transition information indicating at least one transition relation between communication states or between images of a plurality of applications using HTTP communication. The vulnerability diagnosis device according to claim 4. The transition information indicates a transition relation between communication states or between images of a plurality of applications,
8. The vulnerability diagnosis apparatus according to claim 7, wherein the transition information generation unit generates the transition information based on communication content of a browser that displays an image of each application using HTTP communication. a receiving unit connected to a plurality of vulnerability diagnosis devices and configured to receive, from at least one of the plurality of vulnerability diagnosis devices, vulnerability diagnosis processing information generated or changed in the vulnerability diagnosis device;
Based on at least one of the vulnerability diagnosis processing information received by the receiving unit and the vulnerability diagnosis processing information generated or changed in the self device, a vulnerability shared between the plurality of vulnerability diagnosis devices and the self device an updating unit for updating shared vulnerability diagnosis processing information, which is vulnerability diagnosis processing information;
The vulnerability according to any one of claims 1 to 8, further comprising a transmitting unit configured to transmit the shared vulnerability diagnosis processing information updated by the update unit to the plurality of vulnerability diagnosis devices. sex diagnostic device. 10. The vulnerability diagnosis according to claim 9, wherein the shared vulnerability diagnosis processing information includes transition information indicating a transition relationship between a plurality of web pages, between communication states of a plurality of applications, or between images. Device. The vulnerability diagnosis processing information includes vulnerability diagnosis processing progress information indicating the progress of vulnerability diagnosis processing,
The receiving unit receives vulnerability diagnosis processing progress information by the vulnerability diagnosis device from at least one of the plurality of vulnerability diagnosis devices,
The update unit receives the vulnerability diagnosis processing progress information received by the receiving unit and the vulnerability diagnosis processing progress information indicating the progress of the vulnerability diagnosis processing by the vulnerability diagnosis processing by the own device. Update sex diagnosis processing information,
The transmission unit transmits the shared vulnerability diagnosis processing information updated by the update unit to the plurality of vulnerability diagnosis devices,
11. The vulnerability diagnosis device according to claim 9, further comprising a display unit that displays the shared vulnerability diagnosis processing information updated by the update unit. Vulnerability diagnosis processing information generation processing in which the vulnerability diagnosis device generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing vulnerabilities of a web page or application based on a user's operation;
and vulnerability diagnosis processing in which the vulnerability diagnosis device executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated in the vulnerability diagnosis processing information generation processing. A control method for a diagnostic device. A vulnerability diagnosis program for causing a computer to function as the vulnerability diagnosis device according to claim 1, wherein the vulnerability diagnosis process causes the computer to function as the vulnerability diagnosis processing information generating unit and the vulnerability diagnosis processing unit. program.

Images