JP2023168559A - Vulnerability diagnosing device, control method of vulnerability diagnosing device, and vulnerability diagnosing program - Google Patents

Abstract

To provide a vulnerability diagnosing device configured to allow a user who has no special knowledge or experience to diagnose vulnerability of a webpage or an application.SOLUTION: A vulnerability diagnosing device (100) includes: a vulnerability diagnosis processing information generation unit (121) which generates vulnerability diagnosis processing information that specifies vulnerability diagnosis processing for diagnosing vulnerability of a webpage or an application on the basis of a user operation; and a vulnerability diagnosis processing unit (122) which executes vulnerability diagnosis processing on the basis of the vulnerability diagnosis processing information.SELECTED DRAWING: Figure 1

Description

The present invention relates to a vulnerability diagnosis device, a method of controlling the vulnerability diagnosis device, and a vulnerability diagnosis program.

2. Description of the Related Art Techniques for diagnosing vulnerabilities in web pages or applications in order to prevent various attacks on web pages or applications are known as prior art.

For example, Patent Document 1 describes a web application that is equipped with an inspection means that generates inspection data that includes input parameters used for inputting to input items of a web application and a macro that indicates a command to replace the input parameters with predetermined values. Inspection equipment is described.

Japanese Patent Application Publication No. 2005-250945

Conventional techniques such as those disclosed in Patent Document 1 cannot diagnose vulnerabilities in web pages or applications unless the user has specialized knowledge and experience, such as knowledge of vulnerabilities and experience in programming development.

A main object of one aspect of the present invention is to realize a vulnerability diagnosis device and its related technology that can diagnose the vulnerability of a web page or an application even if the user does not have specialized knowledge or experience.

In order to solve the above problems, a vulnerability diagnosis device according to one aspect of the present invention provides a vulnerability diagnosis process that defines a vulnerability diagnosis process for diagnosing the vulnerability of a web page or an application based on a user's operation. A vulnerability diagnosis processing information generation unit that generates information; and a vulnerability diagnosis processing unit that executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit. .

A method for controlling a vulnerability diagnosis device according to an aspect of the present invention includes a vulnerability diagnosis process in which the vulnerability diagnosis device prescribes a vulnerability diagnosis process for diagnosing the vulnerability of a web page or an application based on a user's operation. vulnerability diagnosis processing information generation processing that generates information; and vulnerability diagnosis processing in which the vulnerability diagnosis device executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit. and diagnostic processing.

The vulnerability diagnosis device according to each aspect of the present invention may be realized by a computer, and in this case, the vulnerability diagnosis device A vulnerability diagnosis program for a vulnerability diagnosis apparatus that implements the above on a computer, and a computer-readable recording medium on which the same is recorded also fall within the scope of the present invention.

According to one aspect of the present invention, it is possible to realize a vulnerability diagnosis device and its related technology that can diagnose the vulnerability of a web page or an application even if the user does not have specialized knowledge or experience.

1 is a block diagram illustrating an example of the configuration of a vulnerability diagnosis device according to a first embodiment. FIG. FIG. 2 is a flow diagram illustrating an example of a method for controlling the vulnerability diagnosis device according to the first embodiment. FIG. 3 is a diagram showing an example of a vulnerability diagnosis processing information generation image. It is a figure which shows an example of a vulnerability diagnosis process execution image. FIG. 3 is a diagram illustrating an example of insertion of an attack character string into an HTTP request targeted for vulnerability diagnosis. FIG. 3 is a diagram illustrating an example of a location where an attack character string is inserted into an HTTP request targeted for vulnerability diagnosis. FIG. 3 is a diagram showing an example of a vulnerability diagnosis processing result image. FIG. 2 is a block diagram illustrating an example of the configuration of a vulnerability diagnosis device according to a second embodiment. 7 is a flow diagram illustrating an example of a method for controlling the vulnerability diagnosis device according to the second embodiment. FIG. 7 is a flow diagram illustrating an example of transition information generation processing by the vulnerability diagnosis device according to the second embodiment. FIG. It is a figure which shows an example of transition information. FIG. 3 is a block diagram illustrating an example of the configuration of a vulnerability diagnosis system according to a third embodiment. 7 is a flow diagram illustrating an example of a method for controlling the vulnerability diagnosis device according to Embodiment 3. FIG. FIG. 3 is a diagram illustrating an example of shared vulnerability diagnosis processing information. FIG. 3 is a diagram illustrating an example of shared vulnerability diagnosis processing information.

<Embodiment 1>
Embodiment 1 will be described using FIGS. 1 to 7. FIG. 1 is a block diagram showing an example of the configuration of a vulnerability diagnosis device 100 according to the first embodiment.

[Vulnerability diagnosis device 100]
The vulnerability diagnosis device 100 diagnoses the vulnerability of a web page or an application. As shown in FIG. 1, the vulnerability diagnosis device 100 includes an operation reception section 110, a main control section 120, and an output section 130. Examples of the vulnerability diagnosis device 100 include a computer such as a proxy server.

[Operation reception unit 110]
The operation accepting unit 110 accepts the input of a user's operation on the vulnerability diagnosis processing information generating unit 121 in the main control unit 120 .

For example, the operation reception unit 110 receives input of a user operation on a component of a graphical user interface (GUI), such as clicking a click button or selecting and clicking a combo box.

Examples of the operation reception unit 110 include a user interface (UI: graphical user interface) such as a keyboard, a mouse, a touch panel, and a switch.

[Main control unit 120]
The main control unit 120 controls the vulnerability diagnosis device 100. As shown in FIG. 1, the main control section 120 includes a vulnerability diagnosis processing information generation section 121 and a vulnerability diagnosis processing section 122.

(Vulnerability diagnosis processing information generation unit 121)
The vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing the vulnerability of a web page or application based on the user's operation input to the operation reception unit 110. . When the vulnerability diagnosis processing information is composed of a plurality of items, the vulnerability diagnosis processing information generation unit 121 may change each item of the vulnerability diagnosis processing information according to the user's operation. Details of the vulnerability diagnosis processing information generation process by the vulnerability diagnosis processing information generation unit 121 will be described later.

(Vulnerability diagnosis processing unit 122)
The vulnerability diagnosis processing unit 122 executes vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated or modified by the vulnerability diagnosis processing information generation unit 121. For example, the vulnerability diagnosis processing unit 122 generates or changes an attack string based on the vulnerability diagnosis processing information, and sends an attack HTTP request with the attack string inserted into the HTTP request to the server that is the target of vulnerability diagnosis. By sending, vulnerability diagnosis processing is executed. Details of the vulnerability diagnosis processing by the vulnerability diagnosis processing unit 122 will be described later.

[Output unit 130]
The output unit 130 outputs an image for the user to specify during the vulnerability diagnosis process information generation process (vulnerability diagnosis process information generation image), and an image for executing the vulnerability diagnosis process (vulnerability diagnosis process execution image). and an image showing the vulnerability diagnosis processing result (vulnerability diagnosis processing result image). As shown in FIG. 1, the output section 130 includes a display section 131.

(Display section 131)
The display unit 131 displays a vulnerability diagnosis process information generation image, a vulnerability diagnosis process execution image, a vulnerability diagnosis process result image, and the like.

[Control method S1 of vulnerability diagnosis device 100]
Next, a method S1 for controlling the vulnerability diagnosis device 100 (a method for controlling the vulnerability diagnosis device) according to the first embodiment will be described using FIGS. 2 to 5. FIG. 2 is a flow diagram illustrating an example of the control method S1 of the vulnerability diagnosis device 100 according to the first embodiment.

As shown in FIG. 2, the control method S1 of the vulnerability diagnosis device 100 includes an operation reception process S11, a vulnerability diagnosis process information generation process S12, a vulnerability diagnosis process S13, and an output process S14. The diagnostic device 100 executes the steps in this order.

[Operation reception process S11]
The operation reception unit 110 of the vulnerability diagnosis device 100 accepts the input of a user's operation to the vulnerability diagnosis processing information generation unit 121 in the main control unit 120.

The operation reception process S11 by the operation reception unit 110 will be described below with reference to FIG. FIG. 3 is a diagram illustrating an example of a vulnerability diagnosis processing information generation image. Specifically, FIG. 3 is a diagram showing an example of the first vulnerability diagnosis processing information generation image I1 and the second vulnerability diagnosis processing information generation image I2.

When the operation reception unit 110 executes the operation reception process S11, first, the first vulnerability diagnosis processing information generation image I1 is displayed on the display unit 131.

In the example shown in FIG. 3, the first vulnerability diagnosis processing information generation image I1 includes the following vulnerability diagnosis processing information.
・Vulnerability diagnosis information that can attack servers that use SQL (Structured Query Language) (in the example shown in Figure 3, "SQL injection")
・Vulnerability diagnosis information regarding vulnerabilities that can attack the OS using OS (Operation System) shell commands (in the example shown in Figure 3, "OS command injection") ・Specify the server file path Vulnerability diagnosis information related to vulnerabilities that allow files to be viewed (in the example shown in Figure 3, "path traversal")
・Vulnerability diagnosis information regarding the vulnerability of inserting an attack script (for example, an attack string) into the HTML of a web page by inserting an attack script (for example, an attack string) into the parameters of an HTTP request (in the example shown in Figure 3, "Site Scripting")
In the example shown in FIG. 3, the vulnerability diagnosis processing information D (in the example shown in FIG. 3, "XSS (Params)") included in "Cross-site scripting" in the first vulnerability diagnosis processing information generation image I1 is: Information regarding vulnerability diagnosis processing for vulnerabilities in a web page or application when a user inserts an attack script into the web page or application is shown.

As shown in FIG. 3, the vulnerability diagnosis processing information D may be composed of a plurality of items including at least one of the following items.
・Vulnerability diagnosis processing execution conditions D1 (in the example shown in FIG. 3, "Event Conditions")
・Vulnerability diagnosis processing execution information D2 (in the example shown in FIG. 3, "Attack Methods")
・Vulnerability diagnosis processing result evaluation condition D3 (in the example shown in FIG. 3, "Match Conditions")
The vulnerability diagnosis process execution condition D1 indicates a condition for the vulnerability diagnosis processing unit 122 to execute the vulnerability diagnosis process S13. The vulnerability diagnosis process execution information D2 indicates information used when executing the vulnerability diagnosis process S13, such as attack character strings, parameters, and HTTP responses. The vulnerability diagnosis processing result evaluation condition D3 indicates conditions for evaluating the vulnerability diagnosis processing result. For example, the vulnerability diagnosis process result evaluation condition D3 indicates a condition for evaluating the vulnerability diagnosis process result by evaluating how much the condition to be satisfied is met when a vulnerability exists.

By including the vulnerability diagnosis processing execution condition D1 in the vulnerability diagnosis processing information D, the vulnerability diagnosis processing unit 122 can determine the conditions of communication to be subjected to vulnerability diagnosis. Since the vulnerability diagnosis process information D includes the vulnerability diagnosis process execution information D2, the vulnerability diagnosis processing unit 122 executes the vulnerability diagnosis process S13 in a method desired by the user based on the vulnerability diagnosis process execution information D2. can be executed. Since the vulnerability diagnosis processing information D includes the vulnerability diagnosis processing result evaluation condition D3, the vulnerability diagnosis processing unit 122 can determine the conditions for pointing out vulnerabilities based on the vulnerability diagnosis processing result evaluation condition D3. .

In the example shown in FIG. 3, the operation reception unit 110 receives a click on the vulnerability diagnosis process execution condition D1 from the user. Further, the main control unit 120 causes the display unit 131 to display a second vulnerability diagnosis process information generation image I2 for setting the vulnerability diagnosis process execution condition D1 based on the click of the vulnerability diagnosis process execution condition D1. ing.

The second vulnerability diagnosis process information generation image I2 is an image for setting vulnerability diagnosis process execution conditions D1, and includes the following components. The vulnerability diagnosis process execution condition D1 is the one shown in the options for conditions for executing the vulnerability diagnosis process (in the example shown in FIG. 3, "Common" in the combo box C1, "Header of a specific response" in the combo box C2 "If the condition is met" and component C5 "The character string is included in the HTTP response header character string."). The operation reception unit 110 receives input from the user for at least one of the following components.
- A component that displays options for the vulnerability diagnosis process execution condition D1 (in the example shown in FIG. 3, "combo box C1", "combo box C2", and "component C5")
・Component that determines vulnerability diagnosis process execution information D2 (in the example shown in FIG. 3, "click button C3")
- A component that cancels the vulnerability diagnosis processing execution condition D1 (in the example shown in Figure 3, "click button C4")
[Vulnerability diagnosis processing information generation processing S12]
The vulnerability diagnosis processing information generation unit 121 in the main control unit 120 of the vulnerability diagnosis device 100 generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing the vulnerability of a web page or application based on user operations. generate.

An example of the vulnerability diagnosis process information generation process S12 by the vulnerability diagnosis process information generation unit 121 will be described below with reference to FIG. In particular, generation and modification of the vulnerability diagnosis processing execution condition D1 among a plurality of items constituting vulnerability diagnosis processing information D, which is information related to vulnerability diagnosis processing, will be explained in detail.

Among the multiple items that constitute vulnerability diagnosis processing information D, vulnerability diagnosis processing execution information D2 and vulnerability diagnosis processing result evaluation conditions D3 are determined by user operations in the same manner as vulnerability diagnosis processing execution conditions D1. Since the vulnerability diagnosis processing information generation unit 121 can independently generate and change the information based on the above, the description thereof will be omitted.

For example, when the operation reception unit 110 receives an operation from the user to click the click button C3 while the second vulnerability diagnosis processing information generation image I2 shown in FIG. The diagnostic processing information generation unit 121 generates vulnerability diagnostic processing information based on the operation.

In the example shown in FIG. 3, the operation reception unit 110 clicks the combo boxes C1 and C2 from the state where the second vulnerability diagnosis processing information generation image I2 is displayed on the display unit 131, and by clicking these, the operation reception unit 110 displays the Clicks on the options displayed in section 131 are not accepted. In this case, the vulnerability diagnosis processing information generation unit 121 generates the vulnerability diagnosis processing information set in advance without changing the vulnerability diagnosis processing information.

In the example shown in FIG. 3, "Common" in the combo box C1 indicates a condition that does not have significant characteristics when each condition is divided into groups. "When the header of a specific response meets a condition" in the combo box C2 indicates a case where the header of the header and body, which are the data that constitute the specific HTTP response, matches "some condition."

In this case, “some condition” indicates something set by the vulnerability diagnosis processing information generation unit 121 based on the selection of details received by the operation reception unit 110 from the user. For example, "some condition" may include the presence of a "Set-Cookie" header in the header of the HTTP response.

When the operation reception unit 110 receives an operation from the user to select an option other than “Common” in the combo box C1 or “When the header of a specific response meets the condition” in the combo box C2, the vulnerability diagnosis processing information generation unit 121 changes the vulnerability diagnosis process execution condition D1.

Using the example shown in FIG. 3, when the operation reception unit 110 receives the following operation from the user, the vulnerability diagnosis process information generation unit 121 changes the vulnerability diagnosis process execution condition D1.
・Operation to select an option other than "Common" in combo box C1 that indicates a condition with remarkable characteristics ・Options other than "When the header of a specific HTTP response meets the condition" in combo box C2 (for example, select the option in combo box C2 that indicates a condition with a remarkable characteristic・Clicking "Contains a character string" in component C5 will take you to a separate screen. An operation for selecting a displayed option (for example, "The number of character strings matches X", "Specific header exists", etc.) The vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing execution conditions. By changing D1, vulnerability diagnosis processing information including vulnerability diagnosis processing execution conditions is changed. In this way, when the vulnerability diagnosis processing information D is composed of a plurality of items in advance and the operation reception unit 110 receives an operation from the user to change the plurality of items, the vulnerability diagnosis processing information generation unit 121 Execute vulnerability diagnosis processing information generation processing that involves modification processing to change vulnerability diagnosis processing information.

For example, when the vulnerability diagnosis process information generation unit 121 changes the vulnerability diagnosis process execution condition D1, the vulnerability diagnosis process unit 122 changes the condition for executing the vulnerability diagnosis process S13 (for example, communication conditions) are changed. In addition, when the vulnerability diagnosis processing information generation unit 121 changes the vulnerability diagnosis processing execution information D2, information used when executing the vulnerability diagnosis processing S13 (for example, an attack inserted into an HTTP request for a web page or application) string) is changed.

As a result, even if the user does not have specialized knowledge or experience such as knowledge about vulnerabilities or experience in programming development, the vulnerability diagnosis processing unit 122 can detect vulnerabilities in web pages or applications using attack strings desired by the user. Can diagnose gender.

Further, even if each item of the vulnerability diagnosis processing information D that is configured in advance includes an item that is not desired by the user due to development circumstances, the vulnerability diagnosis processing information generation unit 121 will respond to the user's operation. Each item can be changed to the desired item for the user.

Further, when the operation reception unit 110 receives an operation to add an item to the vulnerability diagnosis processing information D from the user, the vulnerability diagnosis processing information generation unit 121 can perform a change process to add the item.

The vulnerability diagnosis processing information generation section 121 adds an item by a method in which the operation reception section 110 accepts a click of an option regarding adding an item from the pop-up menu that is displayed when the user right-clicks the vulnerability diagnosis processing information D. You can perform additional changes.

For example, when the item of vulnerability diagnosis processing information D is composed of only vulnerability diagnosis processing execution conditions D1, vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing execution information D2 and vulnerability diagnosis processing result evaluation. Condition D3 may be added as an item, or items other than these may be added.

Based on the user's operation on the operation reception unit 110, the vulnerability diagnosis processing information generation unit 121 generates items of vulnerability diagnosis processing information D having a function of supporting at least one of the user's selection operation and input operation on the GUI components. May be added. This facilitates the user's operation on the operation reception unit 110, and as a result, the vulnerability diagnosis processing information generation unit 121 can generate vulnerability diagnosis processing information more efficiently.

The vulnerability diagnosis processing information generation unit 121 may add vulnerability diagnosis processing information specifying a vulnerability diagnosis method different from the vulnerability diagnosis processing information D based on the user's operation on the operation reception unit 110. When using FIG. 3 as an example, the vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing information other than the vulnerability diagnosis processing information D (in the example shown in FIG. 3, "XSS(Path)", "XSS( DOM Based) and SQL Injection).

Additionally, the vulnerability diagnosis processing information generation unit 121 also generates the following vulnerability diagnosis information, in addition to cross-site scripting vulnerability diagnosis processing information such as XSS (Params), XSS (Path), and XSS (DOM Based). , vulnerability diagnosis processing information D can be independently added, generated, and changed using the same method as vulnerability diagnosis processing information D.
・Vulnerability diagnosis information that can attack servers that use SQL (in the example shown in Figure 3, "SQL injection")
・Vulnerability diagnosis information regarding vulnerabilities that can attack the OS using OS shell commands (in the example shown in Figure 3, "OS command injection")
・Vulnerability diagnosis information regarding vulnerabilities that allow files to be viewed by specifying the file path on the server (in the example shown in Figure 3, "path traversal")
In this way, the vulnerability diagnosis processing information generation unit 121 can generate the items of the vulnerability diagnosis processing information D and the vulnerability diagnosis processing even if the user does not have specialized knowledge or experience such as knowledge about vulnerabilities or programming development experience. Vulnerability diagnosis processing information other than information D can be added.

[Vulnerability diagnosis processing S13]
The vulnerability diagnosis processing section 122 of the vulnerability diagnosis device 100 executes vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated or modified by the vulnerability diagnosis processing information generation section 121.

An example of the vulnerability diagnosis process S13 by the vulnerability diagnosis processing unit 122 will be described below with reference to FIG. FIG. 4 is a diagram illustrating an example of a vulnerability diagnosis process execution image.

Specifically, FIG. 4 shows a case where the vulnerability diagnosis processing information generation unit 121 executes vulnerability diagnosis processing based on all the vulnerability diagnosis processing information generated or modified by the vulnerability diagnosis processing information generation unit 121. A vulnerability diagnosis processing execution image I3 regarding communication list information and vulnerability diagnosis processing results is shown.

When the vulnerability diagnosis processing unit 122 executes the vulnerability diagnosis process S13, the display unit 131 may display the vulnerability diagnosis process execution image I3. As shown in FIG. 4, the vulnerability diagnosis processing execution image I3 may include the following components.
・Domain DM (in the example shown in Figure 4, "Host")
・URL (in the example shown in Figure 4, "URL")
・Number of attack character string insertion points IP (in the example shown in Figure 4, "Insert Point")
・Request transmission count RC (in the example shown in FIG. 4, "Request Count")
-Request failure count FR (in the example shown in Figure 4, "Faild Request")
- Vulnerability diagnosis processing status ST (in the example shown in Figure 4, "Status")
- Vulnerability diagnosis processing result R (in the example shown in Figure 4, "Results")
・Click button C4
Domain DM indicates domain information of a server that is a target of vulnerability diagnosis. In the example shown in FIG. 4, domain DM includes domains DM1 to DM4. All of the domains DM1 to DM4 have domain information “www.….com” targeted for the same vulnerability diagnosis.

URL indicates the URL of the vulnerability diagnosis target. In the example shown in FIG. 4, the URL includes the following URLs.
・URL1 (in the example shown in Figure 4, "https://www.com/contact")
・URL2 (in the example shown in Figure 4, "https://www.com/contact/contact")
・URL3 (in the example shown in Figure 4, "https://www.com/contact/contact/confirm_contact")
・URL4 (in the example shown in Figure 4, "https://www.com/contact/contact/confirm_contact/complete_contact")
The number of attack string insertion locations IP indicates the number of locations where an attack string can be inserted into an HTTP request, which is linked one-to-one with each URL targeted for vulnerability diagnosis, and the number of attack string insertion locations IP1 to IP4 is include. The number of attack character string insertion locations IP is an integer greater than or equal to 0, and in the example shown in FIG. , "18", "18", "22", and "0".

The number of request transmissions RC indicates the number of times an attack HTTP request in which an attack character string is inserted into an HTTP request targeted for vulnerability diagnosis has been transmitted, and includes the number of request transmissions RC1 to RC4. In the example shown in FIG. 4, the request transmission times RC1 to RC4 are "18", "18", "22", and "0", respectively.

The request transmission times RC1 to RC4 are respectively linked to the HTTP requests for URLs 1 to 4 targeted for vulnerability diagnosis. Note that in the above example, the number of attack character string insertion locations IP1 to IP4 and the number of request transmission times RC1 to RC4 match, but in this embodiment, they do not necessarily have to match.

For example, in this embodiment, the number of request transmissions RC1 to RC4 may be greater than the number of attack character string insertion locations IP1 to IP4. In this case, the number of requests sent RC1 to RC4 also includes the number of times the vulnerability diagnosis processing unit 122 attacks the vulnerability diagnosis target by sending an HTTP request to perform vulnerability diagnosis in addition to inserting an attack string. May contain. Similarly, the number of requests sent RC1 to RC4 may also include the number of times when the vulnerability diagnosis processing unit 122 does not insert an attack string in a place where an attack string can be inserted, and sends a normal HTTP request. .

Details of inserting an attack string into an HTTP request targeted for vulnerability diagnosis will be described below with reference to FIGS. 5 and 6. FIG. 5 is a diagram illustrating an example of insertion of an attack string into an HTTP request targeted for vulnerability diagnosis. Specifically, FIG. 5 is a diagram showing an example of generation of an attack HTTP request for diagnosing whether or not a cross-site scripting vulnerability exists in a user ID targeted for vulnerability diagnosis.

In the example shown in FIG. 5, for the attack HTTP requests ATRE1 to ATRE4, the vulnerability diagnosis processing unit 122 uses The attack character string “'”><hr>xss” shown in italics is inserted.

Note that in the example shown in FIG. 5, there are two parameters in the HTTP request. In the example shown in FIG. 5, the first parameter is composed of the parameter name "user id" and the parameter value "test_id" before the character string "&" that separates the parameters. The second parameter consists of the character string "&" followed by the parameter name "user pw" and the parameter value "testtesttest".

FIG. 6 is a diagram illustrating an example of a location where an attack character string is inserted into an HTTP request targeted for vulnerability diagnosis. In the example shown in Figure 6, parameter value, parameter name, body, query, file name, cookie, cookie name, cookie value, and user-specified header values are shown in italics in the HTTP request under each item. ing. For example, in the example shown in FIG. 6, the parameter exists in the query parameter (the part after "?") of the HTTP request, the parameter name is "url", and the parameter value is "test".

In the example shown in FIG. 5, the vulnerability diagnosis processing unit 122 uses the parameter value of the user ID to generate an attack HTTP request for diagnosing whether or not the user ID has a cross-site scripting vulnerability. The attack string is inserted into. However, in this embodiment, the vulnerability diagnosis processing unit 122 adds attack characters to the locations corresponding to the parameter values, parameter names, bodies, queries, file names, cookies, cookie names, cookie values, and header values shown in FIG. You can also insert columns.

The number of request failures FR indicates the number of failures in which an attack HTTP request was not processed normally due to some kind of error, and includes the number of request failures FR1 to FR4. In the example shown in FIG. 4, the number of request failures FR1 to FR4 corresponds to No. 4 in FIG. Indicates the number of failures of attack HTTP requests for each vulnerability diagnosis target from 0 to 3, and all of them must be "0". From this, the example shown in FIG. 4 shows that an error HTTP response is not returned in response to the transmitted attack HTTP request.

The vulnerability diagnosis processing status ST indicates whether the vulnerability diagnosis process is waiting for vulnerability diagnosis processing, vulnerability diagnosis processing, or completed vulnerability diagnosis processing, and indicates vulnerability diagnosis processing status ST1 to ST4. include.

In the example shown in FIG. 4, vulnerability diagnosis processing statuses ST1 to ST4 are No. 4 in FIG. It corresponds to each vulnerability diagnosis target from 0 to 3. The vulnerability diagnosis processing statuses ST1 and ST2 indicate "finished", which indicates that the vulnerability diagnosis processing has been completed. The vulnerability diagnosis processing status ST3 indicates "scanning", which is the vulnerability diagnosis processing in progress. The vulnerability diagnosis processing status ST4 indicates "waiting", which is waiting for vulnerability diagnosis processing.

The vulnerability diagnosis processing result R is obtained by sending an attack HTTP request with an attack string inserted to the vulnerability diagnosis target, and determining the vulnerability of the vulnerability diagnosis target obtained from the HTTP response returned from the vulnerability diagnosis target. number, and includes vulnerability diagnosis processing results R1 and R2.

In the example shown in FIG. 4, the vulnerability diagnosis processing result R indicates the number of detected vulnerabilities of the vulnerability diagnosis target. The vulnerability diagnosis processing results R1 and R2 are No. 4 in FIG. This corresponds to vulnerability diagnosis targets of 0 and 1, respectively, and indicates that the number of vulnerabilities of the detected vulnerability diagnosis targets is "4" in both cases.

In the vulnerability diagnosis processing result R, the presence or absence of a vulnerability is determined every time an attack HTTP request is sent to the vulnerability diagnosis target, and if the vulnerability diagnosis target has a vulnerability, the number of vulnerabilities is added by one. and will not be added if there is no vulnerability.

Therefore, No. 4 in FIG. As shown in 2, even if the vulnerability diagnosis process S13 is not completed and "Scanning" is in progress, the vulnerability diagnosis process result R is "0" every time an attack HTTP request is sent to the vulnerability diagnosis target. '' and will be updated.

From this, No. 4 in FIG. The fact that there is no vulnerability diagnosis processing result R corresponding to vulnerability diagnosis targets 2 and 3 indicates that no attack HTTP request has been sent to these vulnerability diagnosis targets yet.

The click button C4 is a GUI component for transitioning to the vulnerability diagnosis processing result image I4 shown in FIG. The vulnerability diagnosis processing result image I4 will be explained together with the output processing S14.

[Output processing S14]
The output unit 130 of the vulnerability diagnosis device 100 outputs the vulnerability diagnosis process result in the vulnerability diagnosis process S13. As an example, the output unit 130 causes the display unit 131 to display a vulnerability diagnosis processing result image.

Hereinafter, an example of the output processing S14 by the output unit 130 will be described using FIG. 7. FIG. 7 is a diagram illustrating an example of a vulnerability diagnosis processing result image. Specifically, FIG. 7 shows a vulnerability diagnosis process result image I4 in which the output unit 130 displays the vulnerability diagnosis process result of the vulnerability diagnosis process S13 regarding cross-site scripting by the vulnerability diagnosis processing unit 122 on the display unit 131. shows.

When the output unit 130 executes the output process S14, the output unit 130 may display the vulnerability diagnosis process result image I4 on the display unit 131. As in the example shown in FIG. 7, the vulnerability diagnosis processing result image I4 may include the following components.
・Vulnerability diagnosis processing result R'
・Attack string AT
・HTTP request RE (Request)
・Domain DM (Host)'
・URL (URL)'
・Vulnerability diagnosis processing execution information D2''
・Risk level R'''
・Vulnerability diagnosis processing information D''
In the example shown in FIG. 7, the vulnerability diagnosis processing result R' includes the vulnerability diagnosis processing information D'a (cross-site scripting), the vulnerability diagnosis processing result R''1 (risk level), and the vulnerability diagnosis processing information D'a (cross-site scripting). It includes execution information D2'a (vulnerability diagnosis method), parameter P (Parameter), and summary SU. Thereby, the vulnerability diagnosis processing results of the web page or application can be communicated to the user in more detail.

In the example shown in FIG. 7, vulnerability diagnosis processing information D'a is a cross tree node that is an upper tree node of vulnerability diagnosis processing information D (XSS (Params)), XSS (Path), and XSS (DOMBased) shown in FIG. Shows information about vulnerability diagnosis processing using site scripting.

Vulnerability diagnosis processing result R''1 is the HTTP response returned from the vulnerability diagnosis target after sending an attack HTTP request in which the attack string AT is inserted into the parameter P included in the HTTP request RE to the vulnerability diagnosis target. Indicates the degree of risk of the vulnerability diagnosis target obtained from.

In the example shown in FIG. 7, the risk level is indicated by "HIGH" indicating a high risk level, "MEDIUM" indicating a medium risk level, and "LOW" indicating a low risk level. has been done. For example, the risk level of the cross-site scripting vulnerability targeted for vulnerability diagnosis indicated by the vulnerability diagnosis processing result R''1 is "MEDIUM" indicating that it is medium.

In this way, in the example shown in FIG. 7, the vulnerability diagnosis processing result R''1 indicates, for example, the degree of risk of the vulnerability of the vulnerability diagnosis target for each of the following vulnerability diagnosis processing information.
・Vulnerability diagnosis information that can attack servers that use SQL (e.g. "SQL injection")
・Vulnerability diagnosis information regarding vulnerabilities that can attack the OS using OS shell commands (e.g. "OS command injection")
・Vulnerability diagnosis information regarding vulnerabilities that allow files to be viewed by specifying the server file path (e.g. "path traversal")
・Vulnerability diagnosis information regarding vulnerabilities that insert attack scripts (e.g., attack strings) into the HTML of web pages by inserting attack scripts (e.g., attack strings) into the parameters of HTTP requests (e.g., "cross-site scripting")
For example, in the example shown in Figure 7, the cross-site scripting vulnerability is "MEDIUM," the SQL injection vulnerability is "HIGH," and the path traversal is "HIGH." The degree of sexual risk is indicated.

Note that in the example shown in FIG. 7, No. 4 in FIG. Each time a vulnerability is detected in the vulnerability diagnosis target in 0, an item related to cross-site scripting vulnerability is added one line at a time. For example, No. 4 in FIG. 0, four cross-site scripting vulnerabilities were detected, so in FIG. 7, four lines of items related to cross-site scripting vulnerabilities are added.

In this way, the vulnerability diagnosis processing result R''1 "MEDIUM" shown in FIG. 7 and the vulnerability diagnosis processing result R "4" shown in FIG. 4 do not correspond. On the other hand, the vulnerability diagnosis processing result R''1 included in the vulnerability diagnosis processing result R' is the vulnerability diagnosis processing result R'' in the vulnerability diagnosis processing result R'''' (Risk) in the table of FIG. '1 is supported.

The vulnerability diagnosis process execution information D2'a indicates information regarding a vulnerability diagnosis method for executing the vulnerability diagnosis process. In the example shown in FIG. 7, the vulnerability diagnosis process execution information D2'a is a vulnerability diagnosis process for diagnosing the vulnerability of the vulnerability diagnosis target by inserting an attack string AT into the parameter P and modifying the parameter value P. Indicates information regarding diagnostic methods. The vulnerability diagnosis process execution information D2'a corresponds to the vulnerability diagnosis process execution information D2''a in the vulnerability diagnosis process execution information D2'' (Issue Point) in the table of FIG.

The parameter P is information included in the HTTP request RE that is the source of the attack HTTP request that the application side sends to the vulnerability diagnosis target, and is composed of a name and a value. Here, the parameter P is a parameter named "contact" and indicates information whose value is changed by inserting the attack character string AT, and whose value is otherwise constant.

The summary SU indicates the summary of the vulnerability diagnosis processing result. As a result, if there is a risk even if there is no vulnerability, it is possible to specifically inform the user in what aspects there is a risk.

The attack character string AT is inserted into the parameter P to generate an HTTP request with a modified parameter value for vulnerability diagnosis.

Domain DM' indicates domain information of the server that is the target of vulnerability diagnosis. In the example shown in FIG. 7, domain DM' includes domains DM'1 to DM'4. Domains DM'1 to DM'4 are all domain information "www.....com" targeted for the same vulnerability diagnosis.

URL' indicates the URL of the vulnerability diagnosis target. In the example shown in FIG. 7, the URLs include URL'1 to URL'4 (in the example shown in FIG. 4, "https://www.....com/contact"), and URL'1 to URL'4 are , corresponds to URL1 in FIG.

The vulnerability diagnosis process execution information D2'' indicates information regarding a vulnerability diagnosis method for executing the vulnerability diagnosis process. In the example shown in FIG. 7, the vulnerability diagnosis process execution information D2'' includes vulnerability diagnosis process execution information D2''a to D2''d. The vulnerability diagnosis processing execution information D2''a to D2''d all indicate parameter value modification.

The risk level R''' is obtained from the HTTP response returned from the vulnerability diagnosis target by sending an attack HTTP request in which the attack string AT is inserted into the parameter P included in the HTTP request RE to the vulnerability diagnosis target. Indicates the degree of risk of the vulnerability diagnosis target. In the example shown in FIG. 7, the risk level R''' includes risk levels R'''1 to D'''4. Risk levels R'''1 to 4 all indicate "MEDIUM", which indicates that the risk level of cross-site scripting vulnerability is medium, similar to the above-mentioned "MEDIUM" with risk level R''1. It is.

The vulnerability diagnosis processing information D'' indicates information regarding vulnerability diagnosis processing. In the example shown in FIG. 7, the vulnerability diagnosis processing information D'' includes vulnerability diagnosis processing information D''a to D''d. Vulnerability diagnosis processing information D''a to D''d indicates information regarding vulnerability diagnosis processing using cross-site scripting.

<Modified example>
[Modification 1]
In the above example, the vulnerability diagnosis device 100 includes the operation reception unit 110, but in this embodiment, the vulnerability diagnosis device 100 does not need to include the operation reception unit 110.

For example, in the present embodiment, the vulnerability diagnosis device 100 has an operation receiving unit (not shown) external to the vulnerability diagnosis device 100 that receives user operation input, and a vulnerability diagnosis processing information generation unit 121 that User operation information may be acquired from an external operation reception unit of the diagnostic device 100 via a communication unit (not shown). Thereby, the processing amount and load of the vulnerability diagnosis device 100 as a whole can be reduced.

[Modification 2]
In the above example, the vulnerability diagnosis device 100 includes the output unit 130, but in this embodiment, the vulnerability diagnosis device 100 does not need to include the output unit 130.

For example, the vulnerability diagnosis device 100 sends a vulnerability diagnosis processing information generation image, a vulnerability diagnosis processing execution image, a vulnerability diagnosis processing result image, etc. to an output unit (not shown) of an external computer via a communication unit. You can also output it. Thereby, the processing amount and load of the vulnerability diagnosis device 100 as a whole can be reduced.

[Modification 3]
In the above example, the vulnerability diagnosis processing information generation unit 121 integrally generates the vulnerability diagnosis processing information and changes each item of the vulnerability diagnosis processing information, but in this embodiment, these are You can also go separately.

For example, the vulnerability diagnosis processing information generation unit 11 may set each item from a state where no vulnerability diagnosis processing information is set based on the user's operation (for example, customization) received by the operation reception unit 110. The vulnerability diagnosis processing information may be generated by Further, a vulnerability diagnosis processing information changing unit (not shown) different from the vulnerability diagnosis processing information generating unit 121 may independently change the vulnerability diagnosis processing information.

<Embodiment 2>
The vulnerability diagnosis device according to one embodiment of the present invention, like the vulnerability diagnosis device 100X according to the second embodiment, displays information between multiple web pages, between communication states of multiple applications, or between multiple applications. Transition information indicating a transition relationship between images may be generated and the transition information may be displayed.

Embodiment 2 will be described below using FIGS. 8 to 11. For convenience of explanation, members having the same functions as those described in the above-described embodiments will be denoted by the same reference numerals, and the description thereof will be omitted.

[Vulnerability diagnosis device 100X]
FIG. 8 is a block diagram showing an example of the configuration of a vulnerability diagnosis device 100X according to the second embodiment. As shown in FIG. 8, the vulnerability diagnosis device 100X includes a main control section 120X and an output section 130X instead of the main control section 120 and the output section 130 in the first embodiment. Other than this point, the vulnerability diagnosis device 100X has the same configuration as the vulnerability diagnosis device 100 according to the first embodiment.

[Main control unit 120X]
The main control unit 120X further includes a transition information generation unit 123 and a reproduction unit 124. Other than this point, the main control section 120X has the same configuration as the main control section 120 in the first embodiment.

(Transition information generation unit 123)
The transition information generation unit 123 generates transition information indicating a transition relationship between multiple web pages, between communication states of multiple applications, or between images displayed by applications. The transition information may include information for realizing a transition between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications.

(Reproducer 124)
Based on the transition information, the reproduction unit 124 (i) changes the web page displayed by the browser to any web page specified by the user, and (ii) changes the communication state of the application to any web page specified by the user. or (iii) causes the display unit 131X to reproduce the image displayed by the application as an arbitrary image specified by the user.

[Output section 130X]
The output unit 130X includes a display unit 131X instead of the display unit 131 in the first embodiment. Other than this point, the output section 130X has the same configuration as the output section 130 in the first embodiment.

(Display section 131X)
The display unit 131X further displays the transition information generated by the transition information generation unit 123. Other than this point, the display section 131X has the same configuration as the display section 131 in the first embodiment.

[Control method S2 of vulnerability diagnosis device 100X]
Next, a method for controlling the vulnerability diagnosis device 100X (a method for controlling the vulnerability diagnosis device) S2 according to the second embodiment will be described using FIGS. 9 to 11. FIG. 9 is a flow diagram illustrating an example of a control method S2 of the vulnerability diagnosis device 100X according to the second embodiment.

As shown in FIG. 9, the control method S2 of the vulnerability diagnosis device 100X includes a transition information generation process S21, a display process S22, a reproduction process S23, and a display process S24, and the vulnerability diagnosis device 100X controls the vulnerability diagnosis device 100X in this order. is executed.

[Transition information generation process S21]
The transition information generation unit 123 in the main control unit 120X of the vulnerability diagnosis device 100X generates transition information indicating transition relationships between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications. generate. The application image referred to here includes, for example, a screenshot of an application image displayed on the display unit 131X.

Conventionally, in order to investigate transition relationships between multiple web pages, communication states of multiple applications, or images displayed by multiple applications, it is necessary to investigate transition relationships between multiple web pages or between multiple applications. It was necessary to investigate the number of parameters present in the communications (eg, HTTP requests and HTTP responses) that resulted in the transition between images.

In addition, in the conventional method, the user counts parameters while investigating HTTP requests and responses between multiple web pages, communication states of multiple applications, or images displayed by multiple applications. I've done the method.

Therefore, analyzing the transition relationships between multiple web pages, communication states of multiple applications, or images displayed by multiple applications requires specialized knowledge and experience, and it takes a lot of man-hours to conduct the investigation. It was necessary.

On the other hand, as described above, the transition information generation unit 123 automatically generates transition information, making it easy to communicate between multiple web pages or between multiple applications without any specialized knowledge or experience. It is possible to investigate transition relationships between states or between images displayed by multiple applications.

Furthermore, since the transition information generation unit 123 automatically generates transition information, the number of man-hours required for conventional high-cost investigations can be significantly reduced. Furthermore, whereas conventionally, information such as URLs was manually entered by the user, the transition information generation unit 123 automatically generates transition information, so that information such as URLs is automatically input. , the number of man-hours can be reduced.

The transition information generation unit 123 may generate transition information based on the user's operation received by the operation reception unit 110, for example. Thereby, the transition information generation unit 123 can generate transition information desired by the user.

The transition information may include information for realizing a transition between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications. By including such transition information, the transition information generation unit 123 can generate transition information suitable for smartphone applications and game client launchers.

The transition information indicates a transition relationship between a plurality of web pages, and the transition information generation unit 123 may generate the transition information based on the communication content of the browser that displays each web page. That is, the transition information generation unit 123 may generate transition information indicating the transition relationship between a plurality of web pages by referring to the HTTP request and HTTP response obtained by a local proxy server that relays the HTTP request and HTTP response. . Thereby, the transition information generation unit 123 can generate transition information with high precision that indicates the transition relationship between displayed web pages based on the communication content of the browser.

The transition information indicating a transition relationship between communication states or images of multiple applications may include transition information indicating at least one transition relationship between communication states or images of multiple applications that use HTTP communication. . Thereby, the transition information generation unit 123 can generate transition information suitable for an application using HTTP communication.

The transition information indicates a transition relationship between communication states of a plurality of applications or between images, and the transition information generation unit 123 generates transition information based on the communication content of a browser that displays images of each application using HTTP communication. You may. That is, the transition information generation unit 123 refers to the HTTP request and HTTP response acquired by the local proxy server that relays the HTTP request and HTTP response, and generates transition information indicating the transition relationship between communication states of multiple applications or between images. may be generated.

Thereby, the transition information generation unit 123 can generate transition information suitable for an application using HTTP communication, which is displayed based on the communication content of the browser.

(Details of transition information generation process S21)
Hereinafter, using FIG. 10, in transition information generation processing S21, the transition information generation unit 123 generates transition information based on the communication contents of the browser that displays images of each web page or each application that uses HTTP communication. The processing will be explained in more detail.

FIG. 10 is a flow diagram illustrating an example of transition information generation processing S21 by the vulnerability diagnosis device 100X according to the second embodiment. It is assumed that, before executing step S211, the transition information generation unit 123 has set the start URL of the vulnerability diagnosis target and the target domain from which the HTTP response is to be obtained. Furthermore, the transition information generation unit 123 refers to the HTTP request and HTTP response acquired by the local proxy server that relays the HTTP request and HTTP response. Subsequently, the transition information generation unit 123 sends an HTTP request to a web page or an application that uses HTTP communication as needed, and obtains an HTTP response.

Note that the vulnerability diagnosis device 100X stores a set of an already obtained HTTP response and an HTTP request used to obtain the HTTP response in a storage medium (not shown). Further, in the following, the vulnerability diagnosis device 100X generates transition information as tree-structured information. However, the data structure of transition information is not limited to the tree structure. The vulnerability diagnosis device 100X stores the generated transition information in a recording medium (not shown).

(Step S211)
The transition information generation unit 123 determines whether the status of the HTTP response to the HTTP request sent to the web page is 2xx or 3xx.

If the transition information generation unit 123 determines that the status of the HTTP response is 2xx or 3xx (YES in step S211), the process proceeds to step S212. If the transition information generation unit 123 determines that the status of the HTTP response is not 2xx or 3xx (NO in step S211), it ends the transition information generation process S21.

Thereby, the transition information generation unit 123 can filter (exclude) HTTP responses in which errors have occurred.

(Step S212)
The transition information generation unit 123 determines whether the HTTP response is included in the target domain. If the transition information generation unit 123 determines that the HTTP response is included in the target domain (YES in step S212), the process proceeds to step S213. If the transition information generation unit 123 determines that the HTTP response is not included in the target domain (NO in step S212), it ends the transition information generation process S21.

Thereby, the transition information generation unit 123 can filter HTTP responses and HTTP requests that are not included in the target domain.

(Step S213)
The transition information generation unit 123 determines whether communications of the target domain have already been collected. For example, the transition information generation unit 123 can determine whether communications for the target domain have already been collected by determining whether a root tree node regarding the target domain exists in the storage medium. If the transition information generation unit 123 determines that the communication of the target domain has been collected (YES in step S213), the process proceeds to step S214. If the transition information generation unit 123 determines that the communication of the target domain is not collected (NO in step S213), it omits step S214 and proceeds to step S215.

(Step S214)
The transition information generation unit 123 creates a root tree node of the domain from which the HTTP response is obtained.

(Step S215)
The transition information generation unit 123 determines whether or not something equivalent to the acquired HTTP response has not been acquired before. If the transition information generation unit 123 determines that no HTTP response has been obtained before (YES in step S215), the process proceeds to step S216. If the transition information generation unit 123 determines that an HTTP response has been obtained before (NO in step S215), it ends the transition information generation process S21.

In one aspect, the transition information generation unit 123 generates an HTTP response that matches the URL, method, parameters included in the HTTP request, MIMETYPE, etc. of the HTTP request sent to obtain the HTTP response, rather than the HTTP response, on the storage medium. It may be determined whether an HTTP response has not been obtained before by determining whether or not an HTTP response has been accumulated. Since the HTTP response changes depending on the value of the parameter of the HTTP request, the transition information generation unit 123 determines whether the same HTTP request as the previous one has been sent or not. Can be filtered.

(Step S216)
The transition information generation unit 123 determines whether there is a candidate tree node associated with the obtained HTTP response.

If the transition information generation unit 123 determines that there is a candidate tree node linked to the obtained HTTP response (YES in step S216), the process proceeds to step S217. Note that candidate tree nodes associated with the obtained HTTP response will be described in the explanation of step S222, which will be described later.

If the transition information generation unit 123 determines that there is no tree node associated with the obtained HTTP response (NO in step S216), the process proceeds to step S218.

(Step S217)
The transition information generation unit 123 overwrites the data of the HTTP response of the candidate tree node, which is a candidate tree node to be linked to the obtained HTTP response, with the obtained HTTP response. As a result, from this point on, the candidate tree node changes from a candidate tree node in which no actual HTTP response is stored to a tree node in which an actual HTTP response is stored.

Note that when overwriting the data of the HTTP response of the candidate tree node, the transition information generation unit 123 uses the HTTP request used to obtain the HTTP response and the image of the web page displayed based on the HTTP response. etc. may be further stored in the candidate tree node.

(Step S218)
If there is no candidate tree node corresponding to the obtained HTTP response, the transition information generation unit 123 creates a tree node to store the obtained HTTP response, and transfers the created HTTP response tree node to the root tree node. and tie it.

(Step S219)
The transition information generation unit 123 determines whether there is a tree node (parent tree node) corresponding to a web page that includes a tag or the like that is a source of communication for acquiring the acquired HTTP response. If the tree node of the obtained HTTP response is a candidate tree node, the transition information generation unit 123 determines whether there is a tree node linked as a parent node of the candidate tree node. If the transition information generation unit 123 determines that a parent tree node exists (YES in step S219), the process proceeds to step S220. Note that the case where a parent tree node exists will be described in detail in the explanation of step S222, which will be described later.

If the transition information generation unit 123 determines that the parent tree node does not exist (NO in step S219), the process proceeds to step S221.

(Step S220)
The transition information generation unit 123 links the acquired tree node of the HTTP response as a child node of the parent tree node.

(Step S221)
The transition information generation unit 123 associates the obtained tree node of the HTTP response as a child node of the root tree node.

(Step S222)
The transition information generation unit 123 analyzes the obtained HTTP response and collects tags that cause communication. For example, the transition information generation unit 123 refers to the URL of the location and action of the tag, but refers not to the URL but to the function name of the script, collects the corresponding JavaScript (registered trademark) from the HTTP communication record, and selects the communication destination. You may also generate URLs and parameters for. If the acquired HTTP response includes a tag that causes communication, the transition information generation unit 123 generates a candidate tree to which the HTTP request corresponding to the communication is linked as a child node of the tree node of the acquired HTTP response. Generate a node. At this point, the HTTP response of the candidate tree node is empty because the communication content has not yet been actually acquired.

Note that when the transition information generation unit 123 obtains an HTTP response using the HTTP request linked to the currently generated candidate tree node and newly performs the transition information generation process S21, the currently generated candidate tree node becomes a candidate tree node linked to the HTTP response in S216 of the new transition information generation process S21. Furthermore, the tree node of the acquired HTTP response becomes the parent tree node in S219 of the new transition information generation process S21.

The transition information generation unit 123 may repeat the transition information generation process S21 until the user generates the desired transition information. In this case, the transition information generation unit 1123 uses the HTTP request linked to the candidate tree node generated in the predetermined transition information generation process S21 to obtain an HTTP response, and starts the next transition information generation process S21. May be executed.

The transition information generation unit 123 can use the tree information of the target domain generated by the above procedure as the transition information.

[Display processing S22]
The display section 131X in the output section 130X of the vulnerability diagnosis device 100X displays the transition information generated by the transition information generation section 123.

The display process S22 will be described in more detail below using FIG. 11. FIG. 11 is a diagram showing an example of transition information. In the example shown in FIG. 11, the transition information is a transition diagram I10 displayed on the display unit 131X, but the transition information is between multiple web pages, between communication states of multiple applications, or between multiple applications. It is sufficient to show the transition relationship between images. For example, the transition information may be a table instead of an image like the transition diagram I10.

In the example shown in FIG. 11, the transition diagram I10 includes images I11 (top), I12 (notice), I13 (inquiry), I14 (confirmation of inquiry), I15 (inquiry completed), I16 (top), I17 ( Contains images of web pages such as search results), I18 (login), and I19 (membership registration). Further, the transition diagram I10 includes various information on communication between the web pages to be investigated, such as arrows indicating transition relationships between these images, the URL of each web page, and its HTTP request and HTTP response.

Images I11, I13, I14 and I15 are respectively No. 4 in FIG. This is an image corresponding to vulnerability diagnosis targets 0 to 3.

Conventionally, for example, No. 4 in FIG. 4 corresponding to image I15 is used. When performing vulnerability diagnosis on vulnerability diagnosis target No. 3, No. 3 in FIG. 4 corresponding to image I15 is used. No. 3 in FIG. 4 corresponding to vulnerability diagnosis target No. 3 and images I11, I13, and I14 before the transition of image I15, respectively. The contents of communications with vulnerability diagnosis targets 0 to 2 were obtained one by one.

On the other hand, when the user clicks on the image I15, the vulnerability diagnosis processing information generation unit 121 generates the No. in FIG. 4 corresponding to the image I15. When it is decided to perform vulnerability diagnosis for vulnerability diagnosis target No. 3, from transition diagram I10 to No. 4 in FIG. 3 vulnerability diagnosis target and No. 3 in FIG. 4. It is possible to obtain the communication contents with vulnerability diagnosis targets 0 to 2.

This communication content includes an HTTP request and an HTTP response between image I11, image I13, image I14, and image I15. Therefore, the vulnerability diagnosis processing information generation unit 121 uses No. 4 in FIG. It is possible to obtain an HTTP request for obtaining an HTTP response for vulnerability diagnosis in step 3.

The vulnerability diagnosis processing information generation unit 121 generates vulnerability diagnosis processing information based on the above-mentioned HTTP request, and the vulnerability diagnosis processing unit 122 generates the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit 121. Vulnerability diagnosis processing can be automatically executed based on

In this way, by displaying transition information such as the transition diagram I10 on the display unit 131X, the transition information can be linked with the vulnerability diagnosis tool of the vulnerability diagnosis device 100 to investigate transition relationships, refer to transition relationships, and It becomes possible to automate the process of sex diagnosis.

Further, when the vulnerability diagnosis processing unit 122 diagnoses the vulnerability of a vulnerability diagnosis target included in transition information, the vulnerability diagnosis target is linked with the transition information in advance. Therefore, a token for communicating with a web page or application that has a transition relationship with the vulnerability diagnosis target is automatically inferred.

Therefore, the vulnerability diagnosis processing unit 122 does not need to specify a token and set a transition relationship for performing the communication. As a result, after the transition information generation unit 123 and reproduction unit 124 investigate the transition relationship of the web page or application, the vulnerability diagnosis processing unit 122 immediately performs a It is possible to perform highly accurate vulnerability diagnosis that ensures transition relationships.

Reproduction processing S23]
When the transition information includes information for realizing a transition between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications, the reproduction unit 124 reproduces the user information based on the transition information. The display unit 131X may reproduce any web page specified by the user, or the communication status or image of the application.

Note that when reproducing the communication state or image of the web page or application on the display unit 131X, the reproduction unit 124 does not draw the web page or the image of the application on the display unit 131X. The reproduction unit 124 merely reproduces the communication status or image of the web page or application on the display unit 131X.

Conventionally, for example, No. 4 in FIG. When trying to display the image I15 corresponding to the vulnerability diagnosis target of No. 3, the images I11, I13, I14, and I15 are displayed one by one on the display unit 131X while transitioning between these images. I had to let it happen.

On the other hand, when the user specifies image I15 by clicking or the like, reproduction unit 124 can directly display image I15 on display unit 131X without going through images I11, I13, and I14.

<Embodiment 3>
The vulnerability diagnosis device according to an embodiment of the present invention, like the vulnerability diagnosis device 100Y according to the third embodiment, connects to a plurality of vulnerability diagnosis devices and connects the plurality of vulnerability diagnosis devices and the own device. Shared vulnerability diagnosis processing information that is shared vulnerability diagnosis processing information may be transmitted to a plurality of vulnerability diagnosis devices.

Embodiment 3 will be described below using FIGS. 12 to 15. For convenience of explanation, members having the same functions as those described in the above-described embodiments will be denoted by the same reference numerals, and the description thereof will be omitted.

[Vulnerability diagnosis system 1]
FIG. 12 is a block diagram showing an example of the configuration of the vulnerability diagnosis system 1 according to the third embodiment. As shown in FIG. 12, the vulnerability diagnosis system 1 includes a vulnerability diagnosis device 100Y, a vulnerability diagnosis device 200, and a vulnerability diagnosis device 300.

[Vulnerability diagnosis device 100Y]
The vulnerability diagnosis device 100Y is a server computer that serves as a host and is connected to a plurality of vulnerability diagnosis devices 200 and 300 via a network N.

The vulnerability diagnosis device 100Y generates shared vulnerability diagnosis processing information based on the vulnerability diagnosis processing information generated in its own device or the vulnerability diagnosis processing information received from at least one of the vulnerability diagnosis device 200 and the vulnerability diagnosis device 300. It is updated and sent to vulnerability diagnosis devices 200 and 300.

As shown in FIG. 12, the vulnerability diagnosis device 100Y further includes a communication unit 140, and includes a main control unit 120Y and an output unit 130Y instead of the main control unit 120X and output unit 130X in the second embodiment. Other than this point, the vulnerability diagnosis device 100Y has the same configuration as the vulnerability diagnosis device 100X according to the second embodiment.

[Communication Department 140]
The communication unit 140 communicates with the communication unit 240 of the vulnerability diagnosis device 200 and the communication unit 340 of the vulnerability diagnosis device 300, which are connected via a network N based on a predetermined communication protocol such as HTTP and TCP/IP. . As shown in FIG. 12, the communication section 140 includes a receiving section 141 and a transmitting section 142.

(Receiving unit 141)
The receiving unit 141 receives, from at least one of the plurality of vulnerability diagnosis devices 200 and 300, vulnerability diagnosis processing information generated or changed in the vulnerability diagnosis device.

(Transmission unit 142)
The transmitter 142 transmits the shared vulnerability diagnosis processing information updated by the updater 125 to the plurality of vulnerability diagnosis apparatuses 200 and 300.

[Main control unit 120Y]
The main control unit 120Y further includes an updating unit 125. Other than this point, the main control section 120Y has the same configuration as the main control section 125X in the second embodiment.

(Update unit 125)
The updating unit 125 updates the shared vulnerability diagnosis processing information based on at least one of the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device.

[Output section 130Y]
The output unit 130Y includes a display unit 131Y instead of the display unit 131X in the second embodiment. Other than this point, the output section 130Y has the same configuration as the output section 130X in the second embodiment.

(Display section 131Y)
The display unit 131Y further displays the shared vulnerability diagnosis processing information updated by the update unit 125. Other than this point, the display section 131Y has the same configuration as the display section 131X in the second embodiment.

[Vulnerability diagnosis device 200]
The vulnerability diagnosis device 200 is a guest computer that includes an operation reception section 210, a main control section 220, an output section 230, and a communication section 240, and is, for example, a client server.

The operation reception unit 210 has the same configuration as the operation reception unit 110 in the second embodiment. The main control unit 220 has the same configuration as the main control unit 120X in the second embodiment. The output section 230 has the same configuration as the output section 130Y. That is, the vulnerability diagnosis device 200 is similar to the second embodiment except that it further includes a communication unit 240 and includes an output unit 230 having the same configuration as the output unit 130Y instead of the output unit 130X in the second embodiment. It has the same configuration as the vulnerability diagnosis device 100X.

[Communication Department 240]
The communication unit 240 communicates with the communication unit 140 of the vulnerability diagnosis device 100Y connected via the network N based on a predetermined communication protocol such as HTTP and TCP/IP. As shown in FIG. 12, the communication section 240 includes a receiving section 241 and a transmitting section 242.

(Receiving unit 241)
The receiving unit 241 receives the shared vulnerability diagnosis processing information updated by the update unit 125 of the vulnerability diagnosis device 100Y from the vulnerability diagnosis device 100Y.

(Transmission unit 242)
The transmitting unit 242 transmits the vulnerability diagnosis processing information generated or changed in the own device to the vulnerability diagnosis device 100Y.

[Vulnerability diagnosis device 300]
The vulnerability diagnosis device 300 is a guest computer that includes an operation reception section 310, a main control section 320, an output section 330, and a communication section 340, and is, for example, a client server.

The operation reception unit 310 has the same configuration as the operation reception unit 110 in the second embodiment. The main control unit 320 has the same configuration as the main control unit 120X in the second embodiment. The output unit 330 has the same configuration as the output unit 130X in the second embodiment. That is, the vulnerability diagnosis device 300 is similar to the second embodiment except that it further includes a communication unit 340 and includes an output unit 330 having the same configuration as the output unit 130Y instead of the output unit 130X in the second embodiment. It has the same configuration as the vulnerability diagnosis device 100X.

[Communication Department 340]
The communication unit 340 communicates with the communication unit 140 of the vulnerability diagnosis device 100Y connected via the network N based on a predetermined communication protocol such as HTTP and TCP/IP. As shown in FIG. 12, the communication section 340 includes a receiving section 341 and a transmitting section 342.

(Receiving unit 341)
The receiving unit 341 receives the shared vulnerability diagnosis processing information updated by the update unit 125 of the vulnerability diagnosis device 100Y from the vulnerability diagnosis device 100Y.

(Transmission unit 342)
The transmitter 342 transmits the vulnerability diagnosis processing information generated or changed in the own device to the vulnerability diagnosis device 100Y.

[Control method S3 of vulnerability diagnosis device 100Y]
Next, a method for controlling the vulnerability diagnosis device 100Y (control method for the vulnerability diagnosis device) S3 according to the third embodiment will be described using FIGS. 13 to 15. FIG. 13 is a flow diagram illustrating an example of a control method S3 of the vulnerability diagnosis device 100Y according to the third embodiment.

As shown in FIG. 13, the control method S3 of the vulnerability diagnosis device 100Y includes a reception process S31, an update process S32, and a transmission process S33, which are executed in this order by the vulnerability diagnosis device 100Y.

[Reception processing S31]
The receiving unit 141 in the communication unit 140 of the vulnerability diagnosis device 100Y receives vulnerability diagnosis processing information generated or changed in the vulnerability diagnosis device from at least one of the plurality of vulnerability diagnosis devices 200 and 300.

The receiving unit 141 receives, from at least one of the plurality of vulnerability diagnosis devices 200 and 300, vulnerability diagnosis process progress information indicating the progress of the vulnerability diagnosis process included in the vulnerability diagnosis process information by the vulnerability diagnosis device. You may receive it.

[Update process S32]
The update unit 125 in the main control unit 120Y of the vulnerability diagnosis device 100Y updates the shared vulnerability based on at least one of the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device. Update diagnostic processing information.

Hereinafter, updating of the shared vulnerability diagnosis processing information will be described in detail using FIGS. 14 and 15. 14 and 15 are diagrams showing examples of shared vulnerability diagnosis processing information. In the example shown in FIG. 14, the shared vulnerability diagnosis processing information includes a transition diagram I10Y as transition information.

As shown in FIG. 14, the transition diagram I10Y includes vulnerability diagnosis process progress information such as vulnerability diagnosis process progress information PA11, vulnerability diagnosis process progress information PA13, and vulnerability diagnosis process progress information PA14. Vulnerability diagnosis process progress information PA11, vulnerability diagnosis process progress information PA13, and vulnerability diagnosis process progress information PA14 are displayed as text information below images I11, I13, and I14, respectively.

The vulnerability diagnosis processing progress information PA11 indicates that the vulnerability diagnosis apparatus 100Y has the No. 1 in FIG. 4 corresponding to the image I11. This indicates that vulnerability diagnosis is currently being performed for vulnerability diagnosis target 0. In addition, vulnerability diagnosis processing progress information PA11 indicates that the vulnerability diagnosis possible date and time is from 8:10 on November 17, which is later than the vulnerability diagnosis possible date and time of images I12 and I15 to I19 by the vulnerability diagnosis processing period. It shows.

The vulnerability diagnosis process progress information PA13 indicates that the vulnerability diagnosis apparatus 200 has entered No. 4 in FIG. 4 corresponding to the image I13. This indicates that the vulnerability diagnosis target No. 1 is currently undergoing vulnerability diagnosis. In addition, vulnerability diagnosis processing progress information PA13 indicates that the vulnerability diagnosis possible date and time is from 8:10 on November 17, which is later than the vulnerability diagnosis possible date and time of images I12 and I15 to I19 by the vulnerability diagnosis processing period. is indicated by letters.

The vulnerability diagnosis process progress information PA14 indicates that the vulnerability diagnosis apparatus 300 has entered No. 4 in FIG. 4 corresponding to the image I14. This indicates that the vulnerability diagnosis target of No. 2 is being assessed for vulnerability. In addition, vulnerability diagnosis processing progress information PA14 indicates that the vulnerability diagnosis possible date and time is from 8:10 on November 17, which is later than the vulnerability diagnosis possible date and time of images I12 and I15 to I19 by the vulnerability diagnosis processing period. is indicated by letters.

The updating unit 125 updates the shared vulnerability diagnosis processing information based on at least one of the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device. As an example, the update unit 125 updates the vulnerability diagnosis process progress information based on at least one of the vulnerability diagnosis process progress information received by the receiving unit 141 in the vulnerability diagnosis device 100Y and the vulnerability diagnosis process progress information indicating the progress of the vulnerability diagnosis process by the own device. The shared vulnerability diagnosis processing information may be updated.

For example, the receiving unit 141 receives the following vulnerability diagnosis processing progress information, and the receiving unit 141 receives No. 4 in FIG. When vulnerability diagnosis process progress information indicating that the vulnerability diagnosis process for the vulnerability diagnosis target of No. 2 has been completed is generated, the update unit 125 updates the transition diagram I10Y based on the vulnerability diagnosis process completion information. .
- No. 4 in FIG. 4 corresponding to the image I11 obtained by the vulnerability diagnosis device 200. Vulnerability diagnosis process progress information indicating that the vulnerability diagnosis process for vulnerability diagnosis target No. 0 has been completed - No. 0 in FIG. Vulnerability diagnosis process progress information indicating that the vulnerability diagnosis process for the vulnerability diagnosis target No. 1 has been completed In this case, the update unit 125 updates the vulnerability diagnosis process that indicates the information "vulnerability diagnosis device 100Y vulnerability diagnosis in progress" The progress information PA11 is updated to vulnerability diagnosis process progress information PA11' indicating the information "vulnerability diagnosis device 100Y vulnerability diagnosis completed" as shown in the transition diagram I10Y' of FIG. The update unit 125 updates the vulnerability diagnosis process progress information PA13 indicating the information “vulnerability diagnosis device 200 vulnerability diagnosis in progress” to the information “vulnerability diagnosis device 200 vulnerability diagnosis completed” as shown in FIG. The vulnerability diagnosis process progress information is updated to PA13'. The update unit 125 updates the vulnerability diagnosis processing progress information PA14 indicating the information "vulnerability diagnosis device 300 vulnerability diagnosis in progress" to the information "vulnerability diagnosis device 300 vulnerability diagnosis completed" as shown in FIG. The vulnerability diagnosis process progress information is updated to PA14'.

[Display processing S33]
The display unit 131Y in the output unit 130Y of the vulnerability diagnosis device 100Y displays the shared vulnerability diagnosis processing information updated by the update unit 125. For example, the display section 131Y displays the transition diagram I10Y' shown in FIG. 15 on the display section 131Y.

[Transmission process S34]
The transmission unit 142 in the communication unit 140 of the vulnerability diagnosis device 100Y transmits the shared vulnerability diagnosis processing information updated by the update unit 125 to the plurality of vulnerability diagnosis devices 200 and 300. For example, the transmitter 142 transmits the transition diagram I10Y' to the plurality of vulnerability diagnosis devices 200 and 300.

As a result, a large number of users of the vulnerability diagnosis device 100Y, the users of the vulnerability diagnosis device 200, and the users of the vulnerability diagnosis device 300 can share shared vulnerabilities such as the transition diagram I10Y' related to one vulnerability diagnosis process project. Diagnostic processing information can be shared.

In addition, since the updated shared vulnerability diagnosis processing information can be shared among these users, these users do not need to update the vulnerability diagnosis processing information to the latest vulnerability diagnosis processing information. Even if the user participates in the gender diagnosis process, there is no need to separately set vulnerability diagnosis process information.

In addition, even if these users are located far away from each other, they can communicate smoothly, so that the vulnerability diagnosis process can be executed efficiently.

Furthermore, since the shared vulnerability diagnosis processing information includes transition information such as the transition diagram I10Y', the user of vulnerability diagnosis device 100Y, the user of vulnerability diagnosis device 200, and the user of vulnerability diagnosis device 300 can perform vulnerability diagnosis It becomes possible to grasp the progress status of the entire process. This improves the quality of information shared among these users.

<Modified example>
[Modification 1]
In the above example, the main control unit 120Y of the vulnerability diagnosis device 100Y includes a transition information generation unit 123 and a reproduction unit 124. The main control unit 220 of the vulnerability diagnosis device 200 includes a transition information generation unit 223 and a reproduction unit 224. Further, the main control unit 320 of the vulnerability diagnosis device 300 includes a transition information generation unit 323 and a reproduction unit 324.

However, in this embodiment, the vulnerability diagnosis apparatuses 100Y, 200, and 300 do not include these members, and the shared vulnerability diagnosis processing information does not need to include transition information.

Even in such a case, a large number of users such as the user of the vulnerability diagnosis device 100Y, the user of the vulnerability diagnosis device 200, and the user of the vulnerability diagnosis device 300 share shared vulnerability diagnosis processing information regarding one vulnerability diagnosis process project. can be shared.

In addition, since the updated shared vulnerability diagnosis processing information can be shared among these users, these users do not need to update the vulnerability diagnosis processing information to the latest vulnerability diagnosis processing information. Even if the user participates in the gender diagnosis process, there is no need to separately set vulnerability diagnosis process information.

Furthermore, even if the bases where these users execute the vulnerability diagnosis process are far apart, they can communicate smoothly, so the vulnerability diagnosis process can be executed efficiently.

[Modification 2]
In the above example, the update unit 125 updates at least one of the vulnerability diagnosis process progress information received by the receiving unit 141 in the vulnerability diagnosis device 100Y and the vulnerability diagnosis process progress information indicating the progress of the vulnerability diagnosis process by the own device. Shared vulnerability diagnosis processing information is updated based on However, in the present embodiment, the update unit 125 is not limited to vulnerability diagnosis processing progress information, but includes at least the vulnerability diagnosis processing information received by the receiving unit 141 and the vulnerability diagnosis processing information generated or changed in the own device. The shared vulnerability diagnosis processing information may be updated based on one of the two.

For example, the update unit 125 updates the vulnerability diagnosis process execution conditions, vulnerability diagnosis process execution information, or vulnerability diagnosis process result evaluation conditions received by the receiving unit 141, and the vulnerability diagnosis process execution conditions generated or changed in the own device. The shared vulnerability diagnosis processing information may be updated based on at least one of conditions, vulnerability diagnosis processing execution information, or vulnerability diagnosis processing result evaluation conditions.

[Example of implementation using software]
The function of the vulnerability diagnosis devices 100, 100X, and 100Y (hereinafter referred to as "devices") is a vulnerability diagnosis program for making a computer function as the device, and each control block (especially the main control unit) of the device. 120, 120X, and 120Y) by a vulnerability diagnosis program for making the computer function.

In this case, the device includes a computer having at least one control device (for example, a processor) and at least one storage device (for example, a memory) as hardware for executing the vulnerability diagnosis program. By executing the vulnerability diagnosis program with this control device and storage device, each function described in each of the above embodiments is realized.

The vulnerability diagnosis program may be recorded on one or more computer-readable recording media instead of temporary. This recording medium may or may not be included in the above device. In the latter case, the vulnerability diagnosis program may be supplied to the device via any wired or wireless transmission medium.

Further, part or all of the functions of each of the control blocks described above can also be realized by a logic circuit. For example, an integrated circuit in which a logic circuit functioning as each of the control blocks described above is formed is also included in the scope of the present invention. In addition to this, it is also possible to realize the functions of each of the control blocks described above using, for example, a quantum computer.

Further, each process described in each of the above embodiments may be executed by AI (Artificial Intelligence). In this case, the AI may be operated by the control device, or may be operated by another device (for example, an edge computer or a cloud server).

<Additional notes>
The present invention is not limited to the embodiments described above, and various modifications can be made within the scope of the claims, and embodiments obtained by appropriately combining technical means disclosed in different embodiments. are also included within the technical scope of the present invention.

In addition, the vulnerability diagnosis device according to each embodiment can diagnose vulnerabilities in web pages or applications even if the user does not have specialized knowledge or experience. We can contribute to the achievement of "Let's create a foundation for industry and technological innovation."

100 100 131Y Display section 141, 241, 341 Receiving section 142, 242, 342 Transmitting section D, D'a, D'', D''a, D''b, D''c, D''d Vulnerability diagnosis processing Information D1 Vulnerability diagnosis process execution conditions D2 Vulnerability diagnosis process execution information D3 Vulnerability diagnosis process result evaluation conditions I10, I10Y, I10Y' Transition diagram I11, I12, I13, I14, I15, I16, I17, I18, I19 Image PA11 , PA11', PA13, PA13', PA14, PA14' Vulnerability diagnosis processing progress information S1, S2, S3 Control method (control method of vulnerability diagnosis device)
S12 Vulnerability diagnosis processing Information generation processing S13 Vulnerability diagnosis processing S14 Output processing S21 Transition information generation processing S22, S24, S33 Display processing S23 Reproduction processing S31 Reception processing S32 Update processing S33 Transmission processing

Claims (5)

a vulnerability diagnosis processing information generation unit that generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing the vulnerability of a web page or application based on a user's operation;
a vulnerability diagnosis processing unit that executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit;
a transition information generation unit that generates transition information indicating a transition relationship between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications;
a display unit that displays the transition information generated by the transition information generation unit;
a transmitter that connects to a plurality of vulnerability diagnosis devices and transmits the transition information to the plurality of vulnerability diagnosis devices;
The transition information includes information indicating an image to be displayed on the display unit, and communication content between the plurality of web pages, communication states of the plurality of applications, or images displayed by the plurality of applications. is,
A vulnerability diagnosis device characterized by: The display unit displays the transition information as a transition diagram including arrows indicating transition relationships between the plurality of web pages, communication states of the plurality of applications, or images displayed by the plurality of applications.
The vulnerability diagnosis device according to claim 1, characterized in that: A vulnerability diagnosis processing information generation process in which the vulnerability diagnosis device generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing the vulnerability of a web page or application based on a user's operation;
a vulnerability diagnosis process in which the vulnerability diagnosis device executes the vulnerability diagnosis process based on the vulnerability diagnosis process information generated in the vulnerability diagnosis process information generation process;
a transition information generation process in which the vulnerability diagnosis device generates transition information indicating a transition relationship between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications;
a display process in which the vulnerability diagnosis device displays the transition information generated in the transition information generation process;
The vulnerability diagnosis device connects to a plurality of vulnerability diagnosis devices, and includes a transmission process of transmitting the transition information to the plurality of vulnerability diagnosis devices,
The transition information includes information indicating an image to be displayed in the display process, and communication content between the plurality of web pages, communication states of the plurality of applications, or images displayed by the plurality of applications. is,
A method for controlling a vulnerability diagnosis device, characterized in that: to the computer,
a vulnerability diagnosis processing information generation process that generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing the vulnerability of a web page or application based on a user's operation;
a vulnerability diagnosis process that executes the vulnerability diagnosis process based on the vulnerability diagnosis process information generated in the vulnerability diagnosis process information generation process;
a transition information generation process that generates transition information indicating a transition relationship between multiple web pages, between communication states of multiple applications, or between images displayed by multiple applications;
a display process for displaying the transition information generated in the transition information generation process;
A vulnerability diagnosis program that connects to a plurality of vulnerability diagnosis devices and executes a transmission process of transmitting the transition information to the plurality of vulnerability diagnosis devices,
The transition information includes information indicating an image to be displayed in the display process, and communication content between the plurality of web pages, communication states of the plurality of applications, or images displayed by the plurality of applications. is,
A vulnerability diagnosis program characterized by: a vulnerability diagnosis processing information generation unit that generates vulnerability diagnosis processing information that defines vulnerability diagnosis processing for diagnosing the vulnerability of a web page or application based on a user's operation;
a vulnerability diagnosis processing unit that executes the vulnerability diagnosis processing based on the vulnerability diagnosis processing information generated by the vulnerability diagnosis processing information generation unit;
a receiving unit that is connected to a plurality of vulnerability diagnosis devices and receives vulnerability diagnosis processing information generated or changed in the vulnerability diagnosis device from at least one of the plurality of vulnerability diagnosis devices;
vulnerabilities shared between the plurality of vulnerability diagnosis devices and the own device based on at least one of the vulnerability diagnosis processing information received by the receiving unit and the vulnerability diagnosis processing information generated or changed in the own device. an update unit that updates shared vulnerability diagnosis processing information that is vulnerability diagnosis processing information;
a transmitting unit that transmits the shared vulnerability diagnosis processing information updated by the update unit to the plurality of vulnerability diagnosis devices,
The vulnerability diagnosis processing information includes vulnerability diagnosis processing progress information indicating the progress of the vulnerability diagnosis processing,
The receiving unit receives vulnerability diagnosis processing progress information by the vulnerability diagnosis device from at least one of the plurality of vulnerability diagnosis devices,
The update unit updates the shared vulnerability based on at least one of the vulnerability diagnosis process progress information received by the receiving unit and vulnerability diagnosis process progress information indicating the progress of the vulnerability diagnosis process by the vulnerability diagnosis process performed by the own device. Update sex diagnosis processing information,
The transmitter transmits the shared vulnerability diagnosis processing information updated by the updater to the plurality of vulnerability diagnosis devices,
A vulnerability diagnosis device further comprising a display unit that displays the shared vulnerability diagnosis processing information updated by the update unit.

Images