JP5253298B2 - Web application diagnosis apparatus, Web application diagnosis program, and Web application diagnosis method - Google Patents

Description

  In the present invention, an HTTP (HyperText Transfer Protocol) request including pseudo attack data is transmitted to a diagnosis target Web application program (hereinafter referred to as a Web application), and an HTTP response which is a response to the request is analyzed. The present invention relates to a Web application diagnostic apparatus that determines the presence or absence of a security hole.

  A Web application is software that runs on a Web server or application server, and is called from a Web browser through the HTTP protocol, and provides a service to the user by returning the processing result to the browser as HTML. Calling a Web application is performed by storing, in addition to a URL, parameters at the time of calling, such as data input to a form by a user, in an HTTP request and transmitting them to a Web server.

  In recent years, attacks that exploit security flaws (security holes or vulnerabilities) by storing illegal data in parameters and calling Web applications have increased. As one of countermeasure techniques for such a security hole of a Web application, there is a Web application diagnosis technique for finding a security hole before being abused by performing a pseudo attack on the Web application. As products, IBM's AppScan (AppScan is a registered trademark), Hewlett-Packard WebInspect, and the like are known. In the Web application diagnosis technology, an HTTP request in which illegal data simulating an attack is set for each parameter is transmitted, and the presence or absence of a security hole is determined from the response. At that time, in order to avoid parameter checking at the entrance of the Web application, it is common to inspect each parameter by using illegal data in which variations of various character types and formats are prepared. In order to increase the efficiency of the inspection, a method is known in which several patterns of data are transmitted in advance, a character set or the like that passes the parameter check is specified, and only illegal data that passes the parameter check is transmitted (for example, patents). Reference 1).

JP 2008-135029 A

  In recent years, development using a web application framework has become mainstream in order to improve the efficiency of web application development. In development using a framework, functions common to Web applications, such as session management and page transition control, are performed by the framework, so that there is an advantage that the developer can concentrate on the implementation of the processing he / she originally wants to perform. In a web application using such a framework, a large amount of parameters necessary for the framework to operate are added to the HTTP request transmitted from the browser in addition to the parameters originally required by the web application. There is. For example, FIG. 11 shows parameters (a total of nine parameters) transmitted in an HTTP request from a web page generated on a framework called DWR (Direct Web Remoting). However, only “Joe” in c0-param is actually passed to the program implemented by the developer among these, and all the rest are processed in the framework.

  Conventionally, all of these parameters are targeted for diagnosis, and a diagnosis is performed by applying a pseudo attack to each parameter. However, the framework has been fully verified by the vendors and security communities that provide it, and the diagnosis of the parameters consumed by the framework has simply wasted diagnostic time.

  Further, in recent years, Web applications using asynchronous update from JavaScript (registered trademark) to Web applications called AJAX (Asynchronous Javascript And XML) (Javascript is a registered trademark) are also spreading. In AJAX, the format of parameters transmitted from JavaScript (registered trademark) to the Web application is not fixed, and the conventional Web diagnostic technology uses a unique format to send a pseudo attack HTTP request for a Web application that transmits parameters. Could not be generated.

  An object of the present invention is to provide an easy-to-use Web application diagnostic apparatus while selecting parameters that do not require diagnosis.

The Web application diagnosis apparatus of the present invention
A diagnostic HTTP (including a parameter in which pseudo attack data for attacking the diagnosis target Web application program as a test is set in a server device that executes the diagnosis target Web application program as a diagnosis target for whether there is a security defect. A HyperText Transfer Protocol) request is transmitted, an HTTP response that is a response to the diagnostic HTTP request is received from the server device, and the received HTTP response is analyzed to resolve the defect in the diagnostic target Web application program. In the web application diagnostic apparatus for diagnosing,
A parameter extraction unit that extracts parameters from a template HTTP request that is a template of the diagnostic HTTP request;
For a plurality of parameters, a parameter determination condition information storage unit that stores parameter determination condition information indicating whether each parameter is a diagnosis target parameter that is a parameter for which the pseudo attack data is to be set;
A diagnosis target parameter determination unit that determines whether the parameter extracted by the parameter extraction unit corresponds to the diagnosis target parameter based on the parameter determination condition information stored in the parameter determination condition information storage unit; It is characterized by that.

  According to the present invention, it is possible to provide a Web application diagnostic apparatus capable of selecting parameters that do not require diagnosis.

1 is a configuration diagram of a Web application diagnostic apparatus 100a according to Embodiment 1. FIG. 5 is an overall processing flow of the Web application diagnostic apparatus 100a according to the first embodiment. 4 shows an example of format definition information in the parameter configuration rule storage unit 150 according to the first embodiment. 7 is a process flow of parameter extraction in the original format in the first embodiment. An example of data stored in a diagnosis target parameter determination condition accumulation unit 160 according to the first embodiment. 7 is a processing flow for narrowing down diagnosis target parameters in the first embodiment. The block diagram of the Web application diagnostic apparatus 100b in Embodiment 2. FIG. The entire processing flow of the Web application diagnostic apparatus 100b in Embodiment 2. FIG. An example of the appearance of Web application diagnostic apparatuses 100a and 100b according to the third embodiment. An example of hardware resources of Web application diagnostic apparatuses 100a and 100b in the third embodiment. The figure which shows a prior art.

Embodiment 1 FIG.
FIG. 1 is a functional block diagram of the Web application diagnostic apparatus 100a according to the first embodiment. The Web application diagnosis apparatus 100a is connected to the Web server 200 (server apparatus) on which the diagnosis target Web application 201 is operating via the Internet (or IP network).

  In the Web application diagnosis apparatus 100a, a conventional Web application such as a security hole determination unit 101, a pseudo attack generation unit 102, a diagnosis result display unit 103, an HTTP request transmission unit 104, an HTTP response reception unit 105, and a template HTTP request generation unit 106 In addition to the functions provided in the diagnosis apparatus, the framework information input unit 110, the parameter reconstruction unit 120, the diagnosis target parameter narrowing unit 130, the parameter extraction unit 140, the parameter configuration rule storage unit 150, and the diagnosis target parameter determination condition storage unit 160 is added.

  The HTTP request transmission unit 104 has a function of transmitting an HTTP request to a server designated by the same address, with the server address on which the diagnosis target Web application 201 is running and the HTTP request as inputs.

  The HTTP response receiving unit 105 has a function of receiving an HTTP response from the diagnosis target Web application 201.

  The template HTTP request generation unit 106 has a function of generating an HTTP request that can be normally processed by a Web application.

  Based on the information on the framework used in the target web application, the diagnosis target parameter narrowing unit 130 identifies the parameters used for managing the framework among the parameters transmitted in the HTTP request. It is a function to be excluded from.

  The diagnosis target parameter determination condition accumulation unit 160 is a function for accumulating information for specifying parameters used in the framework. The diagnosis target parameter determination condition accumulation unit 160 stores parameter determination condition information indicating whether each parameter is a diagnosis target parameter for which pseudo attack data should be set for a plurality of parameters.

  The parameter extraction unit 140 is a function for extracting information stored in a format unique to a Web application from information on the framework used and an HTTP request.

  The parameter restructuring unit 120 has a function of storing parameters to be transmitted in the HTTP request based on information on the framework being used in a format unique to the Web application.

(Operation)
The operation will be described with reference to FIG. First, the Web application diagnostic apparatus 100a causes the diagnosis practitioner 400 to input the framework name used in the diagnosis target Web application 201 (S201). The input framework name is stored in the main memory or the like by the framework information input unit 110.

  Next, the template HTTP request generation unit 106 generates an HTTP request that is a template of a pseudo attack HTTP request to be transmitted to the diagnosis target Web application 201 (S202). This HTTP request must be processed normally by the diagnosis target Web application. As a method of realizing the template HTTP request generation unit 106, for example, a method of recording and reusing an HTTP request generated by a browser when a user operates a Web application through the browser is known. In the first embodiment, a known method may be used.

(Parameter extraction unit 140)
Next, the parameter extraction unit 140 extracts a parameter group included in the HTTP request with respect to the generated HTTP request (S203). The parameter extraction unit 140 extracts parameters from the URL, Cookie header, and body part in the HTTP request. The parameter is composed of a parameter name and a parameter value, and zero or more parameters are given to the URL, Cookie header, and body part in the HTTP request. The extracted parameters are composed of (parameter name, parameter value, extraction location, additional information).

  The format of parameters assigned to the URL and Cookie header is common to all Web applications, and the parameter extraction unit 140 analyzes the URL and Cookie header according to the common format and extracts parameters. The format of the parameter stored in the body part may be a standard format or an original format. In fact, in the DWR mentioned above, parameters are transmitted using a format unique to the framework.

  If the data in the HTTP request body part does not match the standard format, the parameter extraction unit 140 extracts parameters by referring to the parameter configuration rule storage unit 150 based on the framework information input previously.

(Parameter configuration rule storage unit 150: format definition information)
FIG. 3 is a diagram illustrating an example of the parameter configuration rule accumulation unit 150 in which format definition information is stored. “Format definition information” is information indicating the format definition of the framework for each of the plurality of frameworks. The parameter configuration rule storage unit 150 will be described.

The parameter configuration rule storage unit 150 stores zero or more “format definition information”.
Each format definition information
(1) Framework name,
(2) Parameter format pattern character string,
(3) Parameter name format specification pattern character string,
(4) It consists of a parameter value format designation pattern character string.

The (2) “parameter format pattern character string” is a regular expression character string including a parameter name and a placeholder in which the parameter value is stored.
The above (3) “parameter name format designation pattern character string” is a regular expression representing the format of the parameter name.
Similarly,
The above (4) “parameter value format designation pattern character string” is a regular expression representing the format of the parameter value. In the present embodiment, the parameter name and parameter value placeholders included in the parameter format pattern character string are {{NAME}} and {{VALUE}}, respectively. Any other character string may be used as long as it is not likely to occur.

(Processing by parameter extraction unit 140)
FIG. 4 is a diagram for explaining the processing of the parameter extraction unit 140 for the parameters stored in the HTTP request body portion in a unique format. The parameter extraction unit 140 extracts one (one line record) of “format definition information” stored in the parameter configuration rule storage unit 150 (S401), and the framework name described in the format definition information is the diagnosis target It is checked whether the framework name of the Web application 201 matches (S402).
If they do not match, an extraction process using other format definition information is attempted (S410). If matching format definition information is found, the HTTP request body part is extracted from the HTTP request (S403), the extracted parameter storage area is initialized (S404), and the extraction order counter is initialized (S405).

  Next, the parameter extraction unit 140 converts {{NAME}} and {{VALUE}} in the parameter format pattern character string in the format definition information into a parameter name format specification pattern character string and a parameter value format specification pattern character string, respectively. (S406, S407).

  The parameter extraction unit 140 matches the parameter format pattern generated in S406 and S407 with the extracted HTTP request body part from the current head part of the body part of the HTTP request (S408).

  If there is a match, the parameter extraction unit 140 extracts from the HTTP request body part the character string that matches the parameter name and parameter value pattern character string in the previous step, and registers it as the parameter name and parameter value (S411). , S412). Further, the parameter extraction unit 140 stores, as additional information, the value of the extraction order counter, all matched character strings, the parameter name, and the offset from the beginning of the character string of the matched part as the parameter value (S413 to S416). . Thereafter, the extraction order counter is incremented by 1 (S417), and the matched part is removed from the head of the body part (S418). If the body becomes empty, the parameter extraction ends (S419). Otherwise, the process returns to S408 and the parameter extraction is continued.

  In the case where a plurality of format definition information exists for one framework, when matching with one format definition information fails, another format definition information is used (S410).

  If parameter extraction from the HTTP request body part cannot be completed even if all the format definition information is used, the parameter extraction part 140 notifies the user as an analysis error.

(Parameter selection: diagnosis target parameter narrowing unit 130)
Returning to FIG. 2 again, the description of the diagnosis process will be continued. When the parameter extraction unit 140 completes parameter extraction, the diagnosis target parameter narrowing unit 130 performs diagnosis for each parameter (determining whether the parameter corresponds to the diagnosis target parameter). The diagnosis target parameter narrowing unit 130 extracts one parameter from the extracted parameter group (hereinafter referred to as P) (S204), and determines whether the parameter P is a diagnosis target (S205).

(Details of the determination by the diagnosis target parameter narrowing unit 130)
FIG. 5 is a diagram illustrating “determination conditions” (parameter determination condition information) stored in the diagnosis target parameter determination condition storage unit 160 described below. The determination process performed by the diagnosis target parameter narrowing unit 130 will be described with reference to FIG.

(Determination conditions stored in diagnosis target parameter determination condition storage unit 160)
The diagnosis target parameter narrowing unit 130 refers to the information stored in the diagnosis target parameter determination condition accumulation unit 160 (“determination condition”) to determine whether or not the extracted parameter P is a diagnosis target. The diagnosis target parameter determination condition accumulation unit 160 stores a plurality of determination conditions. That is, the diagnosis target parameter determination condition storage unit 160 describes determination conditions for whether or not the framework parameters used in the framework correspond to the diagnosis target parameters for a plurality of frameworks.
Each judgment condition is
(1) Framework name,
(2) Parameter storage location,
(3) Parameter name pattern character string,
(4) Parameter value pattern character string,
(5) Parameter value format specification pattern character string,
(6) and target / non-target instruction information.
In the above (2) “parameter storage location”, any of URL, Cookie header, and body part can be specified.
In (3) “Parameter name pattern character string”, the condition for the parameter name is specified by a regular expression.
In the above (4) “parameter value pattern character string”, the condition for the parameter value is specified as a regular expression including a placeholder {{VALUE}} indicating a pseudo attack data storage location (similar to the format definition information). The character string indicating the placeholder may be another expression).
In (5) “Parameter value format designation pattern character string”, the format of the character string stored in the placeholder described above is designated as a regular expression.
Finally,
In the above (6) “target / non-target instruction information”, it is specified whether or not a parameter matching the condition is to be diagnosed. Each item in the determination condition can be omitted except for the framework name and target / non-target instruction information. If omitted, the condition is not used for determination.

(Narrowing processing by the diagnosis target parameter narrowing unit 130)
FIG. 6 is a flowchart showing a narrowing process performed by the diagnosis target parameter narrowing unit 130. The diagnosis target parameter narrowing-down process will be described with reference to FIG.

The diagnosis target parameter narrowing-down unit 130 extracts a determination condition with a matching framework name from the determination conditions stored in the diagnosis target parameter determination condition storage unit 160 (S602). It is determined whether the parameter storage location information and the parameter name pattern character string stored in the extracted determination condition correspond to the storage location and parameter name of the parameter P (S603 to S605).
If it matches,
A regular expression is generated by replacing the placeholder in the parameter value pattern character string with the parameter value format designation pattern character string (S606), and it is confirmed whether the parameter value of the parameter matches the regular expression (S607). If there is a match, the content of the target / non-target instruction information is set as the determination result (S611). When it is determined to be a diagnosis target (S612), the parameter value format designation pattern character string and the position matching the character string are recorded in the parameter additional information (S613, S614). Finally, the determination result is output and the process ends (S615).

  The above process is repeated until a corresponding determination condition is found or until all the determination conditions are collated. If a matching determination condition is not found, it is determined as a diagnosis target and the process ends (S610).

  If the diagnosis target parameter narrowing unit 130 determines that it is a diagnosis target, an HTTP request in which pseudo attack data is inserted with respect to the parameter P is generated and transmitted, and diagnosis is performed (S206).

(Diagnosis processing)
Next, the diagnosis process will be described. First, in the diagnostic device 100, the pseudo attack generation unit 102 generates the pseudo attack data a (S208). An existing method may be used as the pseudo attack generation method.

  Next, the pseudo attack generation unit 102 determines whether or not the pseudo attack data a is accepted by the framework (S209). The determination is made based on whether or not the pseudo attack data a matches the parameter value format designation pattern character string stored at the time of narrowing down the diagnosis target parameter. If they do not match, the process proceeds to S216, and a diagnosis using other pseudo attack data is attempted. If there is a match, then the pseudo attack data a is set for the parameter P (S210). The setting is performed by replacing the parameter value of the parameter P with a by the length of the parameter value from the position matching the parameter value format designation pattern character string.

(Parameter reconstruction unit 120)
After the pseudo attack data is set by the pseudo attack generation unit 102, the parameter reconstruction unit 120 stores the parameter group in the HTTP request again (S211). If it was originally stored in a known format, the parameters extracted according to the format are stored again. If it is stored in a unique format (that is, extracted using the parameter configuration rule storage unit 150), all parameters extracted from the body part are HTTP requests according to the extraction order stored in the additional information. Store in the body. At that time, if the parameter to be stored does not include a pseudo attack, all matched character strings stored in the additional information are stored as they are. If a pseudo attack is included, the part corresponding to the parameter value (the offset information in the additional information and the length of the original parameter value) in all the matched character strings stored in the additional information Is replaced with the parameter value including the pseudo attack generated in the previous processing, and then stored in the HTTP request.

  The HTTP request (diagnostic HTTP request) generated by the above processing is transmitted to the Web application by the HTTP request transmission unit 104, and an HTTP response is received as a response (S212, S213). Thereafter, the security hole determination unit 101 analyzes the HTTP response, checks whether or not there is a security hole (S214), and if a security hole is detected, notifies the diagnosis operator 400 (S215). A conventional method can also be used for security hole determination.

  The diagnosis for the parameter P is completed by repeating the above processing until there is no variation in the pseudo attack data. By repeating S204 to S207 for all the parameters, the diagnosis for one HTTP request is completed.

  As described above, by using the information of the Web application framework used in the Web application 201 to be diagnosed, it becomes possible to diagnose a Web application that could not be diagnosed because the parameter format is unknown, and send Of these parameters, parameters added by the framework for its own management are excluded from the diagnosis target, thereby reducing the number of diagnosis target parameters and shortening the diagnosis time.

  The parameter configuration rule accumulation unit 150 and the diagnosis target parameter determination condition accumulation unit 160 according to the first embodiment assume an on-memory configuration in the same device, but these are stored in a remote database server. Of course. Further, it is possible to obtain information in each storage function periodically from a remote distribution server so that it always corresponds to the latest framework.

Embodiment 2. FIG.
FIG. 7 shows a configuration of the Web application diagnostic apparatus 100b according to the second embodiment. Unlike the first embodiment, in the Web application diagnosis apparatus 100, a library that can dynamically add a parameter extraction unit 140b, a parameter reconstruction unit 120b, and a diagnosis target parameter narrowing unit 130b for each framework is called a plug-in. Is realized. Plug-ins are stored in the framework plug-in storage unit 1300, and are searched and loaded by the plug-in load unit 1202 using the framework name as a key. Each plug-in is equipped with a parameter reconstruction unit 120b, a parameter extraction unit 140b, and a diagnosis target parameter narrowing unit 130b corresponding to each framework, and is called from the plug-in calling unit 1201 as necessary.

  FIG. 8 shows the overall processing flow of the Web application diagnostic apparatus 100b. The flow in FIG. 8 is the same as that in the first embodiment except that the plug-in corresponding to the framework name is loaded in S802. There are three differences: "Parameter extraction process included in HTTP request" (S804), "P is a process for determining whether P is a diagnosis target" (S806), and "Process for reconfiguring HTTP request from changed parameters" (S812) One is that it is executed as a function in the plug-in. Thus, by implementing each function as a function in the plug-in, it is possible to realize analysis of a very complicated parameter format and narrowing down determination.

  As described above, by programming the framework-specific processing in the form of plug-in, it is possible to perform more complex parameter extraction, reconstruction, and diagnosis target parameter narrowing processing as compared with the first embodiment. There is.

Embodiment 3 FIG.
The third embodiment will be described with reference to FIGS.

  The third embodiment shows a specific embodiment in which the Web application diagnostic apparatuses 100a and 100b are realized by a computer. Since the Web application diagnostic apparatuses 100a and 100b are the same computers, the following description will be made assuming the Web application diagnostic apparatus 100a. However, the following description also applies to the Web application diagnostic apparatus 100b.

  FIG. 9 is a diagram illustrating an example of the appearance of the Web application diagnostic apparatus 100a. In FIG. 9, a Web application diagnosis apparatus 100a includes a system unit 830, a display device 813 having a CRT (Cathode / Ray / Tube) or LCD (liquid crystal) display screen, a keyboard 814 (Key / Board: K / B), a mouse. 815, FDD817 (Flexible Disk Drive), compact disk device 818 (CDD: Compact Disk Drive), printer device 819, and the like are provided with hardware resources, and these are connected by cables and signal lines. The system unit 830 is connected to the Web server 200 via a network.

  FIG. 10 is a diagram illustrating an example of hardware resources of the Web application diagnostic apparatus 100a implemented by a computer. In FIG. 10, the Web application diagnostic apparatus 100a includes a CPU 810 (Central Processing Unit) that executes a program. The CPU 810 includes a ROM (Read Only Memory) 811, a RAM (Random Access Memory) 812, a display device 813, a keyboard 814, a mouse 815, a communication board 816, an FDD 817, a CDD 818, a printer device 819, and a magnetic disk device 820 via a bus 825. And control these hardware devices. Instead of the magnetic disk device 820, a storage device such as an optical disk device or a flash memory may be used.

  The RAM 812 is an example of a volatile memory. Storage media such as the ROM 811, the FDD 817, the CDD 818, and the magnetic disk device 820 are examples of nonvolatile memories. These are examples of a storage device or a storage unit, a storage unit, and a buffer. The communication board 816, the keyboard 814, the FDD 817, and the like are examples of an input unit and an input device. The communication board 816, the display device 813, the printer device 819, and the like are examples of an output unit and an output device.

  The communication board 816 is connected to a network (such as a LAN). The communication board 816 may be connected not only to the LAN but also to a WAN (wide area network) such as the Internet or ISDN.

  The magnetic disk device 820 stores an operating system 821 (OS), a window system 822, a program group 823, and a file group 824. The programs in the program group 823 are executed by the CPU 810, the operating system 821, and the window system 822.

  The program group 823 stores programs that execute the functions described as “˜units” in the description of the above embodiments. The program is read and executed by the CPU 810.

  The file group 824 includes data described as “parameter configuration rule” and “diagnosis target parameter determination condition”, “determination result of”, “calculation result of”, “ "Extraction result", "generation result of", "processing result of", data, signal values, variable values, parameters, etc. are stored as items of "~ file" and "~ database" Has been. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 810 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the CPU operations of extraction, search, reference, comparison, operation, calculation, processing, output, printing, and display. Is remembered.

  In the description of the embodiment described above, data and signal values are stored in the memory of the RAM 812, the flexible disk of the FDD 817, the compact disk of the CDD 818, the magnetic disk of the magnetic disk device 820, other optical disks, mini disks, DVDs (Digital). -It records on recording media, such as Versatile and Disk. Data and signals are transmitted on-line via the bus 825, signal lines, cables, and other transmission media.

  In the above description of the embodiment, what has been described as “to part” may be “to means”, “to circuit”, and “to device”, and “to step” and “to”. “Procedure” and “˜Process” may be used. That is, what has been described as “˜unit” may be realized by firmware stored in the ROM 811. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 810 and executed by the CPU 810. That is, the program causes the computer to function as the “˜unit” described above. Alternatively, the computer executes the procedure and method of “to part” described above.

  In the first and second embodiments, the Web application diagnostic apparatus has been described. However, as in the third embodiment, it is also possible to grasp the Web application diagnostic apparatus as a Web application diagnostic program that causes a computer to execute the operation of the Web application diagnostic apparatus. . Alternatively, it can be grasped as a computer-readable recording medium on which the Web application diagnostic program is recorded. Furthermore, it is possible to grasp the operation of the web application diagnostic apparatus as a web application diagnostic method performed by the web application diagnostic apparatus.

In the above embodiment,
In a Web application diagnostic apparatus that transmits an HTTP request including pseudo attack data to a diagnosis target Web application, analyzes an HTTP response that is a response to the HTTP request, and determines whether there is a security hole on the diagnosis target Web application.
Describes a web application diagnostic apparatus having a diagnostic target parameter narrowing section that selects parameters that should not be diagnosed based on information about the framework used in the diagnostic target web application from among parameters transmitted to the diagnostic target web application did.

In the above embodiment,
If the data format of the parameter to be sent to the diagnosis target web application is not standard, such as an HTTP request generated by AJAX, the format is analyzed based on the framework information input by the user, and the parameter is A web application diagnostic apparatus has been described that is capable of extracting and reconstructing an HTTP request.

In the above embodiment,
Judgment conditions that are referred to from the diagnosis target parameter narrowing down part and are composed of framework name, parameter storage location, parameter name pattern character string, parameter value pattern character string, parameter value format specification pattern character string, and target / non-target instruction information A Web application diagnostic apparatus having a diagnostic object parameter determination condition accumulation unit in which is stored has been described.

In the above embodiment,
Described a Web application diagnostic apparatus having a parameter configuration rule storage unit storing format definition information composed of a framework name, a parameter format pattern character string, a parameter name format specification pattern character string, and a parameter value format specification pattern character string .

  100a, 100b Web application diagnosis device, 101 security hole determination unit, 102 pseudo attack generation unit, 103 diagnosis result display unit, 104 HTTP request transmission unit, 105 HTTP response reception unit, 106 template HTTP request generation unit, 110 framework information input , 120, 120b Parameter reconstruction unit, 130, 130b Diagnosis target parameter narrowing unit, 140, 140b Parameter extraction unit, 150 Parameter configuration rule accumulation unit, 160 Diagnosis target parameter determination condition accumulation unit, 200 Web server, 201 Diagnosis target Web Application, 300 Internet, 400 Diagnosis performer, 1201 Plug-in calling unit, 1202 Plug-in loading unit, 1300 Framework plug-in storage unit.

Claims (7)

A diagnostic HTTP (including a parameter in which pseudo attack data for attacking the diagnosis target Web application program as a test is set in a server device that executes the diagnosis target Web application program as a diagnosis target for whether there is a security defect. A HyperText Transfer Protocol) request is transmitted, an HTTP response that is a response to the diagnostic HTTP request is received from the server device, and the received HTTP response is analyzed to resolve the defect in the diagnostic target Web application program. In the web application diagnostic apparatus for diagnosing,
A parameter extraction unit that extracts parameters from a template HTTP request that is a template of the diagnostic HTTP request;
For a plurality of parameters, a parameter determination condition information storage unit that stores parameter determination condition information indicating whether each parameter is a diagnosis target parameter that is a parameter for which the pseudo attack data is to be set;
A diagnosis target parameter determination unit that determines whether the parameter extracted by the parameter extraction unit corresponds to the diagnosis target parameter based on the parameter determination condition information stored in the parameter determination condition information storage unit; A Web application diagnostic apparatus characterized by that. The diagnosis target web application program is:
A given framework is used,
The parameter determination condition information stored in the parameter determination condition information storage unit is:
For a plurality of frameworks, the conditions for determining whether or not the framework parameters used in the framework correspond to the diagnosis target parameters are described,
The diagnosis target parameter determination unit
Based on the parameter determination condition information stored in the parameter determination condition information storage unit, a parameter for a framework that does not correspond to the diagnosis target parameter is selected from the parameters extracted by the parameter extraction unit. The Web application diagnosis apparatus according to claim 1. The web application diagnostic apparatus further includes:
For each framework of a plurality of frameworks, a format definition information storage unit that stores format definition information indicating the format definition of the framework;
A pseudo-attack generator,
A parameter reconstruction unit,
The parameter extraction unit
When parameters are stored in a unique format that is not a standard format in the template HTTP request, by referring to the format definition information stored in the format definition information storage unit, from among the format definition information Identify the format corresponding to the unique format, extract parameters based on the identified format,
The pseudo attack generator
Set pseudo-attack data to a parameter determined to correspond to the diagnosis target parameter by the diagnosis target parameter determination unit,
The parameter restructuring unit
The Web application diagnosis apparatus according to claim 2, wherein the parameter set in the pseudo attack data by the pseudo attack generation unit is stored in the template HTTP request. A diagnostic HTTP (including a parameter in which pseudo attack data for attacking the diagnosis target Web application program as a test is set in a server device that executes the diagnosis target Web application program as a diagnosis target for whether there is a security defect. A HyperText Transfer Protocol) request is transmitted, an HTTP response that is a response to the diagnostic HTTP request is received from the server device, and the received HTTP response is analyzed to resolve the defect in the diagnostic target Web application program. A web application diagnostic apparatus that is a computer for diagnosing
(1) a parameter extraction unit that extracts parameters from a template HTTP request that is a template of the diagnostic HTTP request;
(2) For a plurality of parameters, a parameter determination condition information storage unit that stores parameter determination condition information indicating whether each parameter is a diagnosis target parameter that is a parameter for which the pseudo attack data is to be set;
(3) A diagnosis target parameter determination unit that determines whether the parameter extracted by the parameter extraction unit corresponds to the diagnosis target parameter based on the parameter determination condition information stored in the parameter determination condition information storage unit ,
Web application diagnostic program for functioning as The diagnosis target web application program is:
A given framework is used,
The parameter determination condition information stored in the parameter determination condition information storage unit is:
For a plurality of frameworks, the conditions for determining whether or not the framework parameters used in the framework correspond to the diagnosis target parameters are described,
The diagnosis target parameter determination unit
Based on the parameter determination condition information stored in the parameter determination condition information storage unit, a parameter for a framework that does not correspond to the diagnosis target parameter is selected from the parameters extracted by the parameter extraction unit. The Web application diagnosis program according to claim 4. The Web application diagnostic program further includes the computer,
For each framework of a plurality of frameworks, a format definition information storage unit that stores format definition information indicating the format definition of the framework,
Pseudo attack generator,
Parameter reconstruction unit,
As well as
The parameter extraction unit
When parameters are stored in a unique format that is not a standard format in the template HTTP request, by referring to the format definition information stored in the format definition information storage unit, from among the format definition information Identify the format corresponding to the unique format, extract parameters based on the identified format,
The pseudo attack generator
Set pseudo-attack data to a parameter determined to correspond to the diagnosis target parameter by the diagnosis target parameter determination unit,
The parameter restructuring unit
6. The Web application diagnosis program according to claim 5, wherein parameters set in the pseudo attack data by the pseudo attack generation unit are stored in the template HTTP request. A diagnostic HTTP (including a parameter in which pseudo attack data for attacking the diagnosis target Web application program as a test is set in a server device that executes the diagnosis target Web application program as a diagnosis target for whether there is a security defect. A HyperText Transfer Protocol) request is transmitted, an HTTP response that is a response to the diagnostic HTTP request is received from the server device, and the received HTTP response is analyzed to resolve the defect in the diagnostic target Web application program. In the web application diagnostic method performed by the web application diagnostic apparatus to diagnose,
(1) A parameter extraction unit extracts parameters from a template HTTP request that is a template of the diagnostic HTTP request,
(2) The parameter determination condition information storage unit stores, for a plurality of parameters, parameter determination condition information indicating whether each parameter is a diagnosis target parameter that is a parameter for setting the pseudo attack data, and (3) a diagnosis target A parameter determination unit determines whether the parameter extracted by the parameter extraction unit corresponds to the diagnosis target parameter based on the parameter determination condition information stored in the parameter determination condition information storage unit. Web application diagnosis method.

Images