JP5421950B2 - Page change judgment device - Google Patents

Description

  The present invention relates to an apparatus that can easily detect a noticeable change in a target page.

  A program for inspecting vulnerability to attacks on a website has been developed (for example, Patent Document 1). However, a program for determining vulnerability to CSRF (cross-site request forgery), which is one of attacks, has not been put into practical use.

  One of the attacks against websites is CSRF (Cross Site Request Forgery). FIG. 1 explains the outline of CSRF.

  A malicious attacker who performs CSRF accesses the SNS of the server device S from the attacker terminal device C, and sets a link on the bulletin board B of Mr. B. The user logs in to the SNS including his / her bulletin board from the user terminal device A1. Next, the user accesses and browses B's bulletin board B. Subsequently, when the user clicks a link in the bulletin board B on which the attacker has set a device, the device program is activated. Using the fact that the user terminal device A1 is logged in, the device program transmits a malicious request to the SNS as if it was a request from the user terminal device A1. For example, the setting of the user's bulletin board A is changed (such as changing private to public).

  As described above, websites that are vulnerable to attacks by CSRF may be subject to configuration changes that are not intended by the user.

  Software for checking such web vulnerabilities has been developed. A CSRF attack is performed on the website, and it is determined whether or not the website can withstand the CSFR attack.

  In order to check the vulnerability to CSRF, the user terminal device for checking must be logged in to the server device. That is, it is assumed that it is accurately determined whether or not the user is in the login state.

  Conventionally, the presence or absence of login is automatically determined by the following processing. First, a target page before login (a page for logging in) and a target page after login are acquired. Of the target page after login, the number of bytes of data corresponding to the target page before login and the data of a different part are calculated and recorded. Actually, when the presence / absence of login is determined, login is performed and the target page is acquired. The previously recorded matching portion is deleted from the acquired target page, and the number of bytes of data of the remaining portion is calculated. If the number of bytes is the same as the number of bytes recorded in advance, it is determined that login has been completed.

JP-A-2005-250945

  However, in the conventional technology as described above, if the logged-in screen includes a time display or an advertisement display or the like that is different every time access is performed (every predetermined time), the login state is set. However, there are many cases where the number of bytes is not the same, and there is a problem that it is impossible to accurately determine whether or not there is a login.

  In addition to the above-described login presence / absence determination, there is a request to execute a quick determination by paying attention only to a change to be detected in a page tampering determination or the like.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a login determination device and a page change determination device that can solve the above problems and make a quick determination by paying attention to a change to be detected.

(1) A login determination apparatus according to the present invention includes a reference hierarchical structure recording unit that records, as a reference hierarchical structure, a hierarchical structure of tags constituting a target page that is known to be after login or before login, and a determination target Target page acquisition means for acquiring the target page, hierarchical structure analysis means for obtaining the analysis hierarchical structure by analyzing the hierarchical structure of the tags constituting the acquired target page, the analysis hierarchical structure, and the reference hierarchical structure recording unit The reference hierarchical structure recorded in the above, the extraction means for extracting different parts of the hierarchical structure, and whether or not a predetermined keyword is included in the part corresponding to the different part of the analysis hierarchical structure, Login determination means for determining whether the acquired target page is after login or before login.

  Therefore, the presence / absence of login can be determined accurately and quickly.

(2) The login determination program according to the present invention is accessible to a reference hierarchical structure recording unit that records a hierarchical structure of tags constituting a target page that is known to be after login or before login as a reference hierarchical structure. A login determination program using a computer, wherein the login determination program analyzes a hierarchical structure of target page acquisition means for acquiring a target page as a determination target and a tag constituting the acquired target page. A hierarchical structure analyzing means for obtaining an analytical hierarchical structure; an extracting means for comparing the analytical hierarchical structure with a reference hierarchical structure recorded in a reference hierarchical structure recording unit to extract a different part of the hierarchical structure; and the analytical hierarchy Depending on whether a predetermined keyword is included in a part corresponding to a part having a different structure, the acquired target page is It is a login determination program for functioning as a login determining means for determining the or those wherein either logged out later ones in.

  Therefore, the presence / absence of login can be determined accurately and quickly.

(3) In the login determination program according to the present invention, the target page is described in the HTML language, and the hierarchical structure analyzing means analyzes the hierarchical structure according to the nesting state of the HTML tag of the acquired target page. It is characterized by performing.

  Therefore, the hierarchical structure can be analyzed based on the HTML tag.

(4) In the login determination program according to the present invention, the hierarchical structure analyzing means analyzes the number of tags of each type included in each level of the HTML tag as a hierarchical structure, and the extracting means is stored in the structure recording unit. The number of tags of each type included in each level of tags constituting the recorded target page and the number of tags of each type included in each level of tags constituting the target page analyzed by the hierarchical structure analyzing means And a portion having a different number of corresponding tags is extracted as a portion having a different hierarchical structure.

  Therefore, content determination can be performed only for a portion where the hierarchical structure has changed, so that determination is quick and accurate.

(5) The page change detection apparatus according to the present invention compares the hierarchical structure of the tags constituting the first target page with the hierarchical structure of the tags constituting the second target page, and compares portions having different hierarchical structures. Based on a part corresponding to a different part of the hierarchical structure of the extraction means to be extracted and the tag constituting the first target page or the second target page, the change contents of the first target page and the second target page Change content determining means for determining.

  Therefore, since the comparison can be performed only for the portion where the hierarchical structure has changed, the determination is quick and accurate.

  In the embodiment, “target page acquisition unit” corresponds to step S4.

  In the embodiment, “hierarchical structure analyzing means” corresponds to step S5.

  In the embodiment, “extraction means” corresponds to step S6.

  In the embodiment, the “login determination unit” corresponds to steps S7, S8, and S9.

  “Page” is a concept including one display unit that is displayed as a unit, including scrolling, such as one display unit of a language having a hierarchical structure by tags.

  The “program” is a concept that includes not only a program that can be directly executed by the CPU, but also a source format program, a compressed program, an encrypted program, and the like.

It is a figure for demonstrating the outline | summary of cross-site request forgery. It is a functional block diagram of the login determination apparatus by one Embodiment of this invention. It is a figure which shows the relationship between the diagnostic server apparatus 14 as a login determination apparatus, the user terminal device 12, and the diagnostic object server apparatus 16. FIG. It is a hardware configuration of the diagnostic server device 14. It is a figure which shows the screen for login. It is HTML data of the screen of FIG. It is the hierarchical structure of the HTML data of FIG. It is a flowchart of a login determination program. It is a figure which shows the screen after login. It is HTML data of the screen of FIG. It is the hierarchical structure of the HTML data of FIG. It is a figure which shows a difference flag table.

1. Functional Block Diagram FIG. 2 shows a functional block diagram of a login determination device according to one embodiment of the present invention. The reference hierarchical structure recording unit 4 records in advance a reference hierarchical structure of a page for login that is known to be before login. When making the determination, the target page acquisition unit 2 transmits an ID, a password, and the like to make a login request and acquires the target page. The hierarchical structure analyzing means 6 analyzes the hierarchical structure of the acquired target page. The extracting unit 8 compares the recorded reference hierarchical structure with the hierarchical structure of the target page, and specifies a different part. The contents of the target page corresponding to different parts of the hierarchical structure are extracted. The login determination means 10 determines the login status based on whether or not a predetermined keyword (for example, a keyword such as “login” displayed on the screen before login) is included in the content extracted from the target page. to decide. As described above, it is possible to determine whether or not there is a login for the target page.

2. Hardware Configuration FIG. 3 shows the connection status of the diagnostic server device 14 as a login determination device according to an embodiment of the present invention. The diagnosis server device 14 receives a command from the user terminal device 12 and accesses the diagnosis target server device 16 to perform vulnerability diagnosis thereof. The diagnosis target server device 16 transmits the vulnerability diagnosis result to the user terminal device 12.

  FIG. 4 shows a hardware configuration of the diagnostic server device 14. A memory 22, a hard disk 24, a CD-ROM drive 26, and a communication circuit 28 are connected to the CPU 20. The communication circuit 28 is a circuit for communicating with the diagnosis target server device 16 and the user terminal device 12 via the Internet or the like.

  On the hard disk 24, an operating system 32 such as WINDOWS (trademark), a login determination program 34, a reference HTML hierarchical structure 36, and a keyword 38 are recorded. The OS 32 and the login determination program 34 are installed on the hard disk 24 via the CD-ROM drive 26 as recorded on the CD-ROM 30. The login determination program 34 performs its function in cooperation with the OS 32.

  The reference HTML hierarchical structure 36 is obtained by analyzing and recording in advance an HTML hierarchical structure before login of a page for performing login determination. For example, assume that the HTML data of the login page (the page before login) as shown in FIG. 5 is as shown in FIG. The reference HTML hierarchical structure of this page is as shown in FIG.

  That is, in FIG. 6, the portion surrounded by the <html> tag and the corresponding </ html> tag (from the second line to the 43rd line) is the highest hierarchy (hierarchy 0). Since there is one <html> tag </ html> tag at the level of this hierarchy, 1 is recorded in the tag type <html> of hierarchy 0 in FIG.

  <head> </ head> and <body> </ body> are included as the next layer in the part surrounded by <html> tag </ html> tags (from the second line to the 43rd line) It is. Therefore, 1 is recorded in each tag type <head> <body> of the hierarchy 1 in FIG.

  In the part surrounded by <head> </ head> and <body> </ body> (3rd to 5th line, 6th to 42nd line), <title> </ title >, <Center> </ center>, <br>, <table> </ table> are included as the next layer. Note that <br> is different from other tags, and there is no corresponding </br>. In this embodiment, the hierarchy is determined as if there is </br> immediately after <br>. . For example, in FIG. 6, it can be determined that <br> in the 10th row is the same second hierarchy as <center> and <table> which are the second hierarchy. The same processing is performed for tags that do not have a corresponding </ input> such as <input> other than <br>.

  As described above, 1 is recorded in each of the tag types <center>, <br>, and <table> in the hierarchy 2 in FIG.

  When two or more same tags exist in the hierarchy, the numbers are recorded in FIG. For example, in FIG. 7, since 2 is recorded in the tag type <td> of the hierarchy 4, it can be seen that there are two <td> in this hierarchy.

  As described above, the keyword 38 is also recorded on the hard disk 24. In this embodiment, a unique term (for example, “Welcome” or “Logout”) that appears on the screen after login is recorded as the keyword 38.

3. Login Determination Processing FIG. 8 shows a flowchart of the login determination program 34. First, the CPU 20 receives a command from the user terminal device 12 (step S1). The command from the user terminal device 12 includes a URL of a diagnosis target site, a user ID for login, a password, and the like. Note that a plurality of commands from the user terminal device 12 may be recorded, and processing may be performed collectively.

  Next, the CPU 20 controls the communication circuit 28 and accesses the diagnosis target site (diagnosis target server device 16) based on the URL included in the command (step S2). Thereby, a login screen as shown in FIG. 5 is transmitted from the diagnosis target site. In response to this, the CPU 20 transmits the user ID and password to the diagnosis target site (step S3).

  The CPU 20 receives the response (HTML data) from the diagnostic site and records it on the hard disk 24 (step S4). If the login is successful, HTML data for displaying the screen after login as shown in FIG. 9 should be returned. FIG. 10 shows HTML data corresponding to the screen of FIG.

  The CPU 20 analyzes the hierarchical structure of the HTML data recorded on the hard disk 24 (step S5). The HTML hierarchical structure obtained by the analysis is as shown in FIG.

  Subsequently, the CPU 20 compares the reference HTML hierarchical structure (FIG. 7) recorded on the hard disk 24 with the HTML hierarchical structure (FIG. 11) obtained by analyzing the response, and extracts the difference ( Step S6). FIG. 12 shows a difference flag table generated for extracting the difference portion. The CPU 20 compares the reference HTML hierarchical structure 36 of FIG. 7 with the HTML hierarchical structure of FIG. 11, and sets the same part as “0” and the different part as “1” to generate a difference flag table.

  The reference HTML hierarchical structure 36 in FIG. 7 and the HTML hierarchical structure in FIG. 11 have the same values in the <form> of the hierarchy 5 and the <br> <input> of the hierarchy 6, and the rest. Therefore, a difference flag table as shown in FIG. 12 is generated.

Next, the CPU 20 specifies a part corresponding to the difference part of the response. Here, since <form> of hierarchy 5 and <br><input> of hierarchy 6 are different parts, the contents of the corresponding part in the response of FIG. 10 are extracted. The 14th to 16th lines correspond to the <form> of the hierarchy 5, and the 15th line corresponds to the <input> of the hierarchy 6. Also, since there is no corresponding </br> in layer 6, it is treated as having no content portion. Accordingly, the 14th to 16th lines are extracted as shown below.
<form action = "logout.php" method = "post">
<input type = "submit" value = "logout">
</ form>

  The CPU 20 determines whether any of the extracted contents matches the keyword 38 recorded on the hard disk 24 (step S7). In this embodiment, “Welcome” and “Logout” are recorded as the keywords 38. Here, “logout” is included in the extracted contents. Therefore, the CPU 20 determines that “login is present” (step S8).

  Further, in the case of a response that is not correctly logged in, the screen does not have the data as shown in FIG. 10, but a screen to which a message such as “Please enter the correct user ID and password” is added. In this case, the keyword 38 is not included in the extracted content. If the keyword 38 is not included, the CPU 20 determines that there is no login (step S9).

  As described above, the presence / absence of login can be determined. In this embodiment, a difference portion is extracted by comparing HTML hierarchical structures. In most cases, the advertisement structure or the clock display part that changes at every access or every predetermined time changes the display content, but the HTML structure remains unchanged. Therefore, according to this embodiment, such a change can be ignored, and a determination can be made by extracting a portion where the target change may occur, and the processing is quick.

  Thus, after determining the presence or absence of login, vulnerability determination with respect to CSRF is performed.

4). Other embodiments
(1) In the above embodiment, the login determination as a premise of vulnerability determination for CSRF has been described. However, the present invention can be applied to the general determination of whether or not there is a login.

(2) In the above embodiment, the hierarchical structure of HTML data before login is recorded as the reference HTML hierarchical structure 36. However, the hierarchical structure of HTML data after login may be recorded as the reference HTML hierarchical structure 36. In this case, the hierarchical structure of the response HTML data and the reference HTML hierarchical structure 36 are compared to extract a different portion, and a keyword specific to the login screen (for example, “ If there is “login”, “new registration”, etc., it is determined that the login has not been made correctly.

(3) In the above embodiment, the presence / absence of login is determined. However, for two pages to be compared, changes such as an advertisement part and a clock display part that change at every access or every predetermined time can be ignored and used to detect a noticeable change part.

  Also, the similarity (difference) between both pages can be determined based on the difference flag table. All the “1” s in the difference flag table are found, and a rectangle from each “1” to the square of the final hierarchy is drawn to the right. The larger the sum of the rectangular areas, the lower the similarity between the two pages. This is because the difference is considered to be larger as the higher part of the hierarchy is different.

  For example, in the difference flag table shown in FIG. 12, the rectangular area (2 squares) from the tag type <form> “1” of the layer 5 to the last layer and the tag type <br> <input> of the layer 6 The total area (4 squares) is the sum of the rectangular areas (1 square each) from “1” to the last layer.

(4) In the above embodiment, HTML data has been described as an example, but the present invention can also be applied to languages having other hierarchical structures (for example, XML).

(5) In the above embodiment, the case where the login determination program is recorded in the diagnosis server device 14 has been described. However, a login determination program may be recorded in the user terminal device 12 and the determination may be made by accessing the diagnosis target server device 16 directly from the user terminal device 12.

(6) In the above embodiment, an example in which two pages are compared is shown. However, it can also be used to record access logs of pages visited by the user. It is troublesome to record all the HTML data of the page visited by the user. Therefore, only the contents related to the hierarchical structure and the tag to be noted need be recorded.

Claims (5)

A reference hierarchical structure recording unit that records a hierarchical structure of tags constituting a target page that is known to be after login or before login as a reference hierarchical structure;
A target page acquisition means for acquiring a target page as a determination target;
A hierarchical structure analyzing means for analyzing the hierarchical structure of tags constituting the acquired target page and obtaining an analytical hierarchical structure;
Extracting means for comparing the analysis hierarchical structure with a reference hierarchical structure recorded in a reference hierarchical structure recording unit, and extracting a different part of the hierarchical structure;
Depending on whether or not a predetermined keyword is included in a part corresponding to a different part of the analysis hierarchical structure extracted by the extraction unit , the acquired target page is after login or before login. Login determination means for determining whether or not
A login determination device. A login determination program using a computer capable of accessing a reference hierarchical structure recording unit in which a hierarchical structure of tags constituting a target page that is known to be after login or before login is recorded as a reference hierarchical structure, The login determination program includes target page acquisition means for acquiring a target page that is a target of determination by the computer,
A hierarchical structure analyzing means for analyzing the hierarchical structure of tags constituting the acquired target page and obtaining an analytical hierarchical structure;
Extracting means for comparing the analysis hierarchical structure with a reference hierarchical structure recorded in a reference hierarchical structure recording unit, and extracting a different part of the hierarchical structure;
Depending on whether or not a predetermined keyword is included in a part corresponding to a different part of the analysis hierarchical structure extracted by the extraction unit , the acquired target page is after login or before login. Login determination means for determining whether or not
Log-in determination program to make it function. In the login determination program according to claim 2,
The target page is described in HTML language,
The hierarchical structure analyzing means analyzes a hierarchical structure according to the nesting state of the HTML tag of the acquired target page. In the login determination program according to claim 2 or 3,
The hierarchical structure analyzing means analyzes the number of tags of each type included in each level of the HTML tag as a hierarchical structure,
The extraction means includes the number of tags of each type included in each hierarchy of tags constituting the target page recorded in the structure recording unit, and each tag constituting the target page analyzed by the hierarchical structure analysis means. A login determination program characterized by comparing the number of tags of each type included in a hierarchy and extracting a portion having a different number of corresponding tags as a portion having a different hierarchical structure. An extraction means for comparing the hierarchical structure of the tags constituting the first target page with the hierarchical structure of the tags constituting the second target page, and extracting a portion having a different hierarchical structure;
Based on the contents of portions corresponding to different portions of the hierarchical structure of the tags constituting the first target page or the second target page extracted by the extracting means , the first target page and the second target page Change content determining means for determining the change content of the page;
A page change detection device.

Images