JP6224022B2 - Security diagnostic apparatus, system, method and program - Google Patents

Description

  The present invention relates to a security diagnosis apparatus, system, method, and program, and more particularly, to a security diagnosis of a Web application.

  In recent Web application development, after an application is corrected, a regression test (regression test, acceptance test) is performed in order to confirm that no defect or degration due to the correction has occurred. Once a script has been written, it can be used as many times as possible, so the development process that performs regression testing after application modification has permeated.

  On the other hand, in order to confirm that the Web application operates safely, a security diagnostic test may be performed at the time of Web application development and modification such as addition of a function. Examples of the security diagnostic test include those disclosed in Patent Document 2 and Patent Document 3.

Japanese Patent No. 4619867 International Publication No. 2012/063493

  The security diagnostic test software can diagnose in auto mode and manual mode. In the auto mode, a Web screen to be diagnosed is automatically extracted using a Web crawler. Since the extraction result corresponds to “the number of link combinations existing on the screen”, the number of screens to be diagnosed is enormous, resulting in a time cost.

  In the manual mode, how the end user uses the Web application, login information, page transition information, and the like are manually input using the GUI and registered in the security diagnostic test software. Since an operation for manually inputting login information, page transition information, and the like using the GUI only for security diagnosis occurs, human costs are required.

  The present invention has been made in view of the above circumstances, and an object thereof is to execute a security diagnosis at a low cost.

  In order to achieve the above object, a security diagnostic apparatus of the present invention is a security diagnostic apparatus that communicates with a Web server, a communication unit that sends a request to a Web application provided by the Web server and obtains a response, and a regression test A storage unit for storing a script for security, data for security diagnosis, a regression test execution means for generating a request based on the regression test script and executing a regression test, and a page based on the regression test script And a security diagnostic test execution means for generating a request including abnormality information based on the security diagnostic data and executing a security diagnostic test.

  The security diagnosis system of the present invention includes a communication unit that sends a request to a Web application provided by a Web server and obtains a response, a regression test script, a storage unit that stores security diagnosis data, and the regression Generates a request based on the test script, and executes a regression test execution means for executing a regression test, and generates a request for page transition based on the regression test script, and anomalies based on the security diagnosis data. Security diagnostic test execution means for generating a request including information and executing a security diagnostic test.

  The security diagnosis method of the present invention generates a request based on a step of sending a request to a Web application provided by a Web server, a step of obtaining a response, and a regression test script stored in the storage unit, Based on the regression test execution step for executing the test and the regression test script, a page transition request is generated, and a request including abnormality information is generated based on the security diagnosis data stored in the storage unit. And a security diagnostic test execution step for executing a security diagnostic test.

  The security diagnosis program of the present invention includes a step of sending a request to a Web application provided by the Web server to a computer communicating with the Web server, a step of obtaining a response, and a regression test script stored in the storage unit A request is generated based on the regression test execution step for executing the regression test, and a request for page transition is generated based on the regression test script, and the security diagnosis data stored in the storage unit is used as a basis. And generating a request including abnormality information and executing a security diagnostic test execution step of executing a security diagnostic test.

  According to the present invention, security diagnosis can be executed at low cost.

It is a block diagram which shows the structural example of the 1st Embodiment of this invention. It is a conceptual diagram for demonstrating the regression test in the said embodiment. It is a figure (the 1) which shows the execution flow of the regression test and security diagnostic test in the said embodiment. It is FIG. (2) which shows the execution flow of the regression test and security diagnostic test in the said embodiment. It is a figure which shows the execution flow of the regression test and security diagnostic test in the 2nd Embodiment of this invention. It is a block diagram which shows the modification (the 1) of a structure of each said embodiment. It is a block diagram which shows the modification (the 2) of a structure of each said embodiment.

  BIGLOBE, JavaScript, Ruby, Cassperjs, google, etc. appearing in the following description of the embodiments are registered trademarks or trademarks.

<First Embodiment>
FIG. 1 shows a configuration example of this embodiment.
The illustrated security diagnostic apparatus 10 includes an output unit 11, an input unit 12, a storage unit 13, a control unit 14, and a communication unit 17. The communication unit 17 has a function of communicating with the diagnosis target Web server 21 via the network 20 using at least the HTTP protocol.

  The control unit 14 has a function of controlling each unit, and functions as a regression test execution unit 16 and a security diagnosis test execution unit 15. The communication unit 17 has a function of communicating with other devices via the network 20 and functions as an HTTP request transmission unit 19 and an HTTP response reception unit 18.

  The regression test execution means 16 reads the regression test script from the storage unit 13, generates an HTTP request according to the script, and provides it to the HTTP request transmission means 19.

  The regression test execution means 16 confirms whether the response from the diagnosis target Web server 21 to the HTTP request matches the response described in the regression test script, and provides the confirmation result to the output unit 11.

  The security diagnostic test execution means 15 reads a regression test script from the storage unit 13, extracts a page transition script from the script, generates an HTTP request, and provides it to the HTTP request transmission means 19.

  Further, the security diagnostic test execution means 15 confirms that the response from the Web server 21 to be diagnosed of the HTTP request of the page transition script matches the response described in the regression test script and is an input page to the form. In this case, the security diagnosis data stored in the storage unit 13 is read, an HTTP request for security diagnosis is generated, and provided to the HTTP request transmission means 19. Thereafter, the security diagnosis test execution means 15 confirms whether the response from the diagnosis target Web server 21 to the HTTP request for security diagnosis matches the response described in the security diagnosis data, and outputs the confirmation result to the output unit 11 is provided.

  The HTTP request transmission unit 19 transmits the HTTP request generated by the regression test execution unit 16 or the security diagnostic test execution unit 15 to the diagnosis target Web server 21 via the network 20.

  The HTTP response reception unit 18 provides the response received by the diagnosis target Web server 21 via the network 20 to the regression test execution unit 16 or the security diagnosis test execution unit 15.

<Regression test>
First, the regression test will be described. FIG. 2 shows an explanatory diagram of the regression test.
The regression test is roughly composed of the following three processes. First, a regression test script that is a program that operates as an HTTP client generates an HTTP request to the diagnosis target Web server 21 that is an HTTP server. Secondly, the diagnosis target Web server 21 returns an HTTP response thereto. Third, the regression test execution means 16 which is an HTTP client checks whether or not the HTTP response returned from the diagnosis target Web server 21 includes information on an expected test result.

  The regression test script is a script program written using a programming language such as JavaScript (registered trademark) or Ruby, and information on how the end user uses the Web application is embedded in the script. The following is an example of a regression test script when Cassperjs is used as the tool and JavaScript is used as the programming language.

casper.test.begin ('BIGLOBE search retrieves 10 or more results', 5, function suite (test) [
// (1)
casper.start ("http://www.biglobe.ne.jp/", function () [
test.assertExists ('form [action = "/ search"]', "main form is found");
this.fill ('form [action = "/ search"]', [q: "biglobe"], true);
]);
// (2)
casper.then (function () [
test.assertUrlMatch (/ q = biglobe /, "search term has been submitted");
test.assertEval (function () [
return __utils __. findAll ("h3.r"). length> = 10;
], "google search for \" biglobe \ "retrieves 10 or more results");]);
// (3)
casper.run (function () [
test.done ();
]);
]);

Specifically,
(1) Access http://www.biglobe.ne.jp/, confirm the existence of the form <form action = "/ search">, enter biglobe in the form and send it.
(2) Wait for the response, confirm that the URL is / q = biglobe /, and confirm that there are 10 or more <h3 class = "r"> tags.
(3) End the test.
The operations and responses that the server operates in response to the end user's operation on the terminal are shown. When the expected response is returned, the regression test displays OK, and when the expected response is not returned, NG is displayed while the portion not expected is displayed.

In (1) shown as an example of a regression test script
this.fill ('form [action = "/ search"]', [q: "biglobe"], true);
Corresponds to a process of generating an HTTP request.

In this regression test script, the HTML form to be tested is, for example, as follows.
<form method = "get" action = "/ search">
<input type = "text" name = "q">
<input type = "submit" value = "search">
</ form>

When the regression test script of the above example is executed, the regression test execution means 16 generates the following HTTP request and provides it to the HTTP request transmission means 19.
GET / search? Q = biglobe HTTP / 1.1
Host: www.biglobe.ne.jp
...

In the regression test script, as in the above example, not only the script to be entered in the form, but also a page transition script for generating and sending an HTTP request for sending a URL etc. and confirming the page to be subjected to the regression test after the page transition Is included. In (1) shown as an example of a regression test script
casper.start ("http://www.biglobe.ne.jp/", function () [
test.assertExists ('form [action = "/ search"]', "main form is found");
Corresponds to a page transition script.
Further, the page transition script includes a script for generating and transmitting an HTTP request for transmitting an ID / password to an authentication form or the like, shifting to an authenticated page, and checking the authenticated page. The page transition script is for generating and transmitting an HTTP request with page transition.

  As described above, the regression test script includes transition information necessary when the subsequent HTTP request transmission unit 19 generates an HTTP request. The transition information includes a URL, a value input to the form, and the like. It may be a value, a file name, etc. sent by a selected radio button or check box. In some cases, the HTTP request includes a plurality of pieces of transition information. In the above-described regression test script, a plurality of pieces of transition information are included in the page transition script portion.

  Further, as in the above example, the regression test script also includes an expected value of information included in the HTTP response that is returned when the HTTP request is transmitted. Although the conditional expression is used in the above example, the specific mode of the expected value such as only the URL or only the character string is not limited to this.

  In addition, as in the above example, the regression test script includes information (information received in the form of a Web page, a cookie, etc.) included in the HTTP response that is actually returned after sending the HTTP request, and included in the script. The process includes outputting an error if there is a difference between the expected value and the expected value.

  Accordingly, the regression test is a process for confirming whether a normal response is received by inputting a normal parameter in a form and sending it, making a connection request to a normal link destination URL, and the like. Specific examples of information to be entered into the form include personal information such as addresses and telephone numbers, and free entry information such as comments, in addition to information relating to login such as search words, IDs, and passwords. Also, radio buttons and information entered by multiple selection can be included in the form.

<Security diagnostic test>
Next, a security diagnostic test performed using the regression test script of the present invention will be described. The security diagnostic test execution means 15 acquires a page transition script such as a URL to which an HTTP request is transmitted and form information from the regression test script, and uses the security diagnostic data to generate an HTTP request for the security diagnostic test. Is generated. Preferably, when the response from the Web server 21 to be diagnosed of the HTTP request of the page transition script matches the response described in the regression test script and is confirmed as an input page to the form, it is for the security diagnostic test. The HTTP request is generated. However, the security diagnostic test may be executed on a page that matches a predetermined condition other than the form input page.

  The HTTP request generated by the security diagnostic test execution means 15 includes HTTP request transition information (URL, value to be transmitted to the form, etc.) generated from the page transition script of the regression test script transmitted to the URL. including. Also, the HTTP request generated using the security diagnosis data includes abnormality information. The abnormality information is an abnormality parameter intended to attack the diagnosis target Web server 21 or the Web application.

  Here, “attack” is an act of searching for a web application security flaw. If the attack is successful, an operation unintended by the developer is performed on the server or the Web application, and an illegal act such as obtaining information that is not originally disclosed may be possible. Even if the HTTP request generated by the security diagnostic test execution means 15 includes both transition information and abnormal information as in the case of transmitting abnormal parameters to the transmission destination acquired from the page transition script. Good. In addition to an attack using an HTTP request, an attack using a request such as an attack on 23 ports of TELNET or an attack on 53 ports of DNS may be used.

  Abnormal parameters include, for example, character strings that include control characters, data of an unusually long length that could cause a buffer overflow, and values that are not selectable with radio buttons (cannot be selected) A script that rewrites the content displayed on the screen, a script that displays the contents of the database on the screen, and a script that rewrites the contents of the database.

  Further, the security diagnostic test execution means 15 may generate an HTTP request for requesting connection to a URL different from the URL (link destination URL) of the transition information. The security diagnostic test execution means 15 outputs an alert when this HTTP request is successful.

  As described above, in the security diagnostic test of the present invention, the transition to the form input page is performed using the page transition script, and the default abnormal parameter is input and transmitted to the form, or the abnormal URL different from the link destination URL. This is a process to check the expected response by performing a test such as sending a connection request to.

<Execution to entire Web application>
Next, a configuration and a processing flow for causing the entire Web application to execute the regression test and the security diagnostic test of the present embodiment will be described. The web application is, for example, a site that enables online shopping, a so-called web mail that provides an interface for reading electronic mail with a browser, and the like. A web application provides a user with a plurality of web pages, and the web pages provided may differ depending on conditions. Therefore, there may be a plurality of Web pages and transmission destination URLs that are timings for sending an HTTP request accompanying a security diagnostic test to a Web application. In the present embodiment, as shown in the following flow, since the Web page and URL transition information that is the timing of sending the HTTP request is acquired from the regression test script, it is possible to execute the security diagnosis test on each Web page of the Web application. it can.

  3 and 4 show the flow of processing for causing the entire Web application to execute the regression test and security diagnostic test of this embodiment.

  S101. In the security diagnostic device 10, the control unit 14 sends a regression test from the diagnostician to the input unit 12 (from a keyboard or mouse connected to the security diagnostic device 10 or a diagnostician terminal connected via the network 20). When the script is input, the regression test script is stored in the storage unit 13.

  S102. The regression test execution means 16 reads a regression test script from the storage unit 13 when a regression test execution command is input to the input unit 12 from a diagnostician or a timer (not shown).

  S103. The regression test execution unit 16 generates an HTTP request based on each script included in the regression test script, and provides the generated HTTP request to the HTTP request transmission unit 19.

  S104. The HTTP request transmission unit 19 transmits the HTTP request generated by the regression test execution unit 16 to the diagnosis target Web server 21 via the network 20.

  S105. Thereafter, the HTTP response receiving unit 18 provides the response received from the diagnosis target Web server 21 via the network 20 to the regression test executing unit 16.

  S106. The regression test execution means 16 confirms whether the response from the diagnosis target web server 21 to the HTTP request matches the response described in the regression test script, and provides the confirmation result to the output unit 11. The confirmation result indicates that each “confirmation” in the script is “normal” if “match” (including “exists”), and “abnormal” if it does not match (including “does not exist”). Is output in association with the page address and the request.

  S107. The output unit 11 displays the confirmation result on a screen (a monitor connected to the security diagnostic device 10 or a monitor of a diagnostician terminal connected via the network 20).

  S108. The regression test execution means 16 returns to S103 and repeats until all the scripts included in the regression test script are processed. When all scripts have been processed, exit.

  S109. The security diagnostic test execution means 15 reads a regression test script from the storage unit 13 when a security diagnostic test execution instruction is input to the input unit 12 from a diagnostician or a timer (not shown). Extract page transition script from.

  S110. The security diagnostic test execution means 15 generates an HTTP request from each script of the extracted page transition script and provides it to the HTTP request transmission means 19.

  S111. The HTTP request transmission unit 19 transmits the HTTP request generated by the security diagnostic test execution unit 15 to the diagnosis target Web server 21 via the network.

  S112. Thereafter, the HTTP response receiving unit 18 provides the response received from the diagnosis target Web server 21 via the network 20 to the security diagnostic test executing unit 15.

  S113. When the response from the diagnosis target Web server 21 of the HTTP request of the page transition script matches the response described in the regression test script and is confirmed to be an input page to the form, the security diagnostic test execution means 15 The security diagnosis data stored in the storage unit 13 is read, an HTTP request for security diagnosis is generated, and provided to the HTTP request transmission means 19.

  S114. The HTTP request transmission unit 19 transmits the HTTP request generated by the security diagnostic test execution unit 15 to the diagnosis target Web server 21 via the network 20.

  S115. Thereafter, the HTTP response receiving unit 18 provides the response received from the diagnosis target Web server 21 via the network 20 to the security diagnostic test executing unit 15.

  S116. The security diagnosis test execution means 15 confirms whether the response from the diagnosis target Web server 21 to the HTTP request for security diagnosis matches the response described in the security diagnosis data, and sends the confirmation result to the output unit 11. provide. In the confirmation result, for each “confirmation” in the data for security diagnosis, “match” (eg “entered value is incorrect” or error number etc.) “Normal” is output in association with the page address and the request, and “abnormal” is output in association with the request.

  S117. The output unit 11 displays the confirmation result on a screen (a monitor connected to the security diagnostic device 10 or a monitor of a diagnostician terminal connected via the network 20).

  S118. The security diagnostic test execution means 15 returns to S110 and repeats until all the page transition scripts extracted from the regression test script are processed. When all scripts have been processed, exit.

<Second Embodiment>
In the first embodiment, the security diagnostic test is executed after the regression test is completed. In the second embodiment, the security diagnostic test is performed every time the form input is confirmed on the page in the regression test. Run. Other configurations may be the same.

  The processing flow of this embodiment is shown in FIG.

  S201. In the security diagnostic device 10, the control unit 14 sends a script for regression test from the diagnostician to the input unit 12 (from a keyboard or mouse connected to the security diagnostic device 10 or a diagnostician terminal connected via the network). Is input, the regression test script is stored in the storage unit 13.

  S202. The regression test execution means 16 reads a regression test script from the storage unit 13 when a regression test execution command is input to the input unit 12 from a diagnostician or a timer (not shown).

  S203. The regression test execution unit 16 generates an HTTP request based on each script included in the regression test script, and provides the generated HTTP request to the HTTP request transmission unit 19.

  S204. The HTTP request transmission unit 19 transmits the HTTP request generated by the regression test execution unit 16 to the diagnosis target Web server 21 via the network 20.

  S205. Thereafter, the HTTP request receiving unit 18 provides the response received from the diagnosis target Web server 21 via the network 20 to the regression test executing unit 16.

  S206. The regression test execution means 16 confirms whether the response from the diagnosis target web server 21 to the HTTP request matches the response described in the regression test script, and provides the confirmation result to the output unit 11. The confirmation result indicates that each “confirmation” in the script is “normal” if “match” (including “exists”), and “abnormal” if it does not match (including “does not exist”). Is output in association with the page address and the request.

  S207. Further, when the response from the diagnosis target Web server 21 to the HTTP request is confirmed as the input page to the form at S205 or S206, the regression test execution means 16 sends the security diagnosis test execution means 15 to the security diagnosis test execution means 15. The execution instruction is output.

  S208. When the execution instruction of the security diagnostic test is input from the regression test executing means 16, the security diagnostic test executing means 15 reads the data for security diagnosis stored in the storage unit 13 and generates an HTTP request for security diagnosis. To the HTTP request transmission means 19.

  S209. The HTTP request transmission unit 19 transmits the HTTP request generated by the security diagnostic test execution unit 15 to the diagnosis target Web server 21 via the network 20.

  S210. Thereafter, the HTTP response receiving unit 18 provides the response received from the diagnosis target Web server 21 via the network 20 to the security diagnostic test executing unit 15.

  S211. The security diagnosis test execution means 15 confirms whether the response from the diagnosis target Web server 21 to the HTTP request for security diagnosis matches the response described in the security diagnosis data, and sends the confirmation result to the output unit 11. provide. In the confirmation result, for each “confirmation” in the data for quality diagnosis, “normal” is indicated if “match” (including “existing”), and “non-match” (including “not existing”). “Abnormal” is output in association with the page address and the request.

  S212. The output unit 11 displays the confirmation result on the screen (monitor connected to the security diagnostic apparatus 10 or monitor of the diagnostician terminal connected via the network) screen.

  S213. The regression test execution means 16 returns to S203 and repeats until all the scripts included in the regression test script are processed. When all scripts have been processed, exit. Here, for the page that executes both the regression test and the security diagnostic test, for example, as a result of executing the security diagnostic test on the input page to the form, the page transitions to another page other than the input page to the form. There is a case. In that case, after returning to the form input page, another security diagnostic test is executed, or if all security diagnostic tests are completed, a regression test is executed. Further, on the page that executes both the regression test and the security diagnostic test, the security diagnostic test may be executed after the regression test is executed. However, even in this case, if the regression test transits to another page, the security diagnostic test is executed after returning to the original page.

<Modification of the above embodiment>
6 and 7 show a configuration of a modified example of the above embodiment.
As shown in FIG. 6, the security diagnostic system 1 has a regression test apparatus 10a and a security diagnostic test apparatus 10b. Each apparatus includes an output unit 11, an input unit 12, a storage unit 13, a control unit 14, and a communication unit 17. The control unit 12 of the regression test apparatus 10a includes a regression text execution unit 16, and the control unit 14 of the security diagnosis test apparatus 10b includes a security diagnosis test execution unit 15. The same effect as the above embodiment can be obtained.

  In this configuration, when the security diagnostic test is executed after the regression test is completed as in the first embodiment, the regression test execution instruction is input to the regression test apparatus 10a, and the security diagnostic test apparatus 10b is A security diagnostic test execution instruction may be input, and each device may execute each test independently. In this case, not only the security diagnosis data but also the regression test script is stored in the storage unit 13 of the security diagnosis test apparatus 10b.

  Further, with this configuration, when a security diagnostic test is executed every time a predetermined condition such as form input is confirmed on a page in a regression test as in the second embodiment, an API provided by the security diagnostic test apparatus 10b is provided. (Application Program Interface), when the regression test apparatus 10a confirms a predetermined condition such as form input on the page, it issues an execution command to the security diagnosis test apparatus 10b via the network 20, and the security diagnosis test apparatus The diagnostic result of the security diagnostic test may be received from 10b.

  Further, as shown in FIG. 7, a storage device 22 having a storage unit 13 to which the regression test device 10 a and the security diagnosis test device 10 b of the security diagnosis system 1 of the modified example (FIG. 6) are connected via a network 20 is provided. You may comprise so that it may become the system provided. In this case, since the regression test apparatus 10a and the security diagnosis test apparatus 10b share the storage device 22 having the storage unit 13, the storage unit 13 that each device has can be omitted. In the case of this configuration, there is an effect that the regression test apparatus 10a and the security diagnostic test apparatus 10b can share the data of the regression test script.

DESCRIPTION OF SYMBOLS 10 Security diagnostic apparatus 11 Output part 12 Input part 13 Storage part 14 Control part 15 Security diagnostic test execution means 16 Regression test execution means 17 Communication part 18 HTTP response reception means 19 HTTP request transmission means 20 Network 21 Diagnosis target Web server 22 Storage apparatus

Claims (12)

A security diagnostic device that communicates with a Web server,
A communication unit that sends a request to a Web application provided by the Web server and obtains a response;
A storage unit for storing a regression test script and security diagnosis data;
A regression test execution means for generating a request based on the regression test script and executing the regression test;
Before based on xenon Kyuriti diagnostic data, and security diagnostic test execution means generates a request to perform a security diagnostic tests involving abnormal information,
I have a,
The security diagnostic test execution means extracts a script for transitioning a page from the regression test script, generates a request for transitioning the page, and executes the security diagnostic test on the transitioned page. Diagnostic device. Said security diagnostic test execution means, the regression test execution means, after performing all the regression test based on the regression test script, a request to transition the page is transmitted from the communication unit, the transition of pages The security diagnostic apparatus according to claim 1, wherein a security diagnostic test is performed. A security diagnostic device that communicates with a Web server,
A communication unit that sends a request to a Web application provided by the Web server and obtains a response;
A storage unit for storing a regression test script and security diagnosis data;
A regression test execution means for generating a request based on the regression test script and executing the regression test;
Security diagnostic test execution means for generating a request including abnormality information based on the security diagnostic data and executing a security diagnostic test;
Have
The security diagnostic test execution means executes the security diagnostic test on a page transitioned by a request generated by the regression test execution means based on a script for transitioning a page included in the regression test script. A security diagnostic device. Said security diagnostic test execution means, whenever said regression test execution means performs one regression test based on the regression test scripts, using the security diagnostic data, have rows of security diagnostic tests, in which, in regression testing, when a transition to another page, and wherein the intends row security diagnostic test after returning to the original page, security diagnostic apparatus according to claim 3. The regression test script includes a page transition script including transition information for generating a request for transitioning a page, and an expected value of a response returned by the web application in response to the request. The security diagnostic apparatus of any one of Claim 1 to 4 . The regression test execution means outputs a regression test error when there is a difference between an expected response value returned by the Web application in response to a request and a response actually returned. The security diagnostic apparatus according to any one of claims 1 to 5 . It said security diagnostic test execution means, the response obtained by sending a request based on scripts that before the transition to Kipe over di to the Web server, match the response described in the regression test script and form The security diagnostic apparatus according to any one of claims 1 to 6 , wherein a security diagnostic test is executed when a page has an input. A communication unit that sends a request to a Web application provided by the Web server and obtains a response;
A storage unit for storing a regression test script and security diagnosis data;
A regression test execution means for generating a request based on the regression test script and executing the regression test;
Before based on xenon Kyuriti diagnostic data, and security diagnostic test execution means generates a request to perform a security diagnostic tests involving abnormal information,
I have a,
Said security diagnostic test execution means, said extracting a script that changes the page from the regression test script to generate a request to transition the page, it characterized that you perform the security diagnostic tests transition pages, Security diagnostic system. A communication unit that sends a request to a Web application provided by the Web server and obtains a response;
A storage unit for storing a regression test script and security diagnosis data;
A regression test execution means for generating a request based on the regression test script and executing the regression test;
Security diagnostic test execution means for generating a request including abnormality information based on the security diagnostic data and executing a security diagnostic test;
Have
The security diagnostic test execution means executes the security diagnostic test on a page transitioned by a request generated by the regression test execution means based on a script for transitioning a page included in the regression test script. A security diagnostic system. Regression test script stored in serial憶部generating a request based on, sends the request to the Web application provided by the Web server, a regression test execution step of executing the regression tests to obtain a response,
A page transition step of extracting a script for page transition from the script for regression test, generating a request for page transition, and sending the request to a web application provided by a web server;
A security diagnostic test execution step for generating a request including abnormality information based on the security diagnostic data stored in the storage unit and executing a security diagnostic test on the transitioned page;
A security diagnostic method. A regression test execution step of generating a request based on the regression test script stored in the storage unit, sending the request to a web application provided by the web server, and executing a regression test to obtain a response;
Based on the security diagnosis data stored in the storage unit, a request including abnormality information is generated, and the request generated based on a script that transitions a page included in the regression test script in the regression test execution step. A security diagnostic test execution step for executing a security diagnostic test on the page transitioned by
A security diagnostic method. On the computer that communicates with the Web server,
A security diagnosis program for executing the steps according to claim 10 or 11 .

Images