WO2018188470A1 - 一种上传接口识别方法、识别服务器及系统及存储介质 - Google Patents

一种上传接口识别方法、识别服务器及系统及存储介质 Download PDF

Info

Publication number
WO2018188470A1
WO2018188470A1 PCT/CN2018/080269 CN2018080269W WO2018188470A1 WO 2018188470 A1 WO2018188470 A1 WO 2018188470A1 CN 2018080269 W CN2018080269 W CN 2018080269W WO 2018188470 A1 WO2018188470 A1 WO 2018188470A1
Authority
WO
WIPO (PCT)
Prior art keywords
request packet
upload
interface
content
server
Prior art date
Application number
PCT/CN2018/080269
Other languages
English (en)
French (fr)
Inventor
郑兴
胡珀
郭晶
张强
范宇河
王放
杨勇
唐文韬
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018188470A1 publication Critical patent/WO2018188470A1/zh
Priority to US16/443,433 priority Critical patent/US10972496B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of data processing technologies, and in particular, to an upload interface identification method, an identification server, a system, and a storage medium.
  • File upload vulnerability refers to the hacker uploading dangerous files to the directory accessed through the website or web program through the upload interface. These dangerous files can execute scripts on the remote server to achieve the purpose of controlling the server; it can be seen that the file uploading vulnerability seriously threatens the website and the web. The use of the program is secure, so it is necessary to identify the file upload vulnerability that exists on the page.
  • the embodiment of the present application provides an upload interface identification method, a recognition server, a system, and a storage medium, so as to reduce the probability of missed detection of the upload interface and improve the comprehensiveness of the upload interface identification.
  • a method for identifying an upload interface which includes:
  • the content feature is related to the content feature set by the upload request packet, determining that the to-be-recognized request packet is an upload request packet, and determining an interface address indicated by the upload request packet as corresponding to the upload interface.
  • an identification server including:
  • the to-be-recognized request packet obtaining module is configured to obtain a to-be-recognized request packet, where the to-be-identified request packet is included in a request packet sent by the page client to the page server;
  • a content feature parsing module configured to parse the content feature of the to-be-identified request packet
  • the upload request packet determining module is configured to determine whether the content feature corresponds to a content feature set by the upload request packet
  • the uploading interface identification determining module is configured to: if the content feature is corresponding to the content feature set by the upload request packet, determine that the to-be-recognized request packet is an upload request packet, and determine an interface address indicated by the upload request packet as an uploading The interface corresponds.
  • an upload interface identification system including:
  • Requesting a collection server configured to collect a request packet sent by the page client to the page server
  • Identifying a server configured to obtain a to-be-recognized request packet from the request packet collected by the request collection server; parse the content feature of the to-be-identified request packet; and determine whether the content feature corresponds to a content feature set by the upload request packet If the content feature is corresponding to the content feature set by the upload request packet, determining that the to-be-recognized request packet is an upload request packet, and determining an interface address indicated by the upload request packet as corresponding to the upload interface.
  • a storage medium is further provided, and the storage medium may store an execution instruction, where the execution instruction is set to execute the upload interface identification method in the foregoing embodiment.
  • an electronic device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor performs the uploading by using a computer program Interface identification method.
  • the identification server may obtain the to-be-identified request packet, where the to-be-identified request packet is included in the request packet sent by the page client to the page server, so that the identification server may Parsing the content feature of the to-be-identified request packet, determining whether the content feature corresponds to a content feature set by the upload request packet, and if the content feature corresponds to a content feature set by the upload request packet, the identification server may determine Determining that the identification request packet is an upload request packet, and determining an interface address indicated by the upload request packet as corresponding to the upload interface, and implementing the identification of the upload interface;
  • the upload request packet must carry the agreed content feature, so the content feature and the upload request package are determined by analyzing the content feature of the request packet sent to the page server.
  • the corresponding request packet of the content feature can be used to identify the request packet of the valid upload request, and the interface address indicated by the identified request packet is determined to correspond to the upload interface, and the upload interface can be identified;
  • the request necessarily carries the agreed content feature. Therefore, the content request is used to identify the upload request packet, and the upload interface is determined by the interface address indicated by the identified upload request packet, so that a more comprehensive upload request packet can be identified and recognized. The comprehensiveness of the upload interface will also be improved accordingly, reducing the probability of missed detection.
  • FIG. 1 is a schematic structural diagram of an upload interface identification system according to an embodiment of the present application
  • FIG. 3 is a flowchart of a method for identifying an upload interface according to an embodiment of the present application
  • FIG. 5 is a flowchart of a method for identifying an upload vulnerability according to an embodiment of the present application
  • FIG. 6 is a flowchart of another method for identifying an upload vulnerability according to an embodiment of the present application.
  • FIG. 7 is another schematic structural diagram of an upload interface identification system according to an embodiment of the present application.
  • FIG. 8 is another signaling flowchart of an upload interface identification method according to an embodiment of the present application.
  • FIG. 9 is a structural block diagram of an identification server according to an embodiment of the present application.
  • FIG. 10 is another structural block diagram of an identification server according to an embodiment of the present application.
  • FIG. 11 is a block diagram of still another structure of an identification server according to an embodiment of the present application.
  • FIG. 12 is a structural block diagram of an electronic device according to an embodiment of the present application.
  • the embodiment of the present application considers collecting the request packet sent by the page client to the page server, performing content feature analysis on the collected request packet, and selecting the content from the content.
  • the request packet corresponding to the upload request packet, and the interface address indicated by the request packet is determined to correspond to the upload interface, so as to implement the identification of the upload interface;
  • the HTTP and other upload request packets must carry the agreed content features under the agreement of a network protocol such as HTTP (HyperText Transfer Protocol)
  • HTTP HyperText Transfer Protocol
  • the content characteristics are analyzed by requesting packets to the page server. Thereby, the identification of the upload interface in the page is realized, and the comprehensiveness of the upload interface identification can be improved.
  • FIG. 1 is a schematic structural diagram of an uploading interface identification system according to an embodiment of the present application.
  • the uploading interface identification system can implement the uploading interface identification method provided by the embodiment of the present application. Referring to FIG. 1, the uploading interface is identified.
  • the system may include: requesting the collection server 10, identifying the server 20; optionally, FIG. 1 also shows a page client 30, a page server that may not be present in the upload interface identification system, but may cooperate with the request collection server 10. 40 and switch 50;
  • the page client 30 can be regarded as a client having a function of loading a page (a website, a web program, etc.) such as a browser or a web client, and the page client 30 can be disposed on a user device such as a smart phone, a tablet computer, or a notebook computer. on;
  • the page server 40 is a service device for providing a page service set on the network side, such as a website server, a web server, etc.; one way for the page client 30 to interact with the page server 40 is that the page client sends a page load request to the page server and uploads Requesting a request packet, the page server responds accordingly, and feeds back the page content and uploads feedback results to the page client;
  • the request collection server 10 may be a network device capable of collecting network layer traffic between the page client and the page server, including request incoming traffic between the page client and the page server (eg, four to seven layers of request incoming traffic); That is, the request collection server 10 may collect the request packets sent by the page client to the page server.
  • the request collection server 10 may implement an IDS (Intrusion Detection Systems) server. ;
  • the identification server 20 is a service device for implementing the upload interface identification in the page set by the embodiment of the present application, and the identification server 20 may be implemented by a single server or a server group composed of multiple servers;
  • the identification server 20 may acquire the request packet collected by the request collection server 10, perform content feature analysis on the request packet, and identify the request packet corresponding to the content request and the upload request packet from the collected request packet, thereby The interface address indicated by the identified upload request packet is determined to correspond to the upload interface, and the identification of the upload interface is implemented.
  • FIG. 2 is a signaling flowchart of the upload interface identification method provided by the embodiment of the present application. Referring to FIG. 2, The process can include:
  • Step S10 The IDS server collects a request packet sent by the page client to the page server.
  • the IDS server can be considered as an optional implementation form of the request collection server; the IDS server can monitor the interaction process between the page client and the page server, and collect the request packet sent to the page server from the monitored content, that is, the collection page.
  • the request packet corresponding to the entry of the server (the request packet corresponding to the entry of the page server may be regarded as the inflow of the page server);
  • the request packet sent to the page server may be: a page load request packet for requesting loading of the page content, an upload request packet for uploading the file, and the like.
  • Step S11 The identification server acquires the request packet collected by the IDS server, filters the request packet, and obtains an HTTP request packet to be identified.
  • the HTTP request packet is only an optional form of the request packet sent to the page server when the HTTP protocol is used; when other network protocols are used, the form of the request packet may be adjusted accordingly, where only the HTTP request packet is used.
  • the IDS server may upload the collected request packet to the identification server periodically (the scheduled time may be agreed in advance) or according to the upload instruction (the upload instruction may be input by the staff member); optionally, the process of uploading the request packet to the identification server once at the IDS server
  • the IDS server may upload the request packet collected during the last upload to the current upload;
  • the identification server may perform filtering processing on the request packet obtained from the IDS server to obtain the HTTP request packet to be identified;
  • Filtering can include, but is not limited to, de-duplicating the request packet (for example, the same cgi (common gateway interface) can be deduplicated with the same parameter but different value, down to the same request packet), and does not conform to HTTP.
  • the request packet of the protocol is removed.
  • filtering the request packet collected by the IDS server is not necessary.
  • the embodiment of the present application may directly use the request packet collected by the IDS server as the HTTP request packet to be identified.
  • Step S12 The identification server parses the header field and the package body field of the HTTP request packet to be identified.
  • the number of the HTTP request packets to be identified may be at least one.
  • the embodiment of the present application may use the HTTP protocol to parse the HTTP request packet to be identified, and obtain each to be identified.
  • Step S13 The identification server determines whether the start content of the package body field of the to-be-identified HTTP request packet corresponds to the set first content, and whether the end content corresponds to the set second content.
  • the identification server may randomly select or sequentially select the HTTP request packet to be identified according to the collection order corresponding to the HTTP request packet to be identified, and perform the processing as shown in step S13 on each selected HTTP request packet to be identified. Until all the HTTP request packets to be identified are processed;
  • the first content that is set may be a starting content that is followed in the body of the HTTP upload request packet according to the HTTP protocol, and the second content that is set may be in accordance with the HTTP protocol, and the HTTP upload request packet is in the package body.
  • an HTTP upload request packet generally has an upload keyword such as multipart (multi-region demarcation transmission) or form-data (form data);
  • the multipart in the body of the HTTP upload request packet starts with “ ⁇ r ⁇ n”+"--"+boundary content.
  • the package of the HTTP upload request packet ends, use “ ⁇ r ⁇ n"+"--"+boundary+”--”The content ends; therefore, if the start content of the body field of the HTTP request packet is to be recognized, start with “ ⁇ r ⁇ n"+"--"+boundary content And at the end of the package, using " ⁇ r ⁇ n" + "--"+boundary+”--” content ends, it is considered that the HTTP request packet to be identified is an HTTP upload request packet;
  • first content and the second content description described above by taking the multipart keyword as an example are only schematic, and the forms of the first content and the second content may be adjusted accordingly according to different upload keywords used. It can be determined by the actual HTTP protocol usage.
  • Step S14 If the start content of the package body field of the HTTP request packet to be identified corresponds to the set first content, the end content corresponds to the set second content, and the identification server determines that the HTTP request packet to be identified is
  • the HTTP upload request packet determines the interface address indicated by the packet header field of the HTTP upload request packet as corresponding to the upload interface.
  • the HTTP request packet to be identified is an HTTP upload request packet.
  • the uploading interface address of the HTTP upload request packet is generally carried in the header field of the HTTP upload request packet.
  • the corresponding interface address can be determined from the header field of the HTTP upload request packet, and the interface address is determined as The upload interface corresponds to the identification of the upload interface.
  • the interface address corresponding to the HTTP upload request packet may not be carried in the header field, and the interface address of the upload interface is only an optional form in the header field.
  • step S12 to step S14 is based on an HTTP request packet to be identified.
  • the identification server acquires the HTTP request packet to be identified, parses the content feature of the HTTP request packet to be identified, and determines whether the parsed content feature corresponds to the content feature corresponding to the HTTP upload request packet.
  • Step S14 is to determine that the content of the HTTP request packet to be identified corresponds to the content feature corresponding to the HTTP upload request packet, and the HTTP request packet to be identified is determined as an HTTP upload request packet, and the interface indicated by the HTTP upload request packet is determined.
  • the address is determined to be a specific implementation corresponding to the upload interface.
  • the method for identifying the upload interface provided by the embodiment of the present application is as shown in FIG. 3, and the content of the method shown in FIG. 3 is a core process for identifying the server to implement the upload interface identification. Based on the core process, specific implementation details can be cross-referenced with the above;
  • the method may include:
  • Step S100 The identification server acquires an HTTP request packet to be identified, and the to-be-identified HTTP request packet is included in a request packet of the HTTP protocol sent by the page client to the page server.
  • the method for the identifier server to obtain the HTTP request packet to be identified may be: obtaining a request packet sent by the page client collected by the IDS server to the page server, filtering the obtained request packet, and sending the page client to the page client a non-repeating request packet of the page server and using the HTTP protocol;
  • the identification server may also directly send the request packet sent by the IDS server to the page server as the HTTP request packet to be identified.
  • the HTTP request packet to be identified is only an optional form of the request packet to be identified when the HTTP protocol is used, and the to-be-recognized request packet may be included in a request packet sent by the page client to the page server.
  • Step S110 The identification server parses the content feature of the HTTP request packet to be identified.
  • the identification server may parse the header field and the package body field of the HTTP request packet to be identified, and the content feature referred to herein is not limited to correspond to the content of the parsed package field.
  • Step S120 The identification server determines whether the content feature corresponds to a content feature set by the HTTP upload request packet.
  • the identification server may determine whether the start content of the package body field of the to-be-identified HTTP request packet corresponds to the set first content, and whether the end content corresponds to the set second content, and the set content is
  • the first content may be a starting content that the HTTP upload request packet follows in the body field according to the HTTP protocol
  • the second content that is set may be an ending content that the HTTP upload request packet follows in the body field according to the HTTP protocol;
  • the embodiment of the present application may further implement the content feature setting of the HTTP upload request packet by using other methods.
  • a specific identification character is set in the header content of the HTTP upload request packet, and the identification character can be used to indicate an HTTP upload request packet.
  • the HTTP upload request packet is only an optional form of the upload request packet that is referred to in the embodiment of the present application.
  • the format of the upload request packet may be adjusted accordingly.
  • Step S130 If the content feature is corresponding to the content feature set by the HTTP upload request packet, the to-be-identified server determines that the HTTP request packet to be identified is an HTTP upload request packet.
  • Step S140 The identification server determines the interface address indicated by the HTTP upload request packet as corresponding to the upload interface.
  • the indicated interface address may be extracted from the header field of the HTTP request packet to be identified, and the interface address is determined. Corresponds to the upload interface.
  • the identification server may obtain an HTTP request packet to be identified, and the to-be-identified HTTP request packet is included in a request packet of the HTTP protocol sent by the page client to the page server, thereby identifying the server. And parsing the content feature of the HTTP request packet to be identified, determining whether the content feature corresponds to a content feature set by the HTTP upload request packet, and identifying the content feature according to a content feature set by the HTTP upload request packet.
  • the server may determine that the to-be-identified HTTP request packet is an HTTP upload request packet, so that the interface address indicated by the HTTP upload request packet is determined to correspond to the upload interface, and the upload interface is identified;
  • the HTTP upload request packet must carry the agreed content feature, so the content feature and the HTTP upload request are determined by analyzing the content feature of the request packet sent to the page server.
  • the request packet corresponding to the content feature set by the package can realize the identification of the request packet for the effective upload request, and further determines the interface address indicated by the identified request packet as corresponding to the upload interface, and can realize the identification of the upload interface;
  • the uploading request will inevitably carry the agreed content feature. Therefore, the uploading request packet is identified by the content feature, and the uploading interface is determined by the interface address indicated by the identified uploading request packet, so that the comprehensive uploading request packet can be identified and identified. The comprehensiveness of the upload interface will also be improved accordingly, reducing the probability of missed detection.
  • the uploading of the request packet by the HTTP or the like necessarily carries the characteristics of the agreed content feature, and the uploading interface is identified, and the identified uploading interface is If the status is enabled, the HTTP upload request packet for the upload interface can be sent to the page server. Therefore, the upload interface identification method provided by the embodiment of the present application can also avoid the false alarm of the identified upload interface and improve the accuracy of the recognition result. Sex.
  • the method of crawling the page by the web crawler may also cause the high-frequency request to easily fill the system resources of the page server, causing the page service to hang, and the embodiment of the present application sends the page client through the collection.
  • the request packet of the page server is used as the source data to prevent the web crawler from crawling the page and causing high-frequency requests from the page server, thereby reducing the pressure on the page server.
  • an application example of the upload interface identification method provided by the embodiment of the present application is performed by taking a processing of a request packet (a request packet corresponding to the HTTP upload request) as an example.
  • the page client can upload the document file in the upload interface of the page, so that the page client can construct a request packet corresponding to the HTTP upload request and send it to the page server;
  • the IDS server collects the request packet sent by the page client to the page server, and uploads it to the identification server;
  • the identification server parses the package body field and the packet header field of the request packet; it should be noted that only the collection and processing of a single request packet are illustrated here. In actual applications, the number of request packets uploaded by the IDS server to the identification server is described. There may be multiple; optionally, the identification server may also select a means for filtering the request packets collected by the IDS server;
  • the recognition server determines that the package body field starts with “ ⁇ r ⁇ n”+"--"+boundary content, and when the package body ends, the content ends with “ ⁇ r ⁇ n"+"--"+boundary+”--" Determining that the request packet is an HTTP upload request packet;
  • the identification server determines the interface address carried in the packet header field of the request packet to correspond to the upload interface, and implements the identification of the upload interface.
  • the uploading vulnerability may be identified after the uploading interface is identified; specifically, after the uploading interface is identified by the method described above, the image may be The method shown is used to identify an upload vulnerability.
  • FIG. 5 is a flowchart of a method for identifying an upload vulnerability according to an embodiment of the present application.
  • the method can be applied to the identification server mentioned above (for example, setting a vulnerability identification in the identification server)
  • the program function may also be applied to a vulnerability identification server (the vulnerability identification server may be different from the identification server described above) in communication with the identification server referred to above;
  • the vulnerability identification method may include:
  • Step S200 Determine whether the HTTP upload request packet includes the set upload keyword, and whether the uploaded file name corresponding to the HTTP upload request packet includes a script file suffix.
  • the set upload keyword may be a multipart or a form-data, etc., as an HTTP upload request packet, which inevitably carries a file that needs to be uploaded, and the embodiment of the present application further needs to identify whether the file name of the file requested to be uploaded is Contains the script file suffix;
  • script file suffixes such as ASP, PHP, JSP, HTML, EXE, etc. can be suffixed by the script file uploaded by the web access directory; it should be noted that script files like ASP, PHP, and JSP can pass these files.
  • CGI interpreter you can execute any script on the page server.
  • WEBSHELL is uploaded, it is equivalent to having the permission of this page server, which causes the upload vulnerability to be exploited (the meaning of "web” is obviously the need for the server to open the web.
  • Service the meaning of "shell” is to gain some degree of operational authority on the server. Webshell is often referred to as the intruder's permission to operate the website server to some extent through the website port. Because webshell is mostly in the form of dynamic scripts. Appeared, and some people call it the back door of the website);
  • the HTTP upload request packet using the website vulnerability can be determined, so that the feedback result of the HTTP upload request packet can be determined by analyzing the page server. Whether there is an upload vulnerability in the upload interface corresponding to the HTTP upload request packet.
  • Step S210 If the HTTP upload request packet includes the set upload keyword, and the file name uploaded by the HTTP upload request packet includes a script file suffix, the uploading feedback of the HTTP upload request packet by the page server is retrieved. result.
  • Step S220 If the feedback result indicates that the upload is successful, it is determined that an upload vulnerability exists in the upload interface corresponding to the HTTP upload request packet.
  • the script file uploaded by the HTTP upload request packet is The page server receives, and the script file is likely to be executed on the page server, causing the page server's permissions to be illegally controlled; this does not strictly limit the file suffix and file type uploaded by the user, which will result in the upload of the HTTP upload request packet.
  • the upload interface corresponding to the HTTP upload request packet may be regarded as an upload interface corresponding to the interface address indicated by the HTTP upload request packet.
  • the HTTP upload request packet in the method shown in FIG. 5 is only an optional form of the upload request packet.
  • the embodiment of the present application may also filter the secure and trusted HTTP upload request packet from the identified HTTP upload request packet, thereby Uploading the request packet for uploading vulnerability identification, that is, the HTTP upload request packet processed in step S200 may be a dangerous untrusted HTTP upload request packet;
  • FIG. 6 shows another vulnerability identification method.
  • the vulnerability identification method may include:
  • Step S300 Determine whether the HOST field corresponding to the identified HTTP upload request packet is initiated by the set trusted HOST. If yes, go to step S310, if no, go to step S320.
  • Step S310 filtering the HTTP upload request packet.
  • the embodiment of the present application may determine whether the HOST field corresponding to the HTTP upload request packet is set. The trusted HOST is initiated. If yes, the HTTP upload request packet is secure and trusted, and the HTTP upload request packet can be filtered without uploading vulnerability identification. If not, the HTTP upload request packet may be dangerous. If it is not trusted, the HTTP upload request packet can be processed later.
  • Step S320 Determine whether the HTTP upload request packet includes the set upload keyword, and whether the uploaded file name corresponding to the HTTP upload request packet includes a script file suffix.
  • Step S330 If the HTTP upload request packet includes the set upload keyword, and the file name uploaded by the HTTP upload request packet includes a script file suffix, the uploading feedback of the HTTP upload request packet by the page server is retrieved. result.
  • Step S340 If the feedback result indicates that the upload is successful, it is determined that an upload vulnerability exists in the upload interface corresponding to the HTTP upload request packet.
  • the embodiment of the present application may be separately stored; for example, the first database may be configured to store the identified uploading interface, so as to upload the vulnerability detection, and the first The second database is used to store the identified upload interface with an upload vulnerability.
  • the embodiment of the present application may determine, according to the relationship between the uploading interface and the corresponding maintaining department and the responsible person, the responsible person corresponding to the uploading interface that has the uploading vulnerability and the maintenance department to which the user belongs. And analyze the problem caused by the vulnerability of the upload interface, and the corresponding solution; thus, the responsible person and the maintenance department corresponding to the uploading interface that has the uploading vulnerability, and the problem caused by the vulnerability of the uploading interface, and the corresponding solution
  • the system work order form is summarized and notified to the identified maintenance department and responsible person.
  • FIG. 7 provides another system architecture diagram, which can implement upload interface identification and identification of an upload interface with an upload vulnerability; as shown in FIG. 1 and FIG. 7, the system shown in FIG. It can also include:
  • the signaling interaction process of the system architecture shown in FIG. 7 may be as shown in FIG. 8.
  • the process may include:
  • Step S20 The IDS server collects a request packet sent by the page client to the page server.
  • Step S21 The identification server acquires the request packet collected by the IDS server, filters the request packet, and obtains an HTTP request packet to be identified.
  • Step S22 The identification server parses the header field and the package body field of the HTTP request packet to be identified.
  • Step S23 The identification server determines whether the start content of the package body field of the to-be-identified HTTP request packet corresponds to the set first content, and whether the end content corresponds to the set second content.
  • Step S24 If the start content of the package body field of the to-be-identified HTTP request packet corresponds to the set first content, the end content corresponds to the set second content, and the identification server determines that the to-be-identified HTTP request packet is The HTTP upload request packet determines the interface address indicated by the packet header field of the HTTP upload request packet as corresponding to the upload interface.
  • Step S25 The identification server records the determined upload interface to the first database.
  • Step S26 The identification server determines that the HOST field is not an HTTP upload request packet initiated by the set trusted HOST.
  • Step S27 The identification server determines whether the HOST field is not an HTTP upload request packet initiated by the set trusted HOST, whether the set upload keyword is included, and whether the uploaded file name corresponding to the HTTP upload request packet includes a script file suffix.
  • Step S28 If the HTTP upload request packet includes the set upload keyword, and the file name uploaded by the HTTP upload request packet includes a script file suffix, the recognition server retrieves the upload feedback of the HTTP server to the HTTP upload request packet. result.
  • Step S29 If the feedback result indicates that the upload is successful, the identification server determines that an upload vulnerability exists in the upload interface corresponding to the HTTP upload request packet.
  • Step S30 The identification server records the upload interface with the upload vulnerability to the second database.
  • Step S31 The work order issuing server outputs a system work order according to the upload interface recorded in the second database, where the system work order records the responsible person and the maintenance department corresponding to the upload interface with the upload vulnerability, and the upload interface has a vulnerability. The problem caused by the hazard, and the corresponding solution.
  • the functionality of the work order publishing server can also be integrated into the identification server.
  • the coverage discovery capability and accuracy of the HTTP upload request packet are greatly improved, and the comprehensiveness and accuracy of the upload interface are improved;
  • the following describes the identification server provided by the embodiment of the present application.
  • the content of the identification server described in the following description may be considered as a function module architecture required to identify the upload interface identification method provided by the server to implement the embodiment of the present application;
  • the content of the text method corresponds to each other.
  • FIG. 9 is a structural block diagram of an identification server according to an embodiment of the present disclosure.
  • the identification server may include:
  • the to-be-recognized request packet obtaining module 100 is configured to obtain a to-be-identified request packet, where the to-be-recognized request packet is included in a request packet sent by the page client to the page server;
  • the to-be-recognized request packet may be an HTTP request packet to be identified (that is, the request packet adopts an HTTP protocol form group package).
  • the content feature parsing module 200 is configured to parse the content feature of the to-be-identified request packet
  • the upload request packet determining module 300 is configured to determine whether the content feature corresponds to a content feature set by the upload request packet;
  • the upload request packet may be an HTTP upload request packet (that is, the upload request packet sent by the page client to the page server adopts an HTTP protocol form group package).
  • the uploading interface identification determining module 400 is configured to determine that the to-be-recognized request packet is an upload request packet, and determine an interface address indicated by the upload request packet, if the content feature is corresponding to the content feature set by the upload request packet.
  • the upload interface corresponds.
  • the content feature parsing module 200 is configured to parse the content feature of the to-be-identified request packet, and specifically includes:
  • the upload request packet determining module 300 is configured to determine whether the content feature corresponds to the content feature set by the upload request packet, and specifically includes:
  • the starting content that is followed, the second content set is the ending content that the upload request packet follows in the body field.
  • the content feature parsing module 200 is configured to parse the content feature of the to-be-identified request packet, and may further include:
  • Parsing the header field of the to-be-identified request packet that is, the content feature parsing module 200 may parse the packet body field and the packet header field of the to-be-identified request packet;
  • the uploading interface identification determining module 400 is configured to: if the content feature is corresponding to the content feature set by the uploading request packet, determining that the to-be-recognized requesting packet is an uploading request packet, specifically:
  • the start content of the package field corresponds to the set first content
  • the end content corresponds to the set second content
  • the uploading interface identification determining module 400 is configured to determine the interface address indicated by the uploading request packet to be corresponding to the uploading interface, and specifically includes:
  • the interface address indicated by the header field of the upload request packet is determined to correspond to the upload interface.
  • the to-be-recognized request packet may be a request packet that is filtered by the collected request packet sent by the page client to the page server; correspondingly, the to-be-identified request packet obtaining module 100 is configured to obtain the to-be-recognized request packet, specifically include:
  • the request packet to be identified is a non-repetitive and HTTP protocol request packet sent by the page client to the page server.
  • FIG. 10 shows another structure of the identification server provided by the embodiment of the present application.
  • the identification server may further include:
  • the upload vulnerability requesting module 500 is configured to determine whether the upload request packet includes a set upload keyword, and whether the uploaded file name corresponding to the upload request packet includes a script file suffix; if the upload request packet includes a setting And uploading a keyword, and the file name corresponding to the uploaded request packet includes a script file suffix, and the uploading feedback result of the upload request packet is retrieved; if the feedback result indicates that the uploading is successful, determining the HTTP upload request There is an upload vulnerability in the upload interface corresponding to the package.
  • the identification server may further include:
  • the upload request packet filtering module 600 is configured to determine whether the HOST field corresponding to the upload request packet is initiated by the set trusted HOST, and if the HOST field corresponding to the upload request packet is not initiated by the set trusted HOST, the trigger is triggered.
  • the uploading vulnerability identification module 500 performs a step of determining whether the upload request packet includes a set upload keyword, and whether the uploaded file name corresponding to the upload request packet includes a script file suffix;
  • the upload request packet processed by the upload vulnerability identification module 500 may be an upload request packet that is not filtered by the set trusted HOST after being filtered by the upload request packet filtering module 600.
  • the upload request packet filtering module 600 may also not be selected in the identification server shown in FIG.
  • FIG. 11 shows another structure of the identification server provided by the embodiment of the present application.
  • the identification server may further include:
  • the database recording module 700 is configured to record the determined upload interface to the first database, and record the determined upload interface with the upload vulnerability to the second database;
  • the work order output module 800 is configured to output a system work order according to the upload interface recorded in the second database, where the system work order records the responsible person and the maintenance department corresponding to the upload interface with the upload vulnerability, and the upload interface has a vulnerability. The problem caused by the hazard, and the corresponding solution.
  • the work order output module 800 may also not be selected in the identification server shown in FIG.
  • the identification server provided by the embodiment of the present invention can reduce the probability of missed detection of the upload interface, improve the comprehensiveness of the upload interface identification, and further improve the accuracy of the upload interface identification; thereby providing the possibility of improving the comprehensiveness and accuracy of the upload vulnerability identification.
  • the embodiment of the present application further provides an uploading interface identification system, and the structure of the uploading interface identification system may include: requesting a collecting server and identifying a server;
  • the request collection server is configured to collect a request packet sent by the page client to the page server;
  • Identifying a server configured to obtain a to-be-recognized request packet from the request packet collected by the request collection server; parse the content feature of the to-be-identified request packet; and determine whether the content feature corresponds to a content feature set by the upload request packet If the content feature is corresponding to the content feature set by the upload request packet, determining that the to-be-recognized request packet is an upload request packet, and determining an interface address indicated by the upload request packet as corresponding to the upload interface.
  • the identification server may be further configured to determine whether the upload request packet includes the set upload keyword, and whether the uploaded file name corresponding to the upload request packet includes a script file suffix If the upload request packet includes the set upload keyword, and the file name uploaded by the upload request packet includes a script file suffix, the upload feedback result of the upload request packet is retrieved; if the feedback result indicates If the upload is successful, it is determined that an upload vulnerability exists in the upload interface corresponding to the HTTP upload request packet.
  • the upload interface system may include: a first database, a second database, and a work order release. server;
  • the first database is set to record the determined upload interface
  • a second database configured to record the determined upload interface with an upload vulnerability
  • the work order issuing server is configured to output a system work order according to the upload interface recorded in the second database, where the system work order records the responsible person and the maintenance department corresponding to the upload interface with the upload vulnerability, and the upload interface has a vulnerability.
  • an electronic device for implementing the above upload interface identification method is further provided.
  • FIG. 12 is a structural block diagram of an electronic device according to an embodiment of the invention.
  • the electronic device may include one or more (only one shown) processor 901, memory 903, and transmission device 905.
  • the server may further include an input and output device. 907.
  • the memory 903 can be used to store a computer program and a module, such as a program instruction/module corresponding to the upload interface identification method and device in the embodiment of the present invention, and the processor 901 is configured to run the software program stored in the memory 903 and The module, thereby performing various functional applications and data processing, implements the above-described upload interface identification method.
  • Memory 903 can include high speed random access memory, and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 903 can further include memory remotely located relative to processor 901, which can be connected to the terminal over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the transmission device 905 described above is for receiving or transmitting data via a network, and can also be used for data transmission between the processor and the memory. Specific examples of the above network may include a wired network and a wireless network.
  • the transmission device 905 includes a Network Interface Controller (NIC) that can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network.
  • the transmission device 905 is a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • the memory 903 is configured to store an application.
  • the processor 901 is configured to run a program, wherein the upload interface identification method of the present invention is executed when the program runs.
  • the processor 901 can call the application stored in the memory 903 through the transmission device 905 to perform the following steps:
  • the content feature is related to the content feature set by the upload request packet, determining that the to-be-recognized request packet is an upload request packet, and determining an interface address indicated by the upload request packet as corresponding to the upload interface.
  • the method for the processor 901 to obtain the HTTP request packet to be identified may be: obtaining a request packet sent by the page client collected by the IDS server to the page server, filtering the obtained request packet, and obtaining the page client sending a request packet that is non-repeating to the page server and adopts the HTTP protocol;
  • the processor 901 can also directly send the page client collected by the IDS server to the request packet of the page server, and use it as the HTTP request packet to be identified.
  • the HTTP request packet to be identified is only an optional form of the request packet to be identified when the HTTP protocol is used, and the to-be-recognized request packet may be included in a request packet sent by the page client to the page server.
  • the processor 901 may parse the packet header field and the packet body field of the to-be-identified HTTP request packet, where the content feature referred to is not limited to corresponding to the content of the parsed packet field.
  • the processor 901 may determine whether the start content of the package field of the to-be-identified HTTP request packet corresponds to the set first content, whether the end content corresponds to the set second content, and
  • the first content may be the initial content that the HTTP upload request packet follows in the body field according to the HTTP protocol
  • the second content that is set may be the end content that the HTTP upload request packet follows in the body field according to the HTTP protocol.
  • the embodiment of the present application may further implement the content feature setting of the HTTP upload request packet by using other methods.
  • a specific identification character is set in the header content of the HTTP upload request packet, and the identification character can be used to indicate an HTTP upload request packet.
  • the HTTP upload request packet is only an optional form of the upload request packet that is referred to in the embodiment of the present application.
  • the format of the upload request packet may be adjusted accordingly.
  • the indicated interface address may be extracted from the header field of the HTTP request packet to be identified, and the interface address is determined. Corresponds to the upload interface.
  • the processor 901 may obtain an HTTP request packet to be identified, where the HTTP request packet to be identified is included in a request packet of the HTTP protocol sent by the page client to the page server, so that the processor 901 may Parsing the content feature of the HTTP request packet to be identified, determining whether the content feature corresponds to a content feature set by the HTTP upload request packet, and if the content feature corresponds to a content feature set by the HTTP upload request packet, the processor The 901 may determine that the HTTP request packet to be identified is an HTTP upload request packet, so that the interface address indicated by the HTTP upload request packet is determined to correspond to the upload interface, and the upload interface is identified.
  • the HTTP upload request packet must carry the agreed content feature, so the content feature and the HTTP upload request are determined by analyzing the content feature of the request packet sent to the page server.
  • the request packet corresponding to the content feature set by the package can realize the identification of the request packet for the effective upload request, and further determines the interface address indicated by the identified request packet as corresponding to the upload interface, and can realize the identification of the upload interface;
  • the uploading request will inevitably carry the agreed content feature. Therefore, the uploading request packet is identified by the content feature, and the uploading interface is determined by the interface address indicated by the identified uploading request packet, so that the comprehensive uploading request packet can be identified and identified. The comprehensiveness of the upload interface will also be improved accordingly, reducing the probability of missed detection.
  • FIG. 12 is merely illustrative, and the electronic device can be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a palm computer, and a mobile Internet device (MID). Terminal equipment such as PAD.
  • FIG. 12 does not limit the structure of the above electronic device.
  • the electronic device may also include more or fewer components (such as a network interface, display device, etc.) than shown in FIG. 12, or have a different configuration than that shown in FIG.
  • Embodiments of the present invention also provide a storage medium.
  • the storage medium includes a stored program, wherein the upload interface identification method of the present invention is executed while the program is running.
  • a computer program is stored in the storage medium, wherein the computer program is configured to be used to execute an upload interface identification method at runtime.
  • the foregoing storage medium may be located on at least one of the plurality of network devices in the network shown in the foregoing embodiment.
  • the storage medium is arranged to store program code for performing the following steps:
  • the content feature is related to the content feature set by the upload request packet, determining that the to-be-recognized request packet is an upload request packet, and determining an interface address indicated by the upload request packet as corresponding to the upload interface.
  • the optional manner of obtaining the HTTP request packet to be identified may be: obtaining a request packet sent by the IDS server to the page server, and the obtained request packet Filtering is performed to obtain a non-repetitive and HTTP-based request packet sent by the page client to the page server.
  • the request packet sent by the page client collected by the IDS server to the page server may be directly used as the HTTP request packet to be identified.
  • the HTTP request packet to be identified is only an optional form of the request packet to be identified in the case of adopting the HTTP protocol, and the to-be-identified request packet may be included in the request packet sent by the page client to the page server.
  • the header field and the package body field of the HTTP request packet to be identified may be parsed, and the content feature referred to herein is not limited to correspond to the content of the parsed package field.
  • the storage medium is further configured to store program code for performing the following steps: determining whether a start content of the package body field of the to-be-identified HTTP request packet corresponds to the set first content, and ending the content
  • the set second content is corresponding, and the set first content may be the initial content that the HTTP upload request packet follows in the package body field according to the HTTP protocol, and the set second content may be according to the HTTP protocol, HTTP.
  • the embodiment of the present application may also adopt The other way is to implement the content feature setting of the HTTP upload request packet, such as setting a specific identifier character in the header content of the HTTP upload request packet, and the identifier character can be used to represent the HTTP upload request packet.
  • the HTTP upload request packet is only an optional form of the upload request packet that is referred to in the embodiment of the present application.
  • the format of the upload request packet may be adjusted accordingly.
  • the storage medium is further configured to store program code for performing the following steps: if the content feature of the HTTP request packet to be identified corresponds to the content feature set by the HTTP upload request packet, the HTTP request packet to be identified from the to-be-identified The indicated interface address is extracted from the header field, and the interface address is determined to correspond to the upload interface.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, and a magnetic
  • ROM read-only memory
  • RAM random access memory
  • mobile hard disk a magnetic
  • magnetic A variety of media that can store program code, such as a disc or a disc.
  • the steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented directly in hardware, a software module executed by a processor, or a combination of both.
  • the software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.
  • the request packet of the valid upload request may be identified.
  • the interface address indicated by the identified request packet is determined to correspond to the upload interface, and the upload interface can be identified. Since the upload request such as HTTP necessarily carries the agreed content feature, the content request is used to identify the upload request packet.
  • the uploading interface is determined by the interface address indicated by the identified upload request packet, which can realize the recognition of the more comprehensive upload request packet, and the comprehensiveness of the identified uploading interface will be correspondingly improved, thereby reducing the probability of missed detection.

Abstract

本申请实施例提供一种上传接口识别方法、识别服务器及系统，该方法包括：识别服务器获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；解析所述待识别请求包的内容特征；判断所述内容特征是否与上传请求包设定的内容特征相应；若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。本申请实施例可实现较为全面的上传请求包的识别，从而提升识别出的上传接口的全面性，减少漏检的概率。

Description

一种上传接口识别方法、识别服务器及系统及存储介质
本申请要求于2017年4月11日提交中国专利局、优先权号为201710233531.9、发明名称为“一种上传接口识别方法、识别服务器及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据处理技术领域，具体涉及一种上传接口识别方法、识别服务器及系统及存储介质。
背景技术
目前大部分页面(如网站、web程序等提供的页面)都支持文件上传功能，用户在使用文件上传功能时，可通过页面提供的上传接口上传用户头像、相册照片以及附件等文件；然而方便的文件上传功能极有可能成为黑客利用的入口点，从而出现文件上传漏洞(File Upload Attack)。
文件上传漏洞是指黑客通过上传接口，向通过网站、web程序访问的目录上传危险文件，这些危险文件可以在远程服务器上执行脚本，达到控制服务器的目的；可见，文件上传漏洞严重威胁网站、web程序的使用安全，因此识别页面所存在的文件上传漏洞极为必要。
为识别页面所存在的文件上传漏洞，需要先识别出页面中的上传接口，然后通过操作该上传接口识别出该上传接口是否对应有文件上传漏洞；因此页面中的上传接口识别，作为文件上传漏洞识别的前置步骤，其识别的全面性，对于后续文件上传漏洞识别的全面性而言至关重要。
现有的识别上传接口的方式主要是通过web爬虫技术爬取页面，然后判断爬取的页面中是否存在input type＝"file"(输入类型为文件)的标签，来判断页面中是否存在上传接口，即页面中若存在input type＝"file"的标签，则认为页面中存在上传接口，否则，认为页面中不存在上传接口。
然而，input type＝"file"仅是页面中上传接口的一种常见实现形式，通过判断页面中的input type＝"file"标签来实现上传接口识别的方式，可能会漏检以其他形式实现的上传接口，导致上传接口的漏检概率提升，使得上传接口识别的全面性较低。
发明内容
有鉴于此，本申请实施例提供一种上传接口识别方法、识别服务器及系统及存储介质，以降低上传接口的漏检概率，提升上传接口识别的全面性。
为实现上述目的，本申请实施例提供如下技术方案：
根据本发明的一个方面，提供了一种上传接口识别方法，其中，包括：
获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
解析所述待识别请求包的内容特征；
判断所述内容特征是否与上传请求包设定的内容特征相应；
若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
根据本发明的又一个方面，还提供了一种识别服务器，其中，包括：
待识别请求包获取模块，设置为获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
内容特征解析模块，设置为解析所述待识别请求包的内容特征；
上传请求包判断模块，设置为判断所述内容特征是否与上传请求包设定的内容特征相应；
上传接口识别确定模块，设置为若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
根据本发明的又一个方面，还提供了一种上传接口识别系统，其中， 包括：
请求收集服务器，设置为收集页面客户端发往页面服务器的请求包；
识别服务器，设置为从所述请求收集服务器所收集的请求包中获取待识别请求包；解析所述待识别请求包的内容特征；判断所述内容特征是否与上传请求包设定的内容特征相应；若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
根据本申请实施例的又一方面，还提供了一种存储介质，该存储介质可以存储有执行指令，该执行指令设置为执行上述实施例中的上传接口识别方法。
根据本申请实施例的又一方面，还提供了一种电子装置，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，上述处理器通过计算机程序执行上述上传接口识别方法。
基于上述技术方案，本申请实施例提供的上传接口识别方法中，识别服务器可获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中，从而识别服务器可解析所述待识别请求包的内容特征，判断所述内容特征是否与上传请求包设定的内容特征相应，若所述内容特征与上传请求包设定的内容特征相应，则识别服务器可确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应，实现上传接口的识别；
需要说明的是，在HTTP等网络协议的约定下，上传请求包中必须携带有约定的内容特征，因此通过对发往页面服务器的请求包进行内容特征的分析，确定内容特征与上传请求包设定的内容特征相应的请求包，可以实现有效上传请求的请求包的识别，进而将所识别的请求包指示的接口地址，确定为与上传接口对应，可以实现上传接口的识别；由于HTTP等上传请求必然会携带约定的内容特征，因此通过该内容特征实现上传请求包的识别，以所识别的上传请求包指示的接口地址确定上传接口，可实现较 为全面的上传请求包的识别，识别出的上传接口的全面性也将相应的提升，减少漏检的概率。
附图说明
为了更清楚地说明本申请实施例或相关技术中的技术方案，下面将对实施例或相关技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1为本申请实施例提供的上传接口识别系统的架构示意图；
图2为本申请实施例提供的上传接口识别方法的信令流程图；
图3为本申请实施例提供的上传接口识别方法的流程图；
图4为上传接口识别的示例图；
图5为本申请实施例提供的上传漏洞识别的方法流程图；
图6为本申请实施例提供的上传漏洞识别的另一方法流程图；
图7为本申请实施例提供的上传接口识别系统的另一架构示意图；
图8为本申请实施例提供的上传接口识别方法的另一信令流程图；
图9为本申请实施例提供的识别服务器的结构框图；
图10为本申请实施例提供的识别服务器的另一结构框图；
图11为本申请实施例提供的识别服务器的再一结构框图；
图12为本申请实施例提供的电子装置的结构框图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的 范围。
为降低上传接口的漏检概率，提升上传接口识别的全面性，本申请实施例考虑对页面客户端发往页面服务器的请求包进行收集，对收集的请求包进行内容特征分析，从中选取出内容特征与上传请求包相应的请求包，进而将该请求包指示的接口地址确定为与上传接口对应，实现上传接口的识别；
由于在HTTP(HyperText Transfer Protocol，超文本传输协议)等网络协议的约定下，HTTP等上传请求包中必须携带有约定的内容特征，因此通过对发往页面服务器的请求包进行内容特征的分析，从而实现页面中上传接口的识别，可以提升上传接口识别的全面性。
基于此思路，图1示出了本申请实施例提供的上传接口识别系统的架构示意图，通过该上传接口识别系统可实现本申请实施例提供的上传接口识别方法，参照图1，该上传接口识别系统可以包括：请求收集服务器10，识别服务器20；可选的，图1中还示出了可不存在于上传接口识别系统中，但可与请求收集服务器10相配合的页面客户端30，页面服务器40和交换机50；
其中，页面客户端30可以认为是浏览器、web客户端等具有加载页面(网站、web程序等页面)功能的客户端，页面客户端30可以设置于智能手机、平板电脑、笔记本电脑等用户设备上；
页面服务器40为网络侧设置的提供页面服务的服务设备，如网站服务器、web服务器等；页面客户端30与页面服务器40的一种交互方式是，页面客户端向页面服务器发送页面加载请求、上传请求等请求包，页面服务器作出相应响应，向页面客户端反馈页面内容、上传反馈结果等反馈；
请求收集服务器10可以是能够收集页面客户端与页面服务器之间的网络层流量的网络设备，包括页面客户端与页面服务器之间的请求入流量(如四层～七层的请求入流量)；即请求收集服务器10可以对页面客户端发往页面服务器的请求包进行收集；可选的，在一种可选实现中，请求收集服务器10可以选用IDS(Intrusion Detection Systems，入侵检测系统)服务 器实现；
识别服务器20为本申请实施例设置的用于实现页面中上传接口识别的服务设备，识别服务器20可以由单台服务器实现，也可以由多台服务器组成的服务器群组实现；
在本申请实施例中，识别服务器20可获取请求收集服务器10收集的请求包，对请求包进行内容特征分析，从收集的请求包中识别出内容特征与上传请求包相应的请求包，从而将所识别的上传请求包指示的接口地址确定为与上传接口对应，实现上传接口的识别。
以页面客户端与页面服务器采用HTTP协议交互为例，相应的请求包可以是HTTP请求包，图2示出了本申请实施例提供的上传接口识别方法的信令流程图，参照图2，该流程可以包括：
步骤S10、IDS服务器收集页面客户端发往页面服务器的请求包。
IDS服务器可以认为是请求收集服务器的一种可选实现形式；IDS服务器可对页面客户端与页面服务器的交互过程进行监控，从监控的内容中收集到发往页面服务器的请求包，即收集页面服务器的入口对应的请求包(页面服务器的入口对应的请求包，可以认为是页面服务器的入流量)；
可选的，发往页面服务器的请求包可能是：请求加载页面内容的页面加载请求包，上传文件的上传请求包等。
步骤S11、识别服务器获取IDS服务器收集的请求包，对请求包进行过滤，获取到待识别HTTP请求包。
可选的，HTTP请求包仅是采用HTTP协议时，发往页面服务器的请求包的一种可选形式；在使用其他网络协议时，请求包的形式可相应调整，此处仅以HTTP请求包进行举例说明；
IDS服务器可定期(定期时间可事先约定)或者依照上传指令(上传指令可由工作人员输入)将所收集的请求包上传给识别服务器；可选的，在IDS服务器向识别服务器一次上传请求包的过程中，IDS服务器可将上一次上传结束至本次上传期间收集的请求包进行上传；
由于IDS服务器收集的请求包中可能存在重复的，不符合HTTP协议要求的非法请求包(由于采用HTTP协议，因此上传请求应遵循HTTP协议要求，对于收集的请求包中不符合HTTP协议要求的需要进行去除)，因此识别服务器可对从IDS服务器获取的请求包进行过滤处理，获取到待识别HTTP请求包；
过滤可以包括但不限于：对请求包进行去重(如可将同一个cgi(通用网关接口)同一个参数但值不同的请求包进行去重，归结为同一个请求包)，并不符合HTTP协议的请求包进行去除。
可选地，对IDS服务器收集的请求包进行过滤并不是必要的，本申请实施例也可以直接将IDS服务器收集的请求包，作为待识别HTTP请求包使用。
步骤S12、识别服务器解析所述待识别HTTP请求包的包头字段和包体字段。
可选的，所获取的待识别HTTP请求包的数量可能是至少一个，对于每一个待识别HTTP请求包，本申请实施例可使用HTTP协议，将待识别HTTP请求包进行解析，得到各待识别HTTP请求包的http header(包头)字段，以及http body(包体)字段。
步骤S13、识别服务器判断所述待识别HTTP请求包的包体字段的起始内容是否与设定的第一内容相应，结束内容是否与设定的第二内容相应。
可选的，识别服务器可随机选取或者按序(如按照待识别HTTP请求包对应的收集顺序)选取待识别HTTP请求包，并对所选取的各待识别HTTP请求包进行如步骤S13所示处理，直至所有的待识别HTTP请求包均被处理；
可选的，设定的第一内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的起始内容，设定的第二内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的结束内容；
如依照HTTP协议，HTTP上传请求包中一般具有multipart(多区域分界传输)或form-data(表单数据)等上传关键词；
以具有multipart关键词为例，multipart在HTTP上传请求包的包体字段均使用"\r\n"+"--"+boundary内容开始，在HTTP上传请求包的包体结束时，使用"\r\n"+"--"+boundary+"--"内容结束；因此如果待识别HTTP请求包的包体字段的起始内容，使用"\r\n"+"--"+boundary内容开始，并在包体结束时，使用"\r\n"+"--"+boundary+"--"内容结束，则认为该待识别HTTP请求包为HTTP上传请求包；
显然，上述描述的以multipart关键词为例的第一内容和第二内容说明仅是示意性的，根据所使用的上传关键词的不同，第一内容和第二内容的形式也可以相应调整，具体可视实际的HTTP协议使用情况而定。
步骤S14、若所述待识别HTTP请求包的包体字段的起始内容与设定的第一内容相应，结束内容与设定的第二内容相应，识别服务器确定所述待识别HTTP请求包为HTTP上传请求包，将所述HTTP上传请求包的包头字段指示的接口地址确定为与上传接口对应。
可选的，若待识别HTTP请求包的包体字段的起始内容与设定的第一内容相应，结束内容与设定的第二内容相应，则该待识别HTTP请求包为HTTP上传请求包；而HTTP上传请求包的上传接口地址一般携带在HTTP上传请求包的包头字段，本申请实施例可从该HTTP上传请求包的包头字段中确定相应指示的接口地址，将该接口地址确定为与上传接口对应，实现上传接口的识别。
可选的，HTTP上传请求包所对应的接口地址也可能不一定携带在包头字段中，将上传接口的接口地址携带在包头字段中仅是一种可选形式。
值得注意的是，步骤S12至步骤S14的处理单位是以一个待识别HTTP请求包为基准。
需要说明的是，步骤S12和步骤S13是识别服务器在获取到待识别HTTP请求包，解析待识别HTTP请求包的内容特征，判断所解析的内容特征是否与HTTP上传请求包对应的内容特征相应的一种具体实现；
步骤S14可以认为是在确定待识别HTTP请求包的内容特征与HTTP上传请求包对应的内容特征相应后，将该待识别HTTP请求包确定为HTTP上 传请求包，将该HTTP上传请求包指示的接口地址确定为与上传接口对应的一种具体实现。
基于图2所示信令流程，站在识别服务器的角度，本申请实施例提供的上传接口识别方法可如图3所示，图3所示方法内容为识别服务器实现上传接口识别的核心流程，在该核心流程的基础上，具体实现细节可与上文内容相互参照；
如图3所示，该方法可以包括：
步骤S100、识别服务器获取待识别HTTP请求包，所述待识别HTTP请求包包含于页面客户端发往页面服务器的采用HTTP协议的请求包。
可选的，识别服务器获取待识别HTTP请求包的可选方式可以是：获取IDS服务器收集的页面客户端发往页面服务器的请求包，对所获取的请求包进行过滤，得到页面客户端发往页面服务器的非重复且采用HTTP协议的请求包；
可选的，识别服务器也可直接将IDS服务器收集的页面客户端发往页面服务器的请求包，作为待识别HTTP请求包使用。
可选的，待识别HTTP请求包仅是采用HTTP协议的情况下，待识别请求包的一种可选形式，该待识别请求包可包含于页面客户端发往页面服务器的请求包中。
步骤S110、识别服务器解析所述待识别HTTP请求包的内容特征。
可选的，识别服务器可以解析所述待识别HTTP请求包的包头字段和包体字段，此处所指的内容特征不限于与所解析的包体字段的内容相应。
步骤S120、识别服务器判断所述内容特征是否与HTTP上传请求包设定的内容特征相应。
可选的，识别服务器可判断所述待识别HTTP请求包的包体字段的起始内容是否与设定的第一内容相应，结束内容是否与设定的第二内容相应，且，设定的第一内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的起始内容，设定的第二内容可以是依照HTTP协议，HTTP上 传请求包在包体字段中遵循的结束内容；
可选的，除通过设定HTTP上传请求包的起始内容和结束内容，来设定HTTP上传请求包的内容特征外，本申请实施例还可采用其他方式实现HTTP上传请求包的内容特征设定，如在HTTP上传请求包的包头内容中设定特定的标识字符，该标识字符可以用于表示HTTP上传请求包。
可选的，HTTP上传请求包仅是本申请实施例所指的上传请求包的一种可选形式，在采用其他协议的情况下，上传请求包的形式可相应调整。
步骤S130、若所述内容特征与HTTP上传请求包设定的内容特征相应，所述待识别服务器确定所述待识别HTTP请求包为HTTP上传请求包。
步骤S140、识别服务器将所述HTTP上传请求包指示的接口地址确定为与上传接口对应。
可选的，若待识别HTTP请求包的内容特征与HTTP上传请求包设定的内容特征相应，则可从该待识别HTTP请求包的包头字段中提取所指示的接口地址，将该接口地址确定为与上传接口对应。
本申请实施例提供的上传接口识别方法中，识别服务器可获取待识别HTTP请求包，所述待识别HTTP请求包包含于页面客户端发往页面服务器的采用HTTP协议的请求包中，从而识别服务器可解析所述待识别HTTP请求包的内容特征，判断所述内容特征是否与HTTP上传请求包设定的内容特征相应，若所述内容特征与HTTP上传请求包设定的内容特征相应，则识别服务器可确定所述待识别HTTP请求包为HTTP上传请求包，从而将所述HTTP上传请求包指示的接口地址确定为与上传接口对应，实现上传接口的识别；
需要说明的是，在HTTP等网络协议的约定下，HTTP上传请求包中必须携带有约定的内容特征，因此通过对发往页面服务器的请求包进行内容特征的分析，确定内容特征与HTTP上传请求包设定的内容特征相应的请求包，可以实现有效上传请求的请求包的识别，进而将所识别的请求包指示的接口地址，确定为与上传接口对应，可以实现上传接口的识别；由于HTTP等上传请求必然会携带约定的内容特征，因此通过该内容特征实现 上传请求包的识别，以所识别的上传请求包指示的接口地址确定上传接口，可实现较为全面的上传请求包的识别，识别出的上传接口的全面性也将相应的提升，减少漏检的概率。
可选地，相关技术通过网络爬虫爬取页面，判断页面源代码中是否包含<input type＝"file">标签来识别上传接口的方式，还可能存在此类标签并不代表页面启用了上传功能的情况，导致所确定的上传接口误报的情况发生；而本申请实施例，通过HTTP等上传请求包必然会携带约定的内容特征的特性，识别上传接口，则可表明所识别的上传接口处于启用状态，才可使得针对该上传接口的HTTP上传请求包得以发送至页面服务器，因此本申请实施例提供的上传接口识别方法还可避免所识别的上传接口误报的情况，提高识别结果的准确性。
同时，现有通过网络爬虫抓取页面的方式，还会导致高频的请求容易将页面服务器的系统资源打满，造成页面业务挂掉的情况，而本申请实施例通过收集页面客户端发往页面服务器的请求包作为源数据，可避免网络爬虫抓取页面导致页面服务器存在高频的请求的情况，减轻页面服务器的压力。
可选的，以图4所示示例，为便于说明，以一条请求包(与HTTP上传请求对应的请求包)的处理为例，对本申请实施例提供的上传接口识别方法的一种应用示例进行说明：
页面客户端可在页面的上传接口中上传文档文件，从而页面客户端可构建出HTTP上传请求相应的请求包发送至页面服务器；
IDS服务器对页面客户端发送至页面服务器的请求包进行收集，并上传至识别服务器；
识别服务器解析该请求包的包体字段与包头字段；需要注意的是，此处仅以单条请求包的收集和处理进行示例说明，在实际应用中，IDS服务器上传至识别服务器的请求包的数量可能是多个；可选的，识别服务器还可选用对IDS服务器收集的请求包进行过滤处理的手段；
识别服务器判断包体字段使用"\r\n"+"--"+boundary内容开始，且包体 结束时，使用"\r\n"+"--"+boundary+"--"内容结束，确定该请求包为HTTP上传请求包；
识别服务器将该请求包的包头字段携带的接口地址确定为与上传接口对应，实现上传接口的识别。
在应用本申请实施例提供的上传接口识别方法的基础上，可以在识别出上传接口后，实现上传漏洞的识别；具体的，在以上述描述的方法内容识别出上传接口后，可通过图5所示方法实现上传漏洞的识别，图5示出了本申请实施例提供的上传漏洞识别的方法流程图，该方法可应用于上述所指的识别服务器(如在识别服务器中设置漏洞识别相应的程序功能)，也可以应用于与上述所指的识别服务器相通信的漏洞识别服务器(漏洞识别服务器可与上述所述的识别服务器对应不同的物理服务设备)中；
参照图5，该漏洞识别方法可以包括：
步骤S200、判断HTTP上传请求包是否包含设定的上传关键字，且所述HTTP上传请求包所对应上传的文件名称是否包含脚本文件后缀。
可选的，设定的上传关键字可以是multipart或form-data等，作为HTTP上传请求包，其必然携带有需要上传的文件，本申请实施例还需要识别所请求上传的文件的文件名称是否包含脚本文件后缀；
可选的，脚本文件后缀如ASP、PHP、JSP、HTML、EXE等可通过Web访问的目录上传的脚本文件的后缀；需要说明的是，类似ASP、PHP、JSP的脚本文件能够将这些文件传递给CGI解释器，就可以在页面服务器上执行任意脚本，例如上传了WEBSHELL，则就相当于拥有了这台页面服务器的权限，导致上传漏洞被利用(“web”的含义是显然需要服务器开放web服务，“shell”的含义是取得对服务器某种程度上操作权限。webshell常常被称为入侵者通过网站端口对网站服务器的某种程度上操作的权限。由于webshell其大多是以动态脚本的形式出现，也有人称之为网站的后门)；
因此通过分析上传文件的文件名称包含脚本文件后缀的HTTP上传请 求包，可以确定出利用网站漏洞的HTTP上传请求包，从而后续可通过分析页面服务器对该HTTP上传请求包的反馈结果，来判断该HTTP上传请求包对应的上传接口是否存在上传漏洞。
步骤S210、若所述HTTP上传请求包包含设定的上传关键字，且所述HTTP上传请求包所对应上传的文件名称包含脚本文件后缀，调取页面服务器对所述HTTP上传请求包的上传反馈结果。
步骤S220、若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
对于包含上传关键字，且上传的文件名称包含脚本文件后缀的HTTP上传请求包，如果页面服务器针对该HTTP上传请求包的反馈结果与上传成功对应，则说明该HTTP上传请求包上传的脚本文件被页面服务器所接收，而脚本文件很可能在页面服务器上执行，导致页面服务器的权限被非法控制；这种没有严格限制用户上传的文件后缀以及文件类型的情况，将导致HTTP上传请求包对应的上传接口存在上传漏洞；
可选的，HTTP上传请求包对应的上传接口，可以认为是，HTTP上传请求包指示的接口地址对应的上传接口。
可选的，图5所示方法中HTTP上传请求包仅是上传请求包的一种可选形式。
可选的，在根据识别的HTTP上传请求包进行上传漏洞识别前，本申请实施例还可从识别的HTTP上传请求包中过滤掉安全可信任的HTTP上传请求包，从而根据危险不可信的HTTP上传请求包进行上传漏洞识别，即步骤S200所处理的HTTP上传请求包可以是危险不可信的HTTP上传请求包；
相应的，图6示出了另一种漏洞识别方法，参照图6，该漏洞识别方法可以包括：
步骤S300、判断所识别的HTTP上传请求包对应的HOST字段，是否由设定的可信HOST发起，若是，执行步骤S310，若否，执行步骤S320。
步骤S310、过滤该HTTP上传请求包。
可选的，在通过图1或图2所示方法识别出HTTP上传请求包后，对于所识别的各HTTP上传请求包，本申请实施例可判断HTTP上传请求包对应的HOST字段，是否由设定的可信HOST发起，若是，则说明该HTTP上传请求包安全可信任，可对该HTTP上传请求包进行过滤，不用进行上传漏洞识别，若否，则说明该HTTP上传请求包有可能是危险不可信的，可对该HTTP上传请求包进行后续处理。
步骤S320、判断HTTP上传请求包是否包含设定的上传关键字，且所述HTTP上传请求包所对应上传的文件名称是否包含脚本文件后缀。
步骤S330、若所述HTTP上传请求包包含设定的上传关键字，且所述HTTP上传请求包所对应上传的文件名称包含脚本文件后缀，调取页面服务器对所述HTTP上传请求包的上传反馈结果。
步骤S340、若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
可选的，对于所识别的上传接口，以及存在上传漏洞的上传接口本申请实施例可分开存储；如可设置第一数据库用于存储所识别的上传接口，以便上传漏洞检测，同时可设置第二数据库用于存储所识别的存在上传漏洞的上传接口。
可选地，对于所识别的存在上传漏洞的上传接口，本申请实施例可根据上传接口与对应维护的部门和负责人的关系，确定存在上传漏洞的上传接口对应的负责人和所属维护部门，并分析上传接口存在漏洞所引起的问题危害，和对应解决方案；从而将存在上传漏洞的上传接口对应的负责人和所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案以系统工单形式汇总，通知给所确定的所属维护部门和负责人。
如图7所示，图7提供了另一种系统架构示意图，该系统架构可实现上传接口识别，以及存在上传漏洞的上传接口的识别；结合图1和图7所示，图7所示系统还可以包括：
第一数据库60，第二数据库70，工单发布服务器80；其中，识别服务 器20整合了上传接口识别，以及上传漏洞识别的功能。
可选的，图7所示系统架构的信令交互流程可以如图8所示，参照图8，该过程可以包括：
步骤S20、IDS服务器收集页面客户端发往页面服务器的请求包。
步骤S21、识别服务器获取IDS服务器收集的请求包，对请求包进行过滤，获取到待识别HTTP请求包。
步骤S22、识别服务器解析所述待识别HTTP请求包的包头字段和包体字段。
步骤S23、识别服务器判断所述待识别HTTP请求包的包体字段的起始内容是否与设定的第一内容相应，结束内容是否与设定的第二内容相应。
步骤S24、若所述待识别HTTP请求包的包体字段的起始内容与设定的第一内容相应，结束内容与设定的第二内容相应，识别服务器确定所述待识别HTTP请求包为HTTP上传请求包，将所述HTTP上传请求包的包头字段指示的接口地址确定为与上传接口对应。
步骤S25、识别服务器将所确定的上传接口记录到第一数据库。
步骤S26、识别服务器确定HOST字段不是由设定的可信HOST发起的HTTP上传请求包。
步骤S27、识别服务器判断HOST字段不是由设定的可信HOST发起的HTTP上传请求包，是否包含设定的上传关键字，且该HTTP上传请求包所对应上传的文件名称是否包含脚本文件后缀。
步骤S28、若该HTTP上传请求包包含设定的上传关键字，且所述HTTP上传请求包所对应上传的文件名称包含脚本文件后缀，识别服务器调取页面服务器对该HTTP上传请求包的上传反馈结果。
步骤S29、若所述反馈结果指示上传成功，识别服务器确定该HTTP上传请求包对应的上传接口存在上传漏洞。
步骤S30、识别服务器将存在上传漏洞的上传接口记录到第二数据库。
步骤S31、工单发布服务器根据第二数据库中记录的上传接口，输出系统工单，所述系统工单记录有存在上传漏洞的上传接口对应的负责人和 所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案。
可选的，工单发布服务器的功能也可整合在识别服务器中。
经过实践证明，本申请实施例在上传接口识别方面具有如下优点：
通过对发往页面服务器的请求包进行定位，大大提高了HTTP上传请求包的覆盖发现能力和准确性，提升了上传接口的识别全面性和准确性；
不依赖爬虫等容易使得页面系统遭受高频率扫描，导致web应用及系统挂掉的黑盒行为，避免了爬虫的性能不足与缺陷，大大降低了页面系统挂掉的风险；
由于是实时对发往页面服务器的请求包进行定位，因此避免了爬虫、人工等黑盒手段采集慢的问题，大大提高了上传接口的发现效率；并且可提升后续上传漏洞的识别效率；
可以非常灵活的定义基于HTTP包的规则策略，对接现有的系统非常方便，扩展到其他漏洞的发现也非常方便。
下面对本申请实施例提供的识别服务器进行介绍，下文描述的识别服务器内容可以认为是识别服务器为实现本申请实施例提供的上传接口识别方法，所需设置的功能模块架构；下文描述内容可与上文方法内容相互对应参照。
图9为本申请实施例提供的识别服务器的结构框图，参照图9，该识别服务器可以包括：
待识别请求包获取模块100，设置为获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
可选的，待识别请求包可以是待识别HTTP请求包(即请求包采用HTTP协议形式组包)。
内容特征解析模块200，设置为解析所述待识别请求包的内容特征；
上传请求包判断模块300，设置为判断所述内容特征是否与上传请求包设定的内容特征相应；
可选的，上传请求包可以是HTTP上传请求包(即页面客户端发往页面服务器的上传请求包采用HTTP协议形式组包)。
上传接口识别确定模块400，设置为若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
可选的，内容特征解析模块200，设置为解析所述待识别请求包的内容特征，具体包括：
解析所述待识别请求包的包体字段；
相应的，上传请求包判断模块300，设置为判断所述内容特征是否与上传请求包设定的内容特征相应，具体包括：
判断所述包体字段的起始内容是否与设定的第一内容相应，且结束内容是否与设定的第二内容相应；其中，设定的第一内容为上传请求包在包体字段中遵循的起始内容，设定的第二内容为上传请求包在包体字段中遵循的结束内容。
可选地，内容特征解析模块200，设置为解析所述待识别请求包的内容特征，还可以包括：
解析所述待识别请求包的包头字段；(即内容特征解析模块200可解析所述待识别请求包的包体字段和包头字段)；
相应的，上传接口识别确定模块400，设置为若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，具体包括:
若所述包体字段的起始内容与设定的第一内容相应，且结束内容与设定的第二内容相应，确定所述待识别请求包为上传请求包；
上传接口识别确定模块400，设置为将所述上传请求包指示的接口地址确定为与上传接口对应，具体包括：
将所述上传请求包的包头字段指示的接口地址确定为与上传接口对应。
可选的，待识别请求包可以是对收集的页面客户端发往页面服务器的 请求包进行过滤后的请求包；相应的，待识别请求包获取模块100，设置为获取待识别请求包，具体包括：
获取IDS服务器收集的页面客户端发往页面服务器的请求包；
对所获取的请求包进行过滤，得到待识别请求包；所述待识别请求包为页面客户端发往页面服务器的非重复且采用HTTP协议的请求包。
可选的，图10示出了本申请实施例提供的识别服务器的另一结构，结合图9和图10所示，该识别服务器还可以包括：
上传漏洞识别模块500，设置为判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后缀；若所述上传请求包包含设定的上传关键字，且所述上传请求包所对应上传的文件名称包含脚本文件后缀，调取所述上传请求包的上传反馈结果；若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
可选的，如图10所示，该识别服务器还可以包括：
上传请求包过滤模块600，设置为判断所述上传请求包对应的HOST字段，是否由设定的可信HOST发起，若所述上传请求包对应的HOST字段不由设定的可信HOST发起，触发上传漏洞识别模块500执行判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后缀的步骤；
即上传漏洞识别模块500所处理的上传请求包可以是上传请求包过滤模块600过滤后的，不由设定的可信HOST发起的上传请求包。
可选的，上传请求包过滤模块600也可以不选用在图10所示识别服务器中。
可选的，图11示出了本申请实施例提供的识别服务器的再一结构，结合图10和图11所示，该识别服务器还可以包括：
数据库记录模块700，设置为将所确定的上传接口记录到第一数据库，并将所确定的存在上传漏洞的上传接口记录到第二数据库；
工单输出模块800，设置为根据第二数据库中记录的上传接口，输出 系统工单，所述系统工单记录有存在上传漏洞的上传接口对应的负责人和所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案。
可选的，工单输出模块800也可不选用在图11所示识别服务器中。
本申请实施例提供的识别服务器可以降低上传接口的漏检概率，提升上传接口识别的全面性，进一步可提升上传接口识别的准确性；从而为提升上传漏洞识别的全面性和准确性提供可能。
本申请实施例还提供一种上传接口识别系统，该上传接口识别系统的结构可以如图1所示包括：请求收集服务器和识别服务器；
其中，请求收集服务器，设置为收集页面客户端发往页面服务器的请求包；
识别服务器，设置为从所述请求收集服务器所收集的请求包中获取待识别请求包；解析所述待识别请求包的内容特征；判断所述内容特征是否与上传请求包设定的内容特征相应；若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
可选的，请求收集服务器和识别服务器的具体功能实现细节，还扩展实现功能可参照上文相应部分的描述。
可选地，在本申请实施例中，识别服务器，还可设置为判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后缀；若所述上传请求包包含设定的上传关键字，且所述上传请求包所对应上传的文件名称包含脚本文件后缀，调取所述上传请求包的上传反馈结果；若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
可选地，本申请实施例提供的上传接口识别系统的另一结构可如图7所示，结合图1和图7，该上传接口系统可以包括：第一数据库，第二数据库，工单发布服务器；
其中，第一数据库，设置为记录所确定的上传接口；
第二数据库，设置为记录所确定的存在上传漏洞的上传接口；
工单发布服务器，设置为根据第二数据库中记录的上传接口，输出系统工单，所述系统工单记录有存在上传漏洞的上传接口对应的负责人和所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案。
根据本发明实施例的又一方面，还提供了一种用于实施上述上传接口识别方法的电子装置。
图12是根据本发明实施例的一种电子装置的结构框图。如图12所示，该电子装置可以包括：一个或多个(图中仅示出一个)处理器901、存储器903、以及传输装置905，如图12所示，该服务器还可以包括输入输出设备907。
其中，存储器903可用于存储计算机程序以及模块，如本发明实施例中的对上传接口识别方法和装置对应的程序指令/模块，处理器901被设置为通过运行存储在存储器903内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的上传接口识别方法。存储器903可包括高速随机存储器，还可以包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器903可进一步包括相对于处理器901远程设置的存储器，这些远程存储器可以通过网络连接至终端。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
上述的传输装置905用于经由一个网络接收或者发送数据，还可以用于处理器与存储器之间的数据传输。上述的网络具体实例可包括有线网络及无线网络。在一个实例中，传输装置905包括一个网络适配器(Network Interface Controller，NIC)，其可通过网线与其他网络设备与路由器相连从而可与互联网或局域网进行通讯。在一个实例中，传输装置905为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
其中，可选地，存储器903用于存储应用程序。
处理器901用于运行程序，其中，程序运行时执行本发明的上传接口识别方法。处理器901可以通过传输装置905调用存储器903存储的应用程序，以执行下述步骤：
获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
解析所述待识别请求包的内容特征；
判断所述内容特征是否与上传请求包设定的内容特征相应；
若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
可选的，处理器901获取待识别HTTP请求包的可选方式可以是：获取IDS服务器收集的页面客户端发往页面服务器的请求包，对所获取的请求包进行过滤，得到页面客户端发往页面服务器的非重复且采用HTTP协议的请求包；
可选的，处理器901也可直接将IDS服务器收集的页面客户端发往页面服务器的请求包，作为待识别HTTP请求包使用。
可选的，待识别HTTP请求包仅是采用HTTP协议的情况下，待识别请求包的一种可选形式，该待识别请求包可包含于页面客户端发往页面服务器的请求包中。
可选的，处理器901可以解析所述待识别HTTP请求包的包头字段和包体字段，此处所指的内容特征不限于与所解析的包体字段的内容相应。
可选的，处理器901可判断所述待识别HTTP请求包的包体字段的起始内容是否与设定的第一内容相应，结束内容是否与设定的第二内容相应，且，设定的第一内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的起始内容，设定的第二内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的结束内容；
可选的，除通过设定HTTP上传请求包的起始内容和结束内容，来设定HTTP上传请求包的内容特征外，本申请实施例还可采用其他方式实现 HTTP上传请求包的内容特征设定，如在HTTP上传请求包的包头内容中设定特定的标识字符，该标识字符可以用于表示HTTP上传请求包。
可选的，HTTP上传请求包仅是本申请实施例所指的上传请求包的一种可选形式，在采用其他协议的情况下，上传请求包的形式可相应调整。
可选的，若待识别HTTP请求包的内容特征与HTTP上传请求包设定的内容特征相应，则可从该待识别HTTP请求包的包头字段中提取所指示的接口地址，将该接口地址确定为与上传接口对应。
本申请实施例提供的技术方案，处理器901可获取待识别HTTP请求包，所述待识别HTTP请求包包含于页面客户端发往页面服务器的采用HTTP协议的请求包中，从而处理器901可解析所述待识别HTTP请求包的内容特征，判断所述内容特征是否与HTTP上传请求包设定的内容特征相应，若所述内容特征与HTTP上传请求包设定的内容特征相应，则处理器901可确定所述待识别HTTP请求包为HTTP上传请求包，从而将所述HTTP上传请求包指示的接口地址确定为与上传接口对应，实现上传接口的识别；
需要说明的是，在HTTP等网络协议的约定下，HTTP上传请求包中必须携带有约定的内容特征，因此通过对发往页面服务器的请求包进行内容特征的分析，确定内容特征与HTTP上传请求包设定的内容特征相应的请求包，可以实现有效上传请求的请求包的识别，进而将所识别的请求包指示的接口地址，确定为与上传接口对应，可以实现上传接口的识别；由于HTTP等上传请求必然会携带约定的内容特征，因此通过该内容特征实现上传请求包的识别，以所识别的上传请求包指示的接口地址确定上传接口，可实现较为全面的上传请求包的识别，识别出的上传接口的全面性也将相应的提升，减少漏检的概率。
可选地，本实施例中的具体示例可以参考上述实施例中所描述的示例，本实施例在此不再赘述。
本领域普通技术人员可以理解，图12所示的结构仅为示意，电子装 置可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌上电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。图12其并不对上述电子装置的结构造成限定。例如，电子装置还可包括比图12中所示更多或者更少的组件(如网络接口、显示装置等)，或者具有与图12所示不同的配置。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中。
本发明的实施例还提供了一种存储介质。该存储介质包括存储的程序，其中，程序运行时执行本发明的上传接口识别方法。可选地，在本实施例中，上述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时可以用于执行上传接口识别方法。
可选地，在本实施例中，上述存储介质可以位于上述实施例所示的网络中的多个网络设备中的至少一个网络设备上。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：
获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
解析所述待识别请求包的内容特征；
判断所述内容特征是否与上传请求包设定的内容特征相应；
若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
在被设置为存储用于执行上述步骤的程序代码中，获取待识别HTTP请求包的可选方式可以是：获取IDS服务器收集的页面客户端发往页面服务器的请求包，对所获取的请求包进行过滤，得到页面客户端发往页面服 务器的非重复且采用HTTP协议的请求包。
可选地，在上述被设置为存储用于执行上述步骤的程序代码中，可直接将IDS服务器收集的页面客户端发往页面服务器的请求包，作为待识别HTTP请求包使用。
待识别HTTP请求包仅是采用HTTP协议的情况下，待识别请求包的一种可选形式，该待识别请求包可包含于页面客户端发往页面服务器的请求包中。
可选地，可以解析所述待识别HTTP请求包的包头字段和包体字段，此处所指的内容特征不限于与所解析的包体字段的内容相应。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：判断所述待识别HTTP请求包的包体字段的起始内容是否与设定的第一内容相应，结束内容是否与设定的第二内容相应，且，设定的第一内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的起始内容，设定的第二内容可以是依照HTTP协议，HTTP上传请求包在包体字段中遵循的结束内容。
在被设置为存储用于执行上述步骤的程序代码中，除通过设定HTTP上传请求包的起始内容和结束内容，来设定HTTP上传请求包的内容特征外，本申请实施例还可采用其他方式实现HTTP上传请求包的内容特征设定，如在HTTP上传请求包的包头内容中设定特定的标识字符，该标识字符可以用于表示HTTP上传请求包。
可选的，HTTP上传请求包仅是本申请实施例所指的上传请求包的一种可选形式，在采用其他协议的情况下，上传请求包的形式可相应调整。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：若待识别HTTP请求包的内容特征与HTTP上传请求包设定的内容特征相应，则可从该待识别HTTP请求包的包头字段中提取所指示的接口地址，将该接口地址确定为与上传接口对应。
可选地，本实施例中的具体示例可以参考上述实施例中所描述的示例，本实施例在此不再赘述。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
如上参照附图以示例的方式描述了根据本发明的上传接口识别方法及装置、存储介质及电子装置。但是，本领域技术人员应当理解，对于上述本发明所提出的上传接口识别方法及装置、存储介质及电子装置，还可以在不脱离本发明内容的基础上做出各种改进。因此，本发明的保护范围应当由所附的权利要求书的内容确定。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。
专业人员还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
结合本文中所公开的实施例描述的方法或算法的步骤可以直接用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
对所公开的实施例的上述说明，使本领域专业技术人员能够实现或使用本申请。对这些实施例的多种修改对本领域的专业技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本申请的精神或范围的情况下，在其它实施例中实现。因此，本申请将不会被限制于本文所示的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。
工业实用性
在本申请实施例中，通过对发往页面服务器的请求包进行内容特征的分析，确定内容特征与上传请求包设定的内容特征相应的请求包，可以实现有效上传请求的请求包的识别，进而将所识别的请求包指示的接口地址，确定为与上传接口对应，可以实现上传接口的识别；由于HTTP等上传请求必然会携带约定的内容特征，因此通过该内容特征实现上传请求包的识别，以所识别的上传请求包指示的接口地址确定上传接口，可实现较为全面的上传请求包的识别，识别出的上传接口的全面性也将相应的提升，减少漏检的概率。

Claims (18)

  1. 一种上传接口识别方法，包括：
    获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
    解析所述待识别请求包的内容特征；
    判断所述内容特征是否与上传请求包设定的内容特征相应；
    若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
  2. 根据权利要求1所述的上传接口识别方法，其中，所述解析所述待识别请求包的内容特征包括：
    解析所述待识别请求包的包体字段；
    所述判断所述内容特征是否与上传请求包设定的内容特征相应包括：
    判断所述包体字段的起始内容是否与设定的第一内容相应，且结束内容是否与设定的第二内容相应；其中，设定的第一内容为上传请求包在包体字段中遵循的起始内容，设定的第二内容为上传请求包在包体字段中遵循的结束内容。
  3. 根据权利要求2所述的上传接口识别方法，其中，所述解析所述待识别请求包的内容特征还包括：
    解析所述待识别请求包的包头字段；
    所述若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包包括：
    若所述包体字段的起始内容与设定的第一内容相应，且结束内容与设定的第二内容相应，确定所述待识别请求包为上传请求包；
    所述将所述上传请求包指示的接口地址确定为与上传接口对应包括：
    将所述上传请求包的包头字段指示的接口地址确定为与上传接口对应。
  4. 根据权利要求1所述的上传接口识别方法，其中，所述获取待识别请求包包括：
    获取入侵检测系统IDS服务器收集的页面客户端发往页面服务器的请求包；
    对所获取的请求包进行过滤，得到待识别请求包；所述待识别请求包为页面客户端发往页面服务器的非重复且采用超文本传输协议HTTP协议的请求包。
  5. 根据权利要求1-4任一项所述的上传接口识别方法，其中，还包括：
    判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后缀；
    若所述上传请求包包含设定的上传关键字，且所述上传请求包所对应上传的文件名称包含脚本文件后缀，调取所述上传请求包的上传反馈结果；
    若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
  6. 根据权利要求5所述的上传接口识别方法，其中，还包括：
    判断所述上传请求包对应的HOST字段，是否由设定的可信HOST发起；
    若所述上传请求包对应的HOST字段不由设定的可信HOST发起，执行所述判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后缀的步骤。
  7. 根据权利要求6所述的上传接口识别方法，其中，还包括：
    将所确定的上传接口记录到第一数据库，并将所确定的存在上传漏洞的上传接口记录到第二数据库。
  8. 根据权利要求7所述的上传接口识别方法，其中，还包括：
    根据第二数据库中记录的上传接口，输出系统工单，所述系统工单记录有存在上传漏洞的上传接口对应的负责人和所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案。
  9. 一种识别服务器，包括：
    待识别请求包获取模块，设置为获取待识别请求包，所述待识别请求包包含于页面客户端发往页面服务器的请求包中；
    内容特征解析模块，设置为解析所述待识别请求包的内容特征；
    上传请求包判断模块，设置为判断所述内容特征是否与上传请求包设定的内容特征相应；
    上传接口识别确定模块，设置为若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
  10. 根据权利要求9所述的识别服务器，其中，所述内容特征解 析模块，设置为解析所述待识别请求包的内容特征，具体包括：
    解析所述待识别请求包的包体字段；
    所述上传请求包判断模块，设置为判断所述内容特征是否与上传请求包设定的内容特征相应，具体包括：
    判断所述包体字段的起始内容是否与设定的第一内容相应，且结束内容是否与设定的第二内容相应；其中，设定的第一内容为上传请求包在包体字段中遵循的起始内容，设定的第二内容为上传请求包在包体字段中遵循的结束内容。
  11. 根据权利要求10所述的识别服务器，其中，所述内容特征解析模块，设置为解析所述待识别请求包的内容特征，还包括：
    解析所述待识别请求包的包头字段；
    所述上传接口识别确定模块，设置为若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，具体包括:
    若所述包体字段的起始内容与设定的第一内容相应，且结束内容与设定的第二内容相应，确定所述待识别请求包为上传请求包；
    所述上传接口识别确定模块，设置为将所述上传请求包指示的接口地址确定为与上传接口对应，具体包括：
    将所述上传请求包的包头字段指示的接口地址确定为与上传接口对应。
  12. 根据权利要求9-11任一项所述的识别服务器，其中，还包括：
    上传漏洞识别模块，设置为判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后缀；若所述上传请求包包含设定的上传关键字，且所述上传请求包所对应上传的文件名称包含脚本文件后缀，调取所述上传请求包的上传反馈结果；若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
  13. 根据权利要求12所述的识别服务器，其中，还包括：
    数据库记录模块，设置为将所确定的上传接口记录到第一数据库，并将所确定的存在上传漏洞的上传接口记录到第二数据库；
    工单输出模块，设置为根据第二数据库中记录的上传接口，输出系统工单，所述系统工单记录有存在上传漏洞的上传接口对应的负责人和所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案。
  14. 一种上传接口识别系统，包括：
    请求收集服务器，设置为收集页面客户端发往页面服务器的请求包；
    识别服务器，设置为从所述请求收集服务器所收集的请求包中获取待识别请求包；解析所述待识别请求包的内容特征；判断所述内容特征是否与上传请求包设定的内容特征相应；若所述内容特征与上传请求包设定的内容特征相应，确定所述待识别请求包为上传请求包，将所述上传请求包指示的接口地址确定为与上传接口对应。
  15. 根据权利要求14所述的上传接口识别系统，其中，所述识别服务器，还设置为判断所述上传请求包是否包含设定的上传关键字，且所述上传请求包所对应上传的文件名称是否包含脚本文件后 缀；若所述上传请求包包含设定的上传关键字，且所述上传请求包所对应上传的文件名称包含脚本文件后缀，调取所述上传请求包的上传反馈结果；若所述反馈结果指示上传成功，则确定所述HTTP上传请求包对应的上传接口存在上传漏洞。
  16. 根据权利要求15所述的上传接口识别系统，其中，还包括：
    第一数据库，设置为记录所确定的上传接口；
    第二数据库，设置为记录所确定的存在上传漏洞的上传接口；
    工单发布服务器，设置为根据第二数据库中记录的上传接口，输出系统工单，所述系统工单记录有存在上传漏洞的上传接口对应的负责人和所属维护部门，以及上传接口存在漏洞所引起的问题危害，和对应解决方案。
  17. 一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行所述权利要求1至8任一项中所述的方法。
  18. 一种电子装置，包括存储器和处理器，其中，所述存储器中存储有计算机程序，所述处理器被设置为通过所述计算机程序执行所述权利要求1至8任一项中所述的方法。
PCT/CN2018/080269 2017-04-11 2018-03-23 一种上传接口识别方法、识别服务器及系统及存储介质 WO2018188470A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/443,433 US10972496B2 (en) 2017-04-11 2019-06-17 Upload interface identification method, identification server and system, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710233531.9A CN108696488B (zh) 2017-04-11 2017-04-11 一种上传接口识别方法、识别服务器及系统
CN201710233531.9 2017-04-11

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/443,433 Continuation US10972496B2 (en) 2017-04-11 2019-06-17 Upload interface identification method, identification server and system, and storage medium

Publications (1)

Publication Number Publication Date
WO2018188470A1 true WO2018188470A1 (zh) 2018-10-18

Family

ID=63792807

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/080269 WO2018188470A1 (zh) 2017-04-11 2018-03-23 一种上传接口识别方法、识别服务器及系统及存储介质

Country Status (3)

Country Link
US (1) US10972496B2 (zh)
CN (1) CN108696488B (zh)
WO (1) WO2018188470A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111757378A (zh) * 2020-06-03 2020-10-09 湃方科技(北京)有限责任公司 一种无线网络中设备识别方法及装置

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109412896B (zh) * 2018-11-14 2022-04-15 中国平安人寿保险股份有限公司 上传功能的测试方法、装置、计算机设备和存储介质
CN111585975B (zh) * 2020-04-17 2023-03-14 上海中通吉网络技术有限公司 安全漏洞检测方法、设备及系统、交换机
CN111740996B (zh) * 2020-06-22 2021-06-22 四川长虹电器股份有限公司 一种流量解析场景下快速拆分http请求与响应的方法
US11729790B2 (en) 2020-08-06 2023-08-15 Samsung Electronics Co., Ltd. Mobile communications methods for monitoring and scheduling
CN112446030B (zh) * 2020-10-23 2023-01-06 苏州浪潮智能科技有限公司 一种网页端的文件上传漏洞检测方法和装置
CN115134164B (zh) * 2022-07-18 2024-02-23 深信服科技股份有限公司 一种上传行为检测方法、系统、设备及计算机存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9009841B2 (en) * 2011-06-01 2015-04-14 International Business Machines Corporation Testing web applications for file upload vulnerabilities
CN104537309A (zh) * 2015-01-23 2015-04-22 北京奇虎科技有限公司 应用程序漏洞检测方法、装置及服务器
CN105227387A (zh) * 2014-06-16 2016-01-06 腾讯科技（深圳）有限公司 网页漏洞的检测方法、装置及系统
US9241007B1 (en) * 2013-07-18 2016-01-19 Blue Pillar, Inc. System, method, and computer program for providing a vulnerability assessment of a network of industrial automation devices
WO2016150304A1 (zh) * 2015-03-20 2016-09-29 中兴通讯股份有限公司 一种安全漏洞加固方法及系统

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7496962B2 (en) * 2004-07-29 2009-02-24 Sourcefire, Inc. Intrusion detection strategies for hypertext transport protocol
CN103051596A (zh) * 2011-10-14 2013-04-17 腾讯科技（深圳）有限公司 网络安全识别方法、安全检测服务器、客户端及系统
CN102868765B (zh) * 2012-10-09 2015-06-03 乐视网信息技术（北京）股份有限公司 文件上传方法和系统
CN103905258B (zh) * 2012-12-24 2018-03-06 百度国际科技（深圳）有限公司 一种客户端数据上传功能的测试方法及装置
CN104079528A (zh) * 2013-03-26 2014-10-01 北大方正集团有限公司 一种Web应用的安全防护方法及系统
US9203849B2 (en) * 2013-12-04 2015-12-01 Apple Inc. Preventing URL confusion attacks
CN104079429A (zh) * 2014-05-22 2014-10-01 汉柏科技有限公司 一种基于referer字段的盗链防护的方法及Web网关
CN105516073B (zh) * 2014-10-20 2018-12-25 中国银联股份有限公司 网络入侵防御方法
CN104796426B (zh) * 2015-04-29 2018-04-27 上海络安信息技术有限公司 网页后门的检测方法
CN106302337B (zh) * 2015-05-22 2020-12-04 腾讯科技（深圳）有限公司 漏洞检测方法和装置
US10291643B2 (en) * 2016-07-29 2019-05-14 Praetorian Group, Inc. Method and system for validating a vulnerability submitted by a tester in a crowdsourcing environment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9009841B2 (en) * 2011-06-01 2015-04-14 International Business Machines Corporation Testing web applications for file upload vulnerabilities
US9241007B1 (en) * 2013-07-18 2016-01-19 Blue Pillar, Inc. System, method, and computer program for providing a vulnerability assessment of a network of industrial automation devices
CN105227387A (zh) * 2014-06-16 2016-01-06 腾讯科技（深圳）有限公司 网页漏洞的检测方法、装置及系统
CN104537309A (zh) * 2015-01-23 2015-04-22 北京奇虎科技有限公司 应用程序漏洞检测方法、装置及服务器
WO2016150304A1 (zh) * 2015-03-20 2016-09-29 中兴通讯股份有限公司 一种安全漏洞加固方法及系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111757378A (zh) * 2020-06-03 2020-10-09 湃方科技(北京)有限责任公司 一种无线网络中设备识别方法及装置
CN111757378B (zh) * 2020-06-03 2024-04-02 中科时代(深圳)计算机系统有限公司 一种无线网络中设备识别方法及装置

Also Published As

Publication number Publication date
CN108696488B (zh) 2022-04-15
US10972496B2 (en) 2021-04-06
US20190306186A1 (en) 2019-10-03
CN108696488A (zh) 2018-10-23

Similar Documents

Publication Publication Date Title
WO2018188470A1 (zh) 一种上传接口识别方法、识别服务器及系统及存储介质
US11057427B2 (en) Method for identifying phishing websites and hindering associated activity
US10666686B1 (en) Virtualized exploit detection system
EP3691217B1 (en) Web traffic logging system and method for detecting web hacking in real time
US10326730B2 (en) Verification of server name in a proxy device for connection requests made using domain names
US9100432B2 (en) Cloud-based distributed denial of service mitigation
WO2022083226A1 (zh) 异常识别方法和系统、存储介质及电子装置
JP2019175478A (ja) セッションセキュリティ分割およびアプリケーションプロファイラ
JP2016534607A (ja) 拡張可能なビデオクラウドサービスのためのシステムおよび方法
CN105721479B (zh) 一种网址过滤方法及装置
US20140115705A1 (en) Method for detecting illegal connection and network monitoring apparatus
WO2014187238A1 (zh) 应用类型识别方法及网络设备
WO2015039474A1 (zh) 一种深度包检测控制方法及装置、存储介质
US20180255074A1 (en) Managing data encrypting applications
CN106778229B (zh) 一种基于vpn的恶意应用下载拦截方法及系统
JP4877145B2 (ja) 通信装置を制御するプログラム及び通信装置
JP5478390B2 (ja) ログ抽出システムおよびプログラム
CN107819639B (zh) 一种测试方法和装置
KR101658450B1 (ko) 웹 애플리케이션 서버로부터 수집된 트랜잭션 정보 및 고유세션 id 통한 사용자 식별을 이용한 보안장치.
KR101087291B1 (ko) 인터넷을 사용하는 모든 단말을 구분하는 방법 및 시스템
US10757118B2 (en) Method of aiding the detection of infection of a terminal by malware
CN108259416B (zh) 检测恶意网页的方法及相关设备
CN102299958A (zh) 通过ie浏览监控视频的方法、客户端及系统
WO2008095391A1 (fr) Procédé de localisation de la source des attaques du réseau ims, dispositif et système anti-attaque de ce dernier
CN110602104B (zh) 一种防止公有云盘被僵尸网络恶意利用的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18784734

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18784734

Country of ref document: EP

Kind code of ref document: A1