WO2020019515A1

WO2020019515A1 - Injection vulnerability detection method and device

Info

Publication number: WO2020019515A1
Application number: PCT/CN2018/108718
Authority: WO
Inventors: 熊庆昌
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-07-25
Filing date: 2018-09-29
Publication date: 2020-01-30
Also published as: CN109120603A; CN109120603B

Abstract

Disclosed are an injection vulnerability detection method and device. The method comprises: determining a target request for injection vulnerability detection, then determining a first request and a second request according to the target request, transmitting the first request and the second request to a server, and receiving first page content returned by the server for the first request and second page content returned by the server for the second request; then obtaining a first analysis result of the first page content and a second analysis result of the second page content, the first analysis result comprising N first DOM nodes, and the second analysis result comprising M second DOM nodes; and if at least one different DOM node exists between the N first DOM nodes and the M second DOM nodes, determining that an injection vulnerability exists in the server. The use of the embodiments of the present application may reduce the calculation amount and the calculation difficulty, thereby improving the processing efficiency of injection vulnerability detection.

Description

Method and device for detecting injection loophole

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on July 25, 2018, with application number 2018108320082, and with the application name "An Injection Vulnerability Detection Method and Device", the entire contents of which are incorporated herein by reference. in.

Technical field

The present application relates to the field of Internet technologies, and in particular, to a method and a device for detecting an injection vulnerability.

Background technique

The injection vulnerability is generated when the code is written without judging the legality of the user input data. Similarity detection is a common method in injection vulnerability detection.

The existing similarity detection mainly uses similar algorithms (such as local sensitive hashing algorithm simhash, minimum hashing algorithm minhash, etc.) to calculate page content returned by true logic (sql true logic) requests and false logic (sql false logic) requests. The similarity value of the returned page content. When the similarity value is greater than the preset threshold, the two pages are considered to be similar and there is no injection vulnerability. When the similarity value is less than the preset threshold, the two pages are considered to be not similar and there is an injection vulnerability.

However, the current simhash and minhash are computationally intensive and complicated, which increases the computational difficulty of the terminal and reduces the processing efficiency of detecting injection vulnerabilities.

Summary of the Invention

The embodiments of the present application provide an injection vulnerability detection method and device, which can reduce the calculation amount and the calculation difficulty, thereby improving the processing efficiency of detecting an injection vulnerability.

In a first aspect, an embodiment of the present application provides an injection vulnerability detection method, which includes:

Identify target requests for injection vulnerability detection;

A first request and a second request are determined according to the target request. The first request is determined by inserting a field of a first logical type in the target request, and the second request is obtained by inserting a second logical type into the target request. Field determination request;

Sending the first request and the second request to a server, and receiving the first page content returned by the server for the first request and the second page content returned for the second request;

Obtain a first parsing result of the first page content and a second parsing result of the second page content, the first parsing result includes N first document object model DOM nodes, and the second parsing result includes M second DOMs Node, the N and the M are both integers greater than or equal to 1;

If at least one different DOM node exists between the N first DOM nodes and the M second DOM nodes, it is determined that an injection vulnerability exists in the server.

In a second aspect, an embodiment of the present application provides an injection vulnerability detection device, where the device includes:

A first determining module, configured to determine a target request for injection vulnerability detection;

A second determining module, configured to determine a first request and a second request according to the target request determined by the first determining module, where the first request is determined by inserting a field of a first logical type into the target request, and the second The request is a request determined by inserting a field of a second logical type in the target request;

The transceiver module is configured to send the first request and the second request determined by the second determining module to the server, and receive the first page content returned by the server for the first request and the second page returned by the server Page content

An obtaining module, configured to obtain a first analysis result of the first page content received by the transceiver module and a second analysis result of the second page content received by the transceiver module, where the first analysis result includes N first A document object model DOM node, the second parsing result includes M second DOM nodes, where N and M are integers greater than or equal to 1;

A third determining module, configured to determine that an injection vulnerability exists in the server when there are at least one different DOM node between the N first DOM nodes and the M second DOM nodes.

In a third aspect, an embodiment of the present application provides a terminal, including a processor, an input device, an output device, and a memory. The processor, the input device, the output device, and the memory are connected to each other. The memory is used to store and support the execution of the terminal The computer program of the above method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the injection vulnerability detection method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer storage medium stores a computer program, where the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the foregoing first On the one hand injection detection methods.

The embodiment of the present application determines whether there is an injection vulnerability in the server by comparing whether the DOM nodes between the page contents returned by different requests are the same, which can reduce the calculation amount and the calculation difficulty, thereby improving the processing efficiency of detecting the injection vulnerability.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a data structure of an HTTP request;

FIG. 2 is a schematic flowchart of an injection vulnerability detection method according to an embodiment of the present application; FIG.

Figure 3a is a schematic diagram of an HTML DOM tree;

3b is a schematic diagram of a first DOM node and a second DOM node;

FIG. 4 is another schematic flowchart of an injection vulnerability detection method according to an embodiment of the present application; FIG.

5a is a schematic diagram of a DOM tree structure of a first page content;

FIG. 5b is a schematic diagram of a first DOM node;

5c is a schematic diagram of a DOM tree structure of a second page content;

5d is a schematic diagram of a second DOM node;

6 is a schematic block diagram of an injection vulnerability detection device according to an embodiment of the present application;

FIG. 7 is a schematic block diagram of a terminal according to an embodiment of the present application.

detailed description

In the following, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all of them. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

The target request, the first request, and the second request in the embodiments of the present application may be different Hypertext Transfer Protocol (HTTP) requests, respectively. For the convenience of description, the HTTP request will be taken as an example for description below. An HTTP request can refer to a request message from the client to the server. As shown in FIG. 1, FIG. 1 is a schematic diagram of a data structure of an HTTP request. Among them, the HTTP request consists of three parts: request line, request header, and request body (request data). The HTTP request line contains the request method (such as GET or POST), the Uniform Resource Locator (URL) corresponding to the request, and the protocol name / version number used; the HTTP request header contains many header field names and values , Such as the Host field, Referer field, Cookie field, etc .; the HTTP request body contains the query string information submitted by the customer. The Host field is used to indicate the domain name (IP address) and port number of the server requesting access; the Referer field is used to tell the server which page the request came from; the Cookie field is used to maintain the server session state, usually written by the server In, in subsequent requests, it is read by the server.

The injection vulnerability detection method provided in the embodiments of the present application can be applied to terminals such as smart phones, tablet computers, and desktop computers. Optionally, the injection vulnerability detection method provided by the embodiment of the present application may be executed by any terminal of any of the types described above, or may be executed by a functional module (such as a browser, etc.) of any terminal of any of the types described above. Here, No restrictions. For the convenience of description, the terminal will be taken as an example for description below.

The method and device for detecting an injection vulnerability provided in the embodiments of the present application will be described below with reference to FIGS. 2 to 7.

Referring to FIG. 2, it is a schematic flowchart of an injection vulnerability detection method according to an embodiment of the present application. As shown in FIG. 2, the injection vulnerability detection method may include steps:

S201. The terminal determines a target request for injection vulnerability detection.

In some feasible implementation manners, the terminal may obtain one or more target HTTP requests preset by the user for detecting whether the server has an injection vulnerability. The URL carried in the target HTTP request may be a URL existing in the server, that is, the terminal can normally access the server through the URL.

S202. The terminal determines the first request and the second request according to the target request.

In some feasible implementation manners, the terminal may insert a field of a first logical type into the target HTTP request determined above to obtain a first HTTP request, and may insert a field of a second logical type into the target HTTP request to obtain The second HTTP request. The field of the first logical type may be a structured query language (SQL) statement of true logic, and the field of the second logical type may be a SQL statement of false logic. For example, the field of the first logical type is an orthodox SQL statement such as "or 1 = 1", "or 1 <2", or "or 2 = 2", and the field of the second logical type is "and 1 = 2", SQL statements such as "and 1> 2" or "and 21 = 12".

In some feasible implementation manners, the terminal may insert a true logical SQL statement in a target field of the target HTTP request to obtain a first HTTP request, and may insert a false logical SQL statement in the target field of the target HTTP request. To get a second HTTP request. The target field may include one or more of a Host field, a Referer field, and a Cookie field. The first HTTP request and the second HTTP request are respectively determined by inserting different SQL statements in the same field of the target HTTP request.

For example, the Host field of the target HTTP request is "ulog.jd.com", and the terminal may insert a preset true logical SQL statement "or 1 = 1" after the Host field "ulog.jd.com" of the target HTTP request. The first HTTP request is obtained. At this time, the Host field of the first HTTP request is "ulog.jd.com or 1 = 1", and a preset "Ulog.jd.com" is inserted after the Host field of the target HTTP request. The fake logical SQL statement "and 1> 2" obtains the second HTTP request. At this time, the Host field of the second HTTP request is "ulog.jd.com and 1> 2". For another example, the Referer field of the target HTTP request is "http://xx.xx.xx.com/xx.html", and the terminal may set the Referer field of the target HTTP request at "http://xx.xx.xx.com" /xx.html "and insert the preset true logical SQL statement" or 1 <2 "to get the first HTTP request. At this time, the Referer field of the first HTTP request is" http://xx.xx.xx.com " /xx.html or 1 <2 ", and insert a preset fake logical SQL statement" and 1 = 1 "after the Referer field" http://xx.xx.xx.com/xx.html "of the target HTTP request "To obtain a second HTTP request. At this time, the Referer field of the second HTTP request is" http://xx.xx.xx.com/xx.html and 1 = 2 ". For another example, the cookie field of the target HTTP request is "_jda = 1387505529", and the terminal may insert a preset true logical SQL statement "or 2 = 2" after the cookie field of the target HTTP request "_jda = 1387505529" to obtain the first HTTP request, at this time, the cookie field of the first HTTP request is “_jda = 1387505529or 2 = 2”, and a preset fake logical SQL statement “and 21 =” is inserted after the cookie field of the target HTTP request “_jda = 1387505529” 12 "to get the second HTTP request. At this time, the cookie field of the second HTTP request is" _jda = 1387505529 and 21 = 12 ".

S203: The terminal sends a first request and a second request to the server, and receives the first page content returned by the server for the first request and the second page content returned for the second request.

In some feasible implementation manners, the terminal may send the first HTTP request and the second HTTP request to the server, and the server receives the first HTTP request and the second HTTP request sent by the terminal, and targets the first HTTP The request returns the first page content corresponding to the first HTTP request, and returns the second page content corresponding to the second HTTP request for the second HTTP request. The terminal may receive the first page content and the second page content.

S204. The terminal obtains a first analysis result of the first page content and a second analysis result of the second page content.

In some feasible implementation manners, the terminal may parse the content of the first page received according to a document object model (DOM) to obtain N first DOM nodes, and may decode the second page received above. The page content is parsed according to the DOM, and M second DOM nodes are obtained. Wherein, N and M are integers greater than or equal to 1. The N first DOM nodes include at least one root node and at least one child node, and the M second DOM nodes also include at least one root node and at least one child node. It should be noted that the DOM can logically build a tree model for an HTML document by parsing a Hypertext Markup Language (HTML) document. According to the World Wide Web Consortium (W3C) HTML DOM (Hypertext Markup Document Object Model) standard, everything in an HTML document is a node, the entire document is a document node, each HTML element is an element node, and the text within the HTML element Are text nodes, each HTML attribute is an attribute node, and a comment is a comment node. As shown in Figure 3a, it is a schematic diagram of the HTML DOM tree. Among them, the root element is the root node, and the element is the child node. Each HTML document can be parsed into a root element and one or more elements according to the DOM.

As shown in FIG. 3b, it is a schematic diagram of a first DOM node and a second DOM node. The content1 of the first page is parsed according to the DOM to obtain "root element <bookstore>: Sisyphus Bookstore", "element <book>: books", "element <title>: Harry Potter", "element <author> : J.Kowling "," Element <year>: 2005 "," Element <price>: 29.99 ", a total of 6 first DOM nodes. Parse content2 of the second page according to the DOM, and obtain "root element <bookstore>: Sisyphus Bookstore", "element <book>: books", "element <title>: The Little Price", "element <author>: There are 6 second DOM nodes in St. Exupery "," Element <year>: 2005 ", and" Element <price>: 21.2 ". Optionally, which DOM nodes are included in the DOM tree is determined by the content of the page. In other words, after a page content is parsed according to the DOM, it may only include a part of DOM nodes in the HTML DOM tree shown in FIG. 3a. The embodiment of the present application does not limit which nodes are included in a specific page content.

S205. If at least one different DOM node exists between the N first DOM nodes and the M second DOM nodes, the terminal determines that an injection vulnerability exists in the server.

In some feasible implementation manners, the N first DOM nodes include at least one root node and at least one child node, and the M second DOM nodes also include at least one root node and at least one child node. The terminal can compare whether there are differences between the corresponding nodes of the N first DOM nodes and the M second DOM nodes. If there is at least one difference between the N first DOM nodes and the M second DOM nodes, DOM node, the terminal can determine that an injection vulnerability exists in the above server. This is because if the above server does not filter user data (that is, there is an injection vulnerability), then the true logical SQL statement and the false logical SQL statement inserted in step S202 will be executed by the above server as SQL query statements, and further As a result, the first page content and the second page content returned are not similar, so after parsing the first page content and the second page content according to the DOM, there are different DOM nodes. The embodiment of the present application compares whether the first page content (the page content returned by an HTTP request containing a true logic SQL statement) and the second page content (the page content returned by an HTTP request containing a false logic SQL statement) are compared. There are different DOM nodes to determine whether there is an injection vulnerability in the above server, which can reduce the calculation amount of the terminal and reduce the calculation difficulty, thereby improving the processing efficiency of detecting the injection vulnerability.

For example, the first DOM node and the second DOM node are shown in FIG. 3b, and the terminal compares the "root element <bookstore>: Sisyphus Bookstore" of the first page content content1 with the "root element <bookstore> of the second page content content2: "Sisyph Bookstore" is different. Compare "element <book>: book" of content1 with "element <book>: book" of content2. Compare "element <title>: HarryPotter" of content1 and "2 of content2" The element <title>: The Little Price is different, because the "Element <title>: Harry Potter" of content1 is not the same as the "Element <title>: The Little Price" of content2, so the terminal can determine that there is an injection in the server Vulnerability, at this time, the terminal can no longer compare the nodes that have not been compared among the N first DOM nodes and the M second DOM nodes, thereby improving the detection efficiency. Optionally, the terminal may also compare whether there are differences between the corresponding nodes of all the first DOM nodes and all the second DOM nodes, record the different DOM nodes, and count whether the number of different DOM nodes is greater than or equal to 1. If yes, the terminal determines that an injection vulnerability exists in the above server.

The embodiment of the present application determines a target request for injection vulnerability detection, determines a first request and a second request according to the target request, and sends the first request and the second request to a server, and receives the server's response to the first request. A first page content returned by a request and a second page content returned for the second request; and then obtaining a first parsing result of the first page content and a second parsing result of the second page content, the first parsing The result includes N DOM nodes, and the second parsing result includes M second DOM nodes; if at least one different DOM node exists between the N first DOM nodes and the M second DOM nodes, determining the An injection vulnerability exists in the server, which can reduce the calculation amount of the terminal and reduce the calculation difficulty, thereby improving the processing efficiency of detecting the injection vulnerability.

Referring to FIG. 4, it is another schematic flowchart of an injection vulnerability detection method according to an embodiment of the present application. As shown in FIG. 4, the injection vulnerability detection method may include steps:

S401. The terminal determines a target request for injection vulnerability detection.

For the implementation manner of step S401 in the embodiment of the present application, reference may be made to the implementation manner provided by step S201 in the embodiment shown in FIG. 2, and details are not described herein again.

S402. The terminal inserts a field of a first logical type into a parameter field of a uniform resource locator URL requested by the target to obtain a first request.

S403. The terminal inserts a field of the second logical type into the parameter field of the uniform resource locator URL requested by the target to obtain a second request.

In some feasible implementation manners, the terminal determines the implementation manner of the first request and the second request according to the foregoing target HTTP request. For the implementation manner provided in step S202 of the embodiment shown in FIG. 2, details are not described herein again.

In some feasible implementations, the structure of the URL is usually "protocol: // servername (IP address) / path / filename? Parameter", for example, a URL is: http://xxx.pingna.com/sql .php? id = 1, where id = 1 represents the parameter field of this URL, the parameter field of the URL consists of the parameter name and parameter value, id represents the parameter name, 1 represents the parameter value, and the parameter value can be numbers, letters (including capitalization), Special characters (referring to characters other than numbers and letters) and / or combinations thereof. The question mark "?" Character is used to separate file names and parameters in the URL. The terminal may extract the URL carried by the target HTTP request from the target HTTP request, and then insert a true logical SQL statement in the parameter field of the URL to obtain the first HTTP request, and may insert a false in the parameter field of the URL. Logical SQL statement to get the second HTTP request. The terminal can preset multiple true logical SQL statements and multiple false logical SQL statements. When the terminal inserts true logical SQL statements in the parameter field of the URL, the terminal can preset multiple true logical SQL statements. Select any true logical SQL statement to insert. Similarly, when the terminal inserts a false logical SQL statement into the parameter field of the URL, it can also select one false logical SQL statement from a plurality of preset false logical SQL statements for insertion.

For example, the URL carried in the target HTTP request is http://xxx.pingna.com/sql.php? id = 1, the terminal may insert a preset true logical SQL statement “or 2 = 2” after the parameter field “id = 1” of the URL to obtain the first HTTP request. At this time, the URL of the first HTTP request is http://xxx.pingna.com/sql.php? id = 1or 2 = 2, and insert a preset pseudo-logical SQL statement "and 1> 2" after the parameter field "id = 1" of the URL to obtain a second HTTP request. The URL is http://xxx.pingna.com/sql.php? id = 1 and 1> 2.

S404. The terminal sends a first request and a second request to the server, and receives the first page content returned by the server for the first request and the second page content returned for the second request.

For the implementation manner of step S404 in the embodiment of the present application, reference may be made to the implementation manner provided by step S203 in the embodiment shown in FIG. 2, and details are not described herein again.

S405. The terminal obtains a first analysis result of the first page content and a second analysis result of the second page content.

S406. The terminal matches each first DOM node in the N first DOM nodes with each second DOM node in the M second DOM nodes, and determines whether there is a relationship between the N first DOM nodes and the M second DOM nodes. Not the same DOM node.

In some feasible implementation manners, the terminal may parse the received first page content according to the DOM to obtain the DOM tree structure of the first page content, and then extract N from the DOM tree structure of the first page content. First DOM nodes. Similarly, the terminal can parse the received second page content according to the DOM to obtain the DOM tree structure of the second page content, and then extract M second DOM nodes from the DOM tree structure of the second page content. . The terminal may match each first DOM node in the N first DOM nodes with corresponding second DOM nodes in the M second DOM nodes to determine the N first DOM nodes and the M second DOM. Different DOM nodes between nodes. Wherein, N and M are integers greater than or equal to 1. The N first DOM nodes include at least one root node and at least one child node, and the M second DOM nodes also include at least one root node and at least one child node.

For example, the terminal parses the first page content content1 according to the DOM to obtain the DOM tree structure of content1, as shown in FIG. 5a, which is a schematic diagram of the DOM tree structure of the first page content. Each element and text in the DOM tree structure are Can be called a node. The terminal can extract N first DOM nodes from the DOM tree structure of content1, as shown in FIG. 5b, which is a schematic diagram of the first DOM nodes. Similarly, the terminal parses the content of the second page according to the DOM to obtain the DOM tree structure of content2, as shown in FIG. 5c, which is a schematic diagram of the DOM tree structure of the second page content. The terminal can extract M second DOM nodes from the DOM tree structure of content2, as shown in FIG. 5d, which is a schematic diagram of the second DOM nodes. The terminal can compare the content of the text nodes in the N first DOM nodes and the M second DOM nodes, and the tag names and tag types of the element nodes (<title>, <author>, <year>, and <price>). , Whether the content node (<book>) has the same tag name, tag type, tag attribute, number of child nodes, type of child node, etc. If the content of a text node is different, the terminal may determine that the text node is a different DOM node between the N first DOM nodes and the M second DOM nodes. If any one of the tag names and tag types of an element node is different, the terminal may determine that the certain element node is a DOM node that is different between the N first DOM nodes and the M second DOM nodes. If any one of the content nodes has different tag names, tag types, tag attributes, number of child nodes, and child node types, the terminal can determine that the content node is the N first DOM nodes and the M second DOM nodes that are not the same between DOM nodes.

S407. If at least one different DOM node exists between the N first DOM nodes and the M second DOM nodes, the terminal determines that an injection vulnerability exists in the server.

S408: If there are no different DOM nodes between the N first DOM nodes and the M second DOM nodes, the terminal outputs security prompt information.

In some feasible implementation manners, the terminal may count the number of the different DOM nodes determined above, and may determine whether the number of the different DOM nodes is greater than or equal to 1, and if so, indicate the N first DOM nodes. If there is at least one DOM node different from the M second DOM nodes, the terminal may determine that an injection vulnerability exists in the above server. If not, it means that there are no different DOM nodes between the N first DOM nodes and the M second DOM nodes, then the terminal can output a security prompt message, which is used to prompt that there is no injection in the server Loophole. This is because if the above server filters user data (that is, there is no injection vulnerability), then the true logical SQL statement inserted in step S402 and the false logical SQL statement inserted in step S403 will be filtered by the above server. If the content of the first page and the second page are the same, the content of the first page and the second page will be the same. Therefore, after parsing the content of the first page and the second page according to the DOM, there will be no different DOM nodes. In the embodiment of the present application, when it is determined that there is no injection vulnerability in the server, the security prompt information is output, which can improve the user experience.

In some feasible implementation manners, after determining that an injection vulnerability exists in the server, the terminal may output alarm prompt information. The alarm prompt information may include a parameter field of the URL of the target HTTP request. The alarm prompt information may be used for prompt programming. Personnel processing the injection loopholes in the parameter field of the URL in the above server can prevent the information of customers using the above server from being leaked, resulting in the loss of customer's property. At the same time, it is possible to find out where there are injection holes in the server faster, so that programmers can process the places where there are injection holes in the server faster.

The embodiment of the present application determines a target request for injection vulnerability detection, inserts a field of a first logical type into a parameter field of a uniform resource locator URL of the target request, to obtain a first request, and inserts a uniform resource locator URL in the target request. Insert a field of the second logical type into the parameter field of the, get the second request, and then send the first request and the second request to the server, and receive the first page content returned by the server for the first request and the second returned by the server for the second request Page content, and obtain the first parsing result of the first page content and the second parsing result of the second page content, and each first DOM node in the N first DOM nodes and each second DOM in the M second DOM nodes The nodes are matched to determine different DOM nodes between the N first DOM nodes and the M second DOM nodes. When there are at least one different DOM node between the N first DOM nodes and the M second DOM nodes, it is determined that there is an injection vulnerability in the server; when the N first DOM nodes and the M second DOM nodes are not When there are different DOM nodes, the security prompt information is output, which can reduce the calculation amount of the terminal and reduce the calculation difficulty, thereby improving the processing efficiency of detecting injection vulnerabilities.

6 is a schematic block diagram of an injection vulnerability detection device according to an embodiment of the present application. The injection vulnerability detection device in the embodiment of the present application includes:

The first determining module 10 is configured to determine a target request for injection vulnerability detection.

The second determining module 20 is configured to determine the first request and the second request according to the target request determined by the first determining module 10. The first request is determined by inserting a field of a first logical type into the target request, and the second request is a request determined by inserting a field of a second logical type into the target request.

The transceiver module 30 is configured to send the first request and the second request determined by the second determining module 20 to the server, and receive the first page content returned by the server for the first request and the first page content returned by the server for the second request. Content of the second page.

The obtaining module 40 is configured to obtain a first analysis result of the first page content received by the transceiver module 30 and a second analysis result of the second page content received by the transceiver module 30. The first parsing result includes N first document object model DOM nodes, and the second parsing result includes M second DOM nodes, where N and M are integers greater than or equal to 1.

The third determining module 50 is configured to determine that an injection vulnerability exists in the server when there are at least one different DOM node between the N first DOM nodes and the M second DOM nodes.

In some feasible implementation manners, the foregoing second determining module 20 is specifically configured to:

Inserting a field of a first logical type into a parameter field of the uniform resource locator URL of the target request determined by the first determining module 10 to obtain the first request; the target request of the target request determined by the first determining module 10 A field of the second logical type is inserted into the parameter field of the URL to obtain the second request.

Inserting a field of a first logical type into a target field of the target request determined by the first determining module 10 to obtain the first request; inserting a second in the target field of the target request determined by the first determining module 10 A field of logical type to get the second request. The target field includes one or more of a Host field, a Referer field, and a Cookie field.

In some feasible implementations, the device further includes a matching module 60. The matching module 60 is configured to match each first DOM node in the N first DOM nodes obtained by the obtaining module 40 with each second DOM node in the M second DOM nodes to determine the N first DOM nodes. Whether there are different DOM nodes between the DOM node and the M second DOM nodes.

In some feasible implementation manners, the apparatus further includes an output module 70, which is used when there are no different DOM nodes between the N first DOM nodes and the M second DOM nodes, Output a safety prompt message. The security prompt information is used to indicate that the injection vulnerability does not exist in the server.

In some feasible implementation manners, the output module 70 is further configured to output alarm prompt information after determining that an injection vulnerability exists in the server, and the alarm prompt information is used to prompt processing of the injection vulnerability of the server.

In some feasible implementation manners, the foregoing obtaining module 40 is specifically configured to:

Parse the content of the first page according to the document object model DOM to obtain N first DOM nodes;

Parse the content of the second page according to the DOM to obtain M second DOM nodes.

In some feasible implementation manners, the field of the first logical type is a structured query of true logic; the field of the second logical type is a structured query of false logic.

In specific implementation, the above-mentioned injection vulnerability detection device may implement the implementation manner provided by each step in the implementation manner provided in FIG. 2 or FIG. 4 through the foregoing modules to implement the functions implemented in the foregoing embodiments. For details, refer to the foregoing. The corresponding description provided by each step in the method embodiment shown in FIG. 2 or FIG. 4 is not repeated here.

In the embodiment of the present application, the injection vulnerability detection device may determine a target request for injection vulnerability detection, determine a first request and a second request according to the target request, and send the first request and the second request to a server. Request, receiving the first page content returned by the server for the first request and the second page content returned for the second request; and then obtaining the first parsing result of the first page content and the first page content of the second page content Two parsing results. The first parsing result includes N DOM nodes, and the second parsing result includes M second DOM nodes. For the same DOM node, it is determined that an injection vulnerability exists in the server, which can reduce the calculation amount and reduce the calculation difficulty, thereby improving the processing efficiency of detecting the injection vulnerability.

7 is a schematic block diagram of a terminal provided by an embodiment of the present application. As shown in FIG. 7, the terminal in the embodiment of the present application may include: one or more processors 701; one or more input devices 702, one or more output devices 703, and a memory 704. The processor 701, the input device 702, the output device 703, and the memory 704 are connected through a bus 705. The memory 702 is configured to store a computer program, the computer program includes program instructions, and the processor 701 is configured to execute the program instructions stored in the memory 702. The processor 701 is configured to call the program instruction for execution:

Identify target requests for injection vulnerability detection;

A first request and a second request are determined according to the target request, the first request is determined by inserting a field of a first logical type in the target request, and the second request is inserting a field of a second logical type in the target request determine.

The output device 703 is configured to send the first request and the second request to the server; the input device 702 is configured to receive the first page content returned by the server for the first request and the second page returned for the second request content.

The processor 701 is further configured to call the program instruction for execution:

It should be understood that, in the embodiment of the present application, the processor 701 may be a central processing unit (CPU), and the processor may also be another general-purpose processor or a digital signal processor (DSP). , Application specific integrated circuit (ASIC), ready-made programmable gate array (field-programmable gate array), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The input device 702 may include a receiver, a receiving program interface, and the like, and the output device 703 may include a transmitter, a sending program interface, and the like.

The memory 704 may include a read-only memory and a random access memory, and provide instructions and data to the processor 701. A portion of the memory 704 may also include non-volatile random access memory. For example, the memory 704 may also store device type information.

In specific implementation, the processor 701, the input device 702, and the output device 703 described in the embodiments of the present application may execute the implementation manner described in the injection vulnerability detection method provided in the embodiments of the present application, and may also execute The implementation manner of the described injection vulnerability detection device is not repeated here.

An embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, the injection shown in FIG. 2 or FIG. For details of the vulnerability detection method, please refer to the description of the embodiment shown in FIG. 2 or FIG. 4, and details are not described herein again.

The computer-readable storage medium may be an injection vulnerability detection device or an internal storage unit of a terminal according to any of the foregoing embodiments, such as a hard disk or a memory of the terminal. The computer-readable storage medium may also be an external storage device of the terminal, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, and a flash memory card provided on the terminal. (flash card) and so on. Further, the computer-readable storage medium may include both an internal storage unit of the terminal and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the terminal. The computer-readable storage medium can also be used to temporarily store data that has been or will be output.

The above are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present invention. It should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

An injection vulnerability detection method, comprising:

Identify target requests for injection vulnerability detection;

A first request and a second request are determined according to the target request. The first request is a request determined by inserting a field of a first logical type in the target request, and the second request is determined by the target request. Determine the field of the second logical type inserted;

Sending the first request and the second request to a server, and receiving the first page content returned by the server for the first request and the second page content returned for the second request;

Acquiring a first parsing result of the first page content and a second parsing result of the second page content, the first parsing result includes N first document object model DOM nodes, and the second parsing result includes M Second DOM nodes, where N and M are integers greater than or equal to 1;

If at least one different DOM node exists between the N first DOM nodes and the M second DOM nodes, it is determined that an injection vulnerability exists in the server.
The method according to claim 1, wherein determining the first request and the second request according to the target request comprises:

Inserting a field of a first logical type into a parameter field of the uniform resource locator URL of the target request to obtain the first request;

A field of a second logical type is inserted into a parameter field of the URL of the target request to obtain the second request.
The method according to claim 1, wherein determining the first request and the second request according to the target request comprises:

Inserting a field of a first logical type into a target field of the target request to obtain the first request;

Inserting a field of a second logical type into the target field of the target request to obtain the second request;

The target field includes one or more of a Host field, a Referer field, and a Cookie field.
The method according to any one of claims 1 to 3, wherein after obtaining the first parsing result of the first page content and the second parsing result of the second page content, the method further include:

Matching each first DOM node in the N first DOM nodes with each second DOM node in the M second DOM nodes to determine the N first DOM nodes and the M second DOM Whether there are different DOM nodes between the nodes.
The method according to any one of claims 1-4, further comprising:

If there are no different DOM nodes between the N first DOM nodes and the M second DOM nodes, a security prompt message is output, and the security prompt information is used to prompt that the server does not exist. Inject holes.
The method according to any one of claims 1-5, wherein the acquiring a first parsing result of the first page content and a second parsing result of the second page content comprises:

Parse the first page content according to the document object model DOM to obtain N first DOM nodes;

The content of the second page is parsed according to the DOM to obtain M second DOM nodes.
The method according to any one of claims 1-6, wherein the fields of the first logical type are structured query statements of true logic; and the fields of the second logical type are structured queries of false logic. Statement.
An injection vulnerability detection device, comprising:

A first determining module, configured to determine a target request for injection vulnerability detection;

A second determining module, configured to determine a first request and a second request according to the target request, where the first request is a request determined by inserting a field of a first logical type in the target request, the second request The request is determined by inserting a field of a second logical type in the target request;

A transceiver module, configured to send the first request and the second request to a server, and receive the first page content returned by the server for the first request and the second page content returned for the second request ;

An obtaining module, configured to obtain a first analysis result of the first page content and a second analysis result of the second page content, where the first analysis result includes N first document object model DOM nodes, and the first The second analysis result includes M second DOM nodes, where N and M are integers greater than or equal to 1.

A third determining module is configured to determine that an injection vulnerability exists in the server when there are at least one different DOM node between the N first DOM nodes and the M second DOM nodes.
The apparatus according to claim 8, wherein the second determining module is specifically configured to:

Inserting a field of a first logical type into a parameter field of the uniform resource locator URL of the target request to obtain the first request;

A field of a second logical type is inserted into a parameter field of the URL of the target request to obtain the second request.
The apparatus according to claim 8, wherein the second determining module is specifically configured to:

Inserting a field of a first logical type into a target field of the target request to obtain the first request;

Inserting a field of a second logical type into the target field of the target request to obtain the second request;

The target field includes one or more of a Host field, a Referer field, and a Cookie field.
The device according to any one of claims 8 to 10, wherein the device further comprises:

A matching module, configured to match each first DOM node in the N first DOM nodes obtained by the obtaining module with each second DOM node in the M second DOM nodes to determine the N first Whether a different DOM node exists between a DOM node and the M second DOM nodes.
The device according to any one of claims 8-11, wherein the device further comprises:

An output module, configured to output security prompt information when there are no different DOM nodes between the N first DOM nodes and the M second DOM nodes, and the security prompt information is used to prompt the server The injection vulnerability does not exist in.
The device according to any one of claims 8-12, wherein the obtaining module is specifically configured to:

Parse the first page content according to the document object model DOM to obtain N first DOM nodes;

The content of the second page is parsed according to the DOM to obtain M second DOM nodes.
The device according to any one of claims 8-13, wherein the fields of the first logical type are structured query statements of true logic; and the fields of the second logical type are structured queries of false logic. Statement.
A terminal is characterized in that it comprises a processor, an input device, an output device, and a memory, and the processor, the input device, the output device, and the memory are connected to each other, wherein the memory is used to store a computer program, and the computer program Including program instructions, the processor is configured to execute the program instructions of the memory, wherein:

The processor is configured to determine a target request for injection vulnerability detection; and determine a first request and a second request according to the target request, where the first request is obtained by inserting a first logical type into the target request A field determination request, the second request is determined by inserting a field of a second logical type in the target request;

The output device is configured to send the first request and the second request to a server;

The input device is configured to receive first page content returned by the server for the first request and second page content returned for the second request;

The processor is further configured to obtain a first analysis result of the first page content and a second analysis result of the second page content, where the first analysis result includes N first document object model DOM nodes, The second parsing result includes M second DOM nodes, and N and M are integers greater than or equal to 1; when between the N first DOM nodes and the M second DOM nodes When there is at least one different DOM node, it is determined that an injection vulnerability exists in the server.
The terminal according to claim 15, wherein the processor is specifically configured to:

Inserting a field of a first logical type into a parameter field of the uniform resource locator URL of the target request to obtain the first request;

A field of a second logical type is inserted into a parameter field of the URL of the target request to obtain the second request.
The terminal according to claim 15, wherein the processor is specifically configured to:

Inserting a field of a first logical type into a target field of the target request to obtain the first request;

Inserting a field of a second logical type into the target field of the target request to obtain the second request;

The target field includes one or more of a Host field, a Referer field, and a Cookie field.
The terminal according to any one of claims 15-17, wherein the processor is further configured to:

Matching each first DOM node in the N first DOM nodes with each second DOM node in the M second DOM nodes to determine the N first DOM nodes and the M second DOM Whether there are different DOM nodes between the nodes.
The terminal according to any one of claims 15 to 18, wherein the output device is further configured to:

When there are no different DOM nodes between the N first DOM nodes and the M second DOM nodes, a security prompt message is output, and the security prompt information is used to prompt that the server does not exist. Inject holes.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of 1-7 is required.