WO2020073493A1

WO2020073493A1 - Sql injection vulnerability detection method, apparatus and device, and readable storage medium

Info

Publication number: WO2020073493A1
Application number: PCT/CN2018/122811
Authority: WO
Inventors: 何双宁
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-10-11
Filing date: 2018-12-21
Publication date: 2020-04-16
Also published as: CN109657472A; CN109657472B

Abstract

An SQL injection vulnerability detection method, apparatus and device, and a readable storage medium, the method comprising the steps of: determining a detection point of a uniform resource locator (URL) request for a website to be tested after obtaining the URL request, and constructing a sequence request for Boolean logic parameters corresponding to the detection point (S10); acquiring response pages obtained after executing the URL request and the sequence request, and performing similarity analysis on the response pages to obtain a similarity value between the response page corresponding to the URL request and a response page corresponding to each request in the sequence request (S20); and if the similarity value satisfies a preset condition, determining that an SQL injection vulnerability exists in the URL request (S30). With the present method, whether the SQL injection vulnerability exists in the URL request or not is determined according to the similarity between the response pages, and the accuracy rate of detecting SQL injection vulnerability is thus improved.

Description

SQL injection vulnerability detection method, device, equipment and readable storage medium

This application requires the priority of the Chinese patent application submitted to the China Patent Office on October 11, 2018 with the application number 201811188829.3 and the invention titled "SQL injection vulnerability detection method, device, equipment and readable storage medium" Incorporated by reference in the application.

Technical field

The present application relates to the field of communication technology, and in particular to a method, device, device, and readable storage medium for SQL injection vulnerability detection.

Background technique

The current detection method for SQL (Structured Query Language, Structured Query Language) injection vulnerability is a detection method based on Boolean judgment. The current SQL injection vulnerability detection method based on boolean judgment, in terms of detecting sequence requests, is usually an original URL request, and then construct a logically true SQL statement parameter value, a logically false SQL statement parameter value request, a total of 3 requests . When comparing and judging the website response page of multiple requests, it is usually based on the content length of the website response (Content-Length) to determine whether there is a SQL injection vulnerability. However, due to instability factors such as network fluctuations, changes in server load status, and the emergence of dynamic web pages in the Web2.0 era, the accuracy of detecting whether a URL request has a SQL injection vulnerability through URL detection is low.

Summary of the invention

The main purpose of this application is to provide a method, device, equipment and readable storage medium for SQL injection vulnerability detection, aiming to solve the existing technical problem of low accuracy in detecting SQL injection vulnerability.

In order to achieve the above purpose, this application provides a SQL injection vulnerability detection method. The SQL injection vulnerability detection method includes the steps of:

After obtaining the URL request of the uniform resource locator of the website to be tested, determine the detection point of the URL request, and construct a sequence request corresponding to the detection point corresponding to a Boolean logic parameter;

Obtaining a response page obtained after executing the URL request and the sequence request, and performing a similarity analysis on the response page to obtain a relationship between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request Similarity value

If the similarity value meets a preset condition, it is determined that the URL request has a SQL injection vulnerability.

In addition, in order to achieve the above purpose, the present application also provides a SQL injection vulnerability detection device. The SQL injection vulnerability detection device includes:

The determining module is used to determine the detection point of the URL request after obtaining the URL request of the uniform resource locator of the website to be tested;

A construction module, configured to construct a sequence request corresponding to a Boolean logic parameter of the detection point;

An obtaining module, used to obtain a response page obtained after executing the URL request and the sequence request;

An analysis module, configured to perform a similarity analysis on the response page to obtain a similarity value between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request;

The determining module is further configured to determine that the URL request has a SQL injection vulnerability if the similarity value meets a preset condition.

In addition, in order to achieve the above object, the present application also provides a SQL injection vulnerability detection device, the SQL injection vulnerability detection device includes a memory, a processor, and a computer that is stored on the memory and can run on the processor Read instructions, when the computer-readable instructions are executed by the processor, implement the steps of the SQL injection vulnerability detection method as described above.

In addition, in order to achieve the above object, the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-readable instructions, the computer-readable instructions are executed by the processor to achieve the above Steps of SQL injection vulnerability detection method.

This application constructs a sequence request corresponding to a Boolean logic parameter corresponding to a URL request detection point, executes the URL request and the URL request corresponding to the sequence request, obtains the response page obtained after executing the URL request and the sequence request, and performs a similarity analysis on the response page to obtain the URL The similarity value between the response page corresponding to the request and the response page corresponding to each request in the sequence request; if the similarity value meets the preset condition, it is determined that there is a SQL injection vulnerability in the URL request, which is judged according to the similarity between the response pages Whether there are SQL injection vulnerabilities in URL requests, which improves the accuracy of detecting SQL injection vulnerabilities.

BRIEF DESCRIPTION

FIG. 1 is a schematic flowchart of a preferred embodiment of a method for detecting SQL injection vulnerability in this application;

2 is a functional schematic block diagram of a preferred embodiment of a SQL injection vulnerability detection device of the present application;

FIG. 3 is a schematic structural diagram of a hardware operating environment involved in an embodiment of the present application.

The implementation, functional characteristics and advantages of the present application will be further described in conjunction with the embodiments and with reference to the drawings.

detailed description

It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

This application provides a SQL injection vulnerability detection method. Referring to FIG. 1, FIG. 1 is a schematic flowchart of a preferred embodiment of a SQL injection vulnerability detection method of this application.

The embodiment of the present application provides an embodiment of the SQL injection vulnerability detection method. It should be noted that although the logic sequence is shown in the flowchart, in some cases, the illustrated sequence may be performed in an order different from here. Or describe the steps.

SQL injection vulnerability detection methods are applied to servers or terminals. Terminals can include mobile terminals such as mobile phones, tablets, laptops, PDAs, personal digital assistants (Personal Digital Assistants, PDAs), and fixed terminals such as digital TVs and desktop computers. terminal. In each embodiment of the SQL injection vulnerability detection method, for convenience of description, the execution body is omitted to explain each embodiment. SQL injection vulnerability detection methods include:

Step S10: After obtaining the URL request of the uniform resource locator of the website to be tested, determine the detection point of the URL request, and construct a sequence request corresponding to a Boolean logic parameter of the detection point.

After obtaining the URL request of the website to be tested, the detection point in the URL request is determined, and a sequence request of Boolean logic parameters corresponding to the detection point is constructed. Among them, a URL request corresponds to at least one detection point. A URL detection point is a place where all users of the HTTP (Hyper Text Transfer Protocol) protocol request initiated to the website can construct input when accessing a URL to initiate a request to the website. For example, GET parameters, POST form form parameters, POST JSON (JavaScript Object Notation, JavaScript object notation) format data values, Request header fields and so on. If a URL request is: http://www.test.com/test? param_a = 1, then the GET parameter param_a is a detection point. The URL request is an initial request to enter the website through web crawlers or network traffic.

It should be noted that the constructed Boolean logic parameter sequence request includes at least one logically true condition URL request and one logically false condition URL request. If there are multiple detection points in the URL request, it is necessary to construct a corresponding Boolean logic parameter sequence request for each detection point. As for the URL request described above, a request for constructing a logically true parameter value at the parameter value of the URL detection point param_a, that is, constructing a logically true condition URL request, such as a logically true condition URL request can be expressed as: http: / /www.test.com/test? param_a = 1 and 1 = 1, where "and 1 = 1" is a constructed Boolean logic true SQL (Structured Query Language, Structured Query Language) statement; construct a logical false parameter at the parameter value of the URL detection point param_a The value request is a URL request that constructs a logical false condition. For example, a URL request for a logical false condition can be expressed as: http://www.test.com/test? param_a = 1 and 1 = 2, where “and 1 = 2” is the constructed Boolean logic false SQL statement.

Step S20: Obtain a response page obtained after executing the URL request and the sequence request, and perform a similarity analysis on the response page to obtain a response page corresponding to the URL request and a response page corresponding to each request in the sequence request The similarity value between.

After constructing the sequence request of the Boolean logic parameter corresponding to the detection point of the URL request, execute the URL request in the website to be tested, and execute each URL request corresponding to the sequence request in the website to be tested, and obtain the corresponding response page, and Perform a similarity analysis on the obtained response page to obtain a similarity value between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request. It should be noted that each request corresponds to a response page. Therefore, there are at least three response pages obtained in the embodiments of the present application, which are respectively a response page corresponding to a URL request and a response page corresponding to a logically true URL request. The response page corresponding to the URL request with logically false conditions. Among them, the algorithms used for similarity analysis include but are not limited to cosine distance, Euclidean distance and Jaccard coefficient.

Further, step S20 includes:

Step a: Obtain the response page obtained after executing the URL request and the sequence request, and calculate the Jieka between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request German coefficient.

Specifically, the response page obtained after executing the URL request is recorded as the first response page, and the response page obtained after executing each request in the sequence request is recorded as the sequence response page, and the first response page and each The Jeckard coefficients between pages in the sequence response. The Jaccard coefficient is defined as the ratio of the intersection between set A and set B and the union between set A and set B, defined as follows:

Among them, when both set A and set B are empty sets, the Jaccard coefficient J (A, B) is defined as 1, that is, the value of J (A, B) is 1, J (A, B) ∈ [0, 1], the closer the value of J (A, B) is to 1, the more similar the response page corresponding to set A is to the response page corresponding to set B. When J (A, B) = 1, it indicates that the response page corresponding to set A The same response page as set B.

Further, step a includes:

Step a1: Obtain a response page corresponding to the execution of the URL request and the sequence request, and divide the text corresponding to the first response page and the sequence response page into character segments according to a preset line break.

Specifically, the first response page obtained after executing the URL request, and the sequence response page obtained after executing each request in the sequence request are obtained, the text in the first response page and the sequence response page is obtained, and line breaks in the text are used The character divides the text corresponding to the first response page and the sequence response page into character segments. It should be noted that, during the process of generating the response page, the corresponding line break will be automatically generated in the text corresponding to the response page. When the types of the first response page and the sequence response page are different, the corresponding line breaks are also different. For example, HTML (Hyper Text Markup Language, Super Text Markup Language) document corresponding line break is , can insert a simple line break, tag is an empty tag (meaning it has no end tag, so This is wrong: ). In XHTML (eXtensible HyperText Markup Language, Extensible Hypertext Markup Language), put the end tag in the start tag, which is . The newline character in a word document is a newline symbol, and its function is to display a newline, but it is not a true paragraph mark, and its newline is not a restart of a paragraph in the true sense, so the text divided by the newline is actually still a paragraph In, all operations based on paragraphs in the word document will not recognize the newline character as the end of the paragraph.

Further, in order to improve the efficiency of obtaining corresponding elements of the first response page and the sequence response page, after the first response page and the sequence response page are obtained, it is determined whether the first response page and the sequence response page are HTML documents. After determining that a response page is an HTML document, perform DOM parsing (Document Object Model) on the HTML document to generate a DOM tree corresponding to the response page, and extract text from the DOM nodes of the DOM tree to obtain the The corresponding text on the response page, and then divide the text into character segments according to the line breaks. When it is determined that a response page is not an HTML document, the text corresponding to the response page that is not an HTML document is divided into multiple character segments directly according to the corresponding preset line breaks.

Specifically, the process of detecting whether the response page is an HTML document is: detecting whether the response page carries HTML tags, where HTML DOM defines a standard method for accessing and manipulating the HTML document; DOM expresses the HTML document as a tree structure. It should be noted that HTML tags are pre-set and stored according to the HTML document in the form of tree structure. If it is detected that the response page carries HTML tags, it is determined that the response page is an HTML document; if it is detected that the response page does not carry HTML tags, it is determined that the response page is not an HTML document.

Step a2: Divide the character segment into character strings according to a preset separator, and correspondingly obtain elements corresponding to the first response page and the sequence response page.

After the character segments corresponding to the first response page and the sequence response page are obtained, the character segments are divided into corresponding character strings according to the preset separators, and the elements in the corresponding set of the first response page and the corresponding set of the sequence response page are correspondingly obtained Elements. Among them, the separator includes but is not limited to spaces, commas, semicolons, periods, exclamations, and question marks in the character segment. It can be understood that the string corresponding to the first response page is the element in the set corresponding to the first response page, and the string corresponding to the sequence response page is the element in the set corresponding to the sequence response page. In the response page, a string is the first element.

Step a3: Calculate the intersection and union of elements between the first response page and each of the sequence response pages, and divide the intersection by the corresponding union to obtain the corresponding Jaccard coefficient.

After obtaining the elements of the corresponding set of the first response page and the sequence response page, calculate the intersection and union of the first response page and each sequence response page element, and divide the calculated intersection by the corresponding union to obtain the corresponding Jaccard coefficient. As can be seen from the above definition of the Jaccard coefficient, A can represent a set of elements corresponding to the first response page, and B can represent a set of elements corresponding to one of the sequence response pages.

Step b: Corresponding to the Jaccard coefficient as the similarity value between the first response page and each of the sequence response pages.

After calculating the Jeckard coefficient between the first response page and each sequence response page, the Jeckard coefficient is correspondingly used as the similarity value between the first response page and each sequence response page. It can be understood that, when the value of the Jeckard coefficient approaches 1, the similarity between the first response page and the corresponding sequence response page; when the value of the Jeckard coefficient approaches 0, indicates the first response The less similar the page is to the corresponding sequence response page.

Step S30, if the similarity value meets a preset condition, it is determined that the URL request has a SQL injection vulnerability.

In the embodiment of the present application, the number of URL requests corresponding to sequence requests is different, and the corresponding preset conditions are also different, that is, the number of sequence response pages is different, and the corresponding preset conditions are different. When it is determined that the similarity value satisfies the preset condition, it is determined that there is a SQL injection vulnerability in the URL request, that is, a SQL injection vulnerability is determined on the website to be tested. The SQL injection vulnerability is due to a problem with the input verification of the WEB application, which leads the attacker to inject maliciously constructed SQL statements into the back-end database through the input point of the WEB application for execution, and achieve the purpose of forming a malicious attack on the database. The full name of WEB is World Wide Web, which is the global wide area network, also known as the World Wide Web, commonly known as the website; it is a global, dynamic, interactive, cross-platform distributed graphical information system based on hypertext and HTTP.

In this embodiment, a sequence request corresponding to a Boolean logic parameter corresponding to a URL request detection point is constructed, a URL request corresponding to the URL request and the sequence request is executed, a response page obtained after executing the URL request and the sequence request is obtained, and a similarity analysis is performed on the response page to obtain The similarity value between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request; if the similarity value meets the preset condition, it is determined that there is a SQL injection vulnerability in the URL request. Determine whether there is a SQL injection vulnerability in the URL request, which improves the accuracy of detecting SQL injection vulnerabilities.

Further, a second embodiment of the SQL injection vulnerability detection method of this application is proposed.

The difference between the second embodiment of the SQL injection vulnerability detection method and the first embodiment of the SQL injection vulnerability detection method is that the SQL injection vulnerability detection method further includes:

In step c, a request for constructing a logically true condition for each detection point in the URL request is recorded as the first true request.

In the process of constructing a sequence request corresponding to a Boolean logic parameter of a URL request detection point, a logical true condition URL request is constructed for each detection point in the URL request, which is recorded as the first true request.

Step d: Construct a request for a logical false condition for each detection point in the URL request, and record it as a first false request to form a sequence request including the first true request and the first false request.

Construct a logical false condition URL request for each detection point in the URL request, and record it as the first false request. Among them, the first true request and the first false request constitute a sequence request corresponding to the URL request detection point.

Step S30 includes:

Step e, if it is determined that the first Jaccard coefficient between the first response page corresponding to the URL request and the second response page corresponding to the first true request is greater than a first threshold, the first response page is determined Whether the second Jaccard coefficient between the third response pages corresponding to the first fake request is less than the second threshold.

After obtaining the first true request and the first false request, execute the URL request, the first true request, and the first false request in the website to be tested, and obtain the first response page obtained after executing the URL request. After executing the first true request The resulting second response page, and the third response page obtained after executing the first fake request, and calculating the Jakarta coefficient between the first and second response pages, recorded as the first Jakarta coefficient, and The Jeckard coefficient between the first and third response pages is calculated and recorded as the second Jeckard coefficient.

It can be understood that the first Jaccard coefficient and the second Jaccard coefficient are the similarity values between corresponding response pages. When the first and second Jaccard coefficients are obtained, it is determined whether the first and second Jaccard coefficients satisfy the preset conditions. Specifically, it is determined whether the first Jaccard coefficient is greater than the first threshold. If it is determined that the first Jaccard coefficient is greater than the first threshold, it is determined whether the second Jaccard coefficient is less than the second threshold. If it is determined that the first Jaccard coefficient is less than or equal to the first threshold, it indicates that there is no SQL injection vulnerability in the detection point corresponding to the URL request. At this time, it is judged whether the URL request has an undetected detection point, For the detection point, use the same method to detect whether there is a SQL injection vulnerability in the above detection point, and continue to detect the detection point that has not been detected in the URL request, until all the detection points of the URL request are free of SQL injection vulnerability, determine the URL There is no SQL injection vulnerability in the request.

The first threshold and the second threshold may be set according to specific needs, and the first threshold and the second threshold may be equal or different. For example, both the first threshold and the second threshold can be set to 0.99, or the first threshold can be set to 0.99, the second threshold can be set to 0.98, and so on.

It should be noted that the response page may change dynamically. The reason for the change may be caused by changes in the current time and current weather status of the website to be tested; or due to network fluctuations, some content in the response page has not been loaded. Caused by the completion. However, under normal circumstances, the content of the response page is very small, so the similarity between the first response page and the second response page will be high.

Step f: If the second Jaccard coefficient is less than the second threshold, it is determined that there is a SQL injection vulnerability in the URL request.

If it is determined that the second Jaccard coefficient is less than the second threshold, it is determined that there is a SQL injection vulnerability in the corresponding detection point of the URL request, that is, the URL request has SQL injection vulnerability; if it is determined that the second Jaccard coefficient is greater than or equal to the second threshold, It is determined that there is no SQL injection vulnerability at the corresponding detection point in the URL request.

It should be noted that the similarity analysis is performed on the first response page and the second response page to determine whether the current test environment is stable. The test environment includes a network environment and a server environment. It can be understood that the URL request corresponding to the second response page is a true request. If the test environment is stable, the similarity between the first response page and the second response page should be close to 1, or equal to 1, therefore, the first The threshold should be set to a value close to 1, or equal to 1. By performing similarity analysis on the first response page and the third response page, it is determined whether the corresponding detection point in the URL request may have a SQL injection vulnerability due to the execution of the SQL statement. It can be understood that if the constructed Boolean logic fake SQL statement is executed in the background of the website server to be tested, the response page between the URL request and the first fake request should be different, or even completely different, so the second The threshold should be set to a value close to 1, or equal to 1.

In this embodiment, by constructing a true request and a false request, and then analyzing the relationship between the first Jaccard coefficient and the first threshold between the response page corresponding to the URL request and the response page corresponding to the first true request, and analyzing the URL The relationship between the second Jackard coefficient and the second threshold between the response page corresponding to the request and the response page corresponding to the first fake request, when the first Jackard coefficient is greater than the first threshold and the second Jackard coefficient When it is less than the second threshold, it is determined that there is a SQL injection vulnerability in the URL request, which improves the accuracy of detecting the SQL injection vulnerability.

Further, a third embodiment of the SQL injection vulnerability detection method of this application is proposed.

The difference between the third embodiment of the SQL injection vulnerability detection method and the first or second embodiment of the SQL injection vulnerability detection method is that step d includes:

Step d1: A request to construct a logical false condition for each detection point in the URL request is recorded as a first false request, and a confirmation request to construct a logical true condition for the first true request is recorded as a second true request.

Construct a logical false condition URL request for each detection point in the URL request and record it as the first false request, and construct a logical true condition URL confirmation request for the first true request and record it as the second true request.

Step d2, construct a confirmation request of a logical false condition for the first false request, and record it as a second false request to form a request including the first true request, the first false request, the second true request, and the second false request Sequence request.

After constructing the first fake request, construct a URL confirmation request for the logically false condition for the first fake request, and record it as the second fake request. Put the first true request, the first fake request, the second true request, and the second fake request The request constitutes a sequence request. It should be noted that, in this embodiment, the sequence between the first true request, the first false request, the second true request, and the second false request is not limited. Referring to the URL request described in the first embodiment, the corresponding first true request may be http://www.test.com/test? param_a = 1 and 1 = 1, where “and 1 = 1” is the constructed Boolean logic true SQL statement; the first fake request can be http://www.test.com/test? param_a = 1 and 1 = 2, where “and 1 = 2” is the constructed Boolean logic true SQL statement; the second true request can be http://www.test.com/test? param_a = 1 and 3 * 3 = 9, where “and 3 * 3 = 9” is the constructed Boolean logic true SQL statement, which is different from the first constructed logic true “and 1 = 1”; the second false The request can be http://www.test.com/test? param_a = 1 and 3 * 3 = 8, where “and 3 * 3 = 8” is the constructed Boolean logic false SQL statement, which is different from the first constructed logical false “and 1 = 2”. It can be seen that the Boolean logic SQL statements corresponding to the first true request and the second true request are different, and the Boolean logic SQL statements corresponding to the first false request and the second false request are also different.

Step S30 also includes:

Step g: If it is determined that the first Jakarta coefficient between the first response page corresponding to the URL request and the second response page corresponding to the first true request is greater than a first threshold, the first response page is determined Whether the second Jaccard coefficient between the third response pages corresponding to the first fake request is less than the second threshold.

After constructing the first true request, the second true request, the first false request and the second false request, execute the URL request, the first true request, the first false request, the second true request and the second in the website to be tested Fake request, the first response page obtained after executing the URL request, the second response page obtained after executing the first true request, the third response page obtained after executing the first false request, the third page obtained after executing the second true request Four response pages, and the fifth response page obtained after the execution of the second fake request, and calculate and calculate the Jackard coefficient between the first and second response pages, which is recorded as the first Jackard coefficient, and calculate the first The Jackard coefficient between a response page and the third response page is recorded as the second Jackard coefficient. If it is determined that the first Jaccard coefficient is greater than the first threshold, it is determined whether the second Jaccard coefficient is less than the second threshold.

Step h, if the second Jackard coefficient is less than the second threshold, determine a third Jackard coefficient between the first response page and the fourth response page corresponding to the second true request, And calculate the first difference between the third Jaccard coefficient and the first Jaccard coefficient.

If it is determined that the second Jackard coefficient is less than the second threshold, the third Jackard coefficient between the first and fourth response pages is calculated, and the third Jackard coefficient and the first Jackard coefficient are calculated. The difference between them is recorded as the first difference, and it is determined whether the first difference is less than the third threshold. The third threshold can be set according to specific needs, such as 0.01. It should be noted that, for ease of comparison, the first difference is the absolute value of the difference between the third Jaccard coefficient and the first Jaccard coefficient.

Step i, if the first difference is less than the third threshold, determine a fourth Jakarta coefficient between the first response page and the fifth response page corresponding to the second fake request, and calculate the The second difference between the fourth Jaccard coefficient and the second Jaccard coefficient.

If it is determined that the first difference is less than the third threshold, the fourth Jaccard coefficient between the first response page and the fifth response page corresponding to the second fake request is calculated, and the fourth Jaccard coefficient is subtracted from the second The Jeckard coefficient is used to calculate the difference between the fourth Jeckard coefficient and the second Jeckard coefficient, and is recorded as the second difference. It should be noted that, to facilitate comparison, the second difference is the absolute value of the difference between the fourth Jaccard coefficient and the second Jaccard coefficient.

After calculating the second difference, it is determined whether the second difference is less than the fourth threshold. The fourth threshold may be equal to the third threshold, or may not be equal to the third threshold. Further, if the first difference is greater than or equal to the third threshold, it is determined that there is no SQL injection vulnerability at the corresponding detection point in the URL request.

Step j, if the second difference is less than the fourth threshold, it is determined that there is a SQL injection vulnerability in the URL request.

If it is determined that the second difference is less than the fourth threshold, it is determined that there is a SQL injection vulnerability in the corresponding detection point in the URL request, that is, there is a SQL injection vulnerability in the website to be tested. Further, if it is determined that the second difference is greater than or equal to the fourth threshold, it is determined that there is no SQL injection vulnerability at the corresponding detection point in the URL request.

It should be noted that the process of calculating Jaccard coefficients has been described in detail in the first embodiment, and will not be described in detail in this embodiment. By performing a similarity analysis on the first response page and the fourth response page, the stability of the current test environment is confirmed, and the SQL injection execution result of the logically true condition is confirmed twice. By performing similarity analysis on the first response page and the fifth response page, it is again confirmed whether the corresponding detection point in the URL request has a SQL injection vulnerability due to the execution of the SQL statement.

In order to prove the stability of the test environment for SQL injection vulnerability detection, and to ensure the validity of the logic true detection constructed last time (first true request), a second confirmation request for logic true is initiated. If the test environment for this (second true request) SQL injection vulnerability detection is stable and there are indeed SQL injection vulnerabilities, then the third Jaccard coefficient and the first Jaccard coefficient will definitely be very close, or equal; therefore the third The absolute value of the difference between the Jeckard coefficient and the first Jeckard coefficient will be a value close to 0 or even equal to 0. It can be seen that the third threshold should be set to be equal to 0, or a value close to 0 .

In order to prove the stability of the test environment for SQL injection vulnerability detection and to ensure the validity of the logical false detection constructed last time (first false request), a second confirmation request for logical false is initiated. If the test environment for this (second fake request) SQL injection vulnerability detection is stable and there is indeed a SQL injection vulnerability, then the fourth Jedka coefficient and the second Jedka coefficient will definitely be very close, or equal; therefore the fourth The absolute value of the difference between the Jedka coefficient and the second Jedka coefficient will definitely be a value close to 0 or even equal to 0. Therefore, the fourth threshold should be set to a value equal to 0, or close to 0.

This embodiment constructs two true requests and two false requests, confirms the first true request through the second true request, ensures the validity of the logical true detection corresponding to the first true request, and confirms the first through the second false request A false request ensures the validity of the logical false detection corresponding to the first false request, further improves the accuracy of detecting SQL injection vulnerabilities, and reduces the false positive rate and false negative rate of SQL injection vulnerability detection. Among them, underreporting is in the detection of WEB security vulnerabilities. If a URL request is originally vulnerable, but is not detected, it is called underreporting. False positives are detected in WEB security vulnerabilities. If a URL request does not have vulnerabilities, it is mistakenly detected as vulnerabilities, which is called false positives.

In addition, referring to FIG. 2, the present application also provides a SQL injection vulnerability detection device. The SQL injection vulnerability detection device includes:

The determining module 10 is configured to determine the detection point of the URL request after obtaining the URL request of the uniform resource locator of the website to be tested;

A construction module 20, configured to construct a sequence request corresponding to a Boolean logic parameter of the detection point;

The obtaining module 30 is configured to obtain a response page obtained after executing the URL request and the sequence request;

The analysis module 40 is configured to perform similarity analysis on the response page to obtain a similarity value between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request;

The determining module 10 is further configured to determine that there is a SQL injection vulnerability in the URL request if the similarity value meets a preset condition.

Further, the constructing module 20 is further configured to construct a request for a logically true condition for each detection point in the URL request, and record it as the first true request; construct one for each detection point in the URL request The logically false condition request is recorded as a first false request to form a sequence request including the first true request and the first false request.

Further, the construction module 20 is further configured to construct a request for a logical false condition for each detection point in the URL request, denoted as a first false request, and construct a logical true condition for the first true request A confirmation request is recorded as a second true request; a confirmation request that constructs a logical false condition for the first false request is recorded as a second false request to form the first true request, the first false request, and the second true request The sequence request of the request and the second fake request.

Further, the determination module 10 further includes:

The first determining unit is configured to determine if the first Jaccard coefficient between the first response page corresponding to the URL request and the second response page corresponding to the first true request is greater than a first threshold Whether the second Jaccard coefficient between the first response page and the third response page corresponding to the first fake request is less than a second threshold;

The first determining unit is configured to determine that there is a SQL injection vulnerability in the URL request if the second Jaccard coefficient is less than the second threshold.

Further, the determination module 10 further includes:

A second judging unit, which is used for judging if the first Jaccard coefficient between the first response page corresponding to the URL request and the second response page corresponding to the first true request is greater than the first threshold Whether the second Jaccard coefficient between the first response page and the third response page corresponding to the first fake request is less than a second threshold;

A second determining unit, configured to determine the third master between the first response page and the fourth response page corresponding to the second true request if the second Jackard coefficient is less than the second threshold Card coefficient

A first calculation unit, configured to calculate a first difference between the third Jaccard coefficient and the first Jaccard coefficient;

The second determining unit is further configured to determine the fourth Jaccard between the first response page and the fifth response page corresponding to the second fake request if the first difference is less than the third threshold coefficient;

The first calculation unit is further used to calculate a second difference between the fourth Jaccard coefficient and the second Jaccard coefficient;

The second determining unit is further configured to determine that the URL request has a SQL injection vulnerability if the second difference is less than a fourth threshold.

Further, the analysis module 40 includes:

A second calculation unit, configured to calculate the Jackard coefficient between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request;

The third determining unit is configured to correspond the Jaccard coefficient as a similarity value between the first response page and each of the sequence response pages.

Further, the second calculation unit includes:

A segmentation subunit for segmenting the text corresponding to the first response page and the sequence response page into character segments according to a preset newline character; segmenting the character segment into a character string according to a preset separator, corresponding to Obtaining elements corresponding to the first response page and the sequence response page;

A calculation subunit, used for calculating the intersection and union of elements between the first response page and each of the sequence response pages, dividing the intersection by the corresponding union to obtain the corresponding Jaccard coefficient .

It should be noted that the embodiments of the SQL injection vulnerability detection device are basically the same as the embodiments of the SQL injection vulnerability detection method described above, and details are not repeated here.

In addition, this application also provides a SQL injection vulnerability detection device. As shown in FIG. 3, FIG. 3 is a schematic structural diagram of a hardware operating environment involved in a solution of an embodiment of the present application.

It should be noted that FIG. 3 is a schematic diagram of the hardware operating environment of the SQL injection vulnerability detection device. The SQL injection vulnerability detection device in the embodiment of the present application may be a terminal device such as a PC or a portable computer.

As shown in FIG. 3, the SQL injection vulnerability detection device may include: a processor 1001, such as a CPU, a memory 1005, a user interface 1003, a network interface 1004, and a communication bus 1002. Among them, the communication bus 1002 is used to implement connection communication between these components. The user interface 1003 may include a display (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the foregoing processor 1001.

Optionally, the SQL injection vulnerability detection device may also include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, and so on.

Those skilled in the art can understand that the structure of the SQL injection vulnerability detection device shown in FIG. 3 does not constitute a limitation on the SQL injection vulnerability detection device, and may include more or fewer components than the illustration, or a combination of certain components, Or different component arrangements.

As shown in FIG. 3, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and computer-readable instructions. Among them, the operating system is a program that manages and controls the hardware and software resources of the SQL injection vulnerability detection device, and supports the operation of computer-readable instructions and other software or programs.

In the SQL injection vulnerability detection device shown in FIG. 3, the user interface 1003 can be used for the terminal held by the user to perform data communication with the terminal held by the user; the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the processor 1001 It can be used to call computer-readable instructions stored in the memory 1005 and execute the steps of the SQL injection vulnerability detection method as described above.

The specific implementation of the SQL injection vulnerability detection device of the present application is basically the same as the above embodiments of the SQL injection vulnerability detection method, which will not be repeated here.

In addition, embodiments of the present application also provide a computer-readable storage medium having computer-readable instructions stored on the computer-readable storage medium, the computer-readable instructions being executed by a processor to implement the SQL injection vulnerability described above The steps of the detection method.

The specific implementation of the computer-readable storage medium of the present application is basically the same as the above embodiments of the SQL injection vulnerability detection method, which will not be repeated here.

It should be noted that in this article, the terms "include", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements It also includes other elements that are not explicitly listed, or include elements inherent to this process, method, article, or device. Without more restrictions, the element defined by the sentence "include one ..." does not exclude that there are other identical elements in the process, method, article or device that includes the element.

The sequence numbers of the above embodiments of the present application are for description only, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods in the above embodiments can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware, but in many cases the former is better Implementation. Based on this understanding, the technical solutions of the present application can essentially be embodied in the form of software products, and the computer software products are stored in a storage medium (such as ROM / RAM, magnetic disk, The CD-ROM includes several instructions to enable a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the embodiments of the present application.

The above are only the preferred embodiments of the present application, and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made by the description and drawings of this application, or directly or indirectly used in other related technical fields , The same reason is included in the scope of patent protection of this application.

Claims

A structured query language SQL injection vulnerability detection method, characterized in that the SQL injection vulnerability detection method includes the following steps:

After obtaining the URL request of the uniform resource locator of the website to be tested, determine the detection point of the URL request, and construct a sequence request corresponding to the detection point corresponding to a Boolean logic parameter;

Obtaining a response page obtained after executing the URL request and the sequence request, and performing a similarity analysis on the response page to obtain a relationship between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request Similarity value

If the similarity value meets a preset condition, it is determined that the URL request has a SQL injection vulnerability.
The SQL injection vulnerability detection method according to claim 1, wherein the step of constructing a sequence request corresponding to a Boolean logic parameter of the detection point comprises:

Construct a request for a logically true condition for each detection point in the URL request, and record it as the first true request;

Construct a request for a logical false condition for each detection point in the URL request, and record it as a first false request to form a sequence request including the first true request and the first false request.
The SQL injection vulnerability detection method according to claim 2, wherein the request for constructing a logical false condition for each detection point in the URL request is recorded as a first false request to form a The steps of the sequence request of the first true request and the first false request include:

A request for constructing a logically false condition for each detection point in the URL request is recorded as a first false request, and a confirmation request for a logically true condition for the first true request is recorded as a second true request;

A confirmation request for constructing a logical false condition for the first false request is recorded as a second false request to form a sequence request including the first true request, the first false request, the second true request, and the second false request.
The SQL injection vulnerability detection method according to claim 2, wherein the step of determining that there is a SQL injection vulnerability in the URL request if the similarity value satisfies a preset condition includes:

If it is determined that the first Jackard coefficient between the first response page corresponding to the URL request and the second response page corresponding to the first true request is greater than a first threshold, it is determined that the first response page and the Whether the second Jaccard coefficient between the third response pages corresponding to the first fake request is less than the second threshold;

If the second Jaccard coefficient is less than the second threshold, it is determined that there is a SQL injection vulnerability in the URL request.
The SQL injection vulnerability detection method according to claim 3, wherein the step of determining that there is a SQL injection vulnerability in the URL request if the similarity value satisfies a preset condition includes:

If it is determined that the first Jackard coefficient between the first response page corresponding to the URL request and the second response page corresponding to the first true request is greater than a first threshold, it is determined that the first response page and the Whether the second Jaccard coefficient between the third response pages corresponding to the first fake request is less than the second threshold;

If the second Jackard coefficient is less than the second threshold, determine the third Jackard coefficient between the first response page and the fourth response page corresponding to the second true request, and calculate the A first difference between the third Jaccard coefficient and the first Jaccard coefficient;

If the first difference is less than the third threshold, determine the fourth Jackard coefficient between the first response page and the fifth response page corresponding to the second fake request, and calculate the fourth A second difference between the Card's coefficient and the second Jackard's coefficient;

If the second difference is less than the fourth threshold, it is determined that the URL request has a SQL injection vulnerability.
The SQL injection vulnerability detection method according to claim 1, characterized in that, the response page obtained after executing the URL request and the sequence request is subjected to similarity analysis on the response page to obtain the URL The step of requesting the similarity value between the response page corresponding to the request and the response page corresponding to each request in the sequence request includes:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and calculating the Jackard coefficient between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request;

The Jaccard coefficient is correspondingly used as the similarity value between the first response page and each of the sequence response pages.
The SQL injection vulnerability detection method according to claim 6, wherein the response page obtained after executing the sequence request is obtained, and the first response page corresponding to the URL request and the sequence request corresponding to the sequence request are calculated The steps of the Jeckard coefficient between each sequence of response pages include:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and dividing the text corresponding to the first response page and the sequence response page into character segments according to preset line breaks;

Dividing the character segment into character strings according to a preset separator, and correspondingly obtaining elements corresponding to the first response page and the sequence response page;

Calculate the intersection and union of elements between the first response page and each of the sequence response pages, and divide the intersection by the corresponding union to obtain the corresponding Jaccard coefficient.
The SQL injection vulnerability detection method according to claim 2, characterized in that, the response page obtained after executing the URL request and the sequence request is subjected to similarity analysis on the response page to obtain the URL The step of requesting the similarity value between the response page corresponding to the request and the response page corresponding to each request in the sequence request includes:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and calculating the Jackard coefficient between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request;

The Jaccard coefficient is correspondingly used as the similarity value between the first response page and each of the sequence response pages.
The SQL injection vulnerability detection method according to claim 8, wherein the response page obtained after executing the sequence request is obtained, and the first response page corresponding to the URL request and the sequence request corresponding to the sequence request are calculated The steps of the Jeckard coefficient between each sequence of response pages include:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and dividing the text corresponding to the first response page and the sequence response page into character segments according to preset line breaks;

Dividing the character segment into character strings according to a preset separator, and correspondingly obtaining elements corresponding to the first response page and the sequence response page;

Calculate the intersection and union of elements between the first response page and each of the sequence response pages, and divide the intersection by the corresponding union to obtain the corresponding Jaccard coefficient.
The SQL injection vulnerability detection method according to claim 3, characterized in that, the response page obtained after executing the URL request and the sequence request is subjected to similarity analysis on the response page to obtain the URL The step of requesting the similarity value between the response page corresponding to the request and the response page corresponding to each request in the sequence request includes:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and calculating the Jackard coefficient between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request;

The Jaccard coefficient is correspondingly used as the similarity value between the first response page and each of the sequence response pages.
The SQL injection vulnerability detection method according to claim 10, wherein the response page obtained after executing the sequence request is obtained, and the first response page corresponding to the URL request and the sequence request corresponding to the sequence request are calculated The steps of the Jeckard coefficient between each sequence of response pages include:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and dividing the text corresponding to the first response page and the sequence response page into character segments according to preset line breaks;

Dividing the character segment into character strings according to a preset separator, and correspondingly obtaining elements corresponding to the first response page and the sequence response page;

Calculate the intersection and union of elements between the first response page and each of the sequence response pages, and divide the intersection by the corresponding union to obtain the corresponding Jaccard coefficient.
The SQL injection vulnerability detection method according to claim 4, wherein the response page obtained after executing the URL request and the sequence request is subjected to similarity analysis on the response page to obtain the URL The step of requesting the similarity value between the response page corresponding to the request and the response page corresponding to each request in the sequence request includes:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and calculating the Jackard coefficient between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request;

The Jaccard coefficient is correspondingly used as the similarity value between the first response page and each of the sequence response pages.
The SQL injection vulnerability detection method according to claim 12, wherein the response page obtained after executing the sequence request is obtained, and the first response page corresponding to the URL request and the sequence request corresponding to the sequence request are calculated. The steps of the Jeckard coefficient between each sequence of response pages include:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and dividing the text corresponding to the first response page and the sequence response page into character segments according to preset line breaks;

Dividing the character segment into character strings according to a preset separator, and correspondingly obtaining elements corresponding to the first response page and the sequence response page;

Calculate the intersection and union of elements between the first response page and each of the sequence response pages, and divide the intersection by the corresponding union to obtain the corresponding Jaccard coefficient.
The SQL injection vulnerability detection method according to claim 5, characterized in that, the response page obtained after executing the URL request and the sequence request is subjected to similarity analysis on the response page to obtain the URL The step of requesting the similarity value between the response page corresponding to the request and the response page corresponding to each request in the sequence request includes:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and calculating the Jackard coefficient between the first response page corresponding to the URL request and each sequence response page corresponding to the sequence request;

The Jaccard coefficient is correspondingly used as the similarity value between the first response page and each of the sequence response pages.
The SQL injection vulnerability detection method according to claim 14, wherein the response page obtained after performing the sequence request is obtained, and the first response page corresponding to the URL request and the sequence request corresponding to the sequence request are calculated The steps of the Jeckard coefficient between each sequence of response pages include:

Acquiring a response page corresponding to the execution of the URL request and the sequence request, and dividing the text corresponding to the first response page and the sequence response page into character segments according to preset line breaks;

Dividing the character segment into character strings according to a preset separator, and correspondingly obtaining elements corresponding to the first response page and the sequence response page;

Calculate the intersection and union of elements between the first response page and each of the sequence response pages, and divide the intersection by the corresponding union to obtain the corresponding Jaccard coefficient.
A SQL injection vulnerability detection device, characterized in that the SQL injection vulnerability detection device includes:

The determining module is used to determine the detection point of the URL request after obtaining the URL request of the uniform resource locator of the website to be tested;

A construction module, configured to construct a sequence request corresponding to a Boolean logic parameter of the detection point;

An obtaining module, used to obtain a response page obtained after executing the URL request and the sequence request;

An analysis module, configured to perform a similarity analysis on the response page to obtain a similarity value between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request;

The determining module is further configured to determine that the URL request has a SQL injection vulnerability if the similarity value meets a preset condition.
The SQL injection vulnerability detection device according to claim 16, wherein the construction module is further configured to construct a request for a logically true condition for each detection point in the URL request, which is recorded as a first true request; Construct a request for a logical false condition for each detection point in the URL request, and record it as a first false request to form a sequence request including the first true request and the first false request.
The SQL injection vulnerability detection device according to claim 17, wherein the construction module is further configured to construct a request for a logical false condition for each detection point in the URL request, which is recorded as a first false request, And construct a confirmation request for the logically true condition for the first true request, and record it as a second true request; construct a confirmation request for the logically false condition for the first false request, and record it as a second false request to form Sequence request of the first true request, the first false request, the second true request, and the second false request.
A SQL injection vulnerability detection device, characterized in that the SQL injection vulnerability detection device includes a memory, a processor, and computer-readable instructions stored on the memory and executable on the processor, the computer may When the read instruction is executed by the processor, the following steps are implemented:

After obtaining the URL request of the uniform resource locator of the website to be tested, determine the detection point of the URL request, and construct a sequence request corresponding to the detection point corresponding to a Boolean logic parameter;

Obtaining a response page obtained after executing the URL request and the sequence request, and performing a similarity analysis on the response page to obtain a relationship between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request Similarity value

If the similarity value meets a preset condition, it is determined that the URL request has a SQL injection vulnerability.
A computer-readable storage medium, characterized in that computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the following steps are implemented:

After obtaining the URL request of the uniform resource locator of the website to be tested, determine the detection point of the URL request, and construct a sequence request corresponding to the detection point corresponding to a Boolean logic parameter;

Obtaining a response page obtained after executing the URL request and the sequence request, and performing a similarity analysis on the response page to obtain a relationship between the response page corresponding to the URL request and the response page corresponding to each request in the sequence request Similarity value

If the similarity value meets a preset condition, it is determined that the URL request has a SQL injection vulnerability.