WO2020233022A1

WO2020233022A1 - Vulnerability detection method and apparatus, computer device, and storage medium

Info

Publication number: WO2020233022A1
Application number: PCT/CN2019/118685
Authority: WO
Inventors: 王延辉; 张驰
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-05-21
Filing date: 2019-11-15
Publication date: 2020-11-26
Also published as: CN110324311A; CN110324311B

Abstract

The present application relates to the field of information security. Disclosed are a vulnerability detection method and apparatus, a computer device, and a storage medium. The method comprises: obtaining traffic information sent to a target server, and sending to a detection server said traffic information; upon receiving said traffic information, the detection server analyzes said traffic information to obtain an analysis result; detect whether vulnerability exists in the target server according to the analysis result; and if yes, locate the target server and fix the existing vulnerability. In the present application, traffic information is obtained and sent to a detection server to perform analysis, so as to obtain a vulnerability detection result according to the analysis result, such that vulnerability detection can be effectively performed in different scenarios, and the detection efficiency is improved.

Description

Vulnerability detection method, device, computer equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on May 21, 2019, with the application number of 201910425959.2. The invention title is "Vulnerability detection methods, devices, equipment and storage media", the entire contents of which are incorporated by reference Applying.

Technical field

This application relates to the field of information security, in particular to a method, device, computer equipment and storage medium for vulnerability detection.

Background technique

Website vulnerabilities, as the B/S model is widely used, more and more programmers use this model to write Web applications. The inventor found that due to the uneven level and experience of developers, a considerable number of developers did not make necessary legal judgments on the user’s input data or the information carried in the page (such as cookies) when writing code , Resulting in an attacker can use this programming loophole to invade the database or attack the user of the Web application, thereby obtaining some important data and benefits.

Website vulnerability detection usually refers to a security detection (penetration attack) behavior that detects the security vulnerabilities of specified remote or local computer systems through scanning and other means based on the vulnerability database, and discovers exploitable vulnerabilities.

For the conventional vulnerability scanning system, the web site is mainly based on crawlers. After login, the page is obtained by simulated login or by filling in cookies; the current main problems are: current websites have anti-crawl systems, and simulated login is becoming more and more difficult. Fully applicable; in addition, the comprehensiveness of crawlers has always been a difficult point. It supports web sites, but the network connection of mobile apps cannot be detected.

Summary of the invention

The purpose of this application is to address the deficiencies of the prior art, and provide a method, device, computer equipment and storage medium for vulnerability detection. By obtaining flow information, the flow information is sent to the detection server for analysis, and the results are obtained according to the analysis results. Vulnerability detection results can effectively perform vulnerability detection in different scenarios and improve detection efficiency.

To achieve the above objective, the technical solution of the present application provides a method, device, computer equipment and storage medium for vulnerability detection.

This application discloses a method of vulnerability detection, including the following steps:

Acquiring the traffic information sent to the target server, and sending the traffic information sent to the target server to the detection server;

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain an analysis result;

Detect whether the target server has a loophole according to the analysis result;

When it is detected that the target server has a vulnerability, the target server is located, and the existing vulnerability is repaired.

Preferably, the acquiring the traffic information sent to the target server and sending the traffic information sent to the target server to the detection server includes:

Setting a plug-in in the browser, associating the plug-in with the detection server, and obtaining the Hypertext Transfer Protocol HTTP request information for visiting each site through the plug-in in the browser;

The hypertext transfer protocol HTTP request information is sent to the detection server associated with the plug-in in the browser.

Setting a hypertext transfer protocol HTTP proxy server, and point the web proxy port of the browser to the proxy system through the hypertext transfer protocol HTTP proxy server, and associate the proxy system with the detection server;

When the network flow information is obtained, the network flow information is sent to the detection server associated with the proxy system through the proxy system.

Preferably, after the detection server receives the traffic information sent to the target server, analyzing the traffic information sent to the target server to obtain the analysis result includes:

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain analytical data;

Perform vulnerability detection on the parsed data to obtain a vulnerability detection result.

Preferably, the analyzing the traffic information sent to the target server to obtain the analytical data includes:

Parse the uniform resource locator URL in the traffic information sent to the target server to obtain domain name information of each site and associated domain name information;

Obtaining associated Internet Protocol IP information according to the uniform resource locator URL or the domain name information;

The application function file is obtained from the traffic information sent to the target server, and the uniform resource locator URL corresponding to the application function file is parsed to obtain hypertext transfer protocol HTTP request parameter information.

Preferably, the performing vulnerability detection on the parsed data to obtain a vulnerability detection result includes:

Sending the parsed data to the queue to be detected, and sequentially detect the uniform resource locator URL of the parsed data in the queue to be detected;

When it is detected that the uniform resource locator URL is a periodic detection task and the file corresponding to the uniform resource locator URL has not been changed, the last vulnerability detection result is called as the current vulnerability detection result, otherwise the uniform resource The URL of the locator performs fingerprint recognition on the World Wide Web and obtains the vulnerability detection result.

Preferably, said performing World Wide Web fingerprint recognition on the uniform resource locator URL to obtain the vulnerability detection result includes:

After performing the World Wide Web fingerprint recognition on the uniform resource locator URL, if the fingerprint information of the corresponding website is obtained, the vulnerability detection is performed according to the fingerprint information, and the vulnerability detection result is obtained. The fingerprint information includes: operating system type, World Wide Web Web server, database type and World Wide Web web application script language;

After performing World Wide Web fingerprint recognition on the uniform resource locator URL, if the fingerprint information of the corresponding website is not obtained, the detection tool provided by the vulnerability detection terminal is invoked for detection, and the vulnerability detection result is obtained.

The application also discloses a vulnerability detection device, which includes:

Information sending module: configured to obtain traffic information sent to the target server, and send the traffic information sent to the target server to the detection server;

Data analysis module: configured to, after the detection server receives the traffic information sent to the target server, analyze the traffic information sent to the target server to obtain the analysis result;

Detection module: set to detect whether the target server has vulnerabilities according to the analysis result;

Vulnerability repair module: set to locate the target server when a vulnerability exists in the target server and repair the existing vulnerability.

The application also discloses a computer device, the computer device includes a memory and a processor, the memory stores computer-readable instructions, and when the computer-readable instructions are executed by one or more of the processors, One or more of the processors execute the steps of the vulnerability detection method described above.

This application also discloses a computer-readable storage medium, which can be read and written by a processor, and the storage medium stores computer instructions. When the computer-readable instructions are executed by one or more processors, One or more processors execute the steps of the vulnerability detection method described above.

The beneficial effect of this application is that this application obtains traffic information, sends the traffic information to the detection server for analysis, and obtains the vulnerability detection result according to the analysis result, which can effectively perform vulnerability detection in different scenarios and improve detection efficiency.

Description of the drawings

FIG. 1 is a schematic flowchart of a method for vulnerability detection according to the first embodiment of this application;

FIG. 2 is a schematic flowchart of a method for detecting a vulnerability according to a second embodiment of this application;

FIG. 3 is a schematic flowchart of a method for vulnerability detection according to a third embodiment of this application;

FIG. 4 is a schematic flowchart of a method for detecting a vulnerability according to a fourth embodiment of this application;

FIG. 5 is a schematic flowchart of a vulnerability detection method according to a fifth embodiment of this application;

FIG. 6 is a schematic flowchart of a vulnerability detection method according to a sixth embodiment of this application;

FIG. 7 is a schematic flowchart of a vulnerability detection method according to a seventh embodiment of this application;

Fig. 8 is a schematic structural diagram of a vulnerability detection device according to an embodiment of the application.

Detailed ways

In order to make the purpose, technical solutions, and advantages of this application clearer, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the application, and are not used to limit the application.

Those skilled in the art can understand that, unless specifically stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of this application refers to the presence of the described features, integers, steps, operations, elements, and/or components, but does not exclude the presence or addition of one or more other features, Integers, steps, operations, elements, components, and/or groups thereof.

The flow of a method of vulnerability detection in the first embodiment of the present application is shown in Fig. 1. This embodiment includes the following steps:

Step s101: Obtain the traffic information sent to the target server, and send the traffic information sent to the target server to the detection server;

Specifically, the traffic information includes an HTTP (Hypertext Transfer Protocol) request to the target server, where the HTTP request includes an HTTP GET request and an HTTP POST request; it is possible to initiate an HTTP (Hypertext Transfer Protocol) request to the target server It is a browser, mobile phone or APP application.

Specifically, whether it is a browser, a mobile phone or an APP application, when an HTTP (Hypertext Transfer Protocol) request is initiated to the target server, the HTTP (Hypertext Transfer Protocol) request information can be collected and sent to the detection server for analysis For vulnerability detection.

Step s102, after the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain an analysis result;

Specifically, after the detection server receives the traffic information sent to the target server, that is, after receiving HTTP (Hypertext Transfer Protocol) request and other information, it can analyze the traffic information sent to the target server, To obtain the analysis result, the analysis process can be divided into an analysis phase and a vulnerability detection phase. The analysis phase is used to analyze the traffic information sent to the target server to obtain analysis data; the vulnerability detection phase is used to analyze the analyzed data Perform vulnerability detection and find vulnerabilities in the target server.

Step s103, detecting whether the target server has vulnerabilities according to the analysis result;

Specifically, after the traffic information is analyzed and the vulnerability detection result is obtained, it can be determined whether the target server has a vulnerability based on the vulnerability detection result; wherein the vulnerability detection result includes: the file URL (uniform resource locator) vulnerability scanning result and Application function file URL (Uniform Resource Locator) vulnerability detection result; The file URL (Uniform Resource Locator) vulnerability scanning result is used to scan the file corresponding to the URL (Uniform Resource Locator) by calling the scanning tool provided by the vulnerability detection terminal Obtained, the application function file URL (Uniform Resource Locator) vulnerability detection result can be obtained by calling vulnerability detection tools such as SQL injection, XSS attack, and unauthorized vulnerability detection.

Specifically, when it is detected that the URL (Uniform Resource Locator) vulnerability scan of each file is normal, and the SQL injection, XSS attack and unauthorized vulnerability detection result of the application function file URL (Uniform Resource Locator) is normal, it can be determined that the target server does not exist. Vulnerabilities: When an abnormality in the URL (Uniform Resource Locator) vulnerability scan of each file is detected or the SQL injection, XSS attack and unauthorized vulnerability detection result of the application function file URL (Uniform Resource Locator) is abnormal, it can be determined that the target server has a vulnerability.

Step s104: When it is detected that the target server has a vulnerability, locate the target server, and repair the existing vulnerability.

Specifically, when a loophole in the target server is detected, the location of the target server can be located according to the domain name information or IP (Internet Protocol) information corresponding to the URL (Uniform Resource Locator) of the target server, and then attack the The target server locates a security vulnerability in the target server, and the attack can be carried out by initiating an HTTP (Hypertext Transfer Protocol) request to the target server and obtaining an HTTP (Hypertext Transfer Protocol) response.

In this embodiment, by acquiring traffic information, sending the traffic information to a detection server for analysis, and obtaining a vulnerability detection result according to the analysis result, it is possible to effectively perform vulnerability detection in different scenarios and improve detection efficiency.

Figure 2 is a schematic flow chart of a method for vulnerability detection according to the second embodiment of the application. As shown in the figure, in step s101, the traffic information sent to the target server is obtained, and the traffic information sent to the target server is obtained Send to the detection server, including:

In step s201, a plug-in is set in the browser, the plug-in is associated with the detection server, and the hypertext transfer protocol HTTP request information for visiting each site is obtained through the plug-in in the browser;

Specifically, a self-made plug-in can be installed in the browser, and the flow information of each site can be obtained through the self-made plug-in. The flow information includes HTTP (Hypertext Transfer Protocol) request information, for example: install the chrome plug-in in a chrome browser Associate the detection server with the chrome browser through the chrome plug-in, and then obtain traffic information of each site from the chrome browser through the chrome plug-in, and send the acquired traffic information to the detection server.

Step s202: Send the hypertext transfer protocol HTTP request information to the detection server associated with the plug-in in the browser.

Specifically, after the HTTP (Hypertext Transfer Protocol) request information is obtained through the plug-in in the browser, the corresponding detection server can be found through the association relationship between the plug-in in the browser and the detection server, And send the HTTP (Hypertext Transfer Protocol) request information to the detection server associated with the plug-in in the browser.

In this embodiment, by setting a plug-in in the browser, and sending traffic information to the detection server through the plug-in for vulnerability detection, the efficiency of vulnerability detection can be improved.

Figure 3 is a schematic flow chart of a method for vulnerability detection according to the third embodiment of the application. As shown in the figure, in step s101, the traffic information sent to the target server is obtained, and the traffic information sent to the target server is obtained Send to the detection server, including:

Step s301, setting up a hypertext transfer protocol HTTP proxy server, and directing the web proxy port of the browser to the proxy system through the hypertext transfer protocol HTTP proxy server, and associating the proxy system with the detection server;

Specifically, an HTTP (Hypertext Transfer Protocol) proxy server can be set up first, the network proxy port of the browser is pointed to the proxy system through the Hypertext Transfer Protocol HTTP proxy server, and the proxy system is associated with the detection server, For example, through the HTTP (Hypertext Transfer Protocol) proxy server, the detection server can be associated with the web proxy port of the browser, mobile phone, and APP application.

Step s302: When the network flow information is acquired, the network flow information is sent to the detection server associated with the proxy system through the proxy system.

Specifically, when the network traffic information of each site is obtained through the proxy port, the corresponding detection server can be found through the association relationship between the proxy system and the detection server, and the network traffic information also includes HTTP (Hypertext Transfer Protocol) requests And then send the HTTP (Hypertext Transfer Protocol) request information to the detection server associated with the proxy system.

In this embodiment, the traffic information is sent to the detection server through the proxy server for vulnerability detection, which can improve the efficiency of vulnerability detection.

Figure 4 is a schematic flow chart of a method for vulnerability detection according to the fourth embodiment of the application. As shown in the figure, in step s102, after the detection server receives the traffic information sent to the target server, Analyze the traffic information sent to the target server to obtain the analysis results, including:

Step s401: After receiving the traffic information sent to the target server, the detection server analyzes the traffic information sent to the target server to obtain analytical data;

Specifically, after the detection server receives the traffic information sent to the target server, it may perform data analysis processing on the traffic information sent to the target server to obtain the traffic information sent to the target server. URL (Uniform Resource Locator) and IP (Internet Protocol) information of the file.

Step s402: Perform vulnerability detection on the parsed data to obtain a vulnerability detection result.

Specifically, vulnerability detection is performed according to the parsed data to obtain a vulnerability detection result. The vulnerability detection includes vulnerability scanning of file URL (uniform resource locator) and vulnerability scanning of application function file URL (uniform resource locator). Detect and obtain file URL (Uniform Resource Locator) vulnerability scanning results and application function file URL (Uniform Resource Locator) vulnerability detection results from this.

In this embodiment, the detection server performs vulnerability detection after analyzing the flow information, which can effectively obtain the vulnerability detection result and improve the detection efficiency.

Figure 5 is a schematic flow chart of a method for vulnerability detection according to the fifth embodiment of the application. As shown in the figure, the step s401, parsing the traffic information sent to the target server to obtain analytical data, includes:

Step s501: parse the uniform resource locator URL in the traffic information sent to the target server to obtain domain name information of each site and associated domain name information;

Specifically, URL is a uniform resource locator. It is a concise representation of the location and access method of resources available on the Internet. It is the address of a standard resource on the Internet. Each file on the Internet has a unique URL, it contains information indicating the location of the file and how the browser should handle it. The standard URL contains information such as domain name, port number, resource location, parameters, and anchor.

Specifically, when the URL (Uniform Resource Locator) in the traffic information is obtained, the URL (Uniform Resource Locator) in the traffic information can be parsed to obtain the domain name information and associated domain name information of each site. It is a part of URL (Uniform Resource Locator), so it is easy to parse out domain name information from URL (Uniform Resource Locator).

Step s502, obtaining associated Internet Protocol IP information according to the uniform resource locator URL or the domain name information;

Specifically, since the URL (Uniform Resource Locator) may directly contain IP (Internet Protocol) information, the IP (Internet Protocol) information can be obtained directly from the URL (Uniform Resource Locator); if the URL (Uniform Resource Locator) is It contains domain name information. Because domain name information and IP (Internet Protocol) information represent the same information, IP (Internet Protocol) information is represented by numbers, which are used to uniquely identify the logical address of a computer on the Internet, but it is not easy to remember, such as 192.168.1.1. Therefore, IP (Internet Protocol) information is usually converted into domain name information, and domain name information is represented by characters, which is easy to remember, such as www.baidu.com; therefore, IP (Internet Protocol) can be obtained through the analysis of domain name information. )information.

In step s503, the application function file is obtained from the traffic information sent to the target server, and the uniform resource locator URL corresponding to the application function file is parsed to obtain hypertext transfer protocol HTTP request parameter information.

Specifically, firstly, the application function files can be filtered out from the traffic information sent to the target server, and then the URL (Uniform Resource Locator) corresponding to each application function file can be parsed to obtain the hypertext transfer protocol contained therein. HTTP request parameter information.

In this embodiment, by analyzing the flow information, the URL and IP information contained in the flow information are obtained, and vulnerability detection can be performed based on the URL and IP information, which can effectively improve the detection efficiency.

Figure 6 is a schematic flow chart of a method for vulnerability detection according to the sixth embodiment of the application. As shown in the figure, the step s402, performing vulnerability detection on the parsed data to obtain a vulnerability detection result, includes:

Step s601, sending the parsed data to the queue to be detected, and sequentially detecting the uniform resource locator URL of the parsed data in the queue to be detected;

Specifically, after the URL (Uniform Resource Locator) is obtained by parsing the traffic data, the URL (Uniform Resource Locator) information can be put into the queue to be detected. The queue to be detected contains multiple detection tasks. The tasks are arranged in chronological order and inspections are carried out in chronological order.

Specifically, the detection of URL (Uniform Resource Locator) includes: periodic detection task detection on URL (Uniform Resource Locator) and whether the file corresponding to the URL (Uniform Resource Locator) has been changed Detection.

Step s602, when it is detected that the uniform resource locator URL is a periodic detection task and the file corresponding to the uniform resource locator URL has not been changed, call the previous vulnerability detection result as the current vulnerability detection result, otherwise The Uniform Resource Locator URL performs World Wide Web fingerprint recognition to obtain the vulnerability detection result.

Specifically, when it is detected that the URL (Uniform Resource Locator) is a periodic detection task and the file corresponding to the URL (Uniform Resource Locator) has not changed, the last vulnerability detection result can be called as the current vulnerability detection Results; among them, the vulnerability detection results can be stored after each vulnerability detection.

Specifically, judging whether the file corresponding to the URL (Uniform Resource Locator) has changed includes: recording the md5 value of the file corresponding to the current URL (Uniform Resource Locator) each time the URL (Uniform Resource Locator) is detected, When the file corresponding to the URL (Uniform Resource Locator) is detected again, it is determined whether the md5 value of the file corresponding to the URL (Uniform Resource Locator) is the same as the md5 value recorded during the last detection. The file corresponding to the URL (Uniform Resource Locator) has not changed. If it is not the same, the file corresponding to the URL (Uniform Resource Locator) has been changed.

Specifically, if it is detected that the URL (Uniform Resource Locator) is not a periodic detection task or the file corresponding to the URL (Uniform Resource Locator) has changed, the Uniform Resource Locator URL can be fingerprinted on the World Wide Web Identify, and obtain the vulnerability detection result from this.

In this embodiment, by identifying the detection task corresponding to the URL and detecting the file corresponding to the URL, the detection result can be effectively obtained and the detection efficiency is improved.

Figure 7 is a schematic flow chart of a method for vulnerability detection according to the seventh embodiment of the application. As shown in the figure, in step s602, performing World Wide Web fingerprinting on the uniform resource locator URL to obtain the vulnerability detection result includes :

Step s701: After performing web fingerprint recognition on the uniform resource locator URL, if fingerprint information of the corresponding website is obtained, perform vulnerability detection according to the fingerprint information to obtain the vulnerability detection result, the fingerprint information includes: operating system Type, WWW web server, database type and WWW web application script language;

Specifically, web (World Wide Web) fingerprint identification can be performed on the URL (Uniform Resource Locator). If the fingerprint information of the corresponding website is obtained after the web (World Wide Web) fingerprint identification, then the corresponding fingerprint information can be called Vulnerability detection is performed on the basis of the scanning to obtain the vulnerability detection result. The fingerprint information includes the operating system type, the web (World Wide Web) server used, the database type and the script language of the web (World Wide Web) application.

In step s702, after performing web fingerprint recognition on the uniform resource locator URL, if the fingerprint information of the corresponding website is not obtained, the detection tool provided by the vulnerability detection terminal is invoked for detection, and the vulnerability detection result is obtained.

Specifically, after web (World Wide Web) fingerprint recognition is performed on the URL (Uniform Resource Locator), if the fingerprint information of the corresponding website is not obtained, all the scanning tools provided by the vulnerability detection terminal can be invoked to check the URL (Uniform Resource Locator). The file corresponding to the locator) is scanned for vulnerabilities, and the file corresponding to its URL (Uniform Resource Locator) is determined according to the scanning result whether there are vulnerabilities, and the vulnerability detection result is obtained.

Specifically, the URL (Uniform Resource Locator) corresponding to each file contained in each application function can also be collected, and the detection tool for the application function can be called to perform vulnerability detection on the corresponding URL (Uniform Resource Locator); The detection tools for SQL injection, XSS attacks and unauthorized vulnerabilities automatically detect SQL injection, XSS attacks, and unauthorized vulnerabilities for each application function to obtain the vulnerability detection results.

In this embodiment, by performing web fingerprint recognition on the URL, and performing tool detection according to the fingerprint recognition result, the vulnerability detection efficiency can be effectively improved.

The structure of a vulnerability detection device according to an embodiment of the present application is shown in FIG. 8, and includes:

Information sending module 801, data analysis module 802, detection module 803, and vulnerability repair module 804; among them, information sending module 801 is connected to data analysis module 802, data analysis module 802 is connected to detection module 803, and detection module 803 is connected to vulnerability repair module 804 Connected; the information sending module 801 is set to obtain traffic information sent to the target server, and send the traffic information sent to the target server to the detection server; the data analysis module 802 is set to when the detection server receives the sent After the traffic information of the target server, the traffic information sent to the target server is analyzed to obtain the analysis result; the detection module 803 is set to detect whether the target server has a vulnerability according to the analysis result; the vulnerability repair module 804 is set to When the target server has a vulnerability, the target server is located, and the existing vulnerability is repaired.

The embodiment of the present application also discloses a computer device. The computer device includes a memory and a processor. The memory stores computer-readable instructions. When the computer-readable instructions are executed by one or more of the processors, , Enabling one or more of the processors to execute the steps in the vulnerability detection methods in the foregoing embodiments.

An embodiment of the present application also discloses a computer-readable storage medium, the storage medium can be read and written by a processor, the memory stores computer-readable instructions, and the computer-readable instructions are executed by one or more processors At this time, one or more processors are caused to execute the steps in the vulnerability detection methods described in the foregoing embodiments. The computer storage medium may be a non-volatile storage medium or a volatile storage medium, which is not specifically limited in this application.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The computer program can be stored in a computer readable storage medium. When executed, it may include the processes of the above-mentioned method embodiments. Among them, the aforementioned storage medium may be a non-volatile storage medium such as a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, All should be considered as the scope of this specification.

Claims

A method of vulnerability detection includes the following steps:

Acquiring the traffic information sent to the target server, and sending the traffic information sent to the target server to the detection server;

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain an analysis result;

Detect whether the target server has a loophole according to the analysis result;

When it is detected that the target server has a vulnerability, the target server is located, and the existing vulnerability is repaired.
5. The method of vulnerability detection according to claim 1, wherein said acquiring traffic information sent to the target server and sending said traffic information sent to the target server to the detection server comprises:

Setting a plug-in in the browser, associating the plug-in with the detection server, and obtaining the Hypertext Transfer Protocol HTTP request information for visiting each site through the plug-in in the browser;

The hypertext transfer protocol HTTP request information is sent to the detection server associated with the plug-in in the browser.
5. The method of vulnerability detection according to claim 1, wherein said acquiring traffic information sent to the target server and sending said traffic information sent to the target server to the detection server comprises:

Setting a hypertext transfer protocol HTTP proxy server, and point the web proxy port of the browser to the proxy system through the hypertext transfer protocol HTTP proxy server, and associate the proxy system with the detection server;

When the network flow information is obtained, the network flow information is sent to the detection server associated with the proxy system through the proxy system.
The method of vulnerability detection according to claim 1, wherein after the detection server receives the traffic information sent to the target server, analyzing the traffic information sent to the target server to obtain the analysis result, including :

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain analytical data;

Perform vulnerability detection on the parsed data to obtain a vulnerability detection result.
5. The method of vulnerability detection according to claim 4, said analyzing the traffic information sent to the target server to obtain analytical data, comprising:

Parse the uniform resource locator URL in the traffic information sent to the target server to obtain domain name information of each site and associated domain name information;

Obtaining associated Internet Protocol IP information according to the uniform resource locator URL or the domain name information;

Obtain the application function file from the traffic information sent to the target server, analyze the uniform resource locator URL corresponding to the application function file, and obtain the hypertext transfer protocol HTTP request parameter information.
5. The method for vulnerability detection according to claim 4, wherein said performing vulnerability detection on said parsed data to obtain a vulnerability detection result comprises:

Sending the parsed data to the queue to be detected, and sequentially detect the uniform resource locator URL of the parsed data in the queue to be detected;

When it is detected that the uniform resource locator URL is a periodic detection task and the file corresponding to the uniform resource locator URL has not been changed, the last vulnerability detection result is called as the current vulnerability detection result, otherwise the uniform resource The URL of the locator performs fingerprint recognition on the World Wide Web and obtains the vulnerability detection result.
7. The method for vulnerability detection according to claim 6, wherein said performing World Wide Web fingerprint recognition on said uniform resource locator URL to obtain a vulnerability detection result comprises:

After performing the World Wide Web fingerprint recognition on the uniform resource locator URL, if the fingerprint information of the corresponding website is obtained, the vulnerability detection is performed according to the fingerprint information, and the vulnerability detection result is obtained. The fingerprint information includes: operating system type, World Wide Web Web server, database type and World Wide Web web application script language;

After performing World Wide Web fingerprint recognition on the uniform resource locator URL, if the fingerprint information of the corresponding website is not obtained, the detection tool provided by the vulnerability detection terminal is invoked for detection, and the vulnerability detection result is obtained.
A vulnerability detection device, the device includes:

Information sending module: configured to obtain traffic information sent to the target server, and send the traffic information sent to the target server to the detection server;

Data analysis module: configured to, after the detection server receives the traffic information sent to the target server, analyze the traffic information sent to the target server to obtain the analysis result;

Detection module: set to detect whether the target server has vulnerabilities according to the analysis result;

Vulnerability repair module: set to locate the target server when a vulnerability exists in the target server and repair the existing vulnerability.
A computer device including a memory and a processor, and computer-readable instructions are stored in the memory. When the computer-readable instructions are executed by one or more processors, one or more The processor executes the steps of the vulnerability detection method described below:

Acquiring the traffic information sent to the target server, and sending the traffic information sent to the target server to the detection server;

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain an analysis result;

Detect whether the target server has a loophole according to the analysis result;

When it is detected that the target server has a vulnerability, the target server is located, and the existing vulnerability is repaired.
The computer device according to claim 9, when the computer-readable instructions are executed by one or more of the processors, the one or more of the processors execute the acquisition of traffic information sent to the target server, and When sending the traffic information sent to the target server to the detection server, the following steps are also performed:

Setting a plug-in in the browser, associating the plug-in with the detection server, and obtaining the Hypertext Transfer Protocol HTTP request information for visiting each site through the plug-in in the browser;

The hypertext transfer protocol HTTP request information is sent to the detection server associated with the plug-in in the browser.
The computer device according to claim 9, when the computer-readable instructions are executed by one or more of the processors, the one or more of the processors execute the acquisition of traffic information sent to the target server, and When sending the traffic information sent to the target server to the detection server, the following steps are also performed:

Setting a hypertext transfer protocol HTTP proxy server, and point the web proxy port of the browser to the proxy system through the hypertext transfer protocol HTTP proxy server, and associate the proxy system with the detection server;

When the network flow information is obtained, the network flow information is sent to the detection server associated with the proxy system through the proxy system.
The computer device according to claim 9, when the computer-readable instructions are executed by one or more of the processors, the one or more of the processors execute the when the detection server receives the transmission After the traffic information sent to the target server, the traffic information sent to the target server is analyzed, and when the analysis result is obtained, the following steps are also performed:

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain analytical data;

Perform vulnerability detection on the parsed data to obtain a vulnerability detection result.
The computer device according to claim 12, when the computer-readable instructions are executed by one or more of the processors, the one or more of the processors are executed to analyze the traffic information sent to the target server, When obtaining the step of analyzing data, the following steps are also performed:

Parse the uniform resource locator URL in the traffic information sent to the target server to obtain domain name information of each site and associated domain name information;

Obtaining associated Internet Protocol IP information according to the uniform resource locator URL or the domain name information;

The application function file is obtained from the traffic information sent to the target server, and the uniform resource locator URL corresponding to the application function file is parsed to obtain hypertext transfer protocol HTTP request parameter information.
The computer device according to claim 12, when the computer-readable instructions are executed by one or more of the processors, the one or more processors execute the parsed data to perform vulnerability detection, and obtain a vulnerability detection result The following steps are also performed:

Sending the parsed data to the queue to be detected, and sequentially detect the uniform resource locator URL of the parsed data in the queue to be detected;

When it is detected that the uniform resource locator URL is a periodic detection task and the file corresponding to the uniform resource locator URL has not been changed, the last vulnerability detection result is called as the current vulnerability detection result, otherwise the uniform resource The URL of the locator performs fingerprint recognition on the World Wide Web and obtains the vulnerability detection result.
A computer-readable storage medium that can be read and written by a processor, and the storage medium stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, one or more Each processor executes the steps of the vulnerability detection method as described below:

Acquiring the traffic information sent to the target server, and sending the traffic information sent to the target server to the detection server;

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain an analysis result;

Detect whether the target server has a loophole according to the analysis result;

When it is detected that the target server has a vulnerability, the target server is located, and the existing vulnerability is repaired.
The computer storage medium of claim 15, when the computer-readable instructions are executed by one or more processors, the one or more processors execute the acquisition of traffic information sent to the target server, and the When the traffic information sent to the target server is sent to the detection server, the following steps are also performed:

Setting a plug-in in the browser, associating the plug-in with the detection server, and obtaining the Hypertext Transfer Protocol HTTP request information for visiting each site through the plug-in in the browser;

The hypertext transfer protocol HTTP request information is sent to the detection server associated with the plug-in in the browser.
The computer storage medium of claim 15, when the computer-readable instructions are executed by one or more processors, the one or more processors execute the acquisition of traffic information sent to the target server, and the When the traffic information sent to the target server is sent to the detection server, the following steps are also performed:

Setting a hypertext transfer protocol HTTP proxy server, and point the web proxy port of the browser to the proxy system through the hypertext transfer protocol HTTP proxy server, and associate the proxy system with the detection server;

When the network flow information is obtained, the network flow information is sent to the detection server associated with the proxy system through the proxy system.
The computer storage medium according to claim 15, when the computer-readable instructions are executed by one or more processors, the one or more processors execute the when the detection server receives the information sent to the target server After the traffic information is analyzed, the traffic information sent to the target server is analyzed, and when the analysis result is obtained, the following steps are also performed:

After the detection server receives the traffic information sent to the target server, analyzes the traffic information sent to the target server to obtain analytical data;

Perform vulnerability detection on the parsed data to obtain a vulnerability detection result.
17. The computer storage medium of claim 18, when the computer-readable instructions are executed by one or more processors, the one or more processors execute the analysis of the traffic information sent to the target server, When obtaining the step of analyzing data, the following steps are also performed:

Parse the uniform resource locator URL in the traffic information sent to the target server to obtain domain name information of each site and associated domain name information;

Obtaining associated Internet Protocol IP information according to the uniform resource locator URL or the domain name information;

The application function file is obtained from the traffic information sent to the target server, and the uniform resource locator URL corresponding to the application function file is parsed to obtain hypertext transfer protocol HTTP request parameter information.
The computer-readable storage medium of claim 18, when the computer-readable instructions are executed by one or more processors, the one or more processors execute the vulnerability detection on the parsed data to obtain the vulnerability When checking the results, perform the following steps:

Sending the parsed data to the queue to be detected, and sequentially detect the uniform resource locator URL of the parsed data in the queue to be detected;

When it is detected that the uniform resource locator URL is a periodic detection task and the file corresponding to the uniform resource locator URL has not been changed, the last vulnerability detection result is called as the current vulnerability detection result, otherwise the uniform resource The URL of the locator performs fingerprint recognition on the World Wide Web and obtains the vulnerability detection result.