Script-based website vulnerability scanning method and system

Abstract

The invention relates to the field of network application security, and provides a script-based website vulnerability scanning method and system. The script-based website vulnerability scanning method comprises the steps of setting a website URL to be scanned, selecting security vulnerability types needing to be detected by a website, starting a scanning engine module, constructing and sending an HTTP request to the URL needing to be detected, receiving an HTTP response, storing all data into the scanning engine module, and respectively executing corresponding vulnerability detection script modules according to the security vulnerability types selected by a user. The website vulnerability scanning system comprises the scanning engine module and the vulnerability detection script modules. According to the script-based website vulnerability scanning method and system, vulnerability detection logic is separated from a scanning engine, the coupling degree of the vulnerability detection logic and the scanning engine is reduced, the vulnerability detection logic is achieved through a vulnerability detection script, and the scanning engine has the general basic function not special for vulnerabilities of a certain kind.

Description

technical field [0001] The invention relates to the field of network application security, in particular to a script-based website vulnerability scanning method and system. Background technique [0002] With the development of the Internet, various network applications emerge in an endless stream. While realizing various functions, various security loopholes are also introduced, which provides convenience for attackers. In response to the increasing demand for website security, many website vulnerability scanners have appeared. The scanners usually "crawl" the entire website according to the URL provided by the user, download the webpage, and then detect and analyze the content of the webpage to check whether there is any vulnerability in the webpage. There are loopholes. [0003] But almost all scanners are faced with such problems: (1) there are many kinds of vulnerabilities, and the detection methods for different vulnerabilities are different. How can a scanner be reaso...

AI Technical Summary

Problems solved by technology

[0003] But almost all scanners are faced with such problems: (1) there are many kinds of vulnerabilities, and the detection methods for different vulnerabilities are different. How can a scanner be reasonably designed to support various vulnerabilities to the greatest extent? (2) The Internet is a rapidly developing industry, and new website security vulnerabilities may appear at any time. How can the scanner be quickly expanded to support new vulnerability detection solutions?

But common configuration files are often inflexible, cannot be expanded quickly, and are not convenient for security researchers to use

Images