CN112035840A - A data processing method, apparatus, electronic device and computer storage medium - Google Patents

Abstract

The embodiment of the invention provides a data processing method, a data processing device, electronic equipment and a computer storage medium, wherein the method comprises the following steps: determining a pre-marked vulnerability parameter position in a first request packet; performing coding nesting processing on the obtained effective load to obtain a processed effective load; placing the processed effective load into a vulnerability parameter position marked in advance in the first request packet to obtain a second request packet; and performing bypass detection on the second request packet to obtain a detection result.

Description

A data processing method, apparatus, electronic device and computer storage medium

technical field

The present invention relates to the technical field of network security, and in particular, to a data processing method, apparatus, electronic device and computer storage medium.

Background technique

In today's Internet environment with frequent vulnerabilities, whether it is a traditional World Wide Web (Web) vulnerability, or a constantly emerging common component vulnerability. Manufacturers and organizations tend to deploy simple and effective security protection systems to defend against vulnerabilities, thereby reducing or avoiding the costs and troubles that may arise from vulnerability patching and component upgrades. However, when there are shortcomings and deficiencies in the defense capabilities of the security protection system, vulnerability exploits can attack the back-end application system by bypassing the interception of the security protection system.

In the related art, the detection technology for a payload bypassing a security protection system is mainly: bypass detection or fuzz scanning based on a built-in payload or a given request packet combined with a tamper plug-in. For example, tools such as Sqlmap and WhatWAF are mainly based on the built-in Structured Query Language (SQL) injection payload or Cross Site Scripting (XSS) injection payload combined with user-specified tamper plug-ins and request packets to circumvent vulnerabilities. Attack detection. There are also some Fuzz tools that mainly use a given request package combined with tamper single-plug-in calls to generate different payloads to bypass Fuzz scanning. However, the above-mentioned bypass detection method puts the payload into the request package, and when performing bypass detection on the payload of the request package, it is necessary to find the location of the payload in the request package, that is, the payload cannot be intercepted directly, which reduces the security protection system bypass. over-detection efficiency.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a data processing method, apparatus, electronic device, and computer storage medium.

The technical solution of the embodiment of the present invention is realized as follows:

The present invention provides a data processing method, the method includes:

determining the location of the vulnerability parameter pre-marked in the first request packet;

Perform encoding and nesting processing on the obtained payload to obtain the processed payload;

Putting the processed payload into a pre-marked vulnerability parameter position in the first request packet to obtain a second request packet;

Bypass detection is performed on the second request packet to obtain a detection result.

In some embodiments, the encoding and nesting processing is performed on the acquired payload to obtain the processed payload, including:

The first plug-in is invoked to perform encoding and nesting processing on the acquired payload to obtain the processed payload; the first plug-in includes at least one plug-in.

In some embodiments, the invoking the first plug-in performs encoding and nesting processing on the acquired payload to obtain the processed payload, including:

In the case where the first plug-in includes multiple plug-ins, calling multiple plug-ins in the first plug-in according to the priority order of the multiple plug-ins in the first plug-in, and performing the processing on the obtained payload. Encode the nested processing to get the processed payload.

In some embodiments, the performing bypass detection on the second request packet includes:

Perform bypass detection on the processed payload in the second request packet; or,

Invoke a second plug-in to modify the second request packet, obtain a third request packet, and perform bypass detection on the processed payload in the third request packet; the second plug-in includes at least one plug-in .

In some embodiments, the invoking the second plug-in modifies the second request packet to obtain a third request packet, including:

In the case where the second plug-in includes multiple plug-ins, calling multiple plug-ins in the second plug-in according to the priority order of the multiple plug-ins in the second plug-in, and modifying the second request package process, and obtain the third request packet.

In some embodiments, the obtained payload includes a custom payload.

In some embodiments, the method further includes:

In the case that the detection result is not bypassed, obtain a judgment result of whether the second request packet bypasses the security protection system after the target plug-in is updated; the target plug-in includes the first plug-in and/or the second plug-in; the The first plug-in is used to encode and nest the processed payload in the second request packet; the second plug-in is used to modify the second request packet;

In the case that the judgment result is bypass, update the target plug-in;

In the case that the judgment result is that it is not bypassed, update processing is performed on the processed payload in the second request packet to obtain the updated payload.

The present invention provides a data processing device, the device comprising:

a determining module, used to determine the pre-marked vulnerability parameter position in the first request packet;

a first processing module, configured to perform encoding and nesting processing on the acquired payload to obtain the processed payload;

a second processing module, configured to place the processed payload into a pre-marked vulnerability parameter position in the first request packet to obtain a second request packet;

A detection module, configured to perform bypass detection on the second request packet to obtain a detection result.

In some embodiments, the first processing module is configured to perform encoding and nesting processing on the acquired payload to obtain the processed payload, including:

The first plug-in is invoked to perform encoding and nesting processing on the acquired payload to obtain the processed payload; the first plug-in includes at least one plug-in.

In some embodiments, the first processing module is configured to call the first plug-in to perform encoding and nesting processing on the acquired payload, and obtain the processed payload, including:

In the case where the first plug-in includes multiple plug-ins, calling multiple plug-ins in the first plug-in according to the priority order of the multiple plug-ins in the first plug-in, and performing the processing on the obtained payload. Encode the nested processing to get the processed payload.

In some embodiments, the detection module, configured to perform bypass detection on the second request packet, includes:

Perform bypass detection on the processed payload in the second request packet; or,

Invoke a second plug-in to modify the second request packet, obtain a third request packet, and perform bypass detection on the processed payload in the third request packet; the second plug-in includes at least one plug-in .

In some embodiments, the detection module is configured to call a second plug-in to modify the second request packet to obtain a third request packet, including:

In the case where the second plug-in includes multiple plug-ins, calling multiple plug-ins in the second plug-in according to the priority order of the multiple plug-ins in the second plug-in, and modifying the second request package process, and obtain the third request packet.

In some embodiments, the obtained payload includes a custom payload.

In some embodiments, the apparatus further includes a judging module, the judging module is configured to:

In the case that the detection result is not bypassed, obtain a judgment result of whether the second request packet bypasses the security protection system after the target plug-in is updated; the target plug-in includes the first plug-in and/or the second plug-in; the The first plug-in is used to encode and nest the processed payload in the second request packet; the second plug-in is used to modify the second request packet;

In the case that the judgment result is bypass, update the target plug-in;

In the case that the judgment result is that it is not bypassed, update processing is performed on the processed payload in the second request packet to obtain the updated payload.

The present invention provides an electronic device, the device includes a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements one or more of the foregoing technical solutions when executing the program. data processing method.

The present invention provides a computer storage medium, where a computer program is stored in the computer storage medium; after the computer program is executed, the data processing method provided by one or more of the foregoing technical solutions can be implemented.

Embodiments of the present invention provide a data processing method, apparatus, electronic device, and computer storage medium. The method includes: determining a pre-marked vulnerability parameter location in a first request packet; encoding and nesting the acquired payload , obtain the processed payload; put the processed payload into the pre-marked vulnerability parameter position in the first request packet to obtain a second request packet; perform bypass detection on the second request packet, Get test results. It can be seen that by placing the processed payload into the pre-marked vulnerability parameter position in the first request packet; the processed payload in the second request packet can be quickly bypassed directly based on the pre-marked vulnerability parameter position. Over-detection, and further, improve the efficiency of the security protection system bypassing detection.

Description of drawings

1 is a flowchart of a data processing method according to an embodiment of the present invention;

2 is a schematic flowchart of another data processing method according to an embodiment of the present invention;

3 is a schematic flowchart of a plug-in invocation according to an embodiment of the present invention;

FIG. 4a is a schematic diagram of the composition and structure of a data processing according to an embodiment of the present invention;

FIG. 4b is a schematic diagram of the composition and structure of another data processing according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an electronic device provided by the present invention.

Detailed ways

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

WAF is a product that provides protection for Web applications by implementing a series of security policies for Hyper Text Transfer Protocol (HTTP) and Hyper Text Transfer Protocol over Secure SocketLayer (HTTPS). WAF can perform content detection and verification on various requests from web application clients to ensure their security and legality. For illegal requests, that is, attacks against the network application layer, such as SQL injection, cross-site scripting attacks, and parameter tampering , application platform vulnerability attacks, denial of service attacks, etc. are blocked in real time, so as to effectively protect various websites.

Since WAF bypass detection is a dynamic confrontation process, it is necessary to update the construction of the payload and the invocation of the tamper plugin according to the detection results returned in real time.

In the related art, the WAF bypass detection method has the following disadvantages:

1) In related technologies, WAF bypass detection is usually limited to built-in payloads, such as XSS and SQL injection; it is impossible to put real-time customized payloads into request packets and send packets to interact, making the detection method inflexible. In addition, in the process of bypass detection, for the built-in payloads, each built-in payload needs to be put into the request packet one by one for bypass detection, that is, there will be a large number of packets sent, resulting in excessive attack traffic.

2) In the related art, for WAF bypass detection, the detection tool cannot specify specific vulnerability parameter points through the request packet; furthermore, it is impossible to directly intercept the payload according to the position of the vulnerability parameter point, reducing WAF bypass detection. s efficiency.

3) In the related art, the FUZZ tool is called by a single plug-in, that is, only a single plug-in can be called to bypass detection at a time. However, the request packet of a single plug-in is easily intercepted, and it is easy to generate too many meaningless request packets, which cannot be detected. It satisfies the scenario of multi-plug-in nested bypass, and further reduces the success rate of WAF bypass detection.

Based on the above technical problems, the present invention provides a data processing method. The technical solutions in the present invention will be described clearly and completely below with reference to the accompanying drawings in the present invention.

In some embodiments of the present invention, the data processing method may be implemented by using a processor in a data processing apparatus, and the above-mentioned processor may be an application specific integrated circuit (ASIC), a digital signal processor (Digital Signal Processor, DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (Programmable Logic Device, PLD), Field Programmable Gate Array (Field Programmable Gate Array, FPGA), Central Processing Unit (Central Processing Unit, CPU) ), at least one of a controller, a microcontroller, and a microprocessor.

FIG. 1 is a flowchart of a data processing method according to an embodiment of the present invention. As shown in FIG. 1 , the method includes:

Step 100: Determine the location of the vulnerability parameter pre-marked in the first request packet.

In some embodiments, the first request packet may be an HTTP request packet or an HTTPS request packet; wherein HTTP and HTTPS are used to represent application layer protocols, which define the communication protocol between browsers or other applications and the Web server. Process and format of data interaction.

In the embodiment of the present invention, the first request packet is composed of three parts: a request line, a request header and a request body; wherein, the request line includes a request mode, a Uniform Resource Locator (URL), a protocol and a version of the protocol. Request headers contain useful information about the client's environment and the request body; for example, request headers can declare the language used by the browser, the length of the request body, etc. There is a blank line between the request header and the request body. The blank line is used to indicate the end of the request header and the beginning of the request body; the request body can contain query string information submitted by the user, etc.

In some embodiments, the code of the request line can be expressed as: GET/sample.jspHTTP/1.1, where "GET" indicates the request method, "/sample.jsp" indicates the URL, and "HTTP/1.1" indicates the protocol and the protocol Version.

In one embodiment, the vulnerability parameter position indicates the position where the payload is put into the first request packet; before the bypass detection is performed on the request packet, the vulnerability parameter position in the first request packet needs to be marked; for example, the first The parameters of the request package are: para=<$>xxx<$> or Accept:<$>xxx<$>. Among them, para represents parameters such as query (GET), modification (POST), addition (PUT), and deletion (DELETE) in the first request packet; Accept represents the parameters corresponding to the request header in the first request packet; <$> represents the mark The vulnerability parameter location.

In some embodiments, assuming that the POST parameter of the unmarked first request packet is represented as: para=12345, the POST parameter after marking the vulnerability parameter position can be represented as para=1<$>23<$>45, It can also be expressed as para=1<$>234<$>5, and the vulnerability parameter position can be marked according to the actual application environment.

In an implementation manner, since the first request packet includes three parts: the request line, the request header and the request body, the corresponding vulnerability parameter positions can be marked for the three parts of the first request packet.

It can be seen that through this step, the bypass detection of the first request packet can be not limited to the GET parameter or POST parameter of the request line in the first request packet, but can also be extended to the entire structure of the first request packet.

In some embodiments, the vulnerability parameter position may be marked in any position of the request line, request header and request body in the first request packet according to user requirements.

Step 101: Encoding and nesting processing is performed on the acquired payload to obtain a processed payload.

Here, the payload means that the part of the virus or exploit code that achieves harmful or malicious behavior is called the payload; it can also refer to the code that plays a key role in the program.

In this embodiment of the present invention, the method for acquiring the payload may be directly input by the user, or may be acquired actively by bypassing the detection device.

In this embodiment of the present invention, the encoding nesting process may be used to convert the obtained payload into a payload with more bypass possibility.

In some embodiments of the present invention, if the obtained payload is not subjected to encoding and nesting processing, but is directly subjected to bypass testing, it will be intercepted by the security protection system to a large extent in the process of packet sending and detection. The determination of the defense rules and interception logic of the subsequent security protection system does not have too much reference value, and is a meaningless contract. Here, the security protection system may be a Web Application Firewall (Web Application Firewall, WAF), or may be another protection system composed of hardware, software, or hardware and software that can provide defense capabilities.

It can be seen that by encoding and nesting the obtained payload, the success rate of bypassing the security protection system can be improved, so that it is not easy to be intercepted by the security protection system in the process of packet sending and detection, and further, it is convenient to determine the security protection system in the future. Defense rules and blocking logic.

In one embodiment, performing encoding nesting processing on the acquired payload to obtain the processed payload may include: invoking a first plug-in to perform encoding and nesting processing on the acquired payload to obtain the processed payload. payload; the first plug-in includes at least one plug-in.

In this embodiment of the present invention, the first plug-in may represent a plug-in acting on the current payload; the acquired payload may be encoded and nested by one plug-in or a combination of multiple plug-ins.

In some embodiments, the obtained payload may be encoded by a plug-in such as base64 encoding, where the Base64 encoding is a process from binary to character, and can be used to transmit longer identification information in an HTTP environment.

In some embodiments, when the obtained payload is sky, the payload obtained through base64 encoding processing is c2t5. Since the payload c2t5 is significantly different from the payload sky, the payload is higher than the payload sky. c2t5 is more likely to bypass the security protection system.

In the embodiment of the present invention, since the possibility of a single plug-in bypassing the security protection system is often low, in the bypass detection process, the payload is processed by a combination of multiple plug-ins, which can increase the number of payload bypasses. Safeguard the success rate of the system while reducing unnecessary outsourcing.

In an implementation manner, invoking the first plug-in to perform encoding and nesting processing on the acquired payload to obtain the processed payload may include: in the case that the first plug-in includes multiple plug-ins, according to the first plug-in Multiple plugins in the first plugin are called in the priority order of the multiple plugins, and the obtained payload is encoded and nested to obtain the processed payload.

In this embodiment of the present invention, when the first plug-in includes multiple plug-ins, a priority order among the multiple plug-ins may be preset, and based on the priority order, the plug-ins are called one by one to encode the acquired payload.

In some embodiments, when the first plug-in includes plug-in A1, plug-in A2, and plug-in A3, if the priority order is: plug-in A1, plug-in A2, plug-in A3; then call plug-in A1 first to obtain the payload Perform encoding processing, then call the plug-in A2 to encode the obtained payload, and finally call the plug-in A3 to encode the obtained payload. After the first plug-in is called, the processed payload is obtained.

Here, the method for setting the priorities of multiple plug-ins in the first plug-in may be set according to an actual application environment, which is not limited in the embodiment of the present invention.

In one embodiment, the obtained payload includes a custom payload. That is, the payload can be customized according to the interception characteristics of the security protection system in the specific detection environment, and the custom payload can be encoded and nested, which can effectively avoid unnecessary packet sending and improve the efficiency of the security protection system bypassing detection.

Step 102: Put the processed payload into a pre-marked vulnerability parameter position in the first request packet to obtain a second request packet.

In the embodiment of the present invention, the vulnerability parameter position is pre-marked by the first request packet; then, the payload that needs to be bypassed for detection is obtained, and the payload is encoded and nested by calling the first plug-in to obtain the processed payload ; Finally, put the processed payload into the pre-marked vulnerability parameter position in the first request packet to obtain the second request packet.

In some embodiments, it is assumed that the POST parameter of the unmarked first request packet is represented as: para=1234, and the POST parameter after marking the vulnerability parameter position of the first request packet is represented as para=1<$>23<$ >4; if the obtained payload is payload B, call the first plug-in to encode and nest the payload B to obtain payload C, then replace the original content 23 of the vulnerability parameter position with valid payload in the subsequent packet detection process If the payload is C, the POST parameter of the first request packet for which the bypass detection is finally performed is represented as para=1<$>C<$>4.

In the embodiment of the present invention, by pre-marking the vulnerability parameter position in the first request packet, the program can automatically identify the vulnerability parameter position and replace the original content of the vulnerability parameter position with a valid value for bypassing detection in the subsequent packet sending detection process. Payload; in addition, the payload is encoded and nested based on the priority order of multiple plug-in calls, which can realize dynamic security protection system bypass detection during real-time interaction and efficient packet bypass testing.

Step 103: Perform bypass detection on the second request packet to obtain a detection result.

In the embodiment of the present invention, the processed payload is bypassed and detected by the security protection system; since the second request packet includes the processed payload; therefore, the security protection system can obtain the processed payload according to the second request packet. The detection result of the payload.

In the embodiment of the present invention, the detection result of bypass detection on the processed payload includes two cases: one is not bypassed; the other is bypassed, that is, the security protection system Payload interception failed.

In some embodiments of the present invention, in the case of interception failure, the second request packet is stored for subsequent convenient judgment of the defense rules and interception logic of the security protection system to ensure network security.

In one embodiment, bypassing detection on the second request packet includes:

Perform bypass detection on the processed payload in the second request packet; or,

The second plug-in is called to modify the second request packet to obtain a third request packet, and bypass detection is performed on the processed payload in the third request packet; the second plug-in includes at least one plug-in.

In this embodiment of the present invention, the second plug-in may represent a plug-in acting on the second request package; that is, the second request package may be modified by invoking the second plug-in.

In some embodiments, the request packet of the second request packet can be modified by invoking the second plug-in; the transmission format of the second request packet can also be modified and replaced by bypassing the plug-in; Chunked encoding format transmission, or multipart-data data transmission using malformed format.

In the embodiment of the present invention, on the basis of invoking the first plug-in to process the payload, the second plug-in is invoked to modify the second request packet; the success rate of bypassing the security protection system by the payload can be further increased, and the inconvenience is reduced. Necessary package.

In an implementation manner, invoking the second plug-in to modify the second request packet to obtain the third request packet may include: in the case that the second plug-in includes multiple plug-ins, according to the plurality of plug-ins in the second plug-in Call multiple plug-ins in the second plug-in in order of priority, modify the second request packet, and obtain the third request packet.

In this embodiment of the present invention, when the second plug-in includes multiple plug-ins, a priority order among the multiple plug-ins may be preset, and based on the priority order, the plug-in is invoked to encode the acquired payload.

In some embodiments, when the second plug-in includes plug-in D1, plug-in D2, and plug-in D3, if the priority order is: plug-in D1, plug-in D2, and plug-in D3; After the modification processing, the plug-in D2 is called to modify the second request packet, and finally the plug-in D3 is called to modify the second request packet. After the second plug-in is called, the third request packet is obtained.

In the embodiment of the present invention, the modification processing is performed on the second request packet based on the priority order of multiple plug-ins in the second plug-in, which can improve the bypass detection efficiency and reduce the problem of detection failure caused by multiple plug-in invocation errors.

Here, the priority setting method for multiple plug-ins in the second plug-in may be set according to an actual application environment, which is not limited in this embodiment of the present invention.

In the embodiment of the present invention, the security protection system may directly perform bypass detection on the processed payload in the second request packet to obtain the detection result; it may also perform bypass detection on the processed payload in the third request packet to obtain Test results.

In the case that the detection result is not bypassed, the judgment result of whether the second request packet bypasses the security protection system after the update of the target plug-in is obtained; the target plug-in includes the first plug-in and/or the second plug-in; the first plug-in is used to The processed payload in the second request packet is encoded and nested; the second plug-in is used to modify the second request packet; if the judgment result is bypass, update the target plug-in; if the judgment result is If not bypassed, update the processed payload in the second request packet to obtain the updated payload.

In some embodiments of the present invention, in the case where the detection result is not bypassed, that is, the second request packet is successfully intercepted; for this situation, security personnel are required to further determine whether the second request packet is still available after the target plug-in is updated. It can bypass the security protection system and get the judgment result.

In the embodiment of the present invention, in the case that the judgment result is bypass, the updated first plug-in can be obtained by increasing or decreasing the number of calls of the first plug-in; the processed payload is compared with the updated first plug-in. Combined, the possibility of bypassing the security protection system is improved; the updated first plug-in can also be obtained by increasing or decreasing the number of calls of the second plug-in; the processed third request package is combined with the updated second plug-in , increasing the likelihood of bypassing security systems.

In some embodiments, in the case that the judgment result is that it is not bypassed, the obtained payload can be updated according to the processed payload to obtain the updated payload; and the above-mentioned payload can be sequentially performed using the updated payload. Step 101 to Step 103.

Since the bypass detection of the security protection system is a dynamic confrontation process, it is necessary to dynamically adjust the bypass detection through real-time return. In this embodiment of the present application, it is determined whether to update the processed payload according to the real-time return detection result. processing, or update the first plug-in and/or the second plug-in; that is, it is possible to dynamically adjust the bypass detection through real-time returns, and further, to ensure that the security protection system bypasses the dynamic confrontation in the detection process, so that the bypass detection can be bypassed. Inspection is more flexible and efficient, while reducing the number of packets sent.

In order to better reflect the purpose of the present invention, further examples are provided on the basis of the above embodiments of the present invention.

FIG. 2 is a schematic flowchart of another data processing method according to an embodiment of the present invention, as shown in FIG. 2 , which mainly includes:

Step 20: Vulnerability parameter location marking.

In one implementation, at the beginning of bypass detection, a request package needs to be given, and the location of the vulnerability parameter to be bypassed tested in the request package is marked; for example, the parameter of the request package is: para= <$>xxx<$> or Accept:<$>xxx<$>. Among them, para represents the query (GET), modify (POST), add (PUT) and delete (DELETE) parameters in the request package; Accept represents the parameter corresponding to the request header in the request package; <$> represents the marked vulnerability parameter location . It can be seen that through the vulnerability parameter position mark, the program can identify the vulnerability parameter position and replace the content of the vulnerability parameter position in the subsequent packet detection process. It can be seen that this step makes the bypass test not limited to parameters such as GET or POS, but can be extended to the entire request packet structure.

Step 21: Get the payload.

In one embodiment, the way of acquiring the payload can be directly input by the user, or can be acquired actively by bypassing the detection device; the acquired payload can include a user-defined payload; it can be determined according to the WAF in a specific environment The interception feature makes targeted updates to the payload; that is, the payload can be updated according to the judgment result returned in real time.

Step 22: Get the plugin.

In one embodiment, the plug-in includes the first plug-in and the second plug-in in the above embodiment; the plug-in to be called can be determined by checking; that is, the plug-in can be targeted according to the WAF interception characteristics in the specific environment. Updates and calls can detect the interception logic and interception feature points of WAF faster, and reduce unnecessary packets; it can be seen that by using other payloads or plug-ins that are more likely to bypass, bypass detection can be More flexibility and high efficiency in dynamic adjustment, while reducing the amount of outgoing packages.

Step 23: Do plugin sorting.

In one embodiment, when the first plug-in includes multiple plug-ins, sorting is performed according to the priority order of the multiple plug-ins in the first plug-in, and when the second plug-in includes multiple plug-ins, the sorting is performed according to the second plug-in. The priority order of multiple plug-ins in the plug-in is sorted; in bypass detection, the effect of a single plug-in bypass method is often negligible, and a combination of multiple plug-in bypass methods is required to improve the success rate of attack bypass. Multiple plugin calls need to set a calling priority in each plugin to reduce and avoid unnecessary errors in the nesting process.

Step 24: Invoke the plugin.

In one embodiment, calling the first plug-in according to the priority order can encode the payload, and calling the second plug-in according to the priority order can modify the request packet. In the process of invoking the plug-in, the payload (such as base64 encoding and other plug-ins) is first encoded according to the priority order of multiple plug-ins in the first plug-in, and finally a processed payload is generated to act on the request package; secondly According to the priority order of multiple plug-ins in the second plug-in, the general bypass plug-in (such as Chunked encoding plug-in) that directly acts on the request package is called to modify the request package; after each plug-in is called, the processed request package is obtained .

Step 25: Send the processed request packet and judge the detection result.

In one embodiment, the processed request packet is sent to obtain a detection result; if the detection result is bypassed, the corresponding request packet is stored for subsequent determination of the WAF's defense rules and interception logic . In the case that the detection result is not bypassed, security personnel are required to further judge whether the request package after the target plug-in update can bypass the security protection system, and obtain the judgment result. The target plug-in includes a first plug-in and/or a second plug-in; the first plug-in is used to encode and nest the processed payload in the second request packet; the second plug-in is used to modify the second request packet;

If the judgment result is bypassed, update the target plug-in; after obtaining the updated target plug-in, return to step 22; if the judgment result is not bypassed, update the processed in the second request packet The payload is updated to obtain the updated payload; after the updated payload is obtained, return to step 21 .

In the embodiment of the present invention, WAF bypass is a dynamic confrontation process, and through real-time request packet interaction, it is convenient for security personnel to judge the defense rules and interception logic of WAF. And according to the detection results, the payload or plug-in calls are modified and updated in a targeted manner.

In the embodiment of the present invention, the vulnerability parameter position can be marked in the request package, the custom payload is encoded and nested by invoking the first plug-in, and the processed payload is put into the vulnerability parameter position in the request package to obtain the first plug-in. a request package; then call the second plug-in to modify the first request package, obtain the second request package, and finally perform a bypass test on the second request package; it can be seen that the embodiment of the present invention can interact in real time and efficiently. Dynamic WAF bypass detection is implemented in the process of sending packets. Effectively avoid generating too many meaningless requests, ensure dynamic confrontation in the process of WAF bypass detection, and improve the flexibility of WAF bypass detection.

Since the process of bypassing detection is inseparable from the update and expansion of plug-ins, the ability and level of the overall attack bypass detection can be improved by supplementing and continuously optimizing plug-ins. Plug-ins can be mainly divided into two types: the first is the plug-in that acts on the payload, that is, the first plug-in; it is mainly used to encode and nest the custom payload; the second is the plug-in that acts on the request package. That is, the second plug-in is mainly used to modify the request package; the calling process of the two plug-ins will be described below with reference to FIG. 3 .

FIG. 3 is a schematic flowchart of calling a plug-in according to an embodiment of the present invention. As shown in FIG. 3 , it mainly includes three steps: judging the function type of the plug-in call, processing the payload, and processing the request packet. Processing can be obtained through these three steps. The following payload and request packet.

First, in the process of invoking the plug-in, it is determined whether the invoking plug-in is the first plug-in acting on the payload or the second plug-in acting on the request package according to the plug-in action type.

Then, the first plug-in is determined, the current payload is acquired, the first plug-in is called to encode the current payload, and the processed payload is returned.

Finally, the second plug-in is determined, the request package is obtained, the second plug-in is called to modify the request package, and the processed request package is returned.

In one embodiment, when the current payload is obtained, the encapsulated plug-in encoding function is invoked to perform encoding processing on it; for example, base64 encoding or replacement of comments in SQL injection, etc.

In one embodiment, when the request packet is obtained, it modifies and replaces its format, and tries to use a general bypass plug-in; for example, use the Chunked encoding format with random annotations for transmission, or use the malformed format of multipart-data data transmission.

Here, both the first plugin and the second plugin are extensible. By taking the current payload or request package as a standardized input, a highly encapsulated plugin encoding function is introduced, and the processed payload or request package is returned as a standardized output.

It can be seen that the embodiments of the present invention can perform attack bypass detection by updating payloads or request packets based on the method of nested invocation of multiple plug-ins, thereby realizing dynamic WAF bypass detection.

FIG. 4a is a schematic diagram of the composition and structure of a data processing according to an embodiment of the present invention. As shown in FIG. 4a, the apparatus includes: a determination module 400, a first processing module 401, a second processing module 402, and a detection module 403, wherein:

A determination module 400, configured to determine the pre-marked vulnerability parameter position in the first request packet;

The first processing module 401 is configured to perform encoding and nesting processing on the acquired payload to obtain the processed payload;

The second processing module 402 is configured to put the processed payload into a pre-marked vulnerability parameter position in the first request packet to obtain a second request packet;

The detection module 403 is configured to perform bypass detection on the second request packet to obtain a detection result.

In one embodiment, the first processing module 401 is configured to perform encoding and nesting processing on the acquired payload to obtain the processed payload, including:

The first plug-in is called to perform encoding and nesting processing on the acquired payload to obtain the processed payload; the first plug-in includes at least one plug-in.

In one embodiment, the first processing module 401 is configured to call the first plug-in to perform encoding and nesting processing on the acquired payload, and obtain the processed payload, including:

When the first plug-in includes multiple plug-ins, call multiple plug-ins in the first plug-in according to the priority order of the multiple plug-ins in the first plug-in, perform encoding and nesting processing on the acquired payload, and obtain the processed payload.

In one embodiment, the detection module 403, configured to perform bypass detection on the second request packet, includes:

Perform bypass detection on the processed payload in the second request packet; or,

The second plug-in is called to modify the second request packet to obtain a third request packet, and bypass detection is performed on the processed payload in the third request packet; the second plug-in includes at least one plug-in.

In one embodiment, the detection module 403 is configured to call the second plug-in to modify the second request packet to obtain the third request packet, including:

When the second plug-in includes multiple plug-ins, the multiple plug-ins in the second plug-in are called according to the priority order of the multiple plug-ins in the second plug-in, and the second request packet is modified to obtain the third request packet.

In one embodiment, the obtained payload includes a custom payload.

FIG. 4b is a schematic diagram of the composition structure of another data processing according to an embodiment of the present invention. As shown in FIG. 4b, the apparatus further includes a judgment module 404, and the judgment module 404 is used for:

In the case that the detection result is not bypassed, the judgment result of whether the second request packet bypasses the security protection system after the update of the target plug-in is obtained; the target plug-in includes the first plug-in and/or the second plug-in; the first plug-in is used to The payload processed in the second request packet is encoded and nested; the second plug-in is used to modify the second request packet;

If the judgment result is bypass, update the target plug-in;

In the case that the judgment result is that it is not bypassed, update processing is performed on the processed payload in the second request packet to obtain the updated payload.

In practical applications, the above determination module 400, first processing module 401, second processing module 402, detection module 403 and judgment module 404 can all be implemented by a processor located in an electronic device, and the processor can be an ASIC, DSP, At least one of DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

In addition, each functional module in this embodiment may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or can be implemented in the form of software function modules.

If the integrated unit is implemented in the form of software function modules and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment is essentially or correct. Part of the contribution made by the related art or all or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium, and includes several instructions to make a computer device (which can be a personal computer). , server, or network device, etc.) or processor (processor) executes all or part of the steps of the method in this embodiment. The aforementioned storage medium includes: U disk, removable hard disk, read only memory (Read Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes.

Specifically, a computer program instruction corresponding to a data processing method in this embodiment may be stored on a storage medium such as an optical disk, a hard disk, a U disk, etc. When the computer program instruction corresponding to a data processing method in the storage medium When read or executed by an electronic device, any one of the data processing methods in the foregoing embodiments is implemented.

Based on the same technical concept as the foregoing embodiments, see FIG. 5 , which shows an electronic device 500 provided by an embodiment of the present invention, which may include: a memory 501 and a processor 502; wherein,

memory 501 for storing computer programs and data;

The processor 502 is configured to execute the computer program stored in the memory to implement any one of the data processing methods in the foregoing embodiments.

In practical applications, the above-mentioned memory 501 may be a volatile memory (volatile memory), such as RAM; or a non-volatile memory (non-volatile memory), such as ROM, flash memory (flash memory), hard disk (Hard Disk memory) Drive, HDD) or solid-state drive (Solid-State Drive, SSD); or a combination of the above types of memory, and provide instructions and data to the processor 502 .

The above-mentioned processor 502 may be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor. It can be understood that, for different augmented reality cloud platforms, the electronic device used to implement the above processor function may also be other, which is not specifically limited in the embodiment of the present invention.

In some embodiments, the functions or modules included in the apparatus provided in the embodiments of the present invention may be used to execute the methods described in the above method embodiments. For specific implementation, reference may be made to the above method embodiments. For brevity, here No longer

The above description of the various embodiments tends to emphasize the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, details are not repeated herein.

The methods disclosed in each method embodiment provided by the present invention can be combined arbitrarily without conflict to obtain a new method embodiment.

The features disclosed in each product embodiment provided by the present invention can be combined arbitrarily without conflict to obtain a new product embodiment.

The features disclosed in each method or device embodiment provided by the present invention can be combined arbitrarily without conflict to obtain a new method embodiment or device embodiment.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (10)

1. a data processing method, is characterized in that, described method comprises: determining the location of the vulnerability parameter pre-marked in the first request packet; Perform encoding and nesting processing on the obtained payload to obtain the processed payload; Putting the processed payload into a pre-marked vulnerability parameter position in the first request packet to obtain a second request packet; Bypass detection is performed on the second request packet to obtain a detection result. 2. The method according to claim 1, characterized in that, performing encoding and nesting processing on the acquired payload to obtain the processed payload, comprising: The first plug-in is invoked to perform encoding and nesting processing on the acquired payload to obtain the processed payload; the first plug-in includes at least one plug-in. 3. The method according to claim 2, wherein the invoking the first plug-in performs encoding and nesting processing on the obtained payload to obtain the processed payload, comprising: In the case where the first plug-in includes multiple plug-ins, calling multiple plug-ins in the first plug-in according to the priority order of the multiple plug-ins in the first plug-in, and performing the processing on the obtained payload. Encode the nested processing to get the processed payload. 4. The method according to claim 1, wherein the performing bypass detection on the second request packet comprises: Perform bypass detection on the processed payload in the second request packet; or, Invoke a second plug-in to modify the second request packet, obtain a third request packet, and perform bypass detection on the processed payload in the third request packet; the second plug-in includes at least one plug-in . 5. The method according to claim 4, wherein the invoking a second plug-in to modify the second request packet to obtain a third request packet, comprising: In the case where the second plug-in includes multiple plug-ins, calling multiple plug-ins in the second plug-in according to the priority order of the multiple plug-ins in the second plug-in, and modifying the second request package process, and obtain the third request packet. 6. The method according to any one of claims 1 to 5, wherein the acquired payload comprises a self-defined payload. 7. The method of claim 1, wherein the method further comprises: In the case that the detection result is not bypassed, obtain a judgment result of whether the second request packet bypasses the security protection system after the target plug-in is updated; the target plug-in includes the first plug-in and/or the second plug-in; the The first plug-in is used to encode and nest the processed payload in the second request packet; the second plug-in is used to modify the second request packet; In the case that the judgment result is bypass, update the target plug-in; In the case that the judgment result is that it is not bypassed, update processing is performed on the processed payload in the second request packet to obtain the updated payload. 8. A data processing device, wherein the device comprises: a determining module, used to determine the pre-marked vulnerability parameter position in the first request packet; a first processing module, configured to perform encoding and nesting processing on the acquired payload to obtain the processed payload; a second processing module, configured to place the processed payload into a pre-marked vulnerability parameter position in the first request packet to obtain a second request packet; A detection module, configured to perform bypass detection on the second request packet to obtain a detection result. 9. An electronic device, characterized in that the device comprises a memory, a processor, and a computer program stored on the memory and running on the processor, the processor implementing claims 1 to 7 when executing the program The method of any one. 10. A computer storage medium on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images