- 期刊
JAVA網頁系統之反序列化弱點偵測技術
JAVA Web System Deserialization Vulnerability Detection Technology
摘要
隨著科技不斷的進步，網頁系統已越來越普及，而網頁系統的功能也越來越複雜，進而衍生出更多的漏洞造成了安全威脅。由於開發網頁系統會使用大量的函式庫進行撰寫，而部分有缺陷的函數或是可被利用的函數堆疊後將導致系統產生漏洞，於OWASP TOP 10：2021中，不安全的反序列化（Insecure Deserialization）被列為A8，在現行的黑箱測試中不見得可以發現反序列化的漏洞，是需要透過人工的方式進行審查，才可避免漏洞的產生。白箱測試是網頁滲透測試的主要方法之一，透過滲透測試員對目標網頁進行原始碼檢測發現弱點，開發攻擊程式碼對其網頁進行滲透測試攻擊進而修補網頁弱點。本研究設計Java網頁系統建置反序列化漏洞，並運用知名弱點掃描工具進行黑箱測試，經測試後並無發現可利用弱點，再透過白箱測試檢測原始碼發現網頁弱點，開發攻擊程式碼展示反序列化攻擊方法，進而獲得網頁系統管理者權限，藉此方法顯示白箱測試的重要性。
並列摘要
With the continuous advancement of technology, web systems have become increasingly prevalent, and the functionalities of web systems have also become more complex, leading to the emergence of more vulnerabilities and security threats. Since the development of web systems involves the use of numerous libraries for coding, the existence of defective or exploitable functions in these libraries can result in system vulnerabilities. In OWASP TOP 10: 2021, insecure deserialization is classified as A8. Current black-box testing, may not necessarily uncover deserialization vulnerabilities, requiring a manual review to prevent the occurrence of such vulnerabilities. White-box testing is one of the primary methods in web penetration testing. Through source code analysis, penetration testers identify weaknesses in the target web application. They then develop attack code to perform penetration testing attacks on the web application, subsequently patching any identified vulnerabilities. Based on this issue, this study designs a Java web system to build a deserialization vulnerability and utilizes well-known vulnerability scanning tools for black-box testing. After testing, no exploitable vulnerabilities were discovered. Subsequently, white-box testing is conducted to examine the source code, identifying web vulnerabilities. Attack code is developed to demonstrate deserialization attack methods, thereby gaining administrator privileges in the web system. Through this approach, the significance of white-box testing is highlighted.