- 學位論文
自動化滲透測試框架-目錄遍歷與遠端文件包含漏洞之偵測
Automatic Penetration Testing Framework-Vulnerabilities Detecting of Directory Traversal Attack and Remote File Inclusion
摘要
隨著時間的推移，資料變得越來越重要和不可或缺。許多行業會利用資訊化和線上化來提高生產能力或降低人力成本。 然而，隨著越來越多的企業和組織將其服務和數據數位化，資訊安全成為現代社會的重大問題。黑客可能會覬覦企業的寶貴數據，並將其轉售給敵對或不道德的組織或企業。此外，客戶不希望他們的個人數據被散播到其他地方。因此，企業和組織應確保其資料安全。 為了防止數據洩露，網路服務的開發人員應該確保他們的系統對於不道德的攻擊者來說是無可挑剔的。滲透測試是其中一種有效的方法。通過滲透測試，開發人員可以發現他們的系統是否存在可被滲透的漏洞。此外，自動化檢查工具可以減輕開發人員的負擔。因此，自動滲透測試工具有助於開發人員檢查他們開發的系統。 然而，現存的工具已經有一些問題:在某些情況下它們對連結的覆蓋範圍不足。覆蓋率不足可能會降低檢查的精度，從而使檢查工具失效；另外，這些工具對目錄遍歷和遠端文件包含漏洞偵測的成功率也不足，誤判率也很高。因此，在本論文中，我們將提出另一種在精度和性能上超越其他的工具。我們還進行了一些實驗來證明以上敘述。
並列摘要
As time goes by, information becomes essential and indispensable. Various industries utilize information technology and the internet to increase production ability or decrease labor costs. However, as more enterprises and organizations digitize their services and data, information security becomes a more significant issue for modern society. Some hackers may covet valuable data from enterprises and resell them to hostile or unscrupulous organizations or enterprises. Furthermore, customers do not expect that their data will be stolen and distributed to another place. Hence, enterprises and organizations should keep their data safe. Web services developers should ensure that their web applications are impeccable for unscrupulous attackers to prevent data breaches. One of the practical solutions is checking web applications by penetration testing. Through penetration testing, developers can discover whether their web applications are vulnerable to penetration. In addition, automatized checking tools can decrease the burden on developers of web applications. Thus, automatic penetration testing tools are helpful for developers to examine their web applications. However, current tools have some problems. Although several tools are automatic, they have coverage shortages in some cases. Shortage of coverage may reduce the precision of checking, which invalidates the checking tools. Moreover, those tools have a low percentage of successful detection and a high misjudgment ratio on directory traversal attacks and remote file inclusion. Thus, this thesis proposes another tool that surpasses current tools on precision and performance on both directory traversal attack and remote file inclusion. We also conduct some experiments to prove our tool’s abilities.