远程文件包含漏洞分级检测工具研究  

STUDY ON VULNERABILITY CLASSIFICATION DETECTION TOOL FOR REMOTE FILE INCLUSION

作　　者：周开东[1] 魏理豪[1] 王甜[1] 邹洪[1] 崔磊[1] 刘亚琼 

机构地区：[1]广东电网公司信息中心,广东广州510600 [2]广东博士科技有限公司,广东广州510060

出　　处：《计算机应用与软件》2014年第2期21-23,28,共4页Computer Applications and Software

摘　　要：深入研究基于PHP的远程文件包含漏洞检测以及漏洞分级等技术,在此基础上设计和实现远程文件包含漏洞分级检测工具,并搭建基于PHP语言的目标系统,对检测工具原型进行全面的功能和性能测试。提出漏洞分级检测思想,模拟攻击者向应用系统发送请求,通过服务器的返回信息来判断漏洞的存在性及漏洞的级别。We thoroughly study the PHP-based vulnerability detection and classification technology for remote file inclusion,based on it we design and implement a vulnerability classification and detection tool for remote file inclusion,build a PHP language-based target system,and conduct an overall functional and performance test on the prototype of detection tool.The vulnerability classification and detection idea proposed in this article is to simulate the attacker to send the requests to web application system and then to determine the existence of the vulnerabilities and their levels through the returned information from the server.

关 键 词：远程文件包含 漏洞分级 漏洞检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]