办公系统网络入侵测试及分析  

Testing and analysis of office automation system intrusion

作　　者：李耀辉[1] 龚良波[1] 武志峰[1] 

机构地区：[1]天津职业技术师范大学信息技术工程学院,天津300222

出　　处：《天津职业技术师范大学学报》2015年第1期25-29,共5页Journal of Tianjin University of Technology and Education

基　　金：天津市科技支撑计划项目(14ZLZLZF00031);天津市教委高校自然科学基金项目(20071311);天津职业技术师范大学科研发展基金资助项目(KJY12-09)

摘　　要：通过手工注入方法对天津职业技术师范大学在线办公系统的网络安全性进行了测试,发现该平台存在多个状态错误漏洞,包括登录用户可随意查看他人邮件、任何人不登录系统在浏览器输入特殊URL可直接下载邮件附件等泄露用户私密信息的漏洞;在此基础上,进一步发现了系统存在下载源码和存在拒绝服务攻击等威胁网络服务器的漏洞。针对存在问题,提出了提高网络办公系统安全性的方法。The process of network security testing to office automation system is discussed and the risk of the found network vulnerability is analyzed in this paper. A part of source code of office automation system is downloaded by using its network vulnerability and track the implementation of user login to this system on the base of these codes. And other vulnerability is found after these source code and the input URL in browser are analyzed. The main vulnerabilities include： the user can read others＂ email after he logins to the system; any user can download the registered user＇s email attachment even if he doesn＇t login to this system; there is the risk that hack download the source code of the system and find the absolute path of the website ; there exists the risk of denial of service in the website. In the end the method to improve the security of office automation system in the angle of theory and practice is proposed.

关 键 词：办公自动化 网络安全 入侵检测 网络漏洞 拒绝服务攻击 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]