웹취약점진단시스템개발 (OWASP TOP 10 기반 ) 팀명 : WeST 지도교수 : 양환석교수님 팀 장 : 박의명 팀 원 : 심명섭오경준송요섭강보경조예림 중부대학교정보보호학과

Transcription

1 웹취약점진단시스템개발 (OWASP TOP 10 기반 ) 팀명 : WeST 지도교수 : 양환석교수님 팀 장 : 박의명 팀 원 : 심명섭오경준송요섭강보경조예림 중부대학교정보보호학과

2 목 차 1. 서론 1.1 연구목적및필요성 연구주제선정이유 2 2. 관련연구 2.1 Python Ubuntu Apache MySQL Php Html 4 3. 본론 3.1 구상도설명 취약점진단도구제작및실행 리포팅시스템개발 결론 4.1 결론및기대효과 참고자료 별첨 6.1 발표 PPT 소스코드 26

3 1. 서론 1.1 연구목적및필요성웹은접근의용이성때문에보안사고의대부분을차지할정도로집중적인공격대상이되고있어그범위와피해가날이갈수록증가하고있다. 그래프 ( 출처 : verizon data breach investigations report) 를보면웹어플리케이션을공격하는방식이가장많은공격비중을차지한다는것을알수있다. 이에 OWASP TOP 10을기준으로하여웹취약점을진단하고대응방안까지알려주는보안시스템을개발하려고한다. < 그림 1 : Verizon 데이터침해조사보고서 > 1.2 연구주제선정이유시중에사용되고있는취약점진단서비스는면담을통해수기로이루어지거나직접고객사와만나며이루어져야한다는제한성을가지고있다. 그에비해 WeST팀은직접웹취약점진단사이트를구축함으로써사용자의인증절차를통해접근을편리성을가진웹사이트와발견된취약점에대한대응방안을볼수있는리포팅시스템을개발한다

4 2. 관련연구 2.1 Python python은 1991년프로그래머인 Guido van Rossum이발표한고급프로그래밍언어로플랫폼독립적이며인터프리터식, 객체지향적, 동적타이핑대화형언어이다. Python은비영리의 Python 소프트웨어재단이관리하는개방형, 공동체기반개발모델을가지고있다 C언어로구현된 C파이썬구현사실상의표준이다. < 그림 2-1 : 파이썬로고 > 2.2 Ubuntu 우분투는컴퓨터에서프로그램과주변기기를사용할수있도록해주는운영체제중하나이다. 안드로이드운영체제처럼리눅스커널에기반한운영체제로모바일과데스크톱 PC, 서버에도우분투운영체제를설치해사용할수있다. 리눅스는리누스토발즈라는개발자가어셈블리어라는프로그래밍언어로유닉스를모델삼아개발한오픈소스운영체제이다. 우분투는리눅스 OS의배포판중하나로특히데스크톱 PC에서사용할수있게특화된운영체제이다. < 그림 2-2 : Ubuntu > 2.3 Apache Apache HTTP 서버는아파치소프트웨어재단에서관리하는 HTTP 웹서버이다. BSD, 리눅스등유닉스계열뿐아니라마이크로소프트윈도우나노벨넷웨어같은기종에서 - 3 -

5 도운용할수있다. 아파치프로젝트는공동제작과합의에기반한개발프로세스와오픈 되고실용적인소프트웨어라이선스라는특징으로규정된다. 2.4 MySQL MYSQL은세계에서가장많이쓰이는오픈소스의관계형데이터베이스관리시스템이다. RDBMS라고도불린다. 다중스레드, 다중사용자의형식의구조질의어형식의데이터베이스관리시스템으로써 MYSQL AB가관리및지원하고있으며 Qt처럼이중라이선스가적용된다. 하나의옵션은 GPL이며 GPL이외의라이선스로적용시키려는경우전통적인지적재산권라이선스의적용을받는다. 2.5 Php php는 C언어를기반으로만들어진서버측에서실행되는서버사이드스크립트언어이다. 동적웹페이지를만들기위해설계되었으며이를구현하기위해 php로작성된코드를 html 소스문서안에넣으면 php 처리기능이있는웹서버에서해당코드를인식하여작성자가원하는웹페이지를생성한다. 근래에는 PHP 코드와 HTML을별도파일로분리하여작성하는경우가일반적이며, PHP 또한웹서버가아닌 php-fpm(php FastCGI Process Manager) 을통해실행하는경우가늘어나고있다. 또한 PHP는명령줄인터페이스방식의자체인터프리터를제공하여이를통해범용프로그래밍언어로도사용할수있으며그래픽애플리케이션을제작할수도있다. 2.6 Html 하이퍼본문표식달기언어라는의미의웹페이지를위한지배적인마크업언어다. HTML은제목, 단락, 목록등과같은본문을위한구조적의미를나타내는것뿐만아니라링크, 인용과그밖의항목으로구조적문서를만들수있는방법을제공한다. 그리고이미지와객체를내장하고대화형양식을생성하는데사용될수있다. 3. 본론 3.1 구상도설명 - 4 -

6 < 그림 3-1 : 구상도 > 3.2 취약점진단도구제작및실행 OWASP Top 10 과 KISA 에서발간한주요정보통신기반시설기술적취약점 분석 평가방법상세가이드를토대로해당취약점진단도구를개발하였다. < 그림 3-2 : OWASP Top > - 5 -

7 먼저비회원이인증절차를통하여회원가입을하고, 로그인및진단요청을하게되면취약점진단도구를통해해당웹사이트에대한취약점을진단한다. 이후리포팅시스템을통해취약점진단보고서를작성해데이터베이스에저장하고, 사용자에게보고서를전달해준다. < 그림 3-3 : Web 취약점분석 평가항목 > - 6 -

8 < 그림 3-4 : SQL INJECTION 취약점도구소스일부 > < 그림 3-5 : XSS 취약점도구소스일부 > - 7 -

9 < 그림 3-6 : 디렉토리리스팅취약점도구소스일부 > < 그림 3-7 : 알려진취약점도구소스일부 > - 8 -

10 < 그림 3-8 : 관리자페이지노출취약점도구소스일부 > < 그림 3-9 : 데이터평문전송취약점도구소스일부 > - 9 -

11 웹사이트를개발하여웹상에서취약점진단을할수있도록하였다. < 그림 3-10 : 웹사이트메인화면 >

12 < 그림 3-11: 취약점진단화면 > 3.3 리포팅시스템개발 취약점진단이후사용자에게보고서를제공하기위하여보기쉽게 PDF 파일로 생성하여가독성을높였다. < 그림 3-12 : 리포팅시스템소스일부 >

13 < 그림 3 13 : 진단결과화면 > < 그림 3 14 : 리퍼팅시스템으로만든 PDF 파일 >

14 4. 결론 웹취약점진단시스템을만들어 XSS과 SQL Injection등의취약점을이용한웹공격에대한진단시스템을완성하는것으로목표로설정하고서비스를제공하기위해인가된사용자만이용가능하도록웹사이트를개발하였다. 진단이후리포팅시스템을통해관리자에게대응방안과취약점들을제공해안정적이고효율적으로웹사이트를운영할수있도록지원을한다. 기대효과로는웹서비스를운영하기전이나후에취약점진단도구를이용하여관리자에게대응방안과취약한부분에대한보고서를제공하고온라인에서자동으로웹사이트취약점진단을진행하여빠르고간결하게웹취약점진단을할수있다. 5. 참고자료 [1] verizon data breach investigations report [2] KISA 주요정보통신기반시설취약점진단가이드 2014 [3] KISA 홈페이지취약점진단제거가이드 6. 별첨 6.1 발표 PPT 6.2 소스코드

15 6.1 발표 PPT

16 - 15 -

17 - 16 -

18 - 17 -

19 - 18 -

20 - 19 -

21 - 20 -

22 - 21 -

23 - 22 -

24 - 23 -

25 - 24 -

26 - 25 -

27 - 26 -

28 6.2 소스코드 <db.php> <?php $host = 'localhost'; $username = 'root'; $password = 'song0401'; $dbname = 'WeST'; $options = array(pdo::mysql_attr_init_command => 'SET NAMES utf8'); try { $con = new PDO("mysql:host={$host;dbname={$dbname;charset=utf8",$username, $password); catch(pdoexception $e) { die("failed to connect to the database: ". $e->getmessage());

29 $con->setattribute(pdo::attr_errmode, PDO::ERRMODE_EXCEPTION); $con->setattribute(pdo::attr_default_fetch_mode, PDO::FETCH_ASSOC); if(function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) { function undo_magic_quotes_gpc(&$array) { foreach($array as &$value) { if(is_array($value)) { undo_magic_quotes_gpc($value); else { $value = stripslashes($value); undo_magic_quotes_gpc($_post); undo_magic_quotes_gpc($_get); undo_magic_quotes_gpc($_cookie);?> header('content-type: text/html; charset=utf-8'); session_start(); <dbinit.php> <?php error_reporting(e_all); ini_set('display_errors',1); include('check.php'); $databasename = 'WeST'; $databaseuser = 'root'; $databasepassword = 'song0401'; 데이터베이스생성 $pdodatabase = new PDO('mysql:host=localhost', $databaseuser, $databasepassword); $pdodatabase->setattribute(pdo::attr_errmode, PDO::ERRMODE_EXCEPTION); $pdodatabase->exec('drop DATABASE IF EXISTS WeST;'); $pdodatabase->exec('create DATABASE IF NOT EXISTS WeST DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci'); 테이블생성 $pdo = new PDO('mysql:host=localhost;dbname='.$databaseName, $databaseuser, $databasepassword); $pdo->setattribute(pdo::attr_errmode, PDO::ERRMODE_EXCEPTION);

30 $pdo->exec('drop TABLE IF EXISTS yo;'); $pdo->exec('create TABLE `yo` ( `uid` int(11) NOT NULL AUTO_INCREMENT, `username` VARCHAR(255) NOT NULL, `password` VARCHAR(255) NOT NULL, ` ` VARCHAR(255), `domain` VARCHAR(255), `salt` VARCHAR(255) NOT NULL, `regtime` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP, PRIMARY KEY (`uid`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci') echo " 데이터베이스초기화에성공했습니다.\n"; <check.php> <?php error_reporting(e_all); ini_set('display_errors',1); function is_login(){ global $con; if (isset($_session['user_id']) &&!empty($_session['user_id']) ){ $stmt = $con->prepare("select username from yo where username=:username"); $stmt->bindparam(':username', $_SESSION['user_id']); $stmt->execute(); $count = $stmt->rowcount(); if ($count == 1){ return true; // 로그인상태 else{ // 사용자테이블에없는사람 return false; else{ return false; // 로그인안된상태 // -

31 function encrypt($plaintext, $salt) { $method = "AES-256-CBC"; $key = hash('sha256', $salt, true); $iv = openssl_random_pseudo_bytes(16); $ciphertext = openssl_encrypt($plaintext, $method, $key, OPENSSL_RAW_DATA, $iv); $hash = hash_hmac('sha256', $ciphertext, $key, true); return $iv. $hash. $ciphertext; function decrypt($ivhashciphertext, $salt) { $method = "AES-256-CBC"; $iv = substr($ivhashciphertext, 0, 16); $hash = substr($ivhashciphertext, 16, 32); $ciphertext = substr($ivhashciphertext, 48); $key = hash('sha256', $salt, true); if (hash_hmac('sha256', $ciphertext, $key, true)!== $hash) return null; return openssl_decrypt($ciphertext, $method, $key, OPENSSL_RAW_DATA, $iv);?> < main.php > <?php include('db.php'); include('check.php'); if(is_login()){?> if(isset($_session['user_id'])) { header("location: welcome.php"); <!DOCTYPE HTML> <html> <head> <title>west</title> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta name="description" content="" /> <meta name="keywords" content="" /> <script src="js/jquery.min.js"></script> <script src="js/skel.min.js"></script> <script src="js/skel-layers.min.js"></script> <script src="js/init.js"></script>

32 </head> <script > function check() { alert(' 로그인먼저하세요.') </script> <body id="top"> <header id="header" class="skel-layers-fixed"> <h1><a href="#">west</a></h1> <nav id="nav"> <ul> <li><a href="#" class="button special" onclick="check()"> 진단하기 </a></li> </ul> </nav> </header> </ul> <section id="banner"> <div class="inner"> <h2>west</h2> <p><b> 중부대학교 3 조졸업작품 </b> <a href="#">west Team</a></p> <ul class="actions"> <li><a href="#two" class="button big special">login</a></li> <li><a href="#one" class="button big alt">vulnerabilities</a></li> </div> </section> <section id="one" class="wrapper style1"> <header class="major"> <h2>kind Of Vulnerabilities</h2> <p>xss, Adminstrator Page, Known Vulnerabilities, Port Scan, SQL, Directory Listing</p> </header> <div class="container"> <div class="row"> <div class="4u"> <section class="special box"> <i class="icon fa-area-chart major"></i> <h3>xss</h3> <p>xss(cross Site Script) 는웹상에서가장기초적인취약점공격방법의일종으로, 악의적인사용자기공격하려는사이트에스크립트를넣는기법을말합니다. 공격에성공하면사이트에접속한사용자는삽입된코드를실행하게되며, 보통의도치않는행동을수행시키거나쿠키나세션토큰등의민감한정보를탈취합니다.</p> </section </div> <div class="4u"> <section class="special box"> <i class="icon fa-refresh major"></i> <h3>adminstrator Page</h3> <p>admin, adminstartor 등관리자페이지가인터넷을통해추측성접근이

33 가능할경우, 공격자의주타겟이될수있으며, 이는공격자의 SQL 인젝션, Brute-Force 공격등다양한형태의공격의빌미를제공하는취약점입니다.</p> </section> </div> <div class="4u"> <section class="special box"> <i class="icon fa-cog major"></i> <h3>known Vulnerabilities</h3> <p> 대게라이브러리, 프레임워크및다른소프트웨어모듈같은컴포넌트는애플리케이션과같은권한으로실행됩니다. 알려진취약점이있는컴포넌트를사용한애플리케이션과 API 는애플리케이션방어를약화시키거나다양한공격과영향을주는취약점입니다. </p> </section> </div> </div> </div> </section> <section id="one" class="wrapper style1_2"> <div class="container"> <div class="row"> <div class="4u"> <section class="special box"> <i class="icon fa-area-chart major1"></i> <h3>port Scan</h3> <p> 포트스캔이란, 대상의어떤포트가열려있는지확인하는작업으로침입전취약점을분석하기위한사전작업이라볼수있다, 스캐닝을통해대상의네트워크보안장비사용현황, 우회가능네트워크구조, 해당네트워크내의시스템플랫폼형태, 시스템운영체제의커널버전, 제동하는서비스등에대한정보를알수있어포트가열려있을시취약할수있는취약점이다.</p> </section> </div> <div class="4u"> <section class="special box"> <i class="icon fa-refresh major1"></i> <h3>sql</h3> <p>sql Injection 이란, 대표적인웹어플리케이션취약점중하나입니다. 애플리케이션에서서버로전달되는명령, 쿼리, 스크립트등의값을변도하여비정상적인방법으로시스템에접근하는공격기법입니다. 또한웹어플리케이션에서만국한되지않고데이터베이스와연결된모든어플리케이션에서고려해볼수있는공격기법입니다. </p> </section> </div> <div class="4u"> <section class="special box"> <i class="icon fa-cog major1"></i> <h3>directory Listing</h3> <p>directorying 취약점은브라우징하는모든파일을보여줍니다. 원래의모적은문서의공유로파일탐색기처럼원하는문서로바로찾아갈수있게하는용도였지만최근에는문서의저장및열람이가능하다면문서의취약점 ( 백업파일및소스코드, 스크립트파일의유출로인한계정정보유출등 ) 을이용해악의적인목적을갖고있는사람들에게탈취및웹서버

34 공격이이루어질수있는취약접입니다.</p> </section> </div> </div> </section> <!-- Two --> <section id="two" class="wrapper style2"> <header class="major"> <h2>login</h2> </header> <div class="content"> <div class="signin-cont cont"> <form method="post"> <input id="login username" name="user_name" type="text" class="inpt" placeholder="username"required autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <input id="login password" name="user_password" type="password" class="inpt" placeholder="password" required autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <div class="submit-wrap"> <input type="submit" name="login" class="submit" value="login"> <a href="new_login.php" class="more">new_login</a> </div> </form> </div> </div> </section> </body> </html> <?php $login_ok = false; if ( ($_SERVER['REQUEST_METHOD'] == 'POST') and isset($_post['login']) ) { $username=$_post['user_name']; $userpassowrd=$_post['user_password']; if(empty($username)){ $errmsg = " 아이디를입력하세요."; else if(empty($userpassowrd)){ $errmsg = " 패스워드를입력하세요.";

35 else{ try { username=:username'); $stmt = $con->prepare('select * from yo where $stmt->bindparam(':username', $username); $stmt->execute(); catch(pdoexception $e) { die("database error. ". $e->getmessage()); $row = $stmt->fetch(); $salt = $row['salt']; $password = $row['password']; $decrypted_password = decrypt(base64_decode($password), $salt); if ( $userpassowrd == $decrypted_password) { $login_ok = true; if(isset($errmsg) echo "<script>alert('$errmsg')</script>";?> if ($login_ok){ $_SESSION['user_id'] = $username; header('location:welcome.php'); session_write_close(); else{ echo "<script>alert('$username 인증오류 ')</script>"; <New_login.php> <?php include('db.php'); include('check.php'); function validatepassword($password){

36 if(strlen($password) < 8 empty($password)) { return 0; if((strlen($password) > 48)) { return 0; if(preg_match('/[a-z]/',$password) == (0 false)){ return 1; if(!preg_match('/[\d]/',$password)!= (0 false)){ return 2; if(preg_match('/[\w]/',$password) == (0 false)){ return 3; return true; if( ($_SERVER['REQUEST_METHOD'] == 'POST') && isset($_post['submit'])) { foreach ($_POST as $key => $val) { if(preg_match('#^ autocomplete_fix_#', $key) === 1){ $n = substr($key, 19); if(isset($_post[$n])) { $_POST[$val] = $_POST[$n]; $username=$_post['newusername']; $password=$_post['newpassword']; $confirmpassword=$_post['newconfirmpassword']; $ =$_post['new ']; $domain=$_post['newdomain']; if ($_POST['newpassword']!= $_POST['newconfirmpassword']) { $errmsg = "<script>alert(' 패스워드가일치하지않습니다.')</script>"; if(empty($username)){ $errmsg = "<script>alert(' 아이디를입력하세요 ')</script>"; else if(empty($password)){ $errmsg = "<script>alert(' 패스워드을입력하세요.')</script>"; else if(empty($ )){ $errmsg = "<script>alert(' 을입력하세요.')</script>";

37 else if(empty($domain)){ $errmsg = "<script>alert('domain 을입력하세요.')</script>"; try { $stmt = $con->prepare('select * from yo where username=:username'); $stmt->bindparam(':username', $username); $stmt->execute(); catch(pdoexception $e) { die("database error: ". $e->getmessage()); $row = $stmt->fetch(); if ($row){ $errmsg = "<script>alert(' 이미존재하는아이디입니다 ')</script>"; if(!isset($errmsg)) { try{ $stmt = $con->prepare('insert INTO yo(username, password, , salt, domain) VALUES(:username, :password, : , :salt, :domain)'); $stmt->bindparam(':username',$username); $salt = bin2hex(openssl_random_pseudo_bytes(32)); $encrypted_password = base64_encode(encrypt($password, $salt)); $stmt->bindparam(':password', $encrypted_password); $stmt->bindparam(': ',$ ); $stmt->bindparam(':salt',$salt); $stmt->bindparam(':domain',$domain);?> if($stmt->execute()) { $successmsg = "<script>alert(' 새로운사용자를추가했습니다.')</script>"; header("refresh:1;west.php"); else { $errmsg = " 사용자추가에러 "; catch(pdoexception $e) { die("database error: ". $e->getmessage()); <!DOCTYPE HTML> <html> <head> <title>west</title> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta name="description" content="" />

38 <meta name="keywords" content="" /> <script src="js/jquery.min.js"></script> <script src="js/skel.min.js"></script> <script src="js/skel-layers.min.js"></script> <script src="js/init.js"></script> </head> <script > function _ck(){ var = document.getelementbyid("em").value; var domain = document.getelementbyid("dom").value; url = " _ck.php?domain="+domain+"& ="+ ; window.open(url, "window_name",'width=800,height=500,location=no,status=no,scrollbars=no, resizable=no'); function check(){ var ck = document.getelementbyid("aa").value; che = " _ok.php"; window.open(url, "window_name",'width=800,height=500,location=no,status=no,scrollbars=no, resizable=no'); function check1() { alert(' 로그인먼저하세요.') </script> <body id="top"> <!-- Header --> <header id="header" class="skel-layers-fixed"> <h1><a href="#">west</a></h1> <nav id="nav"> <ul> <li><a href="#" class="button special" onclick="check1()"> 진단하기 </a></li> </ul> </nav> </header> <section id="two" class="wrapper style2"> <header class="major"> <h2> 새로운사용자추가 </h2> </header> <div class= tabs > <span class="tab signin active"><a href="west.php"><b>back</b></a></span> </div> <?php if(isset($errmsg)){?> <div class="alert alert-danger"> <span class="glyphicon glyphicon-info-sign"></span> <strong><?php echo $errmsg;?></strong> </div> <?php

39 else if(isset($successmsg)){?> <div class="alert alert-success"> <strong><span class="glyphicon glyphicon-info-sign"></span> <?php echo $successmsg;?></strong> </div> <?php?> <div class="content"> <div class="signin-cont cont"> <form method="post" enctype="multipart/form-data"> <? $r1 = rmd5(rand().mocrotime(true));?> <input type="text" name="<? echo $r1;?>" class="inpt" placeholder=" 아이디를입력하세요." autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <input type="hidden" name=" autocomplete_fix_<? echo $r1;?>" value="newusername" /> <? $r2 = rmd5(rand().mocrotime(true));?> <input type="password" name="<? echo $r2;?>" class="inpt" placeholder=" 패스워드를입력하세요 " autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <input type="hidden" name=" autocomplete_fix_<? echo $r2;?>" value="newpassword" /> <? $r3 = rmd5(rand().mocrotime(true));?> <input type="password" name="<? echo $r3;?>" class="inpt" placeholder=" 패스워드를다시한번입력하세요 " autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <input type="hidden" name=" autocomplete_fix_<? echo $r3;?>" value="newconfirmpassword" /> <? $r4 = rmd5(rand().mocrotime(true));?> <input type="text" id="em" name="new " name="<? echo $r4;?>" class="inpt" placeholder=" 이메일를입력하세요 " autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <input type="hidden" name=" autocomplete_fix_<? echo $r4;?>" value="new " /> <? $r5 = rmd5(rand().mocrotime(true));?> <input type="text" id="dom" name="newdomain" name="<? echo $r5;?>" class="inpt" placeholder=" 도메인을입력하세요 " autocomplete="off" readonly onfocus="this.removeattribute('readonly');" /> <input type="hidden" name=" autocomplete_fix_<? echo $r5;?>" value="newdomain" /> <div class="do"> <input type="submit" name="submit" value="register" onclick="check()"> </div> <input type="submit" name="aa" value=" 진단하기 " onclick=" _ck() > </div> </form>

40 </div> </section> <welcome.php> <?php include('db.php'); include('check.php'); if (is_login()){ ; else header("location: west.php");?> <?php $user_id = $_SESSION['user_id']; try { $stmt = $con->prepare('select * from yo where username=:username'); $stmt->bindparam(':username', $user_id); $stmt->execute(); catch(pdoexception $e) { die("database error: ". $e->getmessage()); $row = $stmt->fetch();?> <!DOCTYPE HTML> <html> <head> <title>west <?php echo($row['username']);?> 님 </title> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> </head> <body id="top"> <!-- Header --> <header id="header" class="skel-layers-fixed"> <h1><a href="#"><?php echo $user_id;?> 님 </a></h1> <nav id="nav"> <ul> <li><a href="logout.php" class="button special">logout</a></li> </ul>

41 </nav> </header> <!-- Banner --> <section id="banner"> <div class="inner"> <h2>west</h2> <p><b> 중부대학교 3조 졸업작품 </b> <a href=" Team</a></p> <ul class="actions"> <li> <input type="submit" value="<?php echo($row[' ']);?> 진단하기 " class="button big special" onclick="window.open('./song/ppp.php','window_name','width=800,height=500,location=no,status= no,scrollbars=no');"></li> <li><input type="submit" value="<?php echo($row[' ']);?> 조회하기 " class="button big alt" onclick="window.open('look.php','window_name','width=800,height=500,location=no,status=no,scr ollbars=no');"></li> </ul> </div> </section> <result.php> <?php include('/var/www/html/west/db.php'); include('/var/www/html/west/check.php');?> <?php $user_id = $_SESSION['user_id']; try { $stmt = $con->prepare('select * from yo where username=:username'); $stmt->bindparam(':username', $user_id); $stmt->execute(); catch(pdoexception $e) { die("database error: ". $e->getmessage()); $row = $stmt->fetch();?> <!DOCTYPE html> <html> <head> <title>result</title> </head> <table class="table" border="1" > <caption>starting Web scan... <a><?php echo($row[' ']);?></a>...<?php

42 echo($row['regtime']);?></caption> <tr><th> No. </th><th> 진단항목 </th><th> </th></tr> <tr><td> 1/6 </td><td> 데이터평문전송 </td><td> <div ><img id="l05" src="song.gif" width="20px" height="20px"></td></tr> <tr><td> 2/6 </td><td> 관리자페이지노출 </td><td > <div id ="l06" > <img id="l01" src="song.gif" width="20px" height="20px "> </td></tr> <tr><td> 3/6 </td><td> 알려진취약점 </td><td><div ><img id="l02" src="song.gif" width="20px" height="20px"></div> </td></tr> <tr><td> 4/6 </td><td> 디렉토리리스팅 </td><td> <div ><img id="l03" src="song.gif" width="20px" height="20px" ></td></tr> <tr><td> 5/6 </td><td> XSS</td><td ><div ><img id="l04" src="song.gif" height="20px" ></div><div id="l06"> </div></td></tr> width="20px" <tr><td> 6/6 </td><td> SQL INJECTION</td><td> <div ><img id="loading2" src="a.jpg" width="20px" height="20px"><img id="loading" src="song.gif" width="20px" height="20px "></div> <iframe src="result.php" id="iframe100"></iframe> </td></tr> <script> var ld= document.getelementbyid("loading"); window.addeventlistener("load", function(){ ld.style.display="none"; ); </script> </table> </div> <input type='button' value=" 창닫기 " onclick='self.close()'> </body> </html> <lnquiry.php> <?php include('db.php'); include('check.php'); if (is_login()){ ; else header("location: west.php");

43 ?> <?php $user_id = $_SESSION['user_id']; try { $stmt = $con->prepare('select * from yo where username=:username'); $stmt->bindparam(':username', $user_id); $stmt->execute(); catch(pdoexception $e) { die("database error: ". $e->getmessage()); $row = $stmt->fetch();?> <!doctype html> <html lang="kr"> <head> <meta charset="utf-8"> <title>west</title> </head> <body> <p> 진단결과 </p> <table class="table" border="1"> <tr> <th> 번호 </th><th> 제목 </th><th> 날짜 </th><th>download</th> </tr> <tbody> <tr> <td>1</td> <td><?php echo $row['username']?> 의진단결과 </td> <td><?php echo $row['regtime']?></td> <td><a href="download.php">download</a></td> </tr> </tbody> </table> </body> </html> <download.php> <?php include('db.php'); include('check.php'); if (is_login()){ ; else header("location: west.php");?> <?php $user_id = $_SESSION['user_id']; try { $stmt = $con->prepare('select * from yo where username=:username'); $stmt->bindparam(':username', $user_id);

44 $stmt->execute(); catch(pdoexception $e) { die("database error: ". $e->getmessage()); $row = $stmt->fetch();?> <?php $user = $_SESSION['user_id']; $filename = "cve_log_$user.pdf"; $file = "./song/". $filename; if (is_file($file)) { if (preg_match("/msie*/", $_SERVER['HTTP_USER_AGENT'])) { header("content-type: application/octet-stream"); header("content-length: ".filesize("$file")); header("content-disposition: attachment; filename=$filename"); // 다운로드되는파일명 ( 실제파일명과별개로지정가능 ) header("content-transfer-encoding: binary"); header("cache-control: must-revalidate, post-check=0, pre-check=0"); header("pragma: public"); header("expires: 0"); else { header("content-type: file/unknown"); header("content-length: ".filesize("$file")); header("content-disposition: attachment; filename=$filename"); // 다운로드되는파일명 ( 실제파일명과별개로지정가능 ) header("content-description: PHP3 Generated Data"); header("pragma: no-cache"); header("expires: 0"); $fp = fopen($file, "rb"); fpassthru($fp); fclose($fp); else { echo " 해당파일이없습니다.";?> <Vulnerability.py> # -*- coding: utf-8 -*- import socket import datetime import urllib.request import requests from bs4 import BeautifulSoup import re

45 import sys from urllib import parse from urllib.request import urlopen import time import os from fpdf import FPDF def scan(domain): module_name = "Port Scan" contents = "" is_cve = "Safe" comport = {"FTP":21, "SMTP":25,"HTTP":80 ad = domain adip = socket.gethostbyname(ad) for PN, port in comport.items(): try: s= socket.socket(socket.af_inet, socket.sock_stream) result = s.connect_ex((adip, port)) banner = s.recv(1024) if result == 0: contents += str(port)+"/tcp("+str(pn)+") Open " is_cve = "Risk" elif banner==b'': contents += str(port)+"/tcp("+str(pn)+") noservice\n" s.close() except: continue return (module_name, contents.strip(), is_cve) def adpage(domain): module_name = "Admin Page" contents = "" is_cve = "Safe" page= ["/admin", "/manager", "/master", "/system", "/administart"] url = " for pages in page: try: req = urllib.request.urlopen(url+ pages) contents += (pages + " server exist\n") is_cve = "Risk" except : continue if is_cve == "Safe": contents += "no admin page found" return (module_name, contents.strip(), is_cve)

46 def get_header(domain): global req, header, dic, cve req = requests.get(' header = req.headers dic = {'server' : 'hidden', 'os' : 'hidden', 'lang' : 'hidden' cve = {'server' : '', 'lang' : '' if 'Server' in header: server=header['server'] s = server.split(' ') for i, a in enumerate(dic.keys()): dic[a] = s[i] if (len(s) < len(dic)): break else: pass def check_cve(get_header): module_name = "Check CVE" contents = "" is_cve = "Safe" def cve1(key, contents, is_cve): r = requests.get(' soup = BeautifulSoup(r.text, 'html.parser') count_target = soup.find(class_="smaller") cve[key] = count_target.find("b").text list_result = str(soup.select("#tablewithrules")) list_result = re.sub('<.+?>','',list_result,0).strip() if len(list_result) > 26: contents += ' is_cve = "Risk" return contents, is_cve if dic['server']!= 'hidden': contents, is_cve = cve1('server', contents, is_cve) if dic['lang']!= 'hidden': contents, is_cve = cve1('lang', contents, is_cve) if contents == "": contents = "no cve found" return (module_name, contents.strip(), is_cve) def help(): print('usage:./main url') sys.exit(1) def sqlinjection(): sqlinjection_mysql = ['or 1=1--', '\' or 1=1--', '\" or 1=1--', '\' or \'1\'=\'1', '\" or \"1\"=\"1']

47 sqlinjection_oracle = ['\' or 1=1#', '\" or 1=1#', 'or 1=1#', '\' or \'1\'=\'1', '\" or \"1\"=\"1'] return sqlinjection_mysql[1] def send_post(data, next_url): is_cve = "Safe" header = { 'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/ Firefox/66.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-us,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', resp = requests.post(next_url, data=data, headers=header) if "Sign Off" in resp.text: is_cve = "Risk" return (is_cve) def get_domain(url): domainp = '^(https?:\/\/)?([\da-z\.-]+)' domain = re.compile(domainp).match(url).group() return domain def sqltest(url): module_name = "SQL Injection" is_cve = "Safe" url = " url + "/login.jsp" r = requests.get(url).text soup = BeautifulSoup(r, 'html.parser') tags = soup.select("form input") idp = re.compile("id=\"[a-za-z]*id[a-z]*\"") for tag in tags: try: result = idp.search(str(tag)).group() id_value = result.replace("id=", "").replace("\"", "") break except AttributeError: result = None pw_value = soup.select('form input[type=password]')[0]['name'] submit = soup.select('form input[type=submit]') submitp = re.compile("\"[a-za-z]*[l l]ogin[a-za-z]*\"") subnetname = submitp.search(str(submit)).group().replace("\"", "") tags = soup.select("form") formp = re.compile("<form action=\"[a-za-z]*[l l]ogin\"") actionvaluep = re.compile("\"[a-za-z]*\"")

48 for tag in tags: result = formp.search(str(tag)) if result!= None: action_value = actionvaluep.search(result.group()).group().replace("\"", "") domain = get_domain(url) next_url = domain + "/" + action_value data = {id_value:sqlinjection(), pw_value:'donecare' contents = str(data) send_post(data, next_url) is_cve = send_post(data, next_url) return (module_name, contents.strip(), is_cve) pages = set() def getlinks(pageurl): global pages html = urlopen(pageurl) soup = BeautifulSoup(html, "html.parser") for link in soup.findall("a"): if 'href' in link.attrs: pages.add(link.attrs['href']) if link.attrs['href'] not in pages: newpage = link.attrs['href'] pages.add(newpage) getlinks(newpage) def dicxss(url): module_name = "XSS" contents = "" is_cve = "Safe" url = " getlinks(url) lst = list(pages) dic ={ d=0 for i in lst: check = parse.urlparse(lst[int(d)]) check.geturl() if check.query: dic.update(parse.parse_qs(check.query)) d+=1-47 -

49 fname = "payloads.txt" with open(fname) as f: content = f.readlines() payloads = [x.strip() for x in content] vuln = [] for payload in payloads: for t in dic.keys(): payload = payload xss_url = url+"?"+t+"="+payload r = requests.get(xss_url) if payload.lower() in r.text.lower(): if(payload not in vuln): vuln.append(payload) else: continue if vuln: tmp_contents = "\n".join(vuln) contents += str(tmp_contents) is_cve = "Risk" return (module_name, contents.strip(), is_cve) def get_urldirectorypath(url): current_pagep = '\/[a-za-z0-9]*\.[a-za-z0-9]*$' path = re.sub(current_pagep, "", url) return path def return_souporhtml(url, str): r = requests.get(url).text soup = BeautifulSoup(r, 'html.parser') if(str=="soup"): return soup elif(str=="html"): return soup.text def regex_search(regex, str): p = re.compile(regex)

50 s = p.search(str) return s def dicrec(url): module_name = "Directory Listing" contents = "" is_cve = "Safe" c=0 url = " getlinks(url) lst = list(pages) for i in lst: toryurl = url+"/"+lst[int(c)] path = get_urldirectorypath(toryurl) html = return_souporhtml(path, "html") s = regex_search('index of /', html) if s == None: contents = "This website is \"SAFE\" from Directory listing" else: contents = path is_cve = "Risk" c+=1 return (module_name, contents.strip(), is_cve) start = datetime.datetime.now() def Westall(domain): results = [] results.append(scan(domain)) results.append(adpage(domain)) get_header(domain) results.append(check_cve(get_header)) results.append(dicrec(domain)) results.append(dicxss(domain)) results.append(sqltest(domain)) return results data = [] url = str(sys.argv[1]) uid = str(sys.argv[2]) data.extend(westall(url)) filename = "cve_log_"+uid+".pdf" title = 'Web Scan Report' finish = datetime.datetime.now() duration = finish - start class PDF(FPDF):

51 def header(self): self.set_font("arial", size=24) self.cell(200, 20, txt="website Vulnerability Scanner Report", ln=1, align="c") self.set_text_color(46,138,204) self.cell(20, 20, txt="scan Information", ln=1) self.set_line_width(1) self.set_draw_color(255, 0, 0) self.line(10, 45, 200, 45) self.set_line_width(1) self.set_draw_color(0, 0, 0) self.set_text_color(0,0,0) self.set_font("arial", size=11) self.cell(20, 5, txt="website URL = "+url, ln=1) self.cell(10,5,txt="start Time = "+str(start), ln=1) self.cell(10,5,txt="finish Time = "+str(finish), ln=1) self.cell(10,5,txt="scan duration = "+str(duration), ln=1) def footer(self): self.set_y(-15) self.set_font('arial', 'I', 8) self.set_text_color(128) self.cell(0, 10, 'Page ' + str(self.page_no()), 0, 0, 'C') def chapter_title(self, num, label): self.set_font('arial', '', 12) self.set_fill_color(200, 220, 255) self.cell(0, 6, 'Chapter %d : %s' % (num, label), 0, 1, 'L', 1) self.ln(4) def chapter_body(self, spacing=2): global data self.cell(10, 20, ln=1, align="c") self.set_font("arial", 'B', size=24) self.cell(10, 20, txt="list of tests performed (6/6)",ln=1,align="L") self.set_font("arial", 'B', size=15) self.set_draw_color(0, 0, 0) self.set_line_width(0.5) col_width = self.w / 3.3 row_height = self.font_size header = ('Type', 'Contents', 'Resulte') cellwidth =110 cellheight= 5 self.cell(40, cellheight*3, txt=header[0], border=1, align="c") self.cell(cellwidth, cellheight*3, txt=header[1], border=1, align="c") self.cell(40, cellheight*3, txt=header[2], border=1, ln=1, align="c") self.set_font("arial", size=10) for i in range(6):

52 line =1 if self.get_string_width(data[i][1]) < cellwidth: line =1 else: textlength=len(data[i][1]) errmargin = 44 startchar = 0 maxchar = 0 textarray = [] tmpstring="" st = data[i][1] while (startchar < textlength): while (self.get_string_width(tmpstring) < (cellwidth - errmargin) and (startchar+maxchar) < textlength): maxchar +=1 tmpstring = st[startchar : maxchar] startchar= startchar + maxchar textarray.append(tmpstring) line +=1 maxchar=0 tmpstring="" self.cell(40, line*cellheight, txt=data[i][0], border=1, ln=0,align = "C") x = self.get_x() y = self.get_y() self.multi_cell(cellwidth, cellheight, txt=data[i][1], border=1) self.set_xy(x+cellwidth, y) self.cell(40, line*cellheight, txt=data[i][2], border=1, ln=1,align = "C") def print_chapter(self, num, title, name): self.add_page() self.chapter_title(num, title) self.chapter_body(name) pdf = PDF() pdf.set_title(title) pdf.add_page() pdf.chapter_body() pdf.output(filename, 'F')