CAJ | 학술논문

深入研究基于PHP的远程文件包含漏洞检测以及漏洞分级等技术，在此基础上设计和实现远程文件包含漏洞分级检测工具，并搭建基于PHP语言的目标系统，对检测工具原型进行全面的功能和性能测试。提出漏洞分级检测思想，模拟攻击者向应用系统发送请求，通过服务器的返回信息来判断漏洞的存在性及漏洞的级别。
심입연구기우PHP적원정문건포함루동검측이급루동분급등기술，재차기출상설계화실현원정문건포함루동분급검측공구，병탑건기우PHP어언적목표계통，대검측공구원형진행전면적공능화성능측시。제출루동분급검측사상，모의공격자향응용계통발송청구，통과복무기적반회신식래판단루동적존재성급루동적급별。
We thoroughly study the PHP-based vulnerability detection and classification technology for remote file inclusion,based on it we design and implement a vulnerability classification and detection tool for remote file inclusion,build a PHP language-based target system,and conduct an overall functional and performance test on the prototype of detection tool.The vulnerability classification and detection idea proposed in this article is to simulate the attacker to send the requests to web application system and then to determine the existence of the vulnerabilities and their levels through the returned information from the server.