 |
Next, send a request to all the extracted endpoints to check if the reference contains accurate information and to obtain various information used for vulnerability assessment.
For example, the first in the table, GET /posts, will generate a request that matches the extracted information.
From the response, check the HTTP status code, and if the request is processed normally, such as 200 OK, determine that it is a valid endpoint.
At this time, the name of the key in the JSON data of the response is saved as a candidate key, and the content of the response to the request is saved in the vulnerability assessment tool with the request content.
This information will be used in each vulnerability assessment.
In this evaluation experiment, we confirmed that the information in the reference was processed correctly and that it was a valid reference. |
IEEE/ICACT20220047 Slide.19
[Big Slide]