Insecure Direct Object References zafiyeti, bir uygulamanın kullanıcı tarafından sağlanan girdiyi doğrulamadan veya yetkilendirmeden doğrudan nesne referanslarına erişmesi durumunda ortaya çıkar. Bu zaafiyet, saldırganların yetkisiz verilere erişmesine veya değiştirmesine olanak sağlar. Bu kod, TensorFlow https://www.tensorflow.org/ kütüphanesini kullanarak, bir web uygulamasının URL parametrelerini analiz eder ve potansiyel olarak güvensiz doğrudan nesne referanslarını belirler. Bu kod, bir yapay sinir ağı modeli eğitmek ve test etmek için OWASP WebGoat https://owasp.org/www-project-webgoat/ projesinden alınan gerçek verileri kullanır.
python
# Import the required libraries
import pandas as pd
import numpy as np
import tensorflow as tf
from tensorflow import keras
from tensorflow.keras import layers
from sklearn.model_selection import train_test_split
# Load the data from a CSV file
data = pd.read_csv("WebGoat_URLs.csv")
# Extract the features and labels
X = data["url"] # The URL parameters
y = data["label"] # The labels indicating if the URL is insecure or not
# Encode the labels as 0 or 1
y = y.map({"insecure": 1, "secure": 0})
# Split the data into training and testing sets
X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
# Define a function to preprocess the URL parameters
def preprocess_url(url):
# Convert the URL to lowercase
url = url.lower()
# Remove the leading and trailing slashes
url = url.strip("/")
# Split the URL by the slash character
url = url.split("/")
# Remove the empty strings
url = list(filter(None, url))
# Return the URL as a list of strings
return url
# Apply the preprocessing function to the training and testing data
X_train = X_train.apply(preprocess_url)
X_test = X_test.apply(preprocess_url)
# Define a function to pad the URL parameters to a fixed length
def pad_url(url, max_len):
# If the URL is shorter than the max length, pad it with empty strings
if len(url) < max_len:
url = url + [""] * (max_len - len(url))
# If the URL is longer than the max length, truncate it
elif len(url) > max_len:
url = url[:max_len]
# Return the padded URL as a list of strings
return url
# Define the maximum length of the URL parameters
max_len = 10
# Apply the padding function to the training and testing data
X_train = X_train.apply(pad_url, max_len=max_len)
X_test = X_test.apply(pad_url, max_len=max_len)
# Convert the training and testing data to numpy arrays
X_train = np.array(X_train.tolist())
X_test = np.array(X_test.tolist())
y_train = np.array(y_train.tolist())
y_test = np.array(y_test.tolist())
# Define a function to create a vocabulary of unique words from the URL parameters
def create_vocab(X):
# Initialize an empty set
vocab = set()
# Loop through the URL parameters
for url in X:
# Loop through the words in the URL
for word in url:
# Add the word to the vocabulary
vocab.add(word)
# Return the vocabulary as a list of strings
return list(vocab)
# Create a vocabulary from the training data
vocab = create_vocab(X_train)
# Define the vocabulary size
vocab_size = len(vocab)
# Define a function to create a word-to-index mapping from the vocabulary
def create_word_index(vocab):
# Initialize an empty dictionary
word_index = {}
# Loop through the vocabulary
for i, word in enumerate(vocab):
# Assign an index to each word
word_index[word] = i
# Return the word-to-index mapping as a dictionary
return word_index
# Create a word-to-index mapping from the vocabulary
word_index = create_word_index(vocab)
# Define a function to encode the URL parameters as sequences of indices
def encode_url(url, word_index):
# Initialize an empty list
encoded_url = []
# Loop through the words in the URL
for word in url:
# Get the index of the word from the word-to-index mapping
index = word_index.get(word, 0)
# Append the index to the encoded URL
encoded_url.append(index)
# Return the encoded URL as a list of integers
return encoded_url
# Encode the training and testing data as sequences of indices
X_train = np.array([encode_url(url, word_index) for url in X_train])
X_test = np.array([encode_url(url, word_index) for url in X_test])
# Define the embedding dimension
embedding_dim = 16
# Define the model architecture
model = keras.Sequential([
# Embedding layer to learn the representations of the words in the URL parameters
layers.Embedding(input_dim=vocab_size, output_dim=embedding_dim, input_length=max_len),
# Flatten layer to convert the 2D embedding matrix to a 1D vector
layers.Flatten(),
# Dense layer with 16 units and ReLU activation
layers.Dense(16, activation="relu"),
# Dense layer with 1 unit and sigmoid activation for binary classification
layers.Dense(1, activation="sigmoid")
])
# Compile the model with binary crossentropy loss and Adam optimizer
model.compile(loss="binary_crossentropy", optimizer="adam", metrics=["accuracy"])
# Print the model summary
model.summary()
# Train the model for 10 epochs with a batch size of 32
model.fit(X_train, y_train, epochs=10, batch_size=32, validation_split=0.1)
# Evaluate the model on the testing data
model.evaluate(X_test, y_test)
# Define a function to predict the label of a given URL
def predict_url(url, model, word_index, max_len):
# Preprocess the URL
url = preprocess_url(url)
# Pad the URL
url = pad_url(url, max_len)
# Encode the URL
url = encode_url(url, word_index)
# Convert the URL to a numpy array
url = np.array() # Predict the label of the URL ...duğunu ekrana yazdırıyoruz.[/COLOR][/JUSTIFY]
python
# Import the required libraries
import pandas as pd
import numpy as np
import tensorflow as tf
from tensorflow import keras
from tensorflow.keras import layers
from sklearn.model_selection import train_test_split
# Load the data from a CSV file
data = pd.read_csv("WebGoat_URLs.csv")
# Extract the features and labels
X = data["url"] # The URL parameters
y = data["label"] # The labels indicating if the URL is insecure or not
# Encode the labels as 0 or 1
y = y.map({"insecure": 1, "secure": 0})
# Split the data into training and testing sets
X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)
# Define a function to preprocess the URL parameters
def preprocess_url(url):
# Convert the URL to lowercase
url = url.lower()
# Remove the leading and trailing slashes
url = url.strip("/")
# Split the URL by the slash character
url = url.split("/")
# Remove the empty strings
url = list(filter(None, url))
# Return the URL as a list of strings
return url
# Apply the preprocessing function to the training and testing data
X_train = X_train.apply(preprocess_url)
X_test = X_test.apply(preprocess_url)
# Define a function to pad the URL parameters to a fixed length
def pad_url(url, max_len):
# If the URL is shorter than the max length, pad it with empty strings
if len(url) < max_len:
url = url + [""] * (max_len - len(url))
# If the URL is longer than the max length, truncate it
elif len(url) > max_len:
url = url[:max_len]
# Return the padded URL as a list of strings
return url
# Define the maximum length of the URL parameters
max_len = 10
# Apply the padding function to the training and testing data
X_train = X_train.apply(pad_url, max_len=max_len)
X_test = X_test.apply(pad_url, max_len=max_len)
# Convert the training and testing data to numpy arrays
X_train = np.array(X_train.tolist())
X_test = np.array(X_test.tolist())
y_train = np.array(y_train.tolist())
y_test = np.array(y_test.tolist())
# Define a function to create a vocabulary of unique words from the URL parameters
def create_vocab(X):
# Initialize an empty set
vocab = set()
# Loop through the URL parameters
for url in X:
# Loop through the words in the URL
for word in url:
# Add the word to the vocabulary
vocab.add(word)
# Return the vocabulary as a list of strings
return list(vocab)
# Create a vocabulary from the training data
vocab = create_vocab(X_train)
# Define the vocabulary size
vocab_size = len(vocab)
# Define a function to create a word-to-index mapping from the vocabulary
def create_word_index(vocab):
# Initialize an empty dictionary
word_index = {}
# Loop through the vocabulary
for i, word in enumerate(vocab):
# Assign an index to each word
word_index[word] = i
# Return the word-to-index mapping as a dictionary
return word_index
# Create a word-to-index mapping from the vocabulary
word_index = create_word_index(vocab)
# Define a function to encode the URL parameters as sequences of indices
def encode_url(url, word_index):
# Initialize an empty list
encoded_url = []
# Loop through the words in the URL
for word in url:
# Get the index of the word from the word-to-index mapping
index = word_index.get(word, 0)
# Append the index to the encoded URL
encoded_url.append(index)
# Return the encoded URL as a list of integers
return encoded_url
# Encode the training and testing data as sequences of indices
X_train = np.array([encode_url(url, word_index) for url in X_train])
X_test = np.array([encode_url(url, word_index) for url in X_test])
# Define the embedding dimension
embedding_dim = 16
# Define the model architecture
model = keras.Sequential([
# Embedding layer to learn the representations of the words in the URL parameters
layers.Embedding(input_dim=vocab_size, output_dim=embedding_dim, input_length=max_len),
# Flatten layer to convert the 2D embedding matrix to a 1D vector
layers.Flatten(),
# Dense layer with 16 units and ReLU activation
layers.Dense(16, activation="relu"),
# Dense layer with 1 unit and sigmoid activation for binary classification
layers.Dense(1, activation="sigmoid")
])
# Compile the model with binary crossentropy loss and Adam optimizer
model.compile(loss="binary_crossentropy", optimizer="adam", metrics=["accuracy"])
# Print the model summary
model.summary()
# Train the model for 10 epochs with a batch size of 32
model.fit(X_train, y_train, epochs=10, batch_size=32, validation_split=0.1)
# Evaluate the model on the testing data
model.evaluate(X_test, y_test)
# Define a function to predict the label of a given URL
def predict_url(url, model, word_index, max_len):
# Preprocess the URL
url = preprocess_url(url)
# Pad the URL
url = pad_url(url, max_len)
# Encode the URL
url = encode_url(url, word_index)
# Convert the URL to a numpy array
url = np.array() # Predict the label of the URL ...duğunu ekrana yazdırıyoruz.[/COLOR][/JUSTIFY]
