Patent ID: 8918887

Claim:
A vulnerability diagnostic device for diagnosing whether a Web server has vulnerability to an attack or not, comprising: a normal response collection means for transmitting a plurality of normal requests to a diagnosis target Web server and receiving a plurality of normal responses in response to each normal request to store it in a recording section; a common area extraction means for extracting a common area from the contents of the plurality of normal responses, wherein the contents in the common area of the plurality of normal responses have no variation according to the plurality of normal responses stored in the recording section, wherein contents not in the common area include at least one of content that varies with access time or content that varies with a number of access times; an abnormal response collection means for transmitting an abnormal request to the diagnosis target Web server and receiving an abnormal response in response to the abnormal request to store it in the recording section; and a determination means for comparing contents of the extracted common area of the normal response with common area contents of the abnormal response, determining whether there is a difference between the responses or not, and determining absence of vulnerability when there is the difference or presence of vulnerability when there is not the difference.