WO2019144548A1

WO2019144548A1 - Security test method, apparatus, computer device and storage medium

Info

Publication number: WO2019144548A1
Application number: PCT/CN2018/088856
Authority: WO
Inventors: 林嘉思
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-01-26
Filing date: 2018-05-29
Publication date: 2019-08-01
Also published as: CN108256322B; CN108256322A

Abstract

A security test method, comprising: receiving a current network access request, the current network access request carrying a uniform resource locator and access parameters; acquiring, according to the uniform resource locator, a current code corresponding to the current network access request; inserting a probe function in the current code; in the process of executing the current code according to the access parameters, recording an execution sequence of code statements in the current code by means of the probe function, so as to obtain an execution path of the current code; detecting whether the execution path of the current code is consistent with a predetermined path; and if the execution path is inconsistent with the predetermined path, determining that security vulnerabilities exist in the current code.

Description

Safety test method, device, computer device and storage medium

Cross-reference to related applications

This application claims priority to Chinese Patent Application No. 2018100791896, filed on Jan. 26, 2018, the entire disclosure of which is incorporated herein by reference. In this application.

Technical field

The application relates to a security test method, apparatus, computer device and storage medium.

Background technique

With the development of Internet technology and the growth of network information, more and more enterprises or individuals provide information services through the Internet. However, when providing information services, bugs in the design of the application software or the operating system or errors in encoding, or design flaws in the business interaction process or irrationalities in the logic flow can create loopholes. In order to avoid the vulnerability being exploited intentionally or unintentionally, resulting in a loss, a vulnerability detection is required. However, the inventor realized that when detecting a vulnerability, it is usually necessary to understand the internal structure of the code and then perform security testing on the code. However, the amount of data in the code is large, and it takes a lot of time to understand the code structure, resulting in the efficiency of security detection. low.

Summary of the invention

In accordance with various embodiments disclosed herein, a security testing method, apparatus, computer device, and storage medium are provided.

A safety test method includes:

Receiving a current network access request, where the current network access request carries a uniform resource locator and an access parameter;

Obtaining, according to the uniform resource locator, a current code corresponding to the current network access request; inserting a probe function in the current code;

In the process of executing the current code according to the access parameter, the execution order of the code statement in the current code is recorded by the probe function, and an execution path of the current code is obtained;

Detecting whether the execution path of the current code is consistent with the preset path; and

When the execution path is inconsistent with the preset path, it is determined that the current code has a security vulnerability.

A safety test device includes:

a request receiving module, configured to receive a current network access request, where the current network access request carries a uniform resource locator and an access parameter;

a code obtaining module, configured to acquire, according to the uniform resource locator, a current code corresponding to the current network access request;

a probe insertion module for inserting a probe function in the current code;

An execution path obtaining module, configured to record, in the process of executing the current code according to the access parameter, an execution sequence of the code statement in the current code by using the probe function, to obtain an execution path of the current code;

a detecting module, configured to detect whether an execution path of the current code is consistent with a preset path; and

The vulnerability determining module is configured to determine that the current code has a security vulnerability when the execution path is inconsistent with the preset path.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors such that the one or more The processors perform the following steps:

One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps:

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

1 is an application scenario diagram of a security testing method in accordance with one or more embodiments.

2 is a flow diagram of a method of security testing in accordance with one or more embodiments.

FIG. 3 is a schematic flow chart of a safety test method in another embodiment.

4 is a schematic flow chart of a safety test method in another embodiment.

FIG. 5 is a block diagram of a security testing device in accordance with one or more embodiments.

Figure 6 is a block diagram of a safety test apparatus in another embodiment.

Figure 7 is a block diagram of a safety test apparatus in another embodiment.

FIG. 8 is an internal diagram of a computer device in accordance with one or more embodiments.

Detailed ways

In order to make the technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The security test method provided by the present application can be applied to the application environment as shown in FIG. 1. Terminal 102 communicates with server 104 over a network over a network. The middleware and the application are provided on the server 104, and the middleware is used to execute the method provided by the embodiment of the present application. The user can send a network access request through the terminal 102. When receiving the network access request sent by the terminal 102, since the application is set on the middleware, the middleware on the server 104 can obtain the current code corresponding to the current network access request, and Insert a probe function in the current code to record the execution order of the code statement in the current code through the probe function in the process of executing the current code, obtain the execution path of the current code, and detect the execution path and the preset path of the current code. Consistent, when the execution path is inconsistent with the preset path, it is determined that there is a security hole in the current code. The terminal 102 can be, but is not limited to, a network access device such as various personal computers, notebook computers, smart phones, tablets, and portable wearable devices. The server 104 can use a separate server or a server composed of multiple servers. The cluster is implemented. The middleware refers to the software that provides the connection between the system software and the application software, so as to facilitate the communication between the various components of the software. The middleware is on the operating system, the network and the database, and the lower layer of the application software can be in its own The upper application software provides an environment for operation and development.

In some embodiments, as shown in FIG. 2, a security testing method is provided. The method is applied to the server in FIG. 1 as an example, and includes the following steps:

Step S202: Receive a current network access request, where the current network access request carries a uniform resource locator and an access parameter.

Specifically, a Uniform Resource Locator (URL) is a compact representation of the location and access method of resources that can be obtained from the Internet. The uniform resource locator can be used to locate the corresponding resource. The access parameter may be entered by the user or may be selected on the web page corresponding to the outgoing network access request. For example, the access parameter may be a user name and password entered by the user when logging in to the application, a search term entered, and the like. When accessing the database, the user can also retrieve the option as an access parameter by selecting the corresponding search option on the front-end page of the database. When the corresponding page needs to be accessed, the user can input or select an access parameter on the terminal, issue a network access request, and the terminal sends a network access request to the server, and carries the corresponding uniform resource locator and the access parameter. For example, the data carried in the network access request may be "http://ww.test.com/login?username=123&pwd=234", where the character "=" in the username=123&pwd=234 indicates that the user name is 123. The password is 234. The uniform resource locator is "http://ww.test.com/login".

Step S204: Acquire a current code corresponding to the current network access request according to the uniform resource locator.

Specifically, the correspondence between the uniform resource locator and the code is set in advance, so that the current code corresponding to the current network access request can be obtained according to the uniform resource locator carried by the current network access request. The current code can include one or more code statements.

Step S206, inserting a probe function into the current code.

Specifically, the insertion probe function refers to the instrumentation processing of the current code, and the instrumentation processing can insert the probe at the corresponding position of the code without destroying the original logical integrity of the code, so as to execute the code during the execution of the code. The information is collected, such as control flow and data flow information. You can call the open source framework spring's interceptor function for code instrumentation. The location of the function that inserts the probe can be every code statement.

In some embodiments, in order to reduce the number of probes and to capture a critical path, the step of inserting the probe function in the current code includes: detecting the current code, obtaining the target statement of the current code, in the current code Insert a probe function on the target statement. The target statement includes at least one of the following code statements: a start statement, a termination statement, a judgment statement, a statement corresponding to the variable constraint condition, and a code statement corresponding to the access parameter of the current code.

Specifically, when performing code instrumentation, the key position of the code may be selected for code instrumentation. For example, the key position may be the start position of the code, the termination position, the position corresponding to the variable constraint in the code, and the code corresponding to the network access parameter. One or more of the location and the judgment statement of the code. In some embodiments, the instrumentation may also be performed at the position of the judgment statement of the code. For example, when the judgment code includes an "if" statement, the code is inserted.

In some embodiments, in order to reduce the load of the server, the vulnerability detection policy may be determined according to the information type of the access parameter. When the information type of the access parameter is static information, the vulnerability detection is not performed or only the current code is static vulnerability detection. When the information type of the parameter is dynamic information, static vulnerability detection and dynamic vulnerability detection are performed. The static information refers to a parameter that can be selected on the current network access page corresponding to the current network access request, and the dynamic information refers to a parameter input by the user. Therefore, when receiving the current network access request, the access parameters of the current network access request can be compared with the parameters displayed on the current network access page. When not the parameters shown on the current network access page, the probe function is inserted into the current code. Static vulnerability detection means that the code is not run for vulnerability detection. Dynamic vulnerability detection refers to the need to run code for vulnerability detection.

In some embodiments, in order to reduce the load of the middleware for detecting the vulnerability, it is also possible to determine whether to insert a probe function into the current code according to the access parameter of the current network access request and the type of the current network access request, to perform vulnerability detection. The rules can be set according to actual needs. For example, when the user parameter includes the "?" character and the type requested by the user is the acquired data, vulnerability detection is performed. Or the current network access request includes command separators including ":", ".", and the current type of network access request is to insert a probe function in the current code for vulnerability detection.

Step S208, in the process of executing the current code according to the access parameter, the execution order of the code statement in the current code is recorded by the probe function, and the execution path of the current code is obtained.

Specifically, after the current code is obtained, the current code is executed according to the access parameters. For example, when the access parameter is the username and password for logging in, the current code is executed to log in. When the access condition is a search condition of the database, the search is performed based on the search condition and the corresponding code. The order in which code statements are executed can be obtained by recording the execution time of the code statement. After the execution order of the code statements is obtained, the execution paths are composed in the order of execution. For example, the code statement of the current code includes four code statements A, B, C, and D. When the probe function is inserted on A and C, the execution order of the probe function in the process of executing the current code is A, C. Then the execution path is A→C.

Step S210: It is detected whether the execution path of the current code is consistent with the preset path.

Specifically, the preset path is preset. For example, the preset path can be preset to be: A→C→B. The preset path may be obtained according to an execution path corresponding to the historical network access request corresponding to the current code. After obtaining the execution path of the current code, the current code is compared with the preset path to detect whether the current code is consistent with the preset path.

In some embodiments, the historical execution path of the plurality of historical network access requests corresponding to the current code may be obtained, the distribution ratio of each historical execution path is calculated, and the historical execution path exceeding the preset distribution ratio is used as the preset path. The distribution ratio of each historical execution path is calculated, and the method of using the historical execution path exceeding the preset distribution ratio as the preset path may be set as needed. For example, the historical execution paths of the respective historical network access requests may be compared, the number of executions of each historical execution path may be determined, and the distribution ratio of each historical execution path may be counted, and the distribution ratio exceeds a preset ratio, for example, 90% of the historical execution path as a pre- Set the path. Alternatively, the process that is executed by the current code is received when the historical network access request is received, and the process is determined to be a process in the whitelist. If yes, the execution path corresponding to the historical network access request is used as the preset path.

Step S212: When the execution path is inconsistent with the preset path, it is determined that the current code has a security vulnerability.

Specifically, when the execution path is inconsistent with the preset path, it indicates that there is an abnormality, and it may be determined that the current code has a vulnerability. For example, when the preset path is A→C→B, and the execution path is A→B→C, the execution path is inconsistent with the preset path. When the execution path is consistent with the preset path, it can be determined that the current code does not have a vulnerability. Of course, when the execution path is consistent with the preset path, the current code may be further determined according to other vulnerability detection rules. For example, it is possible to obtain data obtained by executing the current code according to the access parameter, and determine whether there is an abnormality according to the running result. When it is abnormal, it is judged that there is a vulnerability in the current code.

In some embodiments, for the running result, the size of the data volume of the running result may be obtained. When the data volume is greater than the preset threshold, the current code may be determined to have a vulnerability, and the preset threshold may be set according to actual needs, for example, 1G. For example, for a network access request for obtaining database data, if the amount of data obtained according to the retrieval condition is greater than 1 G, indicating that there is an abnormality, it may be determined that a vulnerability exists.

In some embodiments, the type of the data of the running result and the display form of the data may also be determined. When the type of the data is sensitive data and one or both of the data display forms are plaintext, the current code may be judged to be vulnerable. . For example, when the obtained data is found to be password information, and the data is plaintext, it can be judged that the current code has a vulnerability.

In some embodiments, the execution duration of the current code is also obtained according to the access parameter, and the execution duration is compared with the duration threshold. When the preset duration is exceeded, the current code is vulnerable. The duration threshold can be a fixed duration or dynamically changed. For example, the duration threshold is determined according to the running time of the historical network access request, and the value of the running time of the historical network access request exceeding the preset threshold, for example, 95%, is used as the duration threshold.

In some embodiments, when it is detected that there is a vulnerability in the current code, the current network access request may be discarded, such as not sending the response information corresponding to the current network access request, such as a data query result, to the terminal that issued the current network access request, to prevent the user from passing the current The vulnerability of the code violates the server. When there is no vulnerability, the response information corresponding to the previous network access request may be returned to the terminal.

In some embodiments, when a vulnerability is detected, a vulnerability alert message can be issued to alert the tester to the current code and fix the vulnerability. Before the repair is performed, the status of the current code may be identified as being to be corrected. When the code status is to be corrected, and the network access request corresponding to the current code is received, the network access request may be rejected.

In some embodiments, before the dynamic test is performed, the current code is executed according to the access parameters, and the vulnerability detection may be performed on the current code to determine whether there is malicious code in the current code. For example, compare the current code with malicious code such as the preset heap injection code, iframe code, and shellcode code to determine if there is malicious code. When not present, further dynamic testing is performed. When it exists, it can be judged that the current code has a vulnerability and no dynamic testing is performed.

In the foregoing security test method, the current network access request is received, the current network access request carries a uniform resource locator and an access parameter, and the current code for executing the current network access request is obtained according to the uniform resource locator, and a probe function is inserted in the current code. In the process of executing the current code according to the access parameter, the execution order of the code statement in the current code is recorded by the probe function, and the execution path of the current code is obtained, and it is detected whether the execution path of the current code is consistent with the preset path, when the execution path and the pre-execution path are The path is inconsistent, and the current code is determined to have a security vulnerability. The method provided by the embodiment of the present application uses the probe function to obtain the execution path of the code corresponding to the network access request, and compares the execution path with the preset path to obtain a vulnerability test result, which can be dynamically Received network access requests for vulnerability detection, and security detection is efficient.

In some embodiments, as shown in FIG. 3, the security detection method may further include the following steps:

Step S302: Acquire a current network page corresponding to the current network access request.

specifically. The current web page refers to a page that sends a current network access request. For example, when the current network access request is a retrieval request, the page for inputting the retrieval keyword is the current web page corresponding to the retrieval request. When the current network access request is a request for acquiring data in the database, the front-end page corresponding to the database for inputting or selecting the retrieval condition is the current web page corresponding to the request for acquiring data in the database.

Step S304, comparing the access parameter with an option parameter preset on the current network page, and determining an inclusion relationship between the option parameter and the access parameter.

Specifically, the option parameter preset on the current network page refers to a parameter that can be selected on the current network page. For example, a drop-down box for selecting a parameter may be set on the current web page, and the drop-down box may be clicked and the parameter displayed on the drop-down box may be selected, and the parameter displayed on the drop-down box is a preset option parameter. After obtaining the current web page, the preset parameter parameters on the current web page are obtained, and the access parameter is compared with the preset selection parameter to determine the inclusion relationship between the selection parameter and the access parameter, that is, whether the preset selection parameter includes access. parameter.

In some embodiments, the step of inserting the probe function in the current code in step S206 comprises inserting a probe function in the current code when detecting that the option parameter does not include an access parameter.

Specifically, the option parameter not including the access parameter means that at least one of the access parameters is not an option parameter. When it is detected that the option parameter does not include the access parameter, the access parameter is constructed by the user and is dynamic. There may be risks. Therefore, the probe function can be inserted in the current code for dynamic vulnerability detection. Static vulnerability detection can be performed when accessing parameter static information, ie, option parameters include access parameters.

In some embodiments, as shown in FIG. 4, the security detection method further includes:

Step S402: Obtain a code feature of the current code, where the code feature includes a variable constraint condition corresponding to the current code.

Specifically, the variable constraint refers to a restriction in the current code that limits the input variable. The variable constraint corresponding to the current code can be obtained during the execution of the current code. It is also possible to obtain a variable constraint corresponding to the current code before executing the current code or when detecting that the current code has a vulnerability. When the variable constraint is obtained, it can be judged whether the if statement exists in the current code. When it exists, the variable constraint condition in the if statement is extracted.

Step S404, constructing test parameters according to variable constraints.

Specifically, the test parameters are used to test the current code. After the variable constraints are obtained, the test function can be constructed according to the variable constraints. Rules for constructing test parameters based on variable constraints can be set as needed.

In some embodiments, the boundary values of the variable constraints can be constructed as test parameters. For example, when the variable constraint condition in the code is x greater than 5, the parameter near the boundary value 5 can be constructed as a test parameter, such as 5.1, 4.9999999999, and the like.

In some embodiments, when the variable constraint condition includes more than two, the test parameter may be constructed according to each variable constraint condition, and then the test parameters of each variable constraint condition are combined to obtain a final test parameter. For example, the variable constraint for a login password consists of two: greater than 10 characters and the first character is a number. Then, a valid test parameter of more than 10 characters and an invalid test parameter of 10 characters or less can be constructed according to a variable constraint of more than 10 characters. And constructing a valid parameter whose first letter is a number according to a variable constraint whose first character is a number, and an invalid test parameter whose first character is a non-numeric. Then, the test parameters constructed according to the variable constraints are combined in pairs to obtain the test parameters. It is assumed that the test parameter of less than 10 characters is 1001, and the test parameter with the first character is number is a, then the test parameters finally obtained after combination For a1001.

In some embodiments, when the execution path is inconsistent with the preset path, the test parameter may be constructed according to the access parameter, such as deforming the access parameter to obtain a test parameter of the black box. For example, when the access parameter is the username "admin" and there is a vulnerability when logging in with that username. You can use adminx01 and admin1 as test parameters.

Step S406, executing the current code according to the test parameters, and obtaining code operation data.

Specifically, after the current test parameters are obtained, the test parameters can be passed into the current code to execute the current code according to the test parameters, and the code operation data is obtained. The code running data may be a path corresponding to the current code according to the test parameter, or may be a result obtained by executing the current code according to the test parameter, such as data obtained by querying the database.

In some embodiments, the code feature includes a function control corresponding to the current code, and thus executing the current code according to the test parameter, the step of obtaining the code operation data includes: constructing a test network access request according to the function control and the test parameter, and according to the test network access request Execute the current code to get the code to run the data.

Specifically, the control identifier corresponding to the code may be obtained by detecting the code, or may be preset. After the control identifier is obtained, the test parameter is constructed according to the variable constraint condition, and the action of clicking the control is triggered, the test network access request is sent, the test network request carries the test parameter, and the current code is executed according to the test network access request, and the code operation data is obtained.

Step S408, determining a vulnerability detection result corresponding to the current code according to the code operation data.

Specifically, the vulnerability detection result may include a vulnerability and no vulnerability. The rules for determining the vulnerability detection result corresponding to the current code according to the code running data can be set according to the actual situation. For example, it may be determined whether the path corresponding to the current code according to the test parameter is consistent with the preset path, and if it is inconsistent, there is a vulnerability. It is also possible to judge whether the data amount of the data obtained by executing the current code according to the test parameter is greater than a preset value. For example, if the amount of data obtained by querying the database is greater than a preset value, when the value is greater than the preset value, it may be determined that the current code has a vulnerability.

In the embodiment of the present application, constructing test parameters according to variable constraints can perform further vulnerability testing on the current code, and improve the accuracy and comprehensiveness of the vulnerability test.

It should be understood that although the various steps in the above-described flowcharts are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, the execution order of the sub-steps or stages Nor is it necessarily performed sequentially, but may be performed alternately or alternately with at least a portion of other steps or sub-steps or stages of other steps.

In some embodiments, as shown in FIG. 5, a security testing apparatus is provided, including: a request receiving module 502, a code obtaining module 504, a probe inserting module 506, an execution path obtaining module 508, a detecting module 510, and a vulnerability determination. Module 512, wherein:

The request receiving module 502 is configured to receive a current network access request, where the current network access request carries a uniform resource locator and an access parameter.

The code obtaining module 504 is configured to obtain a current code corresponding to the current network access request according to the uniform resource locator.

A probe insertion module 506 is used to insert a probe function in the current code.

The execution path obtaining module 508 is configured to record the execution order of the code statements in the current code by using a probe function in the process of executing the current code according to the access parameter, to obtain an execution path of the current code.

The detecting module 510 is configured to detect whether the execution path of the current code is consistent with the preset path.

The vulnerability determination module 512 is configured to determine that the current code has a security vulnerability when the execution path is inconsistent with the preset path.

In some embodiments, as shown in FIG. 6, the security detecting device further includes:

The page obtaining module 602 is configured to obtain a current web page corresponding to the current network access request.

The inclusion relationship determining module 604 is configured to compare the access parameter with an option parameter preset on the current network page, and determine an inclusion relationship of the option parameter and the access parameter.

The execution probe insertion module 506 is configured to insert a probe function in the current code when detecting that the option parameter does not include the access parameter.

In some embodiments, the security testing device further includes: a historical path obtaining module, configured to acquire a historical execution path of the plurality of historical network access requests corresponding to the current code. And a preset path obtaining module, configured to calculate a distribution ratio of each historical execution path, and use a historical execution path exceeding a preset distribution ratio as a preset path.

In some embodiments, as shown in FIG. 7, the security testing device further includes:

The code feature obtaining module 702 is configured to obtain a code feature of the current code, where the code feature includes a variable constraint condition corresponding to the current code.

The parameter construction module 704 is configured to construct a test parameter according to the variable constraint condition.

The executing module 706 is configured to execute the current code according to the test parameter to obtain code running data.

The result is obtained by a module 708, configured to determine, according to the code operation data, a vulnerability detection result corresponding to the current code.

In some embodiments, the code feature further includes a function control corresponding to the current code, and the execution module is configured to: construct a test network access request according to the function control and the test parameter. Execute the current code according to the test network access request to get the code to run the data.

In some embodiments, the apparatus further includes a discarding module for discarding the current network access request when it is determined that the current code is vulnerable.

In some embodiments, the probe insertion module 506 is configured to: detect the current code to obtain a target statement of the current code, and the target statement includes at least one of the following code statements: a start statement, a termination statement, and a judgment statement of the current code The statement corresponding to the variable constraint and the code statement corresponding to the access parameter. Insert a probe function on the target statement of the current code.

For specific definitions of the safety test device, reference may be made to the above definition of the safety test method, and details are not described herein again. Each of the above-described security test devices may be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.

In some embodiments, a computer device is provided, which may be a server, the internal structure of which may be as shown in FIG. The computer device includes a processor, memory, and network interface coupled by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores operating systems and computer readable instructions. The internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. The computer readable instructions are executed by the processor to implement a secure test method.

It will be understood by those skilled in the art that the structure shown in FIG. 8 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied. The specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.

A computer device comprising a memory and one or more processors, the memory storing computer readable instructions, the computer readable instructions being executed by the processor, causing the one or more processors to perform the step of: receiving a current network access request The current network access request carries a uniform resource locator and an access parameter; the current code corresponding to the current network access request is obtained according to the uniform resource locator; the probe function is inserted in the current code; in the process of executing the current code according to the access parameter, The execution order of the code statement in the current code is recorded by the probe function, and the execution path of the current code is obtained; whether the execution path of the current code is consistent with the preset path; and when the execution path is inconsistent with the preset path, it is determined that the current code is safe. Vulnerabilities.

One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of: receiving a current network access request, current The network access request carries a uniform resource locator and an access parameter; the current code corresponding to the current network access request is obtained according to the uniform resource locator; the probe function is inserted in the current code; and the current code is executed according to the access parameter, The pin function records the execution order of the code statement in the current code, and obtains the execution path of the current code; detects whether the execution path of the current code is consistent with the preset path; and, when the execution path is inconsistent with the preset path, determines that the current code has a security hole.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by computer-readable instructions for instructing related hardware, and the computer readable instructions can be stored in a non-volatile computer readable. In the storage medium, the computer readable instructions, when executed, may include the flow of an embodiment of the methods as described above. Any reference to a memory, storage, database or other medium used in the various embodiments provided herein may include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The technical features of the above embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, It is considered to be the range described in this specification.

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A method of security testing, including:

Receiving a current network access request, where the current network access request carries a uniform resource locator and an access parameter;

Obtaining, according to the uniform resource locator, a current code corresponding to the current network access request;

Inserting a probe function into the current code;

In the process of executing the current code according to the access parameter, the execution order of the code statement in the current code is recorded by the probe function, and an execution path of the current code is obtained;

Detecting whether the execution path of the current code is consistent with the preset path; and

When the execution path is inconsistent with the preset path, it is determined that the current code has a security vulnerability.
The method of claim 1 further comprising:

Obtaining a current network page corresponding to the current network access request;

Comparing the access parameter with an option parameter preset on the current network page, and determining an inclusion relationship between the option parameter and the access parameter; and

The step of inserting a probe function in the current code includes:

When it is detected that the option parameter does not include the access parameter, a probe function is inserted in the current code.
The method of claim 1 further comprising:

Obtaining a historical execution path of the plurality of historical network access requests corresponding to the current code; and

Calculating a distribution ratio of each of the historical execution paths, and using a historical execution path exceeding a preset distribution ratio as the preset path.
The method according to any one of claims 1 to 3, further comprising:

Obtaining a code feature of the current code, the code feature including a variable constraint condition corresponding to the current code;

Constructing test parameters according to the variable constraints;

Performing the current code according to the test parameter to obtain code operation data; and

Determining a vulnerability detection result corresponding to the current code according to the code running data.
The method according to claim 4, wherein the code feature further comprises a function control corresponding to the current code, and the executing the current code according to the test parameter to obtain code operation data comprises:

Constructing a test network access request according to the functional control and the test parameter; and

Executing the current code according to the test network access request to obtain code operation data.
The method according to any one of claims 1 to 3, further comprising:

When it is determined that the current code has a vulnerability, the current network access request is discarded.
The method according to any one of claims 1 to 3, wherein the inserting the probe function in the current code comprises:

Detecting the current code to obtain a target statement of the current code, where the target statement includes at least one of the following code statements: a start statement, a termination statement, a judgment statement, a statement corresponding to a variable constraint condition of the current code, and Access the code statement corresponding to the parameter; and

A probe function is inserted on the target statement of the current code.
A safety testing device, the device comprising:

a request receiving module, configured to receive a current network access request, where the current network access request carries a uniform resource locator and an access parameter;

a code obtaining module, configured to acquire, according to the uniform resource locator, a current code corresponding to the current network access request;

a probe insertion module for inserting a probe function in the current code;

An execution path obtaining module, configured to record, in the process of executing the current code according to the access parameter, an execution sequence of the code statement in the current code by using the probe function, to obtain an execution path of the current code;

a detecting module, configured to detect whether an execution path of the current code is consistent with a preset path; and

The vulnerability determining module is configured to determine that the current code has a security vulnerability when the execution path is inconsistent with the preset path.
A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processors perform the following steps:

Receiving a current network access request, where the current network access request carries a uniform resource locator and an access parameter;

Obtaining, according to the uniform resource locator, a current code corresponding to the current network access request;

Inserting a probe function into the current code;

In the process of executing the current code according to the access parameter, the execution order of the code statement in the current code is recorded by the probe function, and an execution path of the current code is obtained;

Detecting whether the execution path of the current code is consistent with the preset path; and

When the execution path is inconsistent with the preset path, it is determined that the current code has a security vulnerability.
The computer apparatus according to claim 9, wherein said computer readable instructions are further executed by said processor to perform the following steps:

Obtaining a current network page corresponding to the current network access request;

Comparing the access parameter with an option parameter preset on the current network page, and determining an inclusion relationship between the option parameter and the access parameter; and

The step of inserting a probe function in the current code includes:

When it is detected that the option parameter does not include the access parameter, a probe function is inserted in the current code.
The computer apparatus according to claim 9, wherein said computer readable instructions are further executed by said processor to perform the following steps:

Obtaining a historical execution path of the plurality of historical network access requests corresponding to the current code; and

Calculating a distribution ratio of each of the historical execution paths, and using a historical execution path exceeding a preset distribution ratio as the preset path.
A computer apparatus according to any one of claims 9 to 11, wherein the computer readable instructions are further executed by the processor to perform the following steps:

Obtaining a code feature of the current code, the code feature including a variable constraint condition corresponding to the current code;

Constructing test parameters according to the variable constraints;

Performing the current code according to the test parameter to obtain code operation data; and

Determining a vulnerability detection result corresponding to the current code according to the code running data.
The computer device according to claim 12, wherein the code feature further comprises a function control corresponding to the current code, and the executing, by the processor, the executing the current code according to the test parameter, Code running data, including:

Constructing a test network access request according to the functional control and the test parameter; and

Executing the current code according to the test network access request to obtain code operation data.
A computer apparatus according to any one of claims 9 to 11, wherein the computer readable instructions are further executed by the processor to perform the following steps:

When it is determined that the current code has a vulnerability, the current network access request is discarded.
One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps: Receiving a current network access request, where the current network access request carries a uniform resource locator and an access parameter;

Obtaining, according to the uniform resource locator, a current code corresponding to the current network access request;

Inserting a probe function into the current code;

In the process of executing the current code according to the access parameter, the execution order of the code statement in the current code is recorded by the probe function, and an execution path of the current code is obtained;

Detecting whether the execution path of the current code is consistent with the preset path; and

When the execution path is inconsistent with the preset path, it is determined that the current code has a security vulnerability.
The storage medium of claim 15 wherein said computer readable instructions, when executed by said processor, further perform the following steps:

Obtaining a current network page corresponding to the current network access request;

Comparing the access parameter with an option parameter preset on the current network page, and determining an inclusion relationship between the option parameter and the access parameter; and

The step of inserting a probe function in the current code includes:

When it is detected that the option parameter does not include the access parameter, a probe function is inserted in the current code.
The storage medium of claim 15 wherein said computer readable instructions, when executed by said processor, further perform the following steps:

Obtaining a historical execution path of the plurality of historical network access requests corresponding to the current code; and

Calculating a distribution ratio of each of the historical execution paths, and using a historical execution path exceeding a preset distribution ratio as the preset path.
The storage medium according to any one of claims 15 to 17, wherein the computer readable instructions are further executed by the processor to perform the following steps:

Obtaining a code feature of the current code, the code feature including a variable constraint condition corresponding to the current code;

Constructing test parameters according to the variable constraints;

Performing the current code according to the test parameter to obtain code operation data; and

Determining a vulnerability detection result corresponding to the current code according to the code running data.
The storage medium according to claim 18, wherein the code feature further comprises a function control corresponding to the current code, and the executing, by the processor, executing the current code according to the test parameter Code running data, including:

Constructing a test network access request according to the functional control and the test parameter; and

Executing the current code according to the test network access request to obtain code operation data.
The storage medium according to any one of claims 15 to 17, wherein the computer readable instructions are further executed by the processor to perform the following steps:

When it is determined that the current code has a vulnerability, the current network access request is discarded.