CN110113366A - A kind of detection method and device of CSRF loophole - Google Patents

Abstract

The invention discloses a kind of detection method and device of CSRF loophole, which comprises determines whether the 2nd Token carried in the second access response of the first access identities Token carried in the first access response of URL website return to be detected and the URL website return to be detected is consistent；First user is different from the second user；If inconsistent, when setting time reaches, the third access request for carrying first user and logging in state information is sent to the URL website to be detected；If the 3rd Token in the corresponding third access response of the third access request is consistent with the first Token, it is determined that there are CSRF loopholes for the URL website to be detected.Using method provided by the invention, it is intended to solve the problems, such as that there are detection means is single, accuracy in detection is not high to CSRF Hole Detection in the prior art.

Description

A CSRF vulnerability detection method and device

technical field

The invention relates to the technical field of financial technology (Fintech), in particular to a method and device for detecting CSRF vulnerabilities.

Background technique

With the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology (Finteh). Due to the security and real-time requirements of the financial industry, the vulnerability detection technology is also proposed. higher requirement.

Cross-site request forgery (CSRF) is a malicious use of a website. Some financial platforms have loopholes in business functions. CSRF allows hackers to pretend to be legitimate users, causing legitimate users to trigger dangerous operations such as financial payment and transfer without knowing it, directly affecting the security of users' funds and accounts.

At present, there are detection methods for CSRF, but both manual detection and automatic detection have the problems of single detection means and low detection accuracy.

Contents of the invention

An embodiment of the present invention provides a method for detecting a CSRF vulnerability, aiming at solving the problems in the prior art that the means for detecting the CSRF vulnerability are single and the detection accuracy is not high.

In the first aspect, the embodiment of the present invention provides a method for detecting CSRF vulnerabilities of cross-site request forgery, including:

Determine whether the first access identifier Token carried in the first access response returned by the URL site to be detected is consistent with the second Token carried in the second access response returned by the URL site to be detected; The first access request for the login state information of a user is sent; the second access response is sent for the second access request carrying the login state information of the second user; the first user is different from the second user;

If inconsistent, when the set time arrives, send the third access request carrying the first user login status information to the URL site to be detected; if the third access response corresponding to the third access request If the three Tokens are consistent with the first Token, it is determined that there is a CSRF vulnerability in the URL site to be detected.

In the above technical solution, in the CSRF vulnerability detection method, Token detection for different user information is added. If different users have the same Token in the access response, there is a greater possibility of CSRF vulnerability; After the Token detection of the information, perform Token detection in different time periods; if the same user has the same Token in different time periods, there is a greater possibility of CSRF vulnerabilities. It can be seen that in the above technical solution, by introducing Token detection of different user information and Token detection of the same user at different time periods, the means of Token detection are enriched, thereby improving the detection accuracy.

In a possible implementation, if the third Token in the third access response corresponding to the third access request of the server is inconsistent with the first Token, further includes:

Constructing a fourth access request conforming to the interaction mode of the URL site to be detected;

sending the fourth access request to the URL site to be detected;

If the fourth access response corresponding to the fourth access request matches the fifth access response, it is determined that the URL site to be detected has a CSRF vulnerability; the fifth access response is a legal access request of the URL site to be detected the response to. It should be noted that the fourth access request may also be the first access request, and thus the fifth access response may also be the first access response.

In the above technical solution, after the Token detection of different user information and the Token detection of the same user at different time periods are passed, the detection method of the structured access request and the legitimate access request is further provided; if the response of the constructed access request is consistent with the legal If the response of the access request matches (for example, the similarity is high), it is determined that there is a CSRF vulnerability. It can be seen from the above technical solutions that the embodiments of the present invention further add detection means, thereby improving detection accuracy.

In a possible implementation, the interaction mode of the URL site is Ajax format; before sending the fourth access request to the URL site to be detected, it also includes:

Setting the sender of the fourth access request to carry cookie information when supporting cross-domain access.

In the above technical solution, according to different interaction modes, different access requests are constructed so that the detection of CSRF vulnerabilities can be realized and the detection accuracy can be ensured.

In a possible implementation, before determining whether the first access identifier Token carried in the first access response returned by the URL site to be detected is consistent with the second Token carried in the second access response returned by the URL page to be detected ,Also includes:

Crawling each data packet of the URL site to be detected; obtaining the first access response and the second access response from each data packet; or constructing the first login request and sending it to the to-be-detected URL site; constructing the second login request and sending it to the URL site to be detected.

In the above technical solution, two ways of realizing the login request are provided. One is to crawl the data packets on the network, which can make the constructed login request conform to the actual situation; the other is to directly construct the login request , which can make the construction more flexible.

In another possible implementation, it is determined whether the first access identifier Token carried in the first access response returned by the URL site to be detected is consistent with the second Token carried in the second access response returned by the URL page to be detected Previously, also included:

It is determined that the first Token and the second Token are not in the blacklist.

In the above technical solution, before the Token detection of different user information is performed, blacklist judgment is also performed; if the Token is in the blacklist, it is determined that there is a CSRF vulnerability; otherwise, the Token detection of different user information is performed. This technical solution can further improve the detection efficiency of CSRF vulnerabilities.

In the second aspect, the embodiment of the present invention also provides a cross-site request forgery CSRF vulnerability detection device, the device comprising:

Determining unit: used to determine whether the first access identifier Token carried in the first access response returned by the URL site to be detected is consistent with the second Token carried in the second access response returned by the URL site to be detected; The access response is sent for the first login request carrying the login status information of the first user; the access response is sent for the second login request carrying the login status information of the second user; the first user and the second user different;

A detection unit: used to send a third access request carrying the login status information of the first user to the URL site to be detected when the first Token is inconsistent with the second Token and when a set time arrives; If the third Token in the third access response corresponding to the third access request is consistent with the first Token, it is determined that the URL site to be detected has a CSRF vulnerability.

In a possible implementation manner, the detection unit is also used for:

Constructing a fourth access request conforming to the interaction mode of the URL site to be detected;

sending the fourth access request to the URL site to be detected;

If the fourth access response corresponding to the fourth access request matches the fifth access response, it is determined that the URL site to be detected has a CSRF vulnerability; the fifth access response is a legal access request of the URL site to be detected the response to.

In a possible implementation, the detection device also includes:

An acquisition unit, configured to crawl each data packet of the URL site to be detected;

The determining unit: further configured to determine that the first Token and the second Token are not in the blacklist.

In a third aspect, an embodiment of the present invention also provides a computing device, including:

memory for storing program instructions;

The processor is configured to call the program instructions stored in the memory, and execute the method of the first aspect or any one of the embodiments of the first aspect according to the obtained program.

In the fourth aspect, the embodiment of the present invention also provides a computer-readable non-volatile storage medium, including computer-readable instructions, and when the computer reads and executes the computer-readable instructions, the computer executes the first aspect or The method of any embodiment of the first aspect.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention, and constitute a part of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention, and do not constitute improper limitations to the present invention. In the attached picture:

FIG. 1 is a schematic diagram of a possible system architecture of an embodiment of the present invention;

Fig. 2 is a schematic diagram of the implementation flow of a CSRF vulnerability detection method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a CSRF vulnerability detection device according to an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and beneficial effects of the present invention more clear, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

FIG. 1 is a schematic diagram of a possible system architecture provided by the present application. As shown in FIG. 1 , it includes: multiple access devices 101 and an access server 102 . The access device 101 may be a personal computer, a mobile terminal, etc., and the access server 102 provides users with a site with page access services.

For each access device 101 , when accessing the access server 102 , it generally needs to perform a login operation first. Specifically, the access device 101 sends a login request to the access server 102, and the login request includes information identifying the identity of the user, usually a user name and a password. After the access server 102 passes the verification of the login request, it will send an access response to the access device 101, and the access response generally carries the cookie information assigned by the access server 102 to the user. The cookie information will be stored in the browser of the access device 101, so that the user does not need to fill in the login information again when the user visits the access server 102 subsequently. However, if the access device 101 is implanted with a CSRF vulnerability, the browser will send various access requests to the access server 102 by using Cookie information without the user's knowledge.

Embodiment one:

In order to detect the aforementioned CSRF vulnerability, as shown in FIG. 2 , an embodiment of the present invention provides a method for detecting a CSRF vulnerability, including the following steps:

S11. Determine the first access identifier Token carried in the first access response returned by the URL site to be detected; the first access response is sent for the first access request carrying the first user login status information;

S12. Determine the second Token carried in the second access response returned by the URL site to be detected; the second access response is sent for the second access request carrying the login state information of the second user; the first user different from the second user.

There is no prior relationship between the above step S11 and step S12, as long as two tokens returned by two different users for the same URL site can be obtained.

S13. Determine whether the first access identifier Token is consistent with the second Token;

S14. If inconsistent, when the set time arrives, send a third access request carrying the login status information of the first user to the URL site to be detected;

The setting time in step S14 can be set by yourself, so as to satisfy the effective use time of the cookie information. Although this step is described with the first Token as an example, it can actually be the second Token or the third Token, as long as the Token satisfies the time of two visits reaching the set time.

Specifically, for example, at 10:00 in the morning, a bank user inquired about the account balance. Assume that TokenA was obtained at this time. For TokenB, TokenA and TokenB should be different.

S15. If the third Token in the third access response corresponding to the third access request is consistent with the first Token, determine that the URL site to be detected has a CSRF vulnerability. In the above embodiment, Token detection of different user information is carried out in step S13 to avoid the CSRF vulnerability caused when different users have the same Token; in step S15, Token detection of the same user at different time periods is carried out, thereby avoiding that the effective time of Token is too long Long lead to CSRF vulnerability.

In a possible implementation, taking FIG. 2 as an example, after step S15, if the third Token in the third access response corresponding to the third access request of the URL site to be detected is the same as the first If a Token is inconsistent, the method also includes:

S16. Construct a fourth access request conforming to the interaction mode of the URL site to be detected;

S17. Send the fourth access request to the URL site to be detected;

S18. If the fourth access response corresponding to the fourth access request matches the fifth access response, it is determined that the URL site to be detected has a CSRF vulnerability; the fifth access response is a legal target of the URL site to be detected The response to the access request.

In the above implementation manner, for the response to the legal access request, a fourth access request similar to or consistent with the legal access request is constructed; if the fourth access response corresponding to the fourth access request matches the fifth access response, it is determined that the The URL site to be detected has a CSRF vulnerability.

Taking the legal access request as a modification request for published content as an example, a fourth access request is constructed according to the crawled legal access request; the content of the fourth access request may be the same as that of the legal access request. If the fourth access response is received, determine whether the fourth access response matches the fifth access response corresponding to the legal access request, such as whether the returned pages are consistent or whether the similarity is greater than a similar threshold; if they match, then determine the URL to be detected The site has a CSRF vulnerability. If the URL site to be detected rejects the fourth access request, it is considered to have the defense capability of the CSRF vulnerability. It should be noted that the fourth access request may be the first access request in step S11 above, and thus the fifth access response may also be the first access response.

In a possible implementation, taking FIG. 2 as an example, before step S11, further include:

Step S10, determining that the first Token and the second Token are not in the blacklist. Before the Token detection of different user information, blacklist judgment is also performed; if the crawled Token is in the blacklist, it is determined that there is a CSRF vulnerability; otherwise, the Token detection of different user information is performed. This technical solution can further improve the detection efficiency of CSRF vulnerabilities.

For the first access response in step S11 and the second access response in step S12, the following two possible implementations are provided.

Mode 1: crawling each data packet of the URL site to be detected; obtaining the first access response and the second access response from each data packet;

Way 2: constructing the first access request and sending it to the URL site to be detected; constructing the second access request and sending it to the URL site to be detected.

Usually, obtaining the user's historical access information through web crawling can construct a more effective and concise detection method. For example, for step S11 and step S12, it is only necessary to compare the Token information of different users crawled. At the same time, it is also possible to compare many users on the network, which further ensures the accuracy of the detection means.

At present, in the detection method for CSRF vulnerabilities, the access request in Form format is basically submitted; however, the site to be detected may have a request body in JSON or XML format, and at this time, an access request that cannot be provided in Form format may occur . Based on this, the embodiment of the present invention provides a CSRF vulnerability detection based on access requests in different formats of the site to be detected. Specifically, for step S16 of constructing the fourth access request conforming to the interaction manner of the URL site to be detected, the following two implementation manners are provided.

Usually, you can judge whether it is an access request in Form format by checking the Form tag in the crawled page code. The following code 1 is a legal access request, which can be seen as an access request in Form format with the Form tag.

<form action="action_page.php">

First name:<br>

<input type="text" name="firstname" value="Mickey">

<br>

Last name:<br>

<input type="text" name="lastname" value="Mouse">

<br><br>

<input type="submit" value="Submit">

</form>

If it is an access request in Form format, add code to the local HTML file to construct the fourth access request by replacing the name and value of <input>. The following code 2 is an example:

<body onload="document.forms[0].submit()">

<form action="http://bank.com/transfer.do" method="POST">

<input type="hidden" name="acct" value="MARIT"/>

<input type="hidden" name="amount" value="100000"/>

<input type="submit" name="View my picture"/>

<form>

Whether there is a CSRF vulnerability is determined by comparing the fifth access response corresponding to the legal access request of code 1 with the fourth access response corresponding to the fourth access request.

Through the Ajax tag in the crawled page code, it can be judged whether it is an Ajax interactive access request. If it is judged that the submission is in the Ajax interactive mode, the fourth access request sent in the Ajax interactive mode is constructed by replacing the sent data. An example of Ajax interaction is as follows: code 3:

In the implementation of the above detection method, if the request sent by Ajax interactive mode is constructed, the browser will check whether the client and the server are in the same domain, if not. You need to set the withCredentials attribute of the sender to True, that is, it supports carrying cookie information during cross-domain access. In other words, the browser of the access device 101 needs to be set to carry cookie information when supporting cross-domain access, so that the above detection process can be performed.

A cross-domain request means that the domain of the currently initiated request is different from the domain where the resource pointed to by the request is located. Here, the domain with the same protocol, domain name, and port number is the same domain.

If it is the request submitted in the Form form format of the construction, the browser of the access device 101 does not check whether its domain is the same as the domain of the site to be detected, and directly sends it out, so it is not necessary to set the browser of the access device 101 to support cross- domain request.

But when constructing the sending request of Ajax interactive mode, the browser of access device 101 will check whether its domain is the same as the domain of the site to be detected. If the browser of different access device 101 will not send the request , at this time, it is necessary to configure the browser of the access device 101 to support cross-domain requests.

In the above technical solution, according to different message formats, different access requests are constructed so that the detection of CSRF vulnerabilities can be realized and the detection accuracy can be ensured.

Based on the same inventive concept, an embodiment of the present invention also provides a detection device for a CSRF vulnerability. Since the principle of the above-mentioned device to solve the problem is similar to the detection method for a CSRF vulnerability, the implementation of the above-mentioned device can Refer to the implementation of the method, and the repetition will not be repeated.

As shown in FIG. 3 , it is a schematic structural diagram of a CSRF vulnerability detection device provided by Embodiment 2 of the present invention, including: a determination unit 32 and a detection unit 33, wherein:

Determining unit: used to determine whether the first access identifier Token carried in the first access response returned by the URL site to be detected is consistent with the second Token carried in the second access response returned by the URL site to be detected; The access response is sent for the first login request carrying the login state information of the first user; the second access response is sent for the second access request carrying the login state information of the second user; the first user and the second user The two users are different;

A detection unit: used to send a third access request carrying the login status information of the first user to the URL site to be detected when the first Token is inconsistent with the second Token and when a set time arrives; If the third Token in the third access response corresponding to the third access request is consistent with the first Token, it is determined that the URL site to be detected has a CSRF vulnerability.

Further, the detection unit is also used for:

Constructing a fourth access request conforming to the interaction mode of the URL site to be detected;

sending the fourth access request to the URL site to be detected;

If the fourth access response corresponding to the fourth access request is consistent with the fifth access response, it is determined that the URL site to be detected has a CSRF vulnerability; the fifth access response is a legal access request of the URL site to be detected the response to.

During specific implementation, the detection device also includes:

An acquisition unit 31, configured to crawl each data packet of the URL site to be detected;

The determining unit: further configured to determine that the first Token and the second Token are not in the blacklist.

The cross-site request forgery CSRF defense authentication device provided by the above-mentioned embodiments of the present application can be realized by a computer program. Those skilled in the art should be able to understand that the above-mentioned module division method is only one of many module division methods. If it is divided into other modules or not divided into modules, as long as the cross-site request forgery CSRF defense authentication device has the above functions, it should be in Within the protection scope of this application.

Based on the same inventive concept, an embodiment of the present invention also provides a computer device, including:

memory for storing program instructions;

The processor is configured to call the program instructions stored in the memory, and execute the method for detecting CSRF vulnerabilities in the above-mentioned embodiments according to the obtained program.

Based on the same inventive concept, an embodiment of the present invention also provides a computer-readable non-volatile storage medium, including computer-readable instructions, and when the computer reads and executes the computer-readable instructions, the computer executes the above-mentioned embodiments A detection method for CSRF vulnerabilities in . Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (10)

1. a kind of detection method for requesting to forge CSRF loophole across station, which is characterized in that the described method includes:

Determine the first access identities Token for being carried in the first access response that URL website to be detected returns with it is described to be detected Whether the 2nd Token carried in the second access response that URL website returns is consistent；First access response is for carrying the What the first access request that one user logs in state information was sent；Second access response is to log in state for carrying second user What the second access request of information was sent；First user is different from the second user；

If inconsistent, when setting time reaches, sent to the URL website to be detected and carry the first user login state The third access request of information；

If the 3rd Token in the corresponding third access response of the third access request is consistent with the first Token, really There are CSRF loopholes for the fixed URL website to be detected.

2. detection method as described in claim 1, which is characterized in that if the corresponding third access of the third access request is rung The 3rd Token and the first Token in answering is inconsistent, the method also includes:

Construction meets the 4th access request of the interactive mode of the URL website to be detected；

The 4th access request is sent to the URL website to be detected；

If corresponding 4th access response of the 4th access request is matched with the 5th access response, it is determined that described to be detected There are CSRF loopholes for URL website；5th access response is the sound for Lawful access request of the URL website to be detected It answers.

3. detection method as claimed in claim 2, which is characterized in that the interactive mode of the URL website is Ajax；

Before sending the 4th access request to the URL website to be detected, further includes:

The transmitting terminal that the 4th access request is arranged is supported to carry cookie information when cross-domain access.

4. detection method as described in claim 1, which is characterized in that the first access for determining that URL website to be detected returns is rung Answer second carried in the first access identities Token of carrying and the second access response of the URL page return to be detected Before whether Token is consistent, further includes:

Crawl each data packet of the URL website to be detected；First access response and institute are obtained from each data packet State the second access response；Or

It constructs first access request and is sent to the URL website to be detected；It constructs second access request and sends To the URL website to be detected.

5. detection method as described in claim 1, which is characterized in that the first access for determining that URL website to be detected returns is rung Answer second carried in the first access identities Token of carrying and the second access response of the URL page return to be detected Before whether Token is consistent, further includes:

Determine the first Token and the 2nd Token not in blacklist.

6. a kind of detection device for requesting to forge CSRF loophole across station, which is characterized in that described device includes:

Determination unit: the first access identities Token carried in the first access response for determining URL website return to be detected Whether the 2nd Token carried in the second access response returned with the URL website to be detected is consistent；First access is rung It should be sent for the first logging request for carrying the first user login state information；Second access response is for carrying the What the second access request that two users log in state information was sent；First user is different from the second user；

Detection unit: being used in the first Token and the 2nd Token inconsistent, when setting time reaches, to institute It states URL website to be detected and sends the third access request for carrying the first user login state information；If the third access is asked Ask the 3rd Token in corresponding third access response consistent with the first Token, it is determined that the URL website to be detected There are CSRF loopholes.

7. detection device as claimed in claim 6, which is characterized in that the detection unit is also used to:

Construction meets the 4th access request of the interactive mode of the URL website to be detected；

The 4th access request is sent to the URL website to be detected；

If corresponding 4th access response of the 4th access request is matched with the 5th access response, it is determined that described to be detected There are CSRF loopholes for URL website；5th access response is the sound for Lawful access request of the URL website to be detected It answers.

8. detection device as claimed in claim 6, which is characterized in that further include:

Acquiring unit, for crawling each data packet of the URL website to be detected；

The determination unit: it is also used to determine the first Token and the 2nd Token not in blacklist.

9. a kind of calculating equipment characterized by comprising

Memory, for storing program instruction；

Processor requires 1 to 5 according to the program execution benefit of acquisition for calling the program instruction stored in the memory Described in any item methods.

10. a kind of computer-readable non-volatile memory medium, which is characterized in that including computer-readable instruction, work as computer When reading and executing the computer-readable instruction, so that computer executes such as method described in any one of claim 1 to 5.