CN114301673A - A vulnerability detection method, device, electronic device and storage medium - Google Patents

Abstract

The present application provides a vulnerability detection method, device, electronic device and storage medium. The method includes: acquiring an interface access request of a server to be detected, where the interface access request includes multiple request parameters; determining a risk parameter in the multiple request parameters in the interface access request; and replacing the risk parameter in the interface access request with a preset one Attack payload, obtain the target detection request, the attack payload is the address pointing to the domain name resolution system; send the target detection request to the server to be detected; monitor the domain name resolution log generated on the domain name resolution system, and judge whether the target detection request exists according to the domain name resolution log Vulnerability. The method constructs a detection request with an attack payload by determining the risk parameters, thereby realizing the accurate test of the risk point of the interface, thus completing the location of the vulnerability, avoiding too much dirty data caused by the attack payload and affecting the normal operation of the interface. run.

Description

A vulnerability detection method, device, electronic device and storage medium

technical field

The present application relates to the field of computer technology, and in particular, to a vulnerability detection method, apparatus, electronic device, and storage medium.

Background technique

Due to the development of WEB Internet technology, the security risks of the Internet are becoming more and more serious. For example, SSRF (Server-Side Request Forgery) server request masquerading vulnerability is a very common vulnerability. The reason for this SSRF vulnerability is that the server provides The function of obtaining data from other server applications without filtering and limiting the target address. For example, get the text content of the web page from the specified URL address, load the picture of the specified address, download and so on. There are also loading of some external resources, involving bad information will also lead to the generation of security compliance loopholes, criminals use the flawed WEB application as a proxy to attack remote and local servers, which is easy to cause irreparable losses.

For the detection of these vulnerabilities, the current method is to use some open source or commercial scanning software for vulnerability detection. By constructing a large number of attack loads and mechanically executing test cases, a large amount of detection dirty data is generated, which affects the normal use of the business. .

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present application is to provide a vulnerability detection method, apparatus, electronic device, and storage medium, so as to reduce dirty data generated during testing.

In a first aspect, an embodiment of the present application provides a vulnerability detection method. The method includes: acquiring an interface access request of a server to be detected, where the interface access request includes multiple request parameters; The risk parameter in the request parameter; replace the risk parameter in the interface access request with a preset attack load, and obtain a target detection request, where the attack load is an address pointing to the domain name resolution system; The terminal sends the target detection request; monitors the domain name resolution log generated on the domain name resolution system, and determines whether there is a loophole in the target detection request according to the domain name resolution log.

In this embodiment of the present application, by acquiring an interface access request of the server to be detected, the interface access request includes multiple request parameters, then determining the risk parameter in the interface access request, and replacing the risk parameter with a preset attack load, the target is obtained. Detect the request, and then monitor the resolution log on the domain name resolution system to determine whether the target detection request has vulnerabilities. Through the precise positioning of risk parameters, the number of target detection requests is reduced, thereby reducing the dirty data generated during the testing process and avoiding the impact on the normal use of the interface.

Further, the determining of the risk parameters in the multiple request parameters in the interface access request includes: matching the multiple request parameters in the interface access request with the preset address feature values respectively; if the matching is successful. , and the corresponding request parameter is determined as the risk parameter.

In this embodiment of the present application, multiple request parameters in the interface access request are matched with preset address feature values, and the request parameters are set as risk parameters after the matching is successful. By matching the request parameters included in the interface access request component, the precise positioning of the risk parameters in the interface access request component is realized, the risk point of the vulnerability is determined, and unnecessary target detection requests are reduced.

Further, the risk parameters in the interface access request include a plurality of risk parameters, and the replacing the risk parameters in the interface access request with a preset attack load to obtain a target detection request includes: A plurality of risk parameters in are replaced with different preset attack payloads, and a target detection request corresponding to the risk parameters is obtained.

In the embodiment of the present application, since the interface access request includes multiple risk parameters, the target detection request corresponding to the risk parameter is obtained by replacing the multiple risk parameters in the interface access request with different preset attack payloads respectively. By separating the target detection requests of different risk parameters, the test interference between the risk parameters can be avoided, and the one-to-one correspondence between the attack load and the risk parameters is realized, which is beneficial to determine the risk points in the interface.

Further, judging whether the target detection request has a loophole according to the domain name resolution log includes: judging whether the domain name resolution log includes log information corresponding to the attack load; wherein, if the domain name resolution log If the log information corresponding to the attack payload is included in the target detection request, there is a loophole in the target detection request; if the domain name resolution log does not include the log information corresponding to the attack payload, the target detection request does not exist. Vulnerability.

In the embodiment of the present application, since the attack payload points to the address in the domain name resolution system, when the attack payload is triggered, log information will be generated in the domain name resolution log. Log information, thus realizing whether there is a vulnerability in the target detection request according to the attack load, completing the detection of the vulnerability, and determining the risk point of the vulnerability according to the attack load, which is helpful for developers to determine the location of the vulnerability.

Further, the obtaining the interface access request of the server to be detected includes: obtaining the real-time traffic from the user access of the server to be detected; processing the real-time traffic according to the interface type of the access and the requirements of the protocol format, and obtaining a request that conforms to the protocol. Interface access request in the format required.

In the embodiment of the present application, before obtaining the interface access request of the server to be detected, the real-time traffic from the user access from the server to be detected can also be obtained, and the real-time traffic can be processed according to the type of the interface accessed and the requirements of the protocol format, so as to obtain The interface access request corresponding to the target detection request that meets the requirements of the protocol format realizes the generation of the interface access request according to the real-time traffic generated by the user, so as to ensure the coverage of the interface, and use the format processing to ensure the validity of the test data.

Further, the processing of the real-time traffic according to the interface type to be accessed and the protocol format requirements to obtain an interface access request that meets the protocol format requirements includes: formatting the real-time traffic according to the protocol format requirements, generating Standard access requests that meet the requirements of the protocol format; classify and combine the standard access requests according to the interface types to obtain interface access requests corresponding to the interface types.

In the embodiment of the present application, the real-time traffic is formatted according to the requirements of the protocol format, so that a standard access request that meets the requirements of the protocol format can be generated, and then the standard access requests are classified and combined by using the accessed interface type, so as to obtain the The interface access request corresponding to the target detection request. Real-time traffic and interface access requests are converted by formatting, classifying, and merging real-time traffic, so that real-time traffic can be transformed to complete the rapid generation of interface access requests.

Further, after obtaining the target detection request, the method further includes: obtaining a pre-configured authentication information pool, where the authentication information pool includes authentication information corresponding to the target detection request; obtaining from the authentication information pool The authentication information is added to the target detection request, so as to realize the authentication of the target detection request by the server to be detected.

In this embodiment of the present application, a pre-configured authentication information pool may also be obtained, and the authentication information pool includes authentication information corresponding to the target detection request. By obtaining the authentication information from the authentication information pool and adding it to the target detection request, The authentication of the target detection request by the server to be detected can be realized. Through the preset authentication information pool, the authentication of the target detection request is completed, and the situation that the authentication of the target detection request is not passed is avoided.

Further, after obtaining the target detection request, the method further includes: adding a marker parameter to the target detection request, where the marker parameter is used to distinguish the target detection request from the real-time traffic or the test traffic.

In this embodiment of the present application, after the target detection request is obtained, a mark parameter may be added to the target detection request, and the mark parameter is used to distinguish whether the target detection request comes from real-time traffic or test traffic. Thus, marking of the target detection request is realized, which is beneficial for business personnel to judge abnormal information.

In a second aspect, an embodiment of the present application provides a vulnerability detection device, the device includes: an acquisition module configured to acquire an interface access request of a server to be detected, the interface access request includes multiple request parameters; a risk parameter determination module , which is used to determine the risk parameters in the multiple request parameters in the interface access request; the request generation module is used to replace the risk parameters in the interface access request with a preset attack load, and obtain a target detection request, The attack payload is an address pointing to a domain name resolution system; a sending module is used to send the target detection request to the to-be-detected server; a judgment module is used to monitor the domain name resolution log generated on the domain name resolution system, and According to the domain name resolution log, it is determined whether the target detection request has a loophole.

In a third aspect, an embodiment of the present application provides an electronic device, including: a processor, a memory, and a bus, wherein the processor and the memory complete mutual interaction through the bus;

The memory stores program instructions executable by the processor, the processor invoking the program instructions capable of performing the method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, including:

The computer-readable storage medium stores computer instructions that cause the computer to perform the method of the first aspect.

Other features and advantages of the present application will be set forth in the description which follows, and, in part, will be apparent from the description, or may be learned by practice of the embodiments of the present application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description, claims, and drawings.

Description of drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the accompanying drawings that need to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, therefore It should not be regarded as a limitation of the scope. For those of ordinary skill in the art, other related drawings can also be obtained from these drawings without any creative effort.

1 is a schematic flowchart of a vulnerability detection method provided by an embodiment of the present application;

2 is a schematic flowchart of a real-time traffic acquisition method provided by an embodiment of the present application;

3 is a schematic flowchart of another vulnerability detection method provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a vulnerability detection apparatus provided by an embodiment of the present application;

FIG. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

Aiming at the problem that too much dirty data is detected in the existing vulnerability detection process, the present application provides a vulnerability detection method. The method obtains the interface access request of the server to be detected and includes multiple request parameters in the interface access request. Determine the risk parameters in the test, and use the risk coefficient to generate a target detection request with an attack payload for vulnerability detection, so as to realize the precise location of the risk point, avoid too much detection dirty data generated during the test process, and affect the normal operation of the interface. .

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

FIG. 1 is a schematic flowchart of a vulnerability detection method provided by an embodiment of the present application. As shown in FIG. 1 , the method can be applied to a test terminal, and the test terminal can be a terminal device (also referred to as an electronic device) and a server; wherein The terminal device may specifically be a smart phone, a tablet computer, a computer, a personal digital assistant (Personal DigitalAssitant, PDA), etc. The server may specifically be an application server or a Web server. A test platform system is deployed on the test terminal to perform vulnerability detection on the interface of the server to be detected. The method includes:

Step 101: Obtain an interface access request of the server to be detected, where the interface access request includes multiple request parameters.

Among them, the server to be detected can be a server that deploys a WEB application, and the WEB application includes multiple interfaces. Vulnerability detection can be performed on these interfaces by obtaining the access request corresponding to the interface. The interface access request can be a uniform resource locator URL path. For example "xxxabc.com". The interface access request may include data of multiple parts, such as request line, request body, and request data, and each part may include multiple request parameters.

Step 102: Determine a risk parameter among the plurality of request parameters in the interface access request.

Wherein, the risk parameter may be a risk parameter that is prone to vulnerabilities in the interface on the WEB application server, such as SSRF vulnerability, corresponding to a request parameter of address information in each parameter included in the interface, and the request parameter may be determined as a risk parameter . The way of determining the risk parameter may be to use a commonly used address protocol value such as http to compare with the request parameters included in these requests to determine the risk parameter with risk. Therefore, the feature analysis of the interface components is realized, the overall detection of the interface is avoided, and a large amount of detection dirty data is generated.

Step 103: Replace the risk parameter in the interface access request with a preset attack payload to obtain a target detection request, where the attack payload is an address pointing to a domain name resolution system.

The preset attack payload payload can be a one-to-one corresponding address value generated according to the risk parameter. The attack payload can be an address pointing to the domain name resolution system, and the domain name resolution system can map the domain name DNS and IP addresses to each other, so as to make attacks with attacks. The target detection request of the payload will be captured by the domain name resolution system when there is a vulnerability in the interface. For example, the address of the domain name resolution system can be "xxxdnslog.com", then the test terminal generates the address corresponding to the risk parameter by setting the attack payload to the third-level domain name under the domain name resolution system, such as "dfga2.xxxdnslog.com" , to obtain the modified target detection request.

Step 104: Send the target detection request to the to-be-detected server.

Step 105: Monitor the domain name resolution log generated on the domain name resolution system, and determine whether there is a loophole in the target detection request according to the domain name resolution log.

Among them, after the test terminal sends a target detection request to the server to be detected, since the attack payload points to the address where the domain name resolution system is located, if there is a loophole in the risk parameter of the target detection request, the corresponding attack payload after the replacement will be triggered. Target detection request, the target detection request with the attack payload will be captured by the domain name resolution system, and corresponding log information will be generated. By monitoring the domain name resolution log generated on the domain name resolution system, you can determine the target detection request Whether the attack payload is triggered to determine whether there is a vulnerability in the target detection request. It should be understood that the server to be detected can include multiple interfaces to be detected, and each interface can construct multiple target detection requests to detect whether the interface has loopholes. When all target detection requests corresponding to the interface have no loopholes , there is no vulnerability in the interface. By determining the risk parameters in the request parameters, the precise construction of the target detection request is realized, a large amount of detection dirty data is avoided in the interface, and the normal operation of the interface is ensured.

On the basis of the foregoing embodiment, the determining of the risk parameters in the multiple request parameters in the interface access request includes:

Matching multiple request parameters in the interface access request with preset address feature values respectively;

If the match is successful, the corresponding request parameter is determined as the risk parameter.

The preset address feature value can transmit address values for protocols commonly used in the Internet, such as "file://", "dict://", "sftp://", "ldap://", "tftp://" ”, “gopher://” and other address bar feature values may be exploited by vulnerabilities, and the server to be detected is used as a springboard to obtain internal data in other servers for tampering, resulting in vulnerability risks, so these address values are all For risk points that may cause vulnerabilities in the interface, it is necessary to match multiple request parameters in the interface access request with these addresses. If the matching is successful, the request parameters can be determined as risk parameters. If none of the above-mentioned address values are detected in multiple request parameters in the interface access request, they do not match, and there is no loophole in the target detection request.

On the basis of the above embodiment, the risk parameters in the interface access request include a plurality of risk parameters, and replacing the risk parameters in the interface access request with a preset attack load to obtain a target detection request includes:

The multiple risk parameters in the interface access request are respectively replaced with different preset attack payloads, and a target detection request corresponding to the risk parameters is obtained.

In some implementation manners, in the above-mentioned replacement of risk parameters with attack payload, if there are multiple risk parameters in the interface access request, these risk parameters need to be replaced with different preset attack payloads, and then obtain The target detection request corresponding to the risk parameter. That is to say, there is a one-to-one correspondence between risk parameters and attack payloads. If there are N risk parameters in the interface access request, it is necessary to construct corresponding N attack payloads according to the risk parameters, and then generate N target detection requests for testing. Thus, independent detection of each attack load is realized, and the test process of the target detection request generated according to each risk parameter is guaranteed not to interfere with each other.

On the basis of the above embodiment, the obtaining the interface access request of the server to be detected includes:

Obtain the real-time traffic from user access of the server to be detected;

The real-time traffic is processed according to the type of the accessed interface and the requirements of the protocol format, and an interface access request that meets the requirements of the protocol format is obtained.

For example, the source of the interface access request may be the real-time traffic of the user accessing the server to be detected, and the interface access request of the server to be detected is established through the real-time traffic. FIG. 2 is a schematic flowchart of a real-time traffic acquisition method provided by an embodiment of the present application. As shown in FIG. 2, the specific implementation may be as follows:

Step 201: First, the test terminal obtains a real-time access request sent by the client to the background WEB server;

Step 202: The test terminal uses the pre-built Nginx proxy server to mirror the real-time traffic of the real-time access request sent by the client, and sends the real-time traffic to the test terminal; Nginx implements traffic mirroring by adding ngx_http_mirror_module. By configuring the proxy server, real-time access traffic can be copied to the electronic device used to test the server to be detected. The proxy configuration is as follows:

Step 203: The test terminal collects real-time traffic of the server to be detected, and uses the real-time traffic to construct an interface access request. The construction method can be to process the real-time traffic according to the type of the accessed interface and the requirements of the protocol format, and obtain the access requests of different interfaces that meet the requirements of the protocol format.

On the basis of the above embodiment, the process of processing the real-time traffic according to the interface type to be accessed and the requirements of the protocol format, and obtaining the interface access request that meets the requirements of the protocol format, includes:

Format the real-time traffic according to the requirements of the protocol format, and generate a standard access request that meets the requirements of the protocol format;

Classify and combine the standard access requests according to the interface types, and obtain interface access requests corresponding to the interface types.

For example, in order to ensure that the access request can meet the requirements of the protocol format, the test terminal needs to format the real-time traffic first. The formatting method can be to use the KAFKA message queue to uniformly process the copied real-time traffic. The processed format of the real-time traffic corresponding to each access request can be a json string, including parameter values corresponding to multiple request parameters, as shown below:

Among them, due to the large amount of traffic accessed by users in real time, considering that most of the URLs of the access requests are repeated, there is no need for the test terminal to perform repeated scanning and detection. Therefore, the test terminal also needs to be classified and merged according to the interface type. The access request data of the same interface is classified. The following is an example to illustrate:

In the above access request, the test terminal can further classify these parameters and extract multiple request parameters. There are also some irregular URL addresses in the interface, such as www.xxxabc.com/test/212dasxdas12313/prd, which can be converted to www.xxxabc.com/test/*/prd in a normalized way, and get the corresponding request parameters. The specific manner of implementation may be as follows: by regular matching, the URL paths contain information such as serial codes, pure numbers, labels, Chinese, etc., which are classified into one category. As shown in Table 1 below, Table 1 is a comparison table of the provided request parameters.

Table 1 Request parameter comparison table

request parameter parameter value PROTOCAL (protocol) http DOMAIN (domain name) www.xxxabc.com PATH (path) /api/list PARAM(parameter) appKey BODY (message body) name, age FRAGMENT (fragment) #top

On the basis of the above embodiment, after obtaining the target detection request, the method further includes:

acquiring a preconfigured authentication information pool, where the authentication information pool includes authentication information corresponding to the target detection request;

The authentication information is obtained from the authentication information pool and added to the target detection request, so as to realize the authentication of the target detection request by the to-be-detected server.

The authentication information pool can be the authentication information extracted by the test terminal from the real-time traffic of the user accessing the server to be tested and used to authenticate the target detection request. In order to ensure the success rate of vulnerability detection, the test terminal can accurately identify the authentication type of the interface. . For example, when the authentication information of the target detection request is invalid, the test terminal will automatically use the configured authentication information to request an update. The authentication information pool can be configured by configuring the authentication field of the interface. For example, the following configuration can be used:

[

{"hostname":"xxxabc.com",

"auth_path": "request_header|cookie"

},

{"hostname":"xxxabc.com",

"auth_path": "request_body|token"

},

]

There are two authentication fields in this interface: the cookie in the request_header and the token field in the request_body. When the authentication information of the target detection request is invalid, the test terminal can update the cookie information and token information by obtaining the authentication information in the authentication information pool. Perform interface authentication.

Based on the above embodiment, after obtaining the target detection request, the method further includes: adding a marker parameter to the target detection request, where the marker parameter is used to distinguish that the target detection request comes from the real-time traffic or Test traffic.

For example, the test terminal may also mark the target detection request by adding a mark parameter to the target detection request. The purpose of the mark is to distinguish whether the target detection request is a normal access request sent by the user or a test request sent by the test terminal. The parameter of the mark can be adding the "scan-request-id-security" parameter in the request header. The test terminal can judge whether it is a safe detection request according to this parameter, and distinguish the test traffic and real-time traffic based on this parameter, and judge the cause of abnormal information.

Summarizing the embodiments provided above, FIG. 3 is a schematic flowchart of another vulnerability detection method provided by the embodiments of the present application. As shown in Figure 3, it is applied to a test terminal, and the test terminal is used to test the interface of the server to be detected. The specific implementation may be:

Step 301: The test terminal uses Nginx to copy the real-time traffic from the user accessing the server to be detected, and converts it into an interface access request. For a specific implementation manner, reference may be made to the real-time traffic processing method provided in the embodiment corresponding to FIG. 2 , which will not be repeated.

Step 302: The test terminal performs authentication configuration on the interface, picks up the authentication information in the real-time traffic of the user, and uses it to authenticate the target detection request. For a specific implementation method, reference may be made to the method for acquiring authentication information from the authentication information pool provided in the embodiment of FIG. 1 .

Step 303: The test terminal determines risk parameters of multiple request parameters in the interface access request. For a specific implementation method, reference may be made to the method for determining risk parameters provided by the corresponding embodiment of FIG. 1 .

Step 304: The test terminal replaces the risk parameter with a preset attack payload, obtains a target detection request, and adds a tag parameter to the target detection request for interface tag processing. For specific implementations, reference may be made to the method for obtaining a target detection request and the method for adding a marker parameter provided by the corresponding embodiment of FIG. 1 .

Step 305: The test terminal sends a target detection request to the server to be detected, and determines whether there is a vulnerability risk in the interface according to the resolution log on the domain name resolution log system. For a specific implementation manner, reference may be made to the method for determining a vulnerability in the embodiment corresponding to FIG. 1 .

FIG. 4 is a schematic structural diagram of a vulnerability detection apparatus 400 according to an embodiment of the present application, and the apparatus may be a module, a program segment, or a code on an electronic device. It should be understood that the apparatus corresponds to the method embodiment of FIG. 1 and can perform various steps involved in the method embodiment of FIG. 1 . For specific functions of the apparatus, refer to the above description. To avoid repetition, the detailed description is appropriately omitted here.

The embodiment of the present application provides a vulnerability detection apparatus 400, and the apparatus includes:

The obtaining module 401 is used to obtain the interface access request of the server to be detected, where the interface access request includes a plurality of request parameters;

a risk parameter determination module 402, configured to determine a risk parameter among the plurality of request parameters in the interface access request;

A request generation module 403, configured to replace the risk parameter in the interface access request with a preset attack load, and obtain a target detection request, where the attack load is an address pointing to a domain name resolution system;

A sending module 404, configured to send the target detection request to the to-be-detected server;

The judging module 405 is configured to monitor the domain name resolution log generated on the domain name resolution system, and judge whether there is a loophole in the target detection request according to the domain name resolution log.

On the basis of the above embodiment, the risk parameter determination module 402 is specifically used for:

Matching multiple request parameters in the interface access request with preset address feature values respectively;

If the match is successful, the corresponding request parameter is determined as the risk parameter.

On the basis of the foregoing embodiment, the risk parameters in the interface access request include a plurality of risk parameters.

On the basis of the above embodiment, the risk parameter determination module is specifically used for:

The multiple risk parameters in the interface access request are respectively replaced with different preset attack payloads, and a target detection request corresponding to the risk parameters is obtained.

On the basis of the above embodiment, the judgment module 405 is specifically used for:

Determine whether the domain name resolution log includes log information corresponding to the attack payload;

Wherein, if the domain name resolution log includes log information corresponding to the attack payload, there is a loophole in the target detection request; if the domain name resolution log does not include log information corresponding to the attack payload, then There is no loophole in the target detection request.

On the basis of the above embodiment, the device further includes an access request generation module:

Obtain the real-time traffic from user access of the server to be detected;

The real-time traffic is processed according to the type of the accessed interface and the requirements of the protocol format, and an interface access request that meets the requirements of the protocol format is obtained.

On the basis of the above embodiment, the access request generation module is specifically used for:

Format the real-time traffic according to the requirements of the protocol format, and generate a standard access request that meets the requirements of the protocol format;

Classify and combine the standard access requests according to the interface types, and obtain interface access requests corresponding to the interface types.

On the basis of the above embodiment, the device further includes an authentication module for:

acquiring a preconfigured authentication information pool, where the authentication information pool includes authentication information corresponding to the target detection request;

The authentication information is obtained from the authentication information pool and added to the target detection request, so as to realize the authentication of the target detection request by the to-be-detected server.

On the basis of the above embodiment, the device further includes a marking module for:

A marker parameter is added to the target detection request, where the marker parameter is used to distinguish that the target detection request comes from the real-time traffic or the test traffic.

FIG. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application. As shown in FIG. 5 , the electronic device includes: a processor (processor) 501, a memory (memory) 502, and a bus 503; wherein,

The processor 501 and the memory 502 complete the mutual interaction through the bus 503;

The processor 501 is configured to call program instructions in the memory 502 to execute the vulnerability detection methods provided by the above method embodiments.

The processor 501 may be an integrated circuit chip with signal processing capability. The aforementioned processor 501 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute various methods, steps and logic block diagrams disclosed in the embodiments of this application. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 502 may include, but is not limited to, random access memory (Random Acc·ess Memory, RAM), read only memory (Read Only Memory, ROM), programmable read only memory (Programmable Read-Only Memory, PROM), and erasable only memory. Read memory (Erasable Programmable Read-Only Memory, EPROM), Electrically Erasable Programmable Read-Only Memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), etc.

This embodiment discloses a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the above-mentioned program instructions. The vulnerability detection method provided by each method embodiment.

This embodiment provides a computer-readable storage medium, where the computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the vulnerability detection methods provided by the foregoing method embodiments.

In the embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or interactive connection may be through some interactive interfaces, indirect coupling or interactive connection of devices or units, and may be in electrical, mechanical or other forms.

In addition, units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

Furthermore, each functional module in each embodiment of the present application may be integrated together to form an independent part, or each module may exist alone, or two or more modules may be integrated to form an independent part.

In this document, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such existence between these entities or operations. The actual relationship or sequence.

The above descriptions are merely examples of the present application, and are not intended to limit the protection scope of the present application. For those skilled in the art, various modifications and changes may be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims (10)

1. a vulnerability detection method, is characterized in that, comprises: Obtain the interface access request of the server to be detected, where the interface access request includes multiple request parameters; determining a risk parameter among the plurality of request parameters in the interface access request; Replace the risk parameter in the interface access request with a preset attack load to obtain a target detection request, where the attack load is an address pointing to the domain name resolution system; sending the target detection request to the to-be-detected server; Monitor the domain name resolution log generated on the domain name resolution system, and determine whether there is a loophole in the target detection request according to the domain name resolution log. 2. The method according to claim 1, wherein the determining the risk parameter among the plurality of the request parameters in the interface access request comprises: Matching multiple request parameters in the interface access request with preset address feature values respectively; If the match is successful, the corresponding request parameter is determined as the risk parameter. 3. The method according to claim 1, wherein the risk parameter in the interface access request includes a plurality of risk parameters, and the risk parameter in the interface access request is replaced with a preset attack load to obtain the target Inspection requests, including: The multiple risk parameters in the interface access request are respectively replaced with different preset attack payloads, and a target detection request corresponding to the risk parameters is obtained. 4. The method according to claim 1, wherein the determining whether the target detection request has a loophole according to the domain name resolution log comprises: Determine whether the domain name resolution log includes log information corresponding to the attack payload; Wherein, if the domain name resolution log includes log information corresponding to the attack payload, there is a loophole in the target detection request; if the domain name resolution log does not include log information corresponding to the attack payload, then There is no loophole in the target detection request. 5. The method according to claim 1, wherein the obtaining the interface access request of the server to be detected comprises: Obtain the real-time traffic from user access of the server to be detected; The real-time traffic is processed according to the type of the accessed interface and the requirements of the protocol format, and an interface access request that meets the requirements of the protocol format is obtained. 6. The method according to claim 5, wherein, the real-time traffic is processed according to the interface type of access and the protocol format requirements, and the interface access request that meets the protocol format requirements is obtained, comprising: Format the real-time traffic according to the requirements of the protocol format, and generate a standard access request that meets the requirements of the protocol format; Classify and combine the standard access requests according to the interface types, and obtain interface access requests corresponding to the interface types. 7. The method according to any one of claims 1-6, wherein after obtaining the target detection request, the method further comprises: acquiring a preconfigured authentication information pool, where the authentication information pool includes authentication information corresponding to the target detection request; The authentication information is obtained from the authentication information pool and added to the target detection request, so as to realize the authentication of the target detection request by the to-be-detected server. 8. A vulnerability detection device, characterized in that, comprising: an acquisition module, configured to acquire an interface access request of the server to be detected, where the interface access request includes a plurality of request parameters; a risk parameter determination module, configured to determine a risk parameter among a plurality of the request parameters in the interface access request; a request generation module, configured to replace the risk parameter in the interface access request with a preset attack load to obtain a target detection request, where the attack load is an address pointing to a domain name resolution system; a sending module, configured to send the target detection request to the to-be-detected server; The judgment module is configured to monitor the domain name resolution log generated on the domain name resolution system, and judge whether the target detection request has loopholes according to the domain name resolution log. 9. An electronic device, comprising: a processor, a memory and a bus, wherein, The processor and the memory communicate with each other through the bus; The memory stores program instructions executable by the processor, and the processor invokes the program instructions to be able to perform the method of any one of claims 1-7. 10. A computer-readable storage medium, characterized in that, the computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a computer, the computer is caused to execute the method according to any one of claims 1-7. Methods.

Images