WO2017008581A1 - 应用程序的测试方法、客户端及系统 - Google Patents

应用程序的测试方法、客户端及系统 Download PDF

Info

Publication number
WO2017008581A1
WO2017008581A1 PCT/CN2016/083106 CN2016083106W WO2017008581A1 WO 2017008581 A1 WO2017008581 A1 WO 2017008581A1 CN 2016083106 W CN2016083106 W CN 2016083106W WO 2017008581 A1 WO2017008581 A1 WO 2017008581A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
application
test
tested application
tested
Prior art date
Application number
PCT/CN2016/083106
Other languages
English (en)
French (fr)
Inventor
王金锭
高岳
邵樊
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to EP16823728.7A priority Critical patent/EP3324325B1/en
Publication of WO2017008581A1 publication Critical patent/WO2017008581A1/zh
Priority to US15/801,934 priority patent/US10915637B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G06F16/986—Document structures and storage, e.g. HTML extensions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115—Third party

Definitions

  • the present application relates to the field of testing of computer systems, and in particular, to a testing method, client and system for an application.
  • an Android client can access a remote service in two ways: one is the same as the traditional PC client, and the browser provided by the Android client (which can be the browser of the Android client or a third-party browser) To access the remote service; the second is that the Android client application (APP) can also access the remote service through its embedded browser component, which is also known as the APP with built-in browser component.
  • the second method is more commonly used, such as mobile QQ, WeChat, Weibo and other APP access to the remote service through its built-in browser component.
  • the application example provides a testing method of an application, wherein the tested application is a browser or an application of a built-in browser component, and a webpage file is pre-created, which includes the measured content for simulating malicious attack behavior.
  • An application executable code the method is applied to a test client, and when the test is performed, the method includes: the test client attempts to provide a link address of the webpage file to the tested application, so as to When the test application loads the webpage file through the link address, attempting to read the content of the private file under the private directory of the tested application by executing the code included in the webpage file; And acquiring, by the local terminal device, a message carrying the content of the privacy file to a test server, so that the test server is based on the message from the tested application. Determine if the tested application has a security vulnerability.
  • the application example further provides a test client of the application, wherein the tested application is a browser or an application of a built-in browser component, and the test client at least includes: an address providing module, configured to try to a link address of the webpage file is provided to the tested application, the webpage file being pre-created, the code of the tested application executable to simulate a malicious attack behavior, to enable the measured application Program when passed
  • an address providing module configured to try to a link address of the webpage file is provided to the tested application, the webpage file being pre-created
  • the code of the tested application executable to simulate a malicious attack behavior, to enable the measured application Program when passed
  • the link address loads the webpage file, attempting to read the content of the private file under the private directory of the tested application by executing the code included in the webpage file; if the content of the privacy file is read,
  • the test application sends a message carrying the content of the privacy file to the test server by using the local terminal device, so that the test server determines whether the tested application exists according to a message from
  • the application example further provides an application testing system for testing at least one tested application, the tested application being a browser or an application of a built-in browser component; the testing system including at least a test client and a test server, wherein: each test client is configured to attempt to provide a link address of a webpage file to any one of the at least one tested application, the webpage file being pre-created, It includes code executable by the tested application for simulating a malicious attack behavior; wherein each of the tested applications, when loading the webpage file through the link address, performs execution of the webpage file by executing Describe the code to try to read the content of the privacy file in the private directory of the tested application; if the content of the private file is read, the tested application sends the content carrying the private file through the local terminal device.
  • the test server for receiving from the at least one application under test Sequence according to any one of the application under test message to determine whether there are security vulnerabilities.
  • test methods, clients and systems provided by the examples of the present application can provide dynamic automated testing, thereby improving test efficiency and accuracy.
  • FIG. 1 is a schematic diagram of an implementation environment involved in an example of the present application.
  • FIG. 2 is a schematic flow chart of a testing method according to an example of the present application.
  • FIG. 3 is a schematic diagram of a test method for simulating a local call attack provided by an example of the present application
  • FIG. 4 is a schematic diagram of a test method for simulating a remote transmission attack provided by an example of the present application
  • FIG. 5 is a schematic diagram of a test method for simulating a man-in-the-middle interception attack provided by an example of the present application
  • FIG. 6 is a schematic structural diagram of an apparatus for testing a client according to an example of the present application.
  • FIG. 7 is a schematic structural diagram of a test system according to an example of the present application.
  • FIG. 1 is a schematic diagram of an implementation environment involved in an example of the present application.
  • the test system includes: an APP 101 to be tested, a test client 102, and a test server 103.
  • the system client where the tested APP 101 is located may be a mobile terminal-based client such as an Android client or an iOS client, or may be a PC client such as Windows, and the tested APP 101 may be a browsing function of the system client. It can also be an APP with a built-in browser component installed in the system client.
  • the tested APP 101 and the test client 102 may be located in the same physical entity, or may be connected through a network, and the test client 102 is configured to provide a malicious webpage for the tested APP 101.
  • the address of the file is linked to simulate a malicious attack on the tested APP 101.
  • the feedback message generated by the tested APP 101 after being maliciously attacked is sent to the test server 103, and the test server 103 determines the test by parsing the received feedback message. As a result, it may include determining whether the tested APP 101 is capable of defending against malicious attacks (ie, whether there is a security vulnerability), what security holes are there, and the like.
  • test server 103 can perform remote communication with the tested APP 101 through the network, and can also perform local communication with the tested APP 101.
  • Test server 104 can also communicate remotely or locally with test client 102 over a network. This application does not limit this.
  • the tested APP 101, test client 102, and test server 103 described above may be implemented in software or hardware, and they may be located in the same or different physical entities, any of which may be located in any device having data computing processing functions. , including but not limited to desktop computers, smart phones, PDAs, tablets, and more.
  • test method flowchart is used to describe the test method provided by the example of the present application. As shown in FIG. 2, the test method includes the following steps:
  • Step 201 Pre-create a webpage file containing code for simulating malicious attack behavior, and the webpage file may also be referred to as a malicious webpage file.
  • the webpage file may be a Hypertext Markup Language (HTML) file, and the code contained therein is program code executable by a browser or a browser component.
  • HTML Hypertext Markup Language
  • Step 202 When testing a tested application 101, the test client 102 provides the link address (eg, URL) of the webpage file created in step 201 to the tested application 101.
  • the link address eg, URL
  • the test client 102 can provide the link address of the webpage file to the tested application 101 by means of local calling; if the tested application 101 is testing the client The far end of the end 102, the test guest The client 102 needs to remotely send the link address of the webpage file to the application under test 101 via the network.
  • the tested application 101 is located in a terminal device and is an application installed by the Android client of the terminal device.
  • the test client 102 is also located in the terminal device, which is a malicious installation of the Android client. software.
  • the test client 102 can attempt to call the tested application 101 and transmit the link address of the webpage file to the tested application 101 through an internal communication message of the operating system, such as an intent message of the Android platform. If the test client 102 successfully invokes the application under test 101 via an internal communication message such as an intent message, the link address of the web page file can be passed to the application under test 101 via the internal communication message.
  • some applications may have some security defense measures. Therefore, the tested application 101 may not be successfully invoked by the test client 102. At this time, the link address of the webpage file cannot be successfully transmitted to the tested.
  • the application 101, and in turn, the application 101 under test cannot steal private files under the specified directory address.
  • Step 203 When the test application 101 loads the webpage file by using the link address, the test application 101 attempts to read the private directory of the tested application 101 by executing the code of the simulated malicious attack included in the webpage file. The content of the privacy document. If the content of the privacy file is read, the test application 101 sends a message carrying the content of the privacy file to the test server 103, so that the test server 103 determines whether the tested application 101 has a security vulnerability according to the received message. . Wherein, if the tested application 101 is located at the remote end of the test server 103, the tested application 101 can send a message to the test server 103 through the terminal device and the network where it is located.
  • the tested application 101 may not read the content of the above privacy file. At this time, the tested application 101 may also send an indication that it is not read. Message to the contents of the privacy file to the test server 103. After receiving the message from the tested application 101, the test server 103 may analyze the message (eg, identify the indication information carried therein and/or perform feature matching on the content carried therein) to determine whether the tested application 101 is If the content of the privacy file is read (that is, whether the malicious attack is successful), if the content of the privacy file can be read, the tested application 101 has a security vulnerability.
  • the test server 103 may analyze the message (eg, identify the indication information carried therein and/or perform feature matching on the content carried therein) to determine whether the tested application 101 is If the content of the privacy file is read (that is, whether the malicious attack is successful), if the content of the privacy file can be read, the tested application 101 has a security vulnerability.
  • dynamic automatic testing can be implemented while the application under test is running, without manual intervention, which can significantly improve test efficiency and accuracy.
  • the code for the web page file above can be used to simulate a more cryptic attack behavior.
  • the tested application 101 loads the webpage file through the link address of the webpage file
  • the tested application 101 displays a preset page by executing the code of the webpage file and delays responding to the predetermined time.
  • a preset page is displayed, which can make the user of the tested application not aware that the page file is attacking, and thus cannot take defense in time. Measures.
  • the tested application 101 attempts to read the contents of the private file under its private directory upon execution of the predetermined time by executing the code of the webpage file.
  • the test method provided by the example of the present application can simulate a variety of malicious attack behaviors, including: local call attack, remote send attack, and man-in-the-middle interception attack, etc., thereby performing various tests on the defense capability of the tested application.
  • the figure details the test methods that simulate these three types of malicious attacks.
  • test client 102 is located in the local terminal device of the application under test (test APP) 101, which can simulate the attack behavior of the malware installed locally by the tested APP 101; the above webpage file is created at the local terminal.
  • the device is tested in the private directory of the client 102, and its attributes are set to be readable and writable by the third party, so that the tested APP 101 can load the web page file.
  • the test method for simulating a local call attack includes the following steps:
  • Step 301 A malicious html file P1 is pre-created, and the html file P1 includes code for simulating a local call attack, and the html file P1 is stored in the private directory of the test client 102 in the local terminal device.
  • Step 302 The test client 102 attempts to call the tested APP 101 through the internal communication message of the operating system of the operating system and transmits the link address of the html file P1 (that is, the private directory address of the test client 102 stored in the html file P1). .
  • the tested APP 101 can be attempted to be invoked through the intent message of the Android platform; if the tested APP 101 is a browser, the call is The browser interface of the APP 101 is tested, and if the APP 101 to be tested is an APP with a built-in browser component, the browser component interface of the tested APP 101 is called.
  • the test client 102 can forward the link address of the APP 101 to be tested through a local call, and the URL can be prefixed with "file://", such as "file:///data/data/com.example.test /P1" (At this time, the above html file P1 is stored under the directory address "/data/data/com.example.test") "file:///data/data/com.tencent.mobileqq/aaa.html (At this time, the above html file P1 is stored under the directory address "/data/data/com.tencent.mobileqq") and the like.
  • Step 303 If the tested APP 101 is successfully called and is transferred to the link address of the html file P1, the tested APP 101 accesses the locally stored html file P1 through the link address and loads the html file P1, thereby starting execution. The code in the html file P1.
  • the step 304 is performed: when the test client 102 successfully calls the tested APP 101 and passes the link address of the html file P1, the html file P1 stored locally is deleted.
  • the soft link of the privacy file P2 in the private directory of the tested APP 101 to the html file P1 is attempted by the operating system command and the link address of the html file P1 set in advance, and the html file P1 is redirected to the privacy file P2.
  • the test client 102 and the tested APP are installed on the Android client, the above soft link can be attempted through the Linux soft link command (In-s).
  • step 305 is performed: after the test client 102 successfully establishes the above soft link, the tested APP 101 attempts to read the content of the privacy file P2 through the soft link by executing the code in the html file P1.
  • the tested APP 101 has learned the link address of the html file P1, and at the same time has established the soft link of the privacy file P2 to the html file P1 in step 304, when the file is loaded through the link address, the tested APP 101 actually The privacy file P2 is loaded through the soft link, and the content of the privacy file P2 can be attempted to be read.
  • step 303 after the tested APP 101 accesses the locally stored html file P1 through the link address and loads the html file P1 for the first time, the method further includes: the tested APP 101 is executed by executing the html file P1.
  • the code shows a preset page and delays responding to the preset time.
  • the style of the preset page can be set arbitrarily, in order to simulate a more secret attack so that the user is unaware that the tested APP 101 is maliciously attacked.
  • the test client 102 performs the above-described step 304 to attempt to establish the above soft link.
  • step 305 the tested APP 101 passes the above code again by executing the code in the html file P1.
  • the link address loads the file.
  • the tested APP 101 actually loads the privacy file P2 through the soft link, and can then attempt to read the content of the privacy file P2.
  • step 304 when the test client 102 attempts to establish a soft link of the privacy file P2 in the private directory of the tested APP 101 to the html file P1, the test client 102 is based on the directory address of the preset privacy file P2 and the The link address of the html file P1 is used to try to establish a soft link.
  • the directory address of the privacy file can be determined, and the directory address of the privacy file can be preset in the test client 102.
  • the privacy file is usually a document that saves data in the APP 101 directory under test, such as a DB data file; for the tested APP installed in the Android client, the directory address of the privacy file can be predetermined, for example: To facilitate the unified test operation, you can use the directory address of the hosts file "/data/data/tested APP directory/../../../hosts" as the private directory address of the privacy file specified during the test.
  • Step 306 After the tested APP 101 successfully reads the content of the privacy file P2, send a message carrying the content of the privacy file P2 to the test server 103. Further, if the tested APP 101 does not successfully read the content of the privacy file P2, it may also send a message to the test server 103, which may indicate that it has not read the content of the privacy file P2. Here, if any of the above steps 302-305 is not successfully executed, the tested APP 101 fails to successfully read the content of the privacy file P2.
  • Step 307 The test server 103 receives the message from the tested APP 101, and determines whether the tested APP 101 reads the content of the privacy file P2 by analyzing the message, thereby determining whether the tested APP 101 has a security vulnerability.
  • the test server 103 can parse the received message content, perform feature matching and the like on the message content, and if the privacy data (user account, password, chat record, bank account number, transaction record, etc.) is parsed from the message, It indicates that the tested APP 101 reads the content of the privacy file P2, which cannot defend against this.
  • the tested APP 101 has a security vulnerability; if an indication indicating that the content of the privacy file P2 is not read is obtained from the message, it indicates that the local calling attack simulated by the test method fails to steal successfully.
  • the APP 101's private data is measured, and the tested APP 101 can defend against such malicious attacks, and the tested APP 101 does not have a security vulnerability.
  • the test client 102 is located at the remote terminal device of the APP 101 under test, which can simulate the attack behavior of the remote malware of the tested APP 101; the above webpage file is created in any site device in the network.
  • the site device may be any remote network device accessible by the local terminal device where the tested APP 101 is located.
  • the test method for simulating a remote transmission attack includes the following steps:
  • Step 401 Create a malicious html file P1 in advance, the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 is stored in any site device in the network.
  • Step 402 The test client 102 sends the link address of the html file P1 to the tested APP 101 through the network.
  • Step 403 If the tested APP 101 successfully receives the link address of the html file P1, the tested APP 101 accesses the html file P1 stored in the site device through the link address and loads the html file P1, thereby starting to execute the html file. The code in P1.
  • Step 404 The tested APP 101 attempts to read the content of the privacy file P2 by executing the code in the html file P1 and attempting to load the privacy file P2 according to the private directory address included in the html file P1.
  • step 403 after the tested APP 101 first loads the html file P1 through the link address, the method further includes: the tested APP 101 displays a preset page and delays by executing the code in the html file P1. Respond to the preset time. Delayed When the preset time is reached, the above step 404 is performed.
  • the tested APP 101 displays a preset page and delays by executing the code in the html file P1. Respond to the preset time. Delayed When the preset time is reached, the above step 404 is performed.
  • a more malicious malicious attack can be simulated, so that the user does not realize that the html file P1 is attacking when the html file P1 is first loaded.
  • Step 405 After the tested APP 101 successfully reads the content of the privacy file P2, send a message carrying the content of the privacy file P2 to the test server 103. Further, if the tested APP 101 does not successfully read the content of the privacy file P2, it may also send a message to the test server 103, which may indicate that it has not read the content of the privacy file P2. Here, if any of the above steps 402-404 is not successfully executed, the tested APP 101 fails to successfully read the content of the privacy file P2.
  • Step 406 The test server 103 receives the message from the tested APP 101, and determines whether the tested APP 101 reads the content of the privacy file P2 by analyzing the message, thereby determining whether the tested APP 101 has a security vulnerability.
  • the test client 102 is located at the remote terminal device of the APP 101 under test, which can simulate the attack behavior of the remote malware of the tested APP 101; the above webpage file is created in any site device in the network.
  • the site device may be any remote network device accessible by the local terminal device where the tested APP 101 is located.
  • the test method for simulating a man-in-the-middle interception attack includes the following steps:
  • Step 501 Create a malicious html file P1 in advance, the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 includes a code for simulating a remote sending attack, and further includes a private directory address of the tested APP 101 for storing the privacy file P2, and the html file P1 is stored.
  • the html file P1 is stored in any site device in the network.
  • Step 502 The test client 102 intercepts the data packet sent by the tested APP 101 from the network, generates a response packet (or a response message) corresponding to the data packet, and carries the link address of the html file P1 in the response. In the packet, the response packet is sent to the tested APP 101.
  • Step 503 If the tested APP 101 successfully receives the response packet carrying the link address of the html file P1, the tested APP 101 extracts the link address of the html file P1 in the response packet, and accesses the site device through the link address.
  • the html file P1 stored in the html file P1 is loaded, and the code in the html file P1 is started to be executed.
  • Step 504 The APP to be tested 101 attempts to read the content of the privacy file P2 by executing the code in the html file P1 and attempting to load the privacy file P2 according to the above-mentioned private directory address included in the html file P1.
  • step 503 after the tested APP 101 first loads the html file P1 through the link address, the method further includes: the tested APP 101 displays a preset page and delays by executing the code in the html file P1. Respond to the preset time. When the preset time of the delayed response arrives, the above step 504 is performed.
  • the tested APP 101 displays a preset page and delays by executing the code in the html file P1. Respond to the preset time.
  • the above step 504 is performed.
  • a more malicious malicious attack can be simulated, so that the user does not realize that the html file P1 is attacking when the html file P1 is first loaded.
  • Step 505 After the tested APP 101 successfully reads the content of the privacy file P2, send a message carrying the content of the privacy file P2 to the test server 103. Further, if the tested APP 101 does not successfully read the content of the privacy file P2, it may also send a message to the test server 103, which may indicate that it has not read the content of the privacy file P2. Here, if any of the above steps 502-504 is not successfully executed, the tested APP 101 fails to successfully read the content of the privacy file P2.
  • Step 506 The test server 103 receives the message from the tested APP 101 and passes the cancellation.
  • the analysis of the interest determines whether the tested APP 101 reads the content of the privacy file P2, thereby determining whether the tested APP 101 has a security vulnerability.
  • the above examples of the application can simulate various attack behaviors, and thus can comprehensively test the tested application.
  • the application example further provides a test client of the application.
  • the test client 600 includes at least:
  • An address providing module 601 configured to try to provide a link address of a webpage file to a test application, the webpage file being pre-created, which contains code executable by the tested application for simulating a malicious attack behavior, In order to enable the tested application to load the webpage file through the link address, attempt to read the content of the private file in the private directory of the tested application by executing the above code included in the webpage file; The content of the privacy file, the test application sends a message carrying the content of the privacy file to the test server through the local terminal device, so that the test server determines whether the tested application is based on a message from the tested application. There is a security hole.
  • the provided test method can simulate a local call attack.
  • the test client 600 is located at the local terminal device of the tested application, and the test client 600 further includes: a storage module 603 for testing the client.
  • the webpage file is stored in the private directory of the 600, wherein the attribute of the webpage file is set to be readable and writable by a third party and executable; at this time, the address providing module 601 is configured to attempt to call the measured by the internal communication message of the operating system.
  • the application passes the link address of the web page file to the application under test.
  • the test client 600 further includes: a soft link establishing module 602, configured to delete the foregoing webpage saved by the storage module 603 in the private directory of the test client 600 when the tested application loads the webpage file by the incoming link address. File, and establish a soft link of the privacy file to the link address of the web file according to the private directory address and operating system command of the privacy file of the tested application, so that the tested application executes the above code in the webpage file To try to read the contents of the privacy file through the soft link.
  • a soft link establishing module 602 configured to delete the foregoing webpage saved by the storage module 603 in the private directory of the test client 600 when the tested application loads the webpage file by the incoming link address.
  • File and establish a soft link of the privacy file to the link address of the web file according to the private directory address and operating system command of the privacy file of the tested application, so that the tested application executes the above code in the webpage file To try to read the contents of the privacy file through the soft link.
  • the tested application when the tested application first loads the webpage file by using the incoming link address, the tested application may further display a preset page and delay response to the predetermined request by executing the code. Time, loading the above link address when the predetermined time arrives, and attempting to load the above privacy file to read the content through the above soft link when loading the link address.
  • the soft link establishing module 602 is configured to delete the webpage file saved in the private directory of the test client 600 in the storage module 603 and establish the soft link in the predetermined time.
  • the provided test method can simulate a remote sending attack or a middleman interception attack.
  • the test client 600 is located at a remote terminal device of the tested application; the webpage file contains the above privacy of the tested application.
  • the address providing module 601 is configured to try to send the link address of the webpage file to the tested application when simulating the remote sending attack, or try to intercept the data sent by the tested application when the simulated middleman intercepts the attack. And generating a response packet corresponding to the intercepted data packet, carrying a link address of the webpage file in the response packet, and then attempting to send the response packet to the tested application.
  • the tested application program can attempt to read the content of the private file according to the private directory address included in the webpage file by executing the above code in the webpage file.
  • each module in each example of the present application may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the test client 600 can include a memory 610, a processor 611, a bus 612, and a port 613.
  • Processor 611 and memory 610 are interconnected by a bus 612.
  • the processor 611 can receive and transmit data through the port 613 to implement network communication.
  • Each of the above modules 601-603 may be machine executable instruction modules stored in memory 610.
  • the processor 611 can implement the functions of the above-described modules 601 to 603 by executing the machine executable instructions included in the respective modules 601 to 603 in the memory 610.
  • the address providing module 601 provides the link address of the webpage file to the tested application in the remote device
  • the processor 611 can send the link address to the port 613 by executing an instruction in the address providing module 601 in the memory 610.
  • the measured application of the remote device, or the data packet sent by the tested application of the remote device is intercepted, and the response packet carrying the link address of the webpage file is sent to the tested application of the remote device through the port 613.
  • the application example also provides a test system for an application.
  • the test system 700 includes a test client 701 and a test server 702.
  • the test application tested by the test system 700 is an application of a browser or a built-in browser component.
  • the test client 701 is configured to attempt to provide a link address of a webpage file to the application under test, the webpage file being pre-created, which contains code executable by the tested application for simulating malicious attack behavior.
  • the tested application When the web application file is loaded by the link address, the tested application attempts to read the content of the private file in the private directory of the tested application by executing the above code included in the webpage file; if the private file is read Content, the test application sends a message carrying the content of the privacy file to the test server 702 through the local terminal device.
  • the test server 702 is configured to determine whether the tested application has a security vulnerability according to a message from the tested application.
  • test client 701, test server 702 during the testing process are detailed in the foregoing examples, and are not described herein again.
  • test system 700 can implement batch testing of multiple applications under test, The specific test method for each application under test is the same as described above.
  • the test system 700 can include a plurality of test clients 701, wherein each test client 701 attempts to provide the link address of the above webpage file to any of the tested applications, and each tested application is tested according to the test.
  • the link address provided by the client 701 attempts to read the contents of the privacy file and sends a message to the test server 702.
  • the test server 702 determines whether each of the tested applications has a vulnerability according to the messages from the respective tested applications. In this way, the test system 700 can utilize these test clients 701 to perform automated tests on multiple tested applications in parallel, which can further improve test efficiency.
  • a plurality of test clients 701 can be located in a plurality of hardware devices.
  • each instance of the present application can be implemented by a data processing program executed by a data processing device such as a computer.
  • the data processing program constitutes the present application.
  • a data processing program usually stored in a storage medium is executed by directly reading a program out of a storage medium or by installing or copying the program to a storage device (such as a hard disk and or a memory) of the data processing device. Therefore, such a storage medium also constitutes the present application.
  • the storage medium can use any type of recording method, such as paper storage medium (such as paper tape, etc.), magnetic storage medium (such as floppy disk, hard disk, flash memory, etc.), optical storage medium (such as CD-ROM, etc.), magneto-optical storage medium ( Such as MO, etc.).
  • the present application also discloses a storage medium in which is stored a data processing program for performing any of the above examples of the methods of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本申请公开了一种应用程序的测试方法、客户端及系统。其中，被测应用程序为浏览器或者内置浏览器组件的应用程序，预先创建一网页文件，其包含用于模拟恶意攻击行为的被测应用程序可执行的代码；当进行测试时，该方法包括：测试客户端尝试将网页文件的链接地址提供给被测应用程序，以使被测应用程序当通过链接地址加载网页文件时，通过执行网页文件包含的代码来尝试读取其私有目录下隐私文件的内容；如果读取到隐私文件的内容，则发送携带隐私文件的内容的消息至测试服务器，以使测试服务器根据来自被测应用程序的消息确定被测应用程序是否存在安全漏洞。本申请还公开相应的测试客户端和测试系统。利用这些技术方案，能够提升测试效率和准确度。

Description

应用程序的测试方法、客户端及系统
本申请要求于2015年07月14日提交中国专利局、申请号为201510412588.6、发明名称为“应用程序的测试方法、客户端及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机系统的测试领域，尤其涉及一种应用程序的测试方法、客户端及系统。
发明背景
传统的个人计算机(PC)客户端通过浏览器(Browser)浏览和访问远端提供的服务，如新闻资讯、搜索、社交等服务，安卓(Android)客户端、iOS客户端等基于移动终端的客户端也不例外。比如，Android客户端访问远端服务通常有两种方式：一是与传统PC客户端相同，通过Android客户端提供的浏览器(可以是Android客户端自带的浏览器或者是第三方浏览器)来访问远端服务；二是Android客户端的应用程序(APP)还可以通过自身内嵌的浏览器组件访问远端服务，这种APP也被称为内置有浏览器组件的APP。目前，第二种方式被更普遍地使用，如手机QQ、微信、微博等APP都是通过其内置浏览器组件访问远端服务的。
如今，基于移动终端的APP(如Android客户端的APP)以极快的速度增长，各分类领域的APP层出不穷。不规范的管理和准入规则导致APP的安全面临很大的挑战。尤其是对基于开放式操作系统平台的APP而言，如Android客户端的各种APP，浏览器安全问题显得尤为突出。有不少APP的浏览器安全漏洞会对用户的隐私数据造成严重威胁，这些 用户隐私数据可能会被本地安装的恶意软件窃取，甚至可能被远端的恶意第三方软件控制和利用。例如，本地恶意软件或者远端的第三方软件可以对一浏览器或者内置于一APP的浏览器组件进行恶意攻击，使其加载恶意网页文件，进而窃取到该浏览器或者该APP的隐私文件的内容(如用户帐号、聊天记录、交易记录等)。
发明内容
本申请实例提供了一种应用程序的测试方法，其中，被测应用程序为浏览器或者内置浏览器组件的应用程序，预先创建一网页文件，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码；该方法应用于测试客户端，当进行测试时，该方法包括：所述测试客户端尝试将所述网页文件的链接地址提供给所述被测应用程序，以使所述被测应用程序当通过所述链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码来尝试读取所述被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则所述被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至测试服务器，以使所述测试服务器根据来自所述被测应用程序的消息确定所述被测应用程序是否存在安全漏洞。
本申请实例还提供了一种应用程序的测试客户端，其中，被测应用程序为浏览器或者内置浏览器组件的应用程序，所述测试客户端至少包括：地址提供模块，用于尝试将一网页文件的链接地址提供给所述被测应用程序，所述网页文件为预先创建的，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码，以使所述被测应用程序当通过所述 链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码来尝试读取所述被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则所述被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至测试服务器，以使所述测试服务器根据来自所述被测应用程序的消息确定所述被测应用程序是否存在安全漏洞。
本申请实例进一步提供了一种应用程序的测试系统，用于对至少一个被测应用程序进行测试，所述被测应用程序为浏览器或者内置浏览器组件的应用程序；所述测试系统包括至少一个测试客户端和测试服务器，其中：每一测试客户端用于尝试将一网页文件的链接地址提供给所述至少一个被测应用程序中的任一者，所述网页文件为预先创建的，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码；其中，每一被测应用程序当通过所述链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码来尝试读取该被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则该被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至所述测试服务器；所述测试服务器，用于根据来自所述至少一个被测应用程序中任一者的消息确定该被测应用程序是否存在安全漏洞。
本申请实例所提供的上述测试方法、客户端及系统能提供动态的自动化测试，进而能提高测试效率及准确度。
附图简要说明
为了更清楚的说明本申请实例中的技术方案，下面将对实例描述中所需要使用的附图作简单的介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实例，对于本领域普通技术人员来说，在不付出创造性 劳动的前提下，还可以根据这些附图获得其它的附图。其中，
图1为本申请实例所涉及的实施环境示意图；
图2为依据本申请一实例的测试方法的流程示意图；
图3为本申请一实例所提供的模拟本地调用攻击的测试方法示意图；
图4为本申请一实例所提供的模拟远程发送攻击的测试方法示意图；
图5为本申请一实例所提供的模拟中间人截获攻击的测试方法示意图；
图6为依据本申请一实例的测试客户端的装置结构示意图；
图7为依据本申请一实例的测试系统的结构示意图。
实施本发明的方式
下面将结合本申请实例中的附图，对本申请实例中的技术方案进行清楚、完整地描述，显然，所描述的实例是本申请一部分实例，而不是全部的实例。基于本申请中的实例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实例，都属于本申请保护的范围。
图1为本申请实例所涉及的实施环境示意图。参见图1，该测试系统包括：被测APP 101、测试客户端102和测试服务器103。其中，被测APP 101所在的系统客户端可以是Android客户端、iOS客户端等基于移动终端的客户端，也可以是Windows等PC客户端，被测APP 101可以是系统客户端自带的浏览器，也可以是系统客户端中安装的一内置有浏览器组件的APP。
此外，被测APP 101与测试客户端102可以位于同一物理实体，也可以通过网络连接，测试客户端102用于为被测APP 101提供恶意网页 文件的地址链接，以便模拟对被测APP 101的恶意攻击，被测APP 101受到恶意攻击后所产生的反馈消息会发送给测试服务器103，测试服务器103通过解析所收到的反馈消息来确定测试结果，可以包括：确定被测APP 101是否能够抵御恶意攻击(即是否具有安全漏洞)以及具有何种安全漏洞等等。
本申请实例中，测试服务器103可以通过网络和被测APP 101进行远程通信，也可以和被测APP 101进行本地通信。测试服务器104也可以和测试客户端102通过网络进行远程通信或者进行本地通信。本申请对此不作限定。
上述的被测APP 101、测试客户端102和测试服务器103可以为软件或硬件实现，它们可以位于相同或不同的物理实体中，它们中的任一者可以位于任一具有数据计算处理功能的设备，包括但不限于台式计算机、智能手机、掌上电脑、平板电脑等。
基于上述实施环境，以下结合方法流程图对本申请实例提供的测试方法加以详述。如图2所示，该测试方法包括如下步骤：
步骤201：预先创建一网页文件，其包含用于模拟恶意攻击行为的代码，此网页文件也可称为恶意网页文件。这里，该网页文件可以是超级文本标记语言(HTML，Hypertext Markup Language)文件，其中包含的代码是浏览器或浏览器组件可执行的程序代码。
步骤202：当对一被测应用程序101进行测试时，测试客户端102将步骤201所创建的网页文件的链接地址(如：URL)提供给该被测应用程序101。
这里，如果被测应用程序101在测试客户端102的本地，则测试客户端102可通过本地调用的方式将网页文件的链接地址提供给被测应用程序101；如果被测应用程序101在测试客户端102的远端，则测试客 户端102需要通过网络远程发送该网页文件的链接地址给被测应用程序101。
在一个实例中，被测应用程序101位于一终端设备，是该终端设备的Android客户端所安装的一个应用程序，测试客户端102也位于该终端设备，是该Android客户端所安装的一个恶意软件。此时，测试客户端102可通过操作系统的内部通信消息，如Android平台的意图(intent)消息，尝试调用被测应用程序101并将该网页文件的链接地址传入被测应用程序101。如果测试客户端102通过诸如intent消息这种操作系统的内部通信消息成功调用了被测应用程序101，则该网页文件的链接地址可通过该内部通信消息被传入被测应用程序101。这里，某些应用程序而言可能具有一些安全防御措施，因此，被测应用程序101有可能不会被测试客户端102成功调用，此时，网页文件的链接地址就不能被成功传入被测应用程序101，进而被测应用程序101无法窃取到指定目录地址下的隐私文件。
步骤203：当被测应用程序101通过上述链接地址加载上述网页文件时，被测应用程序101通过执行该网页文件包含的上述模拟恶意攻击的代码来尝试读取被测应用程序101的私有目录下隐私文件的内容。如果读取到该隐私文件的内容，则被测应用程序101发送携带该隐私文件的内容的消息至测试服务器103，以使测试服务器103根据接收到的消息确定被测应用程序101是否存在安全漏洞。其中，如被测应用程序101位于测试服务器103的远端，则被测应用程序101可通过自身所在的终端设备及网络发送消息至测试服务器103。
这里，某些应用程序而言可能具有一些安全防御措施，因此，被测应用程序101有可能不会读取到上述隐私文件的内容，此时，被测应用程序101也可以发送指示未读取到隐私文件内容的消息给测试服务器 103。测试服务器103在收到来自被测应用程序101的消息之后，可对消息进行分析(比如：识别其中携带的指示信息和/或对其中携带的内容进行特征匹配)以确定被测应用程序101是否读取到隐私文件的内容(即本次恶意攻击是否成功)，如能读取到隐私文件的内容，则说明被测应用程序101存在安全漏洞。
采用上述实例，可在被测应用程序运行时实现动态的自动测试，无需人工干预，可以显著提高测试效率和准确率。
在一实例中，上述网页文件的代码可用于模拟更隐秘的攻击行为。当被测应用程序101通过该网页文件的链接地址加载该网页文件时，被测应用程序101通过执行该网页文件的代码，展示一预设页面并延迟响应预定的时间。这里，由于被测应用程序101刚加载该网页文件时，会展示一预设页面，该预设页面可使被测应用程序的用户意识不到该页面文件正在进行攻击行为，进而不能及时采取防御措施。之后，被测应用程序101通过执行该网页文件的代码，在所述预定的时间到达时再尝试读取其私有目录下隐私文件的内容。
本申请实例所提供的测试方法能够模拟多种恶意攻击行为，包括：本地调用攻击、远程发送攻击、中间人截获攻击等，进而可以对被测应用程序的防御能力进行多方面的测试，以下结合附图对模拟这三种恶意攻击行为的测试方法加以详述。
一、模拟本地调用攻击的测试
此种情况下，测试客户端102位于被测应用程序(被测APP)101的本地终端设备，其可以模拟被测APP 101本地安装的恶意软件的攻击行为；上述的网页文件被创建在本地终端设备中测试客户端102的私有目录下，并且其属性被设置为第三方可读写且可执行，这样，被测APP101才能加载该网页文件。
如图3所示，本申请一实例所提供的模拟本地调用攻击的测试方法包括以下步骤：
步骤301：预先创建一恶意html文件P1，该html文件P1中包含用于模拟本地调用攻击的代码，该html文件P1被存放在上述本地终端设备中测试客户端102的私有目录下。
步骤302：测试客户端102通过其所在操作系统的内部通信消息尝试调用被测APP 101并传入上述html文件P1的链接地址(即该html文件P1所存放的测试客户端102的私有目录地址)。
这里，如测试客户端102和被测APP 101是安装在Android客户端上的，则可以通过Android平台的intent消息来尝试调用被测APP 101；如果被测APP 101是浏览器，则调用的是被测APP 101的浏览器接口，而如果被测APP 101是内置浏览器组件的APP，则调用的是被测APP 101的浏览器组件接口。
对于浏览器及内置有浏览器组件的APP而言，除了支持通过URL访问到远端服务，通常都会默认支持通过本地文件访问协议(即file协议)加载、浏览本地文件系统中的页面文件，这种页面文件的URL是以“file：//”为前缀的。例如，在Android客户端接收或者下载文件后，需要通过浏览器或某APP内置的浏览器组件加载一页面文件来显示该文件，此时就需要浏览器或该APP内置的浏览器组件支持file协议来实现这种功能。在步骤302中，测试客户端102通过本地调用传入被测APP101的链接地址可以是以“file：//”为前缀的URL，如“file：///data/data/com.example.test/P1”(此时，上述html文件P1保存在目录地址“/data/data/com.example.test”之下)者“file：///data/data/com.tencent.mobileqq/aaa.html”(此时，上述html文件P1保存在目录地址“/data/data/com.tencent.mobileqq”之下)等。
步骤303：如果被测APP 101被成功调用并被传入了上述html文件P1的链接地址，则被测APP 101通过该链接地址访问本地存放的html文件P1并加载该html文件P1，进而开始执行该html文件P1中的代码。
在一个实例中，在执行上述步骤303的同时可同步执行步骤304：测试客户端102如成功调用被测APP 101并传入上述html文件P1的链接地址，则删除本地存放的上述html文件P1，通过操作系统命令以及预先设置的上述html文件P1的链接地址，尝试建立被测APP 101的私有目录下隐私文件P2到该html文件P1的软链接，即将该html文件P1重定向到隐私文件P2。这里，如测试客户端102和被测APP是安装在Android客户端上的，则可通过Linux软链接命令(In-s)来尝试建立上述软链接。之后，执行步骤305：在测试客户端102成功建立起上述软链接后，被测APP 101通过执行上述html文件P1中的代码来尝试通过该软链接读取隐私文件P2的内容。这里，被测APP 101已获知html文件P1的链接地址，同时已在步骤304建立了隐私文件P2到该html文件P1的软链接，则当通过该链接地址加载文件时，被测APP 101实际上通过该软链接加载的是隐私文件P2，进而能够尝试读取隐私文件P2的内容。
在另一个实例中，步骤303中，在被测APP 101通过该链接地址访问本地存放的html文件P1并首次加载该html文件P1之后，进一步包括：被测APP 101通过执行该html文件P1中的代码，展示一预设页面并延迟响应预设的时间。这里，该预设页面的样式可以随意设置，目的是为了模拟更隐秘的攻击以使用户意识不到被测APP 101受到了恶意攻击。在被测APP 101延时响应等待的时间，测试客户端102执行上述步骤304以尝试建立上述软链接。在延时响应的预设时间到达时，执行步骤305：被测APP 101通过执行该html文件P1中的代码再次通过上述 链接地址加载文件，此时，如果测试客户端102已成功建立起上述软链接，则被测APP 101实际上通过该软链接加载的是隐私文件P2，进而能够尝试读取隐私文件P2的内容。
在上述步骤304中，测试客户端102尝试建立被测APP 101的私有目录下隐私文件P2到该html文件P1的软链接时，测试客户端102是根据预设的隐私文件P2的目录地址和该html文件P1的链接地址来尝试建立软链接的。这里，根据被测APP 101的类型以及隐私文件的类型，可以确定其隐私文件的目录地址，进而可以在测试客户端102中预设此隐私文件的目录地址。比如，隐私文件通常为被测APP 101目录下保存数据的文档，如DB数据文件；对于Android客户端中安装的被测APP而言，其隐私文件的目录地址是可以预先确定的，如：为了便于统一化测试操作，可以以hosts文件的目录地址“/data/data/被测APP目录/../../../../hosts”作为测试时指定的隐私文件的私有目录地址。
步骤306：在被测APP 101成功读取到隐私文件P2的内容之后，发送携带该隐私文件P2的内容的消息至测试服务器103。进一步的，如果被测APP 101未成功读取到隐私文件P2的内容，也可以发消息给测试服务器103，该消息可指示其未读取到隐私文件P2的内容。这里，如上述步骤302～305中任一者未能成功执行，被测APP 101就未能成功读取到隐私文件P2的内容。
步骤307：测试服务器103从被测APP 101接收消息，并通过对消息的分析来确定被测APP 101是否读取到隐私文件P2的内容，进而确定被测APP 101是否具有安全漏洞。这里，测试服务器103可以解析所收到的消息内容，对消息内容进行特征匹配等处理，如果从该消息中解析得到隐私数据(用户账号、密码、聊天记录、银行账号、交易记录等等)，则说明被测APP 101读取到了隐私文件P2的内容，其不能防御此 种本地调用攻击，被测APP 101具有安全漏洞；如果从该消息中解析得到代表未读取到隐私文件P2的内容的指示，则说明本测试方法所模拟的本地调用攻击未能成功窃取到被测APP 101的隐私数据，被测APP101可以防御此种恶意攻击，被测APP 101不具有安全漏洞。
二、模拟远程发送攻击的测试
此种情况下，测试客户端102位于被测APP 101的远程终端设备，其可以模拟被测APP 101的远端恶意软件的攻击行为；上述的网页文件被创建在网络中的任一站点设备中，该站点设备可以是被测APP 101所在本地终端设备可访问的任一远程网络设备。
如图4所示，本申请一实例所提供的模拟远程发送攻击的测试方法包括以下步骤：
步骤401：预先创建一恶意html文件P1，该html文件P1中包含用于模拟远程发送攻击的代码，还包含被测APP 101的用于存放隐私文件P2的私有目录地址，该html文件P1被存放在网络中的任一站点设备中。
步骤402：测试客户端102通过网络发送该html文件P1的链接地址给被测APP 101。
步骤403：如果被测APP 101成功接收到该html文件P1的链接地址，则被测APP 101通过该链接地址访问站点设备中存放的html文件P1并加载该html文件P1，进而开始执行该html文件P1中的代码。
步骤404：被测APP 101通过执行该html文件P1中的代码，尝试根据该html文件P1中包含的上述私有目录地址而加载隐私文件P2，进而尝试读取隐私文件P2的内容。
在一实例中，步骤403中，在被测APP 101通过该链接地址首次加载该html文件P1之后，进一步包括：被测APP 101通过执行该html文件P1中的代码，展示一预设页面并延迟响应预设的时间。在延时响 应的预设时间到达时，执行上述步骤404。这里，通过首次加载该html文件P1时展示预设页面并延迟响应，可以模拟更隐秘的恶意攻击，使用户在首次加载该html文件P1时意识不到该html文件P1正在进行攻击行为。
步骤405：在被测APP 101成功读取到隐私文件P2的内容之后，发送携带该隐私文件P2的内容的消息至测试服务器103。进一步的，如果被测APP 101未成功读取到隐私文件P2的内容，也可以发消息给测试服务器103，该消息可指示其未读取到隐私文件P2的内容。这里，如上述步骤402～404中任一者未能成功执行，被测APP 101就未能成功读取到隐私文件P2的内容。
步骤406：测试服务器103从被测APP 101接收消息，并通过对消息的分析来确定被测APP 101是否读取到隐私文件P2的内容，进而确定被测APP 101是否具有安全漏洞。
上述步骤405和406的具体实现与前述的步骤306和307相同，这里不再赘述。
三、模拟中间人截获攻击的测试
此种情况下，测试客户端102位于被测APP 101的远程终端设备，其可以模拟被测APP 101的远端恶意软件的攻击行为；上述的网页文件被创建在网络中的任一站点设备中，该站点设备可以是被测APP 101所在本地终端设备可访问的任一远程网络设备。
如图5所示，本申请一实例所提供的模拟中间人截获攻击的测试方法包括以下步骤：
步骤501：预先创建一恶意html文件P1，该html文件P1中包含用于模拟远程发送攻击的代码，还包含被测APP 101的用于存放隐私文件P2的私有目录地址，该html文件P1被存放在网络中的任一站点设备中。
步骤502：测试客户端102从网络中截获被测APP 101发出的数据包，生成对应于该数据包的响应包(或者称为响应消息)，并将该html文件P1的链接地址携带在该响应包中，再发送该响应包给被测APP101。
步骤503：如果被测APP 101成功接收到携带该html文件P1的链接地址的响应包，则被测APP 101提取该响应包中的该html文件P1的链接地址，并通过该链接地址访问站点设备中存放的html文件P1并加载该html文件P1，进而开始执行该html文件P1中的代码。
步骤504：被测APP 101通过执行该html文件P1中的代码，尝试根据该html文件P1中包含的上述私有目录地址而加载隐私文件P2，进而尝试读取隐私文件P2的内容。
在一实例中，步骤503中，在被测APP 101通过该链接地址首次加载该html文件P1之后，进一步包括：被测APP 101通过执行该html文件P1中的代码，展示一预设页面并延迟响应预设的时间。在延时响应的预设时间到达时，执行上述步骤504。这里，通过首次加载该html文件P1时展示预设页面并延迟响应，可以模拟更隐秘的恶意攻击，使用户在首次加载该html文件P1时意识不到该html文件P1正在进行攻击行为。
步骤505：在被测APP 101成功读取到隐私文件P2的内容之后，发送携带该隐私文件P2的内容的消息至测试服务器103。进一步的，如果被测APP 101未成功读取到隐私文件P2的内容，也可以发消息给测试服务器103，该消息可指示其未读取到隐私文件P2的内容。这里，如上述步骤502～504中任一者未能成功执行，被测APP 101就未能成功读取到隐私文件P2的内容。
步骤506：测试服务器103从被测APP 101接收消息，并通过对消 息的分析来确定被测APP 101是否读取到隐私文件P2的内容，进而确定被测APP 101是否具有安全漏洞。
以上本申请实例可以模拟各种攻击行为，进而可以对被测应用程序做全面的测试。
基于上述方法实例，本申请实例还提供了一种应用程序的测试客户端，如图6所示，该测试客户端600至少包括：
地址提供模块601，其用于尝试将一网页文件的链接地址提供给被测应用程序，该网页文件为预先创建的，其包含用于模拟恶意攻击行为的该被测应用程序可执行的代码，以使该被测应用程序当通过该链接地址加载该网页文件时，通过执行该网页文件包含的上述代码来尝试读取该被测应用程序的私有目录下隐私文件的内容；如果读取到该隐私文件的内容，则该被测应用程序通过本地终端设备发送携带该隐私文件的内容的消息至测试服务器，以使该测试服务器根据从来自该被测应用程序的消息确定该被测应用程序是否存在安全漏洞。
在一实例中，所提供的测试方法可模拟本地调用攻击，此时，测试客户端600位于被测应用程序的本地终端设备，测试客户端600进一步包括：存储模块603，用于在测试客户端600的私有目录下保存上述网页文件，其中，该网页文件的属性被设置为第三方可读写且可执行；此时，地址提供模块601，用于通过操作系统的内部通信消息尝试调用被测应用程序并将该网页文件的链接地址传入被测应用程序。测试客户端600还包括：软链接建立模块602，用于当被测应用程序通过被传入的链接地址加载上述网页文件时，删除存储模块603在测试客户端600的私有目录下保存的上述网页文件，并根据被测应用程序的隐私文件所在的私有目录地址和操作系统命令建立该隐私文件到该网页文件的链接地址的软链接，以使被测应用程序通过执行上述网页文件中的上述代码 来尝试通过该软链接读取该隐私文件的内容。
在另一实例中，当上述被测应用程序通过被传入的上述链接地址首次加载上述网页文件时，该被测应用程序通过执行所述代码，可进一步展示一预设页面并延迟响应预定的时间，在该预定的时间到达时加载上述链接地址，并在加载该链接地址时通过上述软链接尝试加载上述隐私文件以读取其中的内容。此时，上述软链接建立模块602，用于在该预定的时间内删除存储模块603中在测试客户端600的私有目录下保存的上述网页文件并建立上述软链接。
在又一实例中，所提供的测试方法可模拟远程发送攻击或者中间人截获攻击，此时，测试客户端600位于被测应用程序的远程终端设备；上述网页文件包含该被测应用程序的上述隐私文件所在的私有目录地址。此时，上述地址提供模块601，用于当模拟远程发送攻击时尝试发送该网页文件的链接地址给该被测应用程序，或者，当模拟中间人截获攻击时尝试截获该被测应用程序发出的数据包，生成对应于所截获的该数据包的响应包，在该响应包中携带该网页文件的链接地址，再尝试发送该响应包给该被测应用程序。通过地址提供模块601的上述操作，可以使该被测应用程序通过执行该网页文件中的上述代码来尝试根据该网页文件中包含的上述私有目录地址读取上述隐私文件的内容。
另外，在本申请各个实例中的各模块可以集成在一个处理单元中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
在一实例中，该测试客户端600可包括：存储器610、处理器611、总线612、端口613。处理器611和存储器610通过总线612互联。处理器611可通过端口613接收和发送数据以实现网络通信。上述各模块 601～603可以是存储器610中存储的机器可执行指令模块。处理器611通过执行存储器610中各个模块601～603中包含的机器可执行指令，进而能够实现上述各模块601～603的功能。其中，当地址提供模块601向远程设备中的被测应用程序提供上述网页文件的链接地址时，处理器611通过执行存储器610中地址提供模块601中的指令，可通过端口613发送该链接地址给远程设备的被测应用程序，或者截获远程设备的被测应用程序所发送的数据包，再通过端口613发送携带上述网页文件的链接地址的响应包给该远程设备的被测应用程序。
上述测试客户端600中，各个模块601～603实现各自功能的具体方法在前述方法实例中均有描述，这里不再赘述。
本申请实例还提供了一种应用程序的测试系统。如图7所示，该测试系统700包括：测试客户端701和测试服务器702。该测试系统700所测试的被测应用程序为浏览器或者内置浏览器组件的应用程序。
测试客户端701，用于尝试将一网页文件的链接地址提供给被测应用程序，该网页文件为预先创建的，其包含用于模拟恶意攻击行为的被测应用程序可执行的代码。
该被测应用程序当通过该链接地址加载该网页文件时，通过执行该网页文件包含的上述代码来尝试读取被测应用程序的私有目录下隐私文件的内容；如果读取到该隐私文件的内容，则被测应用程序通过本地终端设备发送携带该隐私文件的内容的消息至测试服务器702。
测试服务器702，其用于根据来自被测应用程序的消息确定被测应用程序是否存在安全漏洞。
关于被测应用程序、测试客户端701和测试服务器702在测试过程中的具体功能和实现原理在前述实例中均有详述，这里不再赘述。
在一实例中，测试系统700可实现对多个被测应用程序的批量测试， 而针对每个被测应用程序的具体测试方法是与前述相同的。此时，测试系统700可包括多个测试客户端701，其中每一测试客户端701尝试将上述网页文件的链接地址提供给这些被测应用程序中的任一者，各个被测应用程序根据测试客户端701所提供的链接地址尝试读取隐私文件的内容并发送消息给测试服务器702，测试服务器702根据来自各个被测应用程序的消息分别确定各个被测应用程序是否存在漏洞。这样，测试系统700可以利用这些测试客户端701并行的对多个被测应用程序进行自动化的测试，可进一步提高测试效率。这里，多个测试客户端701可以位于多个硬件设备。
另外，本申请的每个实例可以通过由数据处理设备如计算机执行的数据处理程序来实现。显然，数据处理程序构成了本申请。此外，通常存储在一个存储介质中的数据处理程序通过直接将程序读取出存储介质或者通过将程序安装或复制到数据处理设备的存储设备(如硬盘和或内存)中执行。因此，这样的存储介质也构成了本申请。存储介质可以使用任何类型的记录方式，例如纸张存储介质(如纸带等)、磁存储介质(如软盘、硬盘、闪存等)、光存储介质(如CD-ROM等)、磁光存储介质(如MO等)等。
因此，本申请还公开了一种存储介质，其中存储有数据处理程序，该数据处理程序用于执行本申请上述方法的任何一种实例。
以上所述仅为本申请的实例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (11)

  1. 一种应用程序的测试方法，其中，被测应用程序为浏览器或者内置浏览器组件的应用程序，预先创建一网页文件，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码；该方法应用于测试客户端，当进行测试时，该方法包括：
    所述测试客户端尝试将所述网页文件的链接地址提供给所述被测应用程序，以使所述被测应用程序当通过所述链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码来尝试读取所述被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则所述被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至测试服务器，以使所述测试服务器根据来自所述被测应用程序的消息确定所述被测应用程序是否存在安全漏洞。
  2. 根据权利要求1所述的方法，其中，所述测试客户端位于所述被测应用程序的本地终端设备；所述网页文件被创建在所述本地终端设备中所述测试客户端的私有目录下，并且其属性被设置为第三方可读写且可执行；
    所述测试客户端尝试将所述网页文件的链接地址提供给所述被测应用程序，包括：
    所述测试客户端通过操作系统的内部通信消息尝试调用所述被测应用程序并将该网页文件的链接地址传入所述被测应用程序；
    所述被测应用程序通过被传入的所述链接地址加载所述网页文件时，该方法进一步包括：
    所述测试客户端删除所述网页文件，并根据所述被测应用程序的所 述隐私文件所在的私有目录地址和操作系统命令建立所述隐私文件到所述网页文件的链接地址的软链接；
    其中，所述通过执行所述网页文件包含的所述代码来尝试读取所述被测应用程序的私有目录下隐私文件的内容，包括：
    所述被测应用程序通过执行所述代码来尝试通过所建立的所述软链接读取所述隐私文件的内容。
  3. 根据权利要求2所述的方法，其中，所述被测应用程序通过执行所述代码来尝试通过所建立的所述软链接读取所述隐私文件的内容，包括：
    当所述被测应用程序通过被传入的所述链接地址首次加载所述网页文件时，所述被测应用程序通过执行所述代码，展示一预设页面并延迟响应预定的时间，在所述预定的时间到达时加载所述链接地址，并在加载所述链接地址时通过所述软链接尝试加载所述隐私文件以读取其中的内容；
    其中，在所述预定的时间内，所述测试客户端删除所述网页文件并建立所述软链接。
  4. 根据权利要求1所述的方法，其中，所述测试客户端位于所述被测应用程序的远程终端设备；所述网页文件包含所述被测应用程序的所述隐私文件所在的私有目录地址；
    所述测试客户端尝试将所述网页文件的链接地址提供给所述被测应用程序，包括：
    所述测试客户端尝试发送所述网页文件的链接地址给所述被测应用程序；或者，所述测试客户端尝试截获所述被测应用程序发出的数据 包，生成对应于所截获的所述数据包的响应包，该响应包携带所述网页文件的链接地址，再尝试发送该响应包给所述被测应用程序；
    所述通过执行所述网页文件包含的所述代码来尝试读取所述被测应用程序的私有目录下隐私文件的内容，包括：
    所述被测应用程序通过执行所述代码来尝试根据该网页文件中包含的所述私有目录地址读取所述隐私文件的内容。
  5. 根据权利要求4所述的方法，其中，所述被测应用程序通过执行所述代码来尝试根据该网页文件中包含的所述私有目录地址读取所述隐私文件的内容，包括：
    当所述被测应用程序通过所述链接地址加载所述网页文件时，所述被测应用程序通过执行所述代码，展示一预设页面并延迟响应预定的时间，并在所述预定的时间到达时根据该网页文件中包含的所述私有目录地址尝试读取所述隐私文件的内容。
  6. 一种应用程序的测试客户端，其中，被测应用程序为浏览器或者内置浏览器组件的应用程序，所述测试客户端至少包括：
    处理器；
    存储器，存储所述处理器可执行的指令模块；
    其中，所述处理器通过执行所述指令模块中的机器可执行指令来实现所述指令模块的功能；所述指令模块包括：
    地址提供模块，用于尝试将一网页文件的链接地址提供给所述被测应用程序，所述网页文件为预先创建的，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码，以使所述被测应用程序当通过所述链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码 来尝试读取所述被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则所述被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至测试服务器，以使所述测试服务器根据来自所述被测应用程序的消息确定所述被测应用程序是否存在安全漏洞。
  7. 根据权利要求6所述的测试客户端，其中，所述测试客户端位于所述被测应用程序的本地终端设备；所述指令模块进一步包括：
    存储模块，用于在所述测试客户端的私有目录下保存所述网页文件，其中，该网页文件的属性被设置为第三方可读写且可执行；
    所述地址提供模块，用于通过操作系统的内部通信消息尝试调用所述被测应用程序并将该网页文件的链接地址传入所述被测应用程序；
    所述指令模块进一步包括：
    软链接建立模块，用于当所述被测应用程序通过被传入的所述链接地址加载所述网页文件时，删除所述测试客户端的私有目录下保存的所述网页文件，并根据所述被测应用程序的所述隐私文件所在的私有目录地址和操作系统命令建立所述隐私文件到所述网页文件的链接地址的软链接，以使所述被测应用程序通过执行所述代码来尝试通过所述软链接读取所述隐私文件的内容。
  8. 根据权利要求7所述的测试客户端，其中，当所述被测应用程序通过被传入的所述链接地址首次加载所述网页文件时，所述被测应用程序通过执行所述代码，展示一预设页面并延迟响应预定的时间，在所述预定的时间到达时加载所述链接地址，并在加载所述链接地址时通过所述软链接尝试加载所述隐私文件以读取其中的内容；
    所述软链接建立模块，用于在所述预定的时间内删除所述测试客户端的私有目录下保存的所述网页文件并建立所述软链接。
  9. 根据权利要求6所述的测试客户端，其中，所述测试客户端位于所述被测应用程序的远程终端设备；所述网页文件包含所述被测应用程序的所述隐私文件所在的私有目录地址；
    所述地址提供模块，用于尝试发送所述网页文件的链接地址给所述被测应用程序，或者，尝试截获所述被测应用程序发出的数据包，生成对应于所截获的所述数据包的响应包，该响应包携带所述网页文件的链接地址，再尝试发送该响应包给所述被测应用程序，以使所述被测应用程序通过执行所述代码来尝试根据该网页文件中包含的所述私有目录地址读取所述隐私文件的内容。
  10. 一种应用程序的测试系统，用于对至少一个被测应用程序进行测试，所述被测应用程序为浏览器或者内置浏览器组件的应用程序；所述测试系统包括至少一个测试客户端和测试服务器，其中：
    每一测试客户端用于尝试将一网页文件的链接地址提供给所述至少一个被测应用程序中的任一者，所述网页文件为预先创建的，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码；
    其中，每一被测应用程序当通过所述链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码来尝试读取该被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则该被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至所述测试服务器；
    所述测试服务器，用于根据来自所述至少一个被测应用程序中任一 者的消息确定该被测应用程序是否存在安全漏洞。
  11. 一种非易失性计算机可读存储介质，其特征在于，存储有程序，所述计算机可读存储介质位于用于测试应用程序的测试客户端所在的计算机，其中，被测应用程序为浏览器或者内置浏览器组件的应用程序，预先创建一网页文件，其包含用于模拟恶意攻击行为的所述被测应用程序可执行的代码；
    当进行测试时，所述程序能够使计算机执行如下步骤：
    所述测试客户端尝试将所述网页文件的链接地址提供给所述被测应用程序，以使所述被测应用程序当通过所述链接地址加载所述网页文件时，通过执行所述网页文件包含的所述代码来尝试读取所述被测应用程序的私有目录下隐私文件的内容；如果读取到所述隐私文件的内容，则所述被测应用程序通过本地终端设备发送携带所述隐私文件的内容的消息至测试服务器，以使所述测试服务器根据来自所述被测应用程序的消息确定所述被测应用程序是否存在安全漏洞。
PCT/CN2016/083106 2015-07-14 2016-05-24 应用程序的测试方法、客户端及系统 WO2017008581A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16823728.7A EP3324325B1 (en) 2015-07-14 2016-05-24 Method, client, and system for testing application
US15/801,934 US10915637B2 (en) 2015-07-14 2017-11-02 Method, client, and system for testing application

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510412588.6A CN106339309B (zh) 2015-07-14 2015-07-14 应用程序的测试方法、客户端及系统
CN201510412588.6 2015-07-14

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/801,934 Continuation US10915637B2 (en) 2015-07-14 2017-11-02 Method, client, and system for testing application

Publications (1)

Publication Number Publication Date
WO2017008581A1 true WO2017008581A1 (zh) 2017-01-19

Family

ID=57756824

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/083106 WO2017008581A1 (zh) 2015-07-14 2016-05-24 应用程序的测试方法、客户端及系统

Country Status (4)

Country Link
US (1) US10915637B2 (zh)
EP (1) EP3324325B1 (zh)
CN (1) CN106339309B (zh)
WO (1) WO2017008581A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106339309B (zh) * 2015-07-14 2020-01-31 腾讯科技（深圳）有限公司 应用程序的测试方法、客户端及系统
CN106998335B (zh) * 2017-06-13 2020-09-18 深信服科技股份有限公司 一种漏洞检测方法、网关设备、浏览器及系统
CN109189542B (zh) * 2018-09-28 2021-10-15 成都安恒信息技术有限公司 一种用于运维审计系统的远程桌面访问方法
CN109614334A (zh) * 2018-12-07 2019-04-12 北京小米移动软件有限公司 文件测试方法、装置及计算机可读存储介质
WO2020210989A1 (zh) * 2019-04-16 2020-10-22 深圳市欢太科技有限公司 隐私合规检测方法及相关产品
CN110135168B (zh) * 2019-05-16 2021-04-20 北京字节跳动网络技术有限公司 应用程序的检测方法、装置、系统、终端设备及存储介质
CN110502520B (zh) * 2019-08-27 2020-05-12 云汉芯城（上海）互联网科技股份有限公司 一种数据入库的方法、系统、设备及计算机可读存储介质
CN112883370B (zh) * 2019-11-29 2022-12-20 北京三快在线科技有限公司 应用程序状态检测方法和装置、存储介质和电子设备
CN111371745B (zh) * 2020-02-21 2022-06-28 北京百度网讯科技有限公司 用于确定ssrf漏洞的方法和装置
CN111782551B (zh) * 2020-08-04 2021-07-27 腾讯科技（深圳）有限公司 针对区块链项目的测试方法、装置及计算机设备
CN112199272A (zh) * 2020-09-08 2021-01-08 深圳市金锐显数码科技有限公司 一种智能终端的测试方法、装置、终端设备及介质
CN114039760B (zh) * 2021-11-03 2022-08-09 中国工商银行股份有限公司 安全测试方法、装置、计算机设备和存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103281177A (zh) * 2013-04-10 2013-09-04 广东电网公司信息中心 对Internet信息系统恶意攻击的检测方法及系统
CN104063309A (zh) * 2013-03-22 2014-09-24 南京理工大学常熟研究院有限公司 基于模拟攻击的Web应用程序漏洞检测方法

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050222815A1 (en) * 2004-03-31 2005-10-06 Kevin Tolly System and method for testing and certifying products
US8136096B1 (en) * 2004-07-23 2012-03-13 Green Hills Software, Inc. Backward post-execution software debugger
US8584232B2 (en) * 2007-04-23 2013-11-12 Sap Ag Enhanced cross-site attack prevention
US8949990B1 (en) * 2007-12-21 2015-02-03 Trend Micro Inc. Script-based XSS vulnerability detection
US8578482B1 (en) * 2008-01-11 2013-11-05 Trend Micro Inc. Cross-site script detection and prevention
US8869279B2 (en) * 2011-05-13 2014-10-21 Imperva, Inc. Detecting web browser based attacks using browser response comparison tests launched from a remote source
US8468138B1 (en) * 2011-12-02 2013-06-18 International Business Machines Corporation Managing redundant immutable files using deduplication in storage clouds
US9774617B2 (en) * 2012-10-12 2017-09-26 Trustwave Holdings, Inc. Distributed client side user monitoring and attack system
US10223533B2 (en) * 2014-10-21 2019-03-05 Veracode, Inc. Systems and methods for analysis of cross-site scripting vulnerabilities
CN104766013A (zh) * 2015-04-10 2015-07-08 北京理工大学 一种基于跳表的跨站脚本攻击防御方法
CN106339309B (zh) * 2015-07-14 2020-01-31 腾讯科技（深圳）有限公司 应用程序的测试方法、客户端及系统

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104063309A (zh) * 2013-03-22 2014-09-24 南京理工大学常熟研究院有限公司 基于模拟攻击的Web应用程序漏洞检测方法
CN103281177A (zh) * 2013-04-10 2013-09-04 广东电网公司信息中心 对Internet信息系统恶意攻击的检测方法及系统

Also Published As

Publication number Publication date
EP3324325A1 (en) 2018-05-23
US10915637B2 (en) 2021-02-09
EP3324325B1 (en) 2020-10-28
EP3324325A4 (en) 2018-05-23
US20180144140A1 (en) 2018-05-24
CN106339309A (zh) 2017-01-18
CN106339309B (zh) 2020-01-31

Similar Documents

Publication Publication Date Title
WO2017008581A1 (zh) 应用程序的测试方法、客户端及系统
US10079854B1 (en) Client-side protective script to mitigate server loading
US10834115B2 (en) Methods and systems for providing security for page framing
US8752183B1 (en) Systems and methods for client-side vulnerability scanning and detection
CN104767775B (zh) 网页应用消息推送方法及系统
JP6559694B2 (ja) 自動ｓｄｋ受容
US9065725B1 (en) Techniques for virtual environment-based web client management
CN110096370B (zh) 用于虚拟环境的控制反转组件服务模型
CN111400722A (zh) 扫描小程序的方法、装置、计算机设备和存储介质
CN111163095B (zh) 网络攻击分析方法、网络攻击分析装置、计算设备和介质
US10623450B2 (en) Access to data on a remote device
US11770385B2 (en) Systems and methods for malicious client detection through property analysis
WO2022062869A1 (zh) 数据处理方法、装置、计算机设备及存储介质
CN108351941B (zh) 分析装置、分析方法、以及计算机可读存储介质
Bauer et al. Analyzing the dangers posed by Chrome extensions
US10032027B2 (en) Information processing apparatus and program for executing an electronic data in an execution environment
JP2014179025A (ja) 接続先情報抽出装置、接続先情報抽出方法、及び接続先情報抽出プログラム
WO2019037521A1 (zh) 安全检测的方法、装置、系统以及服务器
CN114357457A (zh) 漏洞检测方法、装置、电子设备和存储介质
US11128639B2 (en) Dynamic injection or modification of headers to provide intelligence
CN106375441A (zh) 一种基于web浏览器的功能扩展方法及终端设备
US20190347407A1 (en) Detecting client-side exploits in web applications
JP6867552B2 (ja) 判定方法、判定装置および判定プログラム
CN114598524B (zh) 检测代理工具的方法、装置、设备以及存储介质
Beer et al. Tabbed Out: Subverting the Android Custom Tab Security Model

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16823728

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2016823728

Country of ref document: EP