WO2018188558A1 - 账号权限的识别方法及装置 - Google Patents

账号权限的识别方法及装置 Download PDF

Info

Publication number
WO2018188558A1
WO2018188558A1 PCT/CN2018/082355 CN2018082355W WO2018188558A1 WO 2018188558 A1 WO2018188558 A1 WO 2018188558A1 CN 2018082355 W CN2018082355 W CN 2018082355W WO 2018188558 A1 WO2018188558 A1 WO 2018188558A1
Authority
WO
WIPO (PCT)
Prior art keywords
account
website
information
tested
attribute
Prior art date
Application number
PCT/CN2018/082355
Other languages
English (en)
French (fr)
Inventor
王放
胡珀
郑兴
郭晶
张强
范宇河
唐文韬
杨勇
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018188558A1 publication Critical patent/WO2018188558A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a method and an apparatus for identifying an account right.
  • An ultra-authority vulnerability refers to a site's privilege control system that allows A users to use certain methods or means to access B users, thereby achieving other sensitive operations such as stealing information, modifying information, adding information, and deleting information.
  • a URL Uniform Resource Locator, UniformResourceLocator
  • the attacker can use the URL to pass the guessability of the parameter, and by changing the input parameter value, it may cause horizontal unauthorized access. Personal information to others.
  • the embodiment of the present application provides a method for identifying an account right.
  • a method for identifying account rights including:
  • an embodiment of the present application also provides an apparatus for identifying an account authority.
  • An apparatus for identifying an account authority comprising: a processor and a memory, wherein the memory stores computer readable instructions, the computer readable instructions being executed by the processor to:
  • the embodiment of the present application further provides a method for identifying an account right, which is used for a terminal or a server, where the terminal or server includes: a processor and a memory, and the method includes:
  • embodiments of the present application also provide a computer readable storage medium having instructions stored therein that, when run on a computer, cause the computer to perform the following steps:
  • Figure 1 is a schematic diagram of an implementation environment of the present application
  • FIG. 2 is a schematic flowchart of a method for identifying an account authority according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of data transmission between modules of a terminal for implementing an account right identification method according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of a method for identifying an account authority according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of an apparatus for identifying an account authority according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram of a computer device for operating the foregoing method for identifying an account right in an embodiment of the present application.
  • the detection of ultra-authority loopholes is mainly through manual penetration testing, and then professional penetration testers identify permissions for different account systems of the website, and detect whether the website is truly effective by technical means.
  • the permissions of different users It is not only efficient, but also labor-intensive and manual, which is not only efficient, but also cannot ensure that all the vulnerabilities are detected.
  • the embodiment of the present application proposes a method and a device for identifying an account right, which can reduce the time required for an account to be over-authorized, and can cover all accounts in the website, thereby improving the efficiency of the account over-authority detection.
  • Figure 1 is a schematic diagram of an implementation environment of the present application.
  • the implementation environment includes a detection device 10 and a server 20.
  • the detecting device 10 includes an identification device 30 for account rights.
  • the account identification device 30 can log in to the first account on the website to be tested to obtain the first login status information of the first account, and obtain the information about the account remoteness vulnerability of the website to be tested.
  • the scan rule includes a test address of the website to be tested and a target account attribute type; and the first login state information is modified according to the attribute value in the target account attribute type in the information of the second account,
  • the second login status information is obtained by using the second login status information to access the website to be tested, and receiving the first response content sent by the website to be tested; and acquiring the first response content according to the matching rule defined in the scanning rule.
  • the feature information determines whether the first account is unauthorized according to the feature information and the matching rule.
  • the implementation of the account's rights identification device 30 may rely on a computer program that can run on a von Neumann system-based computer system, which can be a detection application for an account override vulnerability.
  • the detecting device 10 may be a server or terminal such as a smart phone, a tablet computer, a personal computer or the like that runs the above computer program.
  • FIG. 2 is a schematic flowchart of a method for identifying an account authority according to an embodiment of the present application. The method is described by taking a terminal device as a detecting device as an example. Specifically, as shown in FIG. 2, the foregoing method for identifying an account authority includes the following steps S102-S110:
  • Step S102 Log in the first account on the website to be tested, and obtain the first login status information of the first account.
  • the detection of the account over-authorization is carried out for a certain website, that is, the website to be tested.
  • the website is a website to be tested.
  • step S102 is performed for each account traversed. -S110.
  • Whether the account A is over-authorized means that the A user can access the B user's permission control system through certain methods or means to modify, delete, add, etc. the B user's information.
  • the detection of the account over-authority determines whether the related data under the second account can be accessed under the first account.
  • the authentication information such as the account number and password corresponding to the first account is used to log in to the website to be tested, that is, the identity of the first account that is logged in by the APP or browser of the terminal to access the website to be tested.
  • the information is accessed, that is, whether the user currently has the right to access a certain data or whether the user can currently modify the accessed data, etc., is determined by whether the first account that is logged in has the corresponding authority. .
  • the login status information of the first account is obtained.
  • the login status information may be a UIN (Unique Identification Number) code, a cookie information, a session ID, and the like corresponding to the first account.
  • the unique data corresponding to the identity information of an account is unique identification information that can be used to verify the identity information of the current account.
  • the UIN code is an authentication code that the account is assigned to the registrant during the registration process of the website, and the UIN code is permanent and cannot be modified unless the registrant identity change causes the UIN to be deleted. That is to say, in the website, the UIN code corresponding to the first account is determined, and the UIN code is different from the UIN code of other users.
  • the UIN code can uniquely identify the first account currently logged in. If the logged-in account is changed or tampered with, the corresponding UIN code will also change.
  • Cookies are data (browser cache) that a website stores on a user's local terminal in order to identify the user.
  • the terminal can send the user's cookie to the server when sending the HTTP request.
  • the server looks up the user identity information or user authentication information in the database that matches the cookie based on the user's cookie. That is to say, if the cookie changes, the identity information of the user found by the server that matches the current cookie will also change.
  • the session ID is an identifier corresponding to the session generated when the server creates a session for the request of the first account, and the session is a data block stored in the server for the authentication information corresponding to the first account, and the session ID can be used to search in the session list. Go to the session corresponding to the Session ID, and then determine the authentication information corresponding to the Session ID. That is to say, once the session ID is changed or tampered with, the user authentication information that is not found or found may also change when the user authentication information is found.
  • the login status information can uniquely determine the current account. If the login status information changes, the corresponding account determined according to the login status information may also change, possibly other accounts.
  • the login status information may be a combination of one or more parameters of a UIN code, cookie information, a Session ID, and other parameters that may identify the user identity information.
  • the obtaining of the login state information may be implemented by using a login state to pull an interface function.
  • the login function is used to obtain the cookie after the first account is logged in.
  • Step S104 Acquire a preset scan rule, where the scan rule includes a test address of the website to be tested and a target account attribute type.
  • the scanner may modify the login state information of the first account according to the information of the second account.
  • the modified access request is sent to the server in the form of an Http request packet. Then, the scanner judges according to the data returned by the server, and determines whether the account is over-authorized in the first account.
  • a scanner is a type of program that automatically detects local or remote host security vulnerabilities. It can quickly and accurately detect vulnerabilities in scan targets and provide scan results to users.
  • the working principle is that the scanner sends packets to the target computer and then The information fed back by the other party is used to determine whether the account is over-authorized.
  • a test address corresponding to the website to be tested that is, an access address
  • the test address may be an account login address or a payment link in the shopping website.
  • the target account attribute type is one of the at least one attribute item included in the login status information or the attribute item type corresponding to the specified attribute item. For example, if the login status information of the first account includes the UIN code of the first account, and the account identifier and the account nickname, the target account attribute type is one or more of a UIN code, an account identifier, and an account nickname.
  • Step S106 Modify the first login state information according to the attribute value of the second account in the target account attribute type to obtain the second login state information.
  • the second account may be an associated account associated with the first account, or may be any account on the website to be tested.
  • the attribute value of the second account information in the target account attribute type is determined, and the plurality of attribute items included in the first login status information corresponding to the first account are compared with the target
  • the attribute value of the attribute item corresponding to the account attribute type is modified to the attribute value of the second account under the target account attribute type, thereby obtaining the second login status information.
  • the attribute value of the second account may be known, for example, obtained from a server.
  • the target account attribute type is a UIN code
  • the UIN code in the first login status information is modified to the UIN code corresponding to the second account.
  • Step S108 Accessing the website to be tested by using the second login status information, and receiving the first response content sent by the website to be tested.
  • the website to be tested is accessed through the identity right corresponding to the first account, and the operation corresponding to the right of the first account is performed.
  • the second login status information is used to access the website to be tested, because only the attribute value under the target account attribute type is modified to the attribute value of the second account under the target account attribute type in the second login status information, and other information is not modified. And, the second account is not logged into the website to be tested.
  • the other information includes, for example, a protocol field such as a referer, a User Agent, and a Host in the Http request.
  • the second login status information including the attribute value of the second account under the target account attribute type is used to access the website to be tested, and the corresponding content returned by the server receiving the website to be tested is divided into the following Situation:
  • the server receives the access request, it checks the related information contained in the carried second login state information, for example, performs identity verification according to the UIN code included in the login state information, and determines the UIN code.
  • the corresponding account is the second account, and therefore, the returned content is related to the second account;
  • the server does not check the attribute value included in the second login status information and the target account attribute type when the server receives the access request, because the server does not know that the login status information is related to the second account. Therefore, the returned content has nothing to do with the second account, that is, it will continue to operate according to the relevant permissions of the first account.
  • the process of determining whether the first account has an account over-the-counter is the step S110: acquiring the feature information of the first response content according to the matching rule defined in the scan rule, and determining, according to the feature information and the matching rule, Whether the first account is over-authorized.
  • the target account attribute type in the scan rule is determined according to the actual detection needs.
  • the scan rule not only the target account attribute type is included, but also the matching rule used in the process of analyzing the response content returned by the server in the specific process of determining whether the account is over-authorized.
  • all the content returned by the server is not compared and verified, but only part of the content that can determine whether the account is unauthorized or not is compared and verified.
  • an identifier corresponding to the login account for example, Hi, Apple! is displayed on the web page view of the website, so that the user can use the account identifier of the display.
  • the feature information of the response content that needs to be acquired is determined according to the matching rule, and the feature information of the first response content is obtained, and then the first account is determined to be unauthorized according to the feature information and the matching rule.
  • the process of determining whether the first account is over-authorized is: if the feature information of the second response content matches the first account, determining that the first account is not overriding; in the second response content In the case that the feature information matches the second account, it is determined that the first account is unauthorized.
  • the access request of the website to be tested is initiated by the second login status information
  • the preset feature information in the response content returned by the server matches the first account
  • the first account is not overridden, if the server The preset feature information in the returned response content does not match the first account. For example, if the second account is matched, the first account is over-authorized.
  • the feature information reflects the identity information of the initiator, such as the initiator's UIN code, in the process of determining the identity of the initiator of the HTTP request and the corresponding authority after receiving the HTTP request, and the response returned by the server. If the UIN code included in the feature information in the content corresponds to the first account, it is determined that the feature information matches the first account, and vice versa, if the UIN code included in the feature information in the response content returned by the server corresponds to the second account, The feature information is determined to match the second account.
  • the identity information of the initiator such as the initiator's UIN code
  • FIG. 3 shows an interaction relationship between a terminal that implements the above-described identification method of account rights and a website to be tested (target website).
  • the login state information of the first account that is logged in is obtained through the login state pull interface and sent to the scanner.
  • the scanner prefers to determine the test address corresponding to the website to be tested, such as an account login address or payment link in the shopping website. Further, it is also required to determine the target account attribute type that the current scanner needs in determining whether the first account has an account over-authorization.
  • the target account attribute type is one or more of the at least one attribute item included in the login status information, and the attribute item type corresponding to the specified attribute item.
  • the target account attribute type of the A user is the UIN code of the A user and the cookie of the A user.
  • the scanner modifies the first login state information (for example, the UIN of the A user and the UIN code of the B user according to the attribute value of the second account (for example, B user) under the target account attribute type (for example, the UIN code of the B user and the cookie of the B user).
  • the target account attribute type for example, the UIN code of the B user and the cookie of the B user.
  • a user's cookie get the second login status information.
  • the scanner then encapsulates and generates a corresponding HTTP request according to the modified login status information and the payload of the website to be tested, and then sends the corresponding HTTP request to the server corresponding to the website to be tested, and receives the data returned by the server; the scanner targets
  • the received data is analyzed to determine whether there is an unauthorized vulnerability, wherein the relevant rules in the process of generating the HTTP request by the scanner and the rules for analyzing the returned data are scanning rules corresponding to the scanner, and scanning Rules are provided and set by the rules engine that the scanner is connected to.
  • the first account before detecting whether the first account can exceed the data corresponding to the second account, it is also required to determine whether the current website has an account identification function, for example, if all users on the website to be tested have The access rights or operation rights of all data on the website to be tested, or when any account initiates an access request or operation request for data on the website to be tested, the account is not verified or the account has the right to check; In this case, there is no question of whether the account is over-authorized.
  • account identification function for example, if all users on the website to be tested have The access rights or operation rights of all data on the website to be tested, or when any account initiates an access request or operation request for data on the website to be tested, the account is not verified or the account has the right to check; In this case, there is no question of whether the account is over-authorized.
  • FIG. 4 shows a schematic flowchart of a method for identifying an account right. Before determining whether the first account has an excess or not, it is also necessary to determine whether the test URL supports the detection and judgment of the account over-authority.
  • the embodiment of the present application further includes steps S112-S118.
  • Step S112 accessing the website to be tested.
  • the method further includes: accessing the website to be tested by using the login state information of the first account.
  • Step S114 Receive a second response content returned by the website to be tested.
  • Step S116 determining whether the second response content includes the feature information of the first account.
  • the step S104 of acquiring the preset scan rule is performed; and the second account content is not included in the second response content.
  • the feature information it is determined that the test address of the website to be tested does not have the identification function of the account right, and step S118 is executed to switch the test address of the website to be tested.
  • the server of the website to be tested returns.
  • the response content should not contain any relevant data corresponding to the first account. Therefore, when the login status information of the first account is used to access the website to be tested, if the response content returned by the website to be tested does not include the feature information corresponding to the first account, the test of the website is not required to continue. , directly suspend the execution of this method.
  • the website to be tested is a shopping website
  • the test address of the website to be tested determined in step S104 is a product link in the shopping website; generally speaking, the address corresponding to the product link of the shopping website generally does not need to be The identity of the user is verified. If the response information returned by the server does not include the feature information corresponding to the first account in this case, it is considered that the test address of the website to be tested does not have the detection function of the account over-authorization, and the test address needs to be switched. For example, switching to the test address of the website to be tested, such as the account login address or the payment link, which requires verification of the user's identity, begins the steps of FIG. 4 again.
  • test address of the website to be tested does not have the function of detecting the account authority, it does not mean that all the test addresses of the website to be tested do not have the function of detecting the account right, in order to avoid a test address.
  • the detection result ignores the detection of an account violation vulnerability that may exist under other addresses, and needs to switch to other test addresses under the website to be tested to perform account excess detection.
  • Steps S104-S110 are to determine whether the first account is unauthorized.
  • step S110 may specifically include the following steps:
  • Step S120 Acquire feature information of the first response content according to the matching rule defined in the scan rule.
  • step S122 it is determined whether the feature information included in the first response content matches the first account. If the match is determined, the first account is determined to be unauthorized, that is, the process proceeds to step S126, and then the process ends; if not, the first account is determined not to be Excessive authority, that is, step S124 is reached, and then the detection process ends.
  • the login state of the A user may be first pulled, and then another user B may be selected.
  • Set the payload in the B user's website access request to the A user login state send a request to the website, and determine whether the website contains A user feature information.
  • the feature information is preset (for example, an account of the A user, a nickname of the A user (passed by the unique process), and the like). If there is A user feature information, the website has a certain recognition function for the user's account system, and the subsequent override detection logic can be performed. If not, the user directly jumps out and interrupts the scan.
  • the UIN in the A user login state may be replaced with the UIN of the B user.
  • the http package is reassembled and sent to the server. If the website still displays the A user feature information, the website does not have an unauthorized vulnerability. When the original A user feature information of the website is replaced with the B user's feature information, the website has an unauthorized vulnerability. .
  • the identity of the first account under the target account attribute type is automatically modified according to the target account attribute type determined by the scanning rule, without the need for the detection personnel to manually compare and modify the identity identification parameter of the account.
  • the attribute value of the second account that is, the tester only needs to define the target account attribute type in the scan rule to automatically detect whether the account has an unauthorized violation, which reduces the time spent on the account over-authorization detection, and improves the time. The efficiency of account over-authorization detection.
  • an apparatus for identifying an account authority including a login status information acquisition module 102, a scan rule acquisition module 104, a login status information modification module 106, and a response content receiving module. 108 and an override determination module 110, wherein:
  • the login state information obtaining module 102 is configured to log in to the first account on the website to be tested, and obtain the first login state information of the first account.
  • the scan rule obtaining module 104 is configured to obtain a preset scan rule, where the scan rule includes a test address of the website to be tested and a target account attribute type;
  • the login state information modifying module 106 is configured to modify the first login state information according to the attribute value of the second account in the target account attribute type to obtain the second login state information;
  • the response content receiving module 108 is configured to access the website to be tested by using the second login status information, and receive the first response content sent by the website to be tested;
  • the override determination module 110 is configured to acquire feature information of the first response content according to the matching rule defined in the scan rule, and determine, according to the feature information and the matching rule, whether the first account is unauthorized.
  • the device further includes a test website detecting module 112, configured to access the website to be tested by using the login status information of the first account, and receive the first sent by the website to be tested.
  • the second response content in the case that the second response content includes the feature information of the first account, the scan rule acquisition module 104 is invoked.
  • the override determination module 110 is further configured to: when the feature information of the second response content matches the first account, determine that the first account is not overridden; and in the second response content In the case that the feature information matches the second account, it is determined that the first account is unauthorized.
  • test website detecting module 112 is further configured to: if the second response content does not include the feature information of the first account, determine that the test address of the website to be tested does not have the account right. The identification function switches the test address of the website to be tested.
  • the login status information is a UIN code, a cookie, or a session ID.
  • the identity information in the login state information corresponding to the first account may be determined according to the preset scanning rule when the website exceeds the vulnerability. Modifying the identity information corresponding to the second account, and then requesting the data of the website to be tested, and determining, according to the matching rule defined in the scanning rule, whether the account feature information included in the data returned by the website to be tested has exceeded the account. That is to say, after adopting the embodiment of the present application, the detecting personnel do not need to manually compare and modify the identity identification parameters of the account, and automatically automatically set the target account attribute type according to the target account attribute type determined in the scanning rule. The attribute value of the first account is changed to the attribute value of the second account. That is to say, the detecting personnel only need to define the target account attribute type in the scanning rule to automatically detect whether the account has an unauthorized violation, and reduce the account over-authority detection. The time required to increase the efficiency of the account over-authorization detection.
  • FIG. 6 illustrates a terminal of a von Neumann system-based computer system that operates the identification method of the above account rights.
  • the computer system can be a terminal device such as a smartphone, a tablet, a palmtop, a laptop, or a personal computer.
  • an external input interface 1001, a processor 1002, a memory 1003, and an output interface 1004 connected through a system bus may be included.
  • the external input interface 1001 may include at least a network interface 10012.
  • the memory 1003 may include an external memory 10032 (eg, a hard disk, an optical disk, or a floppy disk, etc.) and an internal memory 10034.
  • the output interface 1004 can include at least a device such as a display 10042.
  • the operation of the method is based on a computer program, and the program file of the computer program is stored in the external memory 10032 of the aforementioned von Neumann system-based computer system, and is loaded into the internal memory 10034 at runtime. Then, it is compiled into a machine code and then transferred to the processor 1002 for execution, so that a logic login state information acquisition module 102, a scan rule acquisition module 104, and a login state information modification module 106 are formed in the von Neumann system-based computer system.
  • the input parameters are received by the external input interface 1001, and are transferred to the cache in the memory 1003, and then input to the processor 1002 for processing, and the processed result data is cached in the memory 1003. Subsequent processing is performed or passed to the output interface 1004 for output.
  • processor 1002 is configured to perform the following operations:
  • the processor 1002 is further configured to use the login status information of the first account to access the website to be tested, and receive the second response content sent by the website to be tested; in the second response content.
  • the processor 1002 is further configured to use the login status information of the first account to access the website to be tested, and receive the second response content sent by the website to be tested; in the second response content.
  • the acquiring the preset scan rule is performed.
  • the processor 1002 is further configured to: when the feature information of the second response content matches the first account, determine that the first account is not overridden; in the second response content When the feature information matches the second account, it is determined that the first account is unauthorized.
  • the processor 1002 is further configured to: when the second response content does not include the feature information of the first account, determine that the test address of the website to be tested does not have the function of identifying the account authority. , switching the test address of the website to be tested.
  • the target account attribute type is an attribute item type corresponding to one or more of the at least one attribute item included in the first login status information
  • the processor 1002 passes the following Steps: performing the modifying the first login state information according to the attribute value in the target account attribute type in the information of the second account, and obtaining the second login state information: determining the information of the second account in the target account attribute type Attribute value;
  • the attribute value of the attribute item corresponding to the target account attribute type is modified to the attribute of the second account under the target account attribute type. The value, thereby obtaining the second login state information.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请实施例公开了一种账号权限的识别方法，包括：在待测网站上登录第一账号，获取第一账号的第一登录态信息；获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；根据第二账号在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。此外，本申请实施例还公开了一种账号权限的识别装置。

Description

账号权限的识别方法及装置
本申请要求于2017年04月11日提交中国专利局、申请号为201710234539.7、发明名称为“帐号权限的识别方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，尤其涉及一种账号权限的识别方法及装置。
背景技术
随着互联网技术的不断发展，越来越多的应用或者功能是通过互联网实现的，这样要求互联网中的可能导致用户资料泄漏或者其他安全问题的漏洞都应该尽量避免。在目前存在的互联网漏洞中，越权漏洞是一个不可忽视的重要的漏洞。
越权漏洞是指网站对于权限划分不严格导致A用户可利用某些方法或手段访问B用户的权限控制体系，从而达到窃取信息、修改信息、添加信息、删除信息等其他敏感的操作。如通过URL(统一资源定位符，UniformResourceLocator)访问网页的情况下，由于web程序设计缺陷，攻击者利用URL传入参数的可猜测性，通过变更输入的参数值，就可能造成横向越权访问，拿到他人私有信息。
因为越权漏洞一旦存在，攻击者可以伪造他人身份进行交易、支付、修改密码、获取他人隐私信息等，会对用户的账号安全造成极大的隐患，因此，在测试阶段必须对待测网站中可能存在的漏洞进行检测。
发明内容
本申请实施例提供了一种账号权限的识别方法。
一种账号权限的识别方法，包括：
在待测网站上登录第一账号，获取第一账号的第一登录态信息；
获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
此外，本申请实施例还提出了一种账号权限的识别装置。
一种账号权限的识别装置，包括：处理器和存储器，所述存储器上存储有计算机可读指令，所述计算机可读指令由所述处理器执行以完成以下操作：
在待测网站上登录第一账号，获取第一账号的第一登录态信息；
获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
此外，本申请实施例还提供了一种账号权限的识别方法，用于终端或服务器，所述终端或服务器包括：处理器和存储器，所述方法包括：
在待测网站上登录第一账号，获取第一账号的第一登录态信息；
获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
此外，本申请实施例还提出了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行以下步骤：
在待测网站上登录第一账号，获取第一账号的第一登录态信息；
获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
附图简要说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
其中：
图1为本申请实施环境的示意图；
图2为本申请实施例提供的一种账号权限的识别方法的流程示意图；
图3为本申请实施例中实现账号权限的识别方法的终端的各个模块之间的数据传输示意图；
图4为本申请实施例提供的一种账号权限的识别方法的流程示意图；
图5为本申请实施例提供的一种账号权限的识别装置的结构示意图；
图6为本申请实施例中运行前述账号权限的识别方法的计算机设备的结构示意图。
实施本发明的方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是 全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
在一些越权漏洞的检测方法中，对越权漏洞的检测主要是通过人工进行渗透性测试，然后由专业的渗透测试人员针对网站不同的帐号体系做权限识别，并通过技术手段检测网站是否真正有效区分了不同用户的权限。全凭人工对不同的账号体系进行权限识别，这样不仅效率较低，耗费人力物力，而且不能确保覆盖检测到测试范围内的账号，即不能保证检测到所有的漏洞。
本申请实施例提出了一种账号权限的识别方法和装置，可以减少账号越权检测所需要耗费的时间，能够覆盖网站中的所有账号，提高了账号越权检测的效率。
图1为本申请实施环境的示意图。如图1所示，该实施环境中包括检测设备10和服务器20。检测设备10中包括一个账号权限的识别装置30。在需要对服务器20运行的某一个待测网站是否存在账号越权漏洞进行检测时，账号的权限识别装置30可以在待测网站上登录第一账号，获取第一账号的第一登录态信息；获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。账号的权限识别装置30的实现可依赖于计算机程序，该计算机程序可运行于基于冯诺依曼体系的计算机系统之上，该计算机程序可以是账号越权漏洞的检测应用程序。所述检测设备10可以是运行上述计算机程序的例如智能手机、平板电脑、个人电脑等服务器或终端。
图2为本申请实施例提供的一种账号权限的识别方法的流程示意图。以终端设备作为检测设备为例来说明该方法。具体地，如图2所示，上述账号权限的识别方法包括如下步骤S102-S110：
步骤S102：在待测网站上登录第一账号，获取第一账号的第一登录态信息。
账号越权的检测是针对某一个网站进行的，即待测网站。在本申请实施例中，需要对某一个包含了多个账号的网站进行越权漏洞检测时，该网站即为待测网站。
在本申请实施例中，需要对某一个账号是否存在账号越权的现象进行检测，该账号即为第一账号。需要说明的是，在本申请实施例中，若需要对网站上所包含的所有的账号是否存在账号越权的漏洞进行检测时，可以遍历所有的账号，并针对遍历到的每一个账号执行步骤S102-S110。
账号A是否越权是指在待测网站上，A用户是否可以通过某些方法或手段访问到B用户的权限控制体系，对B用户的信息进行修改、删减、添加等操作。在本申请实施例中，账号越权的检测即判断第一账号下是否可以访问第二账号下的相关数据。
首先在待测网站上，通过第一账号对应的账号、密码等身份验证信息来登录待测网站，也就是说，在终端的APP或者浏览器访问待测网站是通过登录的第一账号的身份信息进行访问的，也就是说，用户当前是否具备访问某一个数据的权限或者用户当前是否可以对访问到的数据进行修改等操作，均是由登录的第一账号是否具备相应的权限来确定的。
在第一账号登录成功之后，获取第一账号的登录态信息，例如，登录态信息可以是与第一账号对应的UIN(Unique Identification Number，唯一识别码)码、cookies信息、Session ID等与第一账号的身份信息唯一对应的数据，是可以用来验证当前账号的身份信息的唯一标识信息。
具体地，UIN码是账号在网站注册的过程中，网站分配给注册者的身份验证码，并且，UIN码是永久和不能修改的，除非注册者身份变更导致UIN被删除。也就是说，在网站中，与第一账号对应的UIN码是确定的，并且该UIN码与其他用户的UIN码是不相同的。用UIN码可以唯一标识当前登录的第一账号，若登录的账号变更或者被篡改，其对应的UIN码也会随之发生改变。
Cookie(或cookies)是网站为了辨别用户身份而存储在用户本地终端上的数据(浏览器缓存)。在用户通过终端的浏览器访问网站时，终端可以在发送HTTP请求时一并将用户的cookie发送给服务器。服务器根据用户的cookie在其数据库中查找与该cookie匹配的用户身份信息或者用户验证信息。也就 是说，如果cookie发生了变化，服务器找到的与当前cookie匹配的用户身份信息也会发生变化。
Session ID是服务器为第一账号的请求创建session时生成的与该session对应的标识，session是为服务器中存储于第一账号对应的身份验证信息的数据块，通过Session ID可以在session列表中查找到与该Session ID对应的session，然后确定与Session ID对应的身份验证信息。也就是说，一旦Session ID更改或者被篡改，在查找用户身份验证信息时会出现查找不到或者查找到的用户身份验证信息也会发生变化的情况。
综上，登录态信息可以唯一确定当前的账号，如果登录态信息变化，那么根据登录态信息确定的对应的账号也会发生变化，可能为别的账号。在本申请实施例中，登录态信息可以是UIN码、cookies信息、Session ID以及其他可以标识用户身份信息的参数中的一个或者多个参数的组合。
在本申请实施例中，登录态信息的获取可以是通过登录态拉取接口函数来实现的。例如，通过登录态拉取接口函数获取第一账号登录以后的cookie。
步骤S104：获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型。
在本申请实施例中，在通过登录态拉取接口获取到第一账号的登录态信息之后，在访问待测网站时，扫描器会根据第二账号的信息修改第一账号的登录态信息，并将修改后的访问请求以Http请求数据包的形式发送给服务器。然后，扫描器根据服务器返回的数据进行判断，判断第一账号是否发生账号越权。
扫描器是一类自动检测本地或远程主机安全弱点的程序，它能够快速、准确地发现扫描目标存在的漏洞并提供给使用者扫描结果；工作原理是扫描器向目标计算机发送数据包，然后根据对方反馈的信息来判断是否发生账号越权。
具体地，在本申请实施例中，首先需要确定与待测网站对应的测试地址，即访问地址。例如，在待测网站为购物网站的情况下，测试地址可以为购物网站中的一个账号登录地址或者支付链接。
进一步的，还需要确定当前扫描器在判断第一账号是否发生账号越权的过程中需要的目标账号属性类型，即扫描器需要根据各类型的目标账号属性进行账号的越权检测。需要说明的是，目标账号属性类型为登录态信息中包含的至 少一个属性项中的一个或者多个指定的属性项对应的属性项类型。例如，第一账号的登录态信息包含了第一账号的UIN码、以及账号标识、账号昵称的情况下，目标账号属性类型为UIN码、账号标识、账号昵称中的一个或者多个。
步骤S106：根据第二账号在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息。
如前所述，在本申请实施例中，需要判断第一账号是否可以越权访问第二账号下的数据或者进行某项功能操作。需要说明的是，在本申请实施例中，第二账号可以是与第一账号关联的关联账号，也可以是待测网站上的任意一个账号。
在目标账号属性类型确定之后，确定第二账号的信息中在目标账号属性类型下的属性值，并且，在第一账号对应的第一登录态信息中包含的多个属性项中，将与目标账号属性类型对应的属性项的属性值，修改为第二账号在目标账号属性类型下的属性值，从而得到第二登录态信息。所述第二账号的属性值可以是已知的，例如从服务器获得。
例如，在目标账号属性类型为UIN码的情况下，将第一登录态信息中的UIN码修改为第二账号对应的UIN码。
步骤S108：使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容。
在本申请实施例中，若使用第一登录态信息访问待测网站，即为通过第一账号对应的身份权限来访问待测网站，进行与第一账号的权限对应的操作。
而采用第二登录态信息访问待测网站，因为在第二登录态信息中仅将目标账号属性类型下的属性值修改为了第二账号在目标账号属性类型下的属性值，并未修改其他信息，并且，第二账号也并未登录待测网站。所述其他信息例如包括Http请求中的referer、User Agent、Host等协议字段。在此种情况下，使用包含了第二账号在目标账号属性类型下的属性值的第二登录态信息来访问待测网站，接收到待测网站的服务器返回的相应内容中，分为下面几种情况：
第一，因为服务器在接收到访问请求时，会对携带的第二登录态信息中包含的相关信息进行校验，例如，根据登录态信息中包含的UIN码进行身份校 验，确定UIN码所对应的账号为第二账号，因此，返回的内容与第二账号相关；
第二，因为服务器在接收到访问请求时，没有对携带的第二登录态信息中包含的与目标账号属性类型下的属性值进行校验，因为服务器并不知道登录态信息与第二账号有关，因此，返回的内容与第二账号无关，也就是说，会继续按照第一账号的相关权限进行操作。
具体地，判断第一账号是否存在账号越权的过程即步骤S110：根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
因为在进行账号越权的检测过程中，需要对账号的各个属性进行全方位的检测，因此，在进行账号越权检测的过程中，根据实际检测的需要，确定扫描规则中的目标账号属性类型。
另外，在扫描规则中，不仅包含了目标账号属性类型，还包括了在判断账号是否越权的具体过程中对服务器返回的响应内容进行分析的过程中用到的匹配规则。
在本申请实施例中，并不对服务器返回的内容的全部进行比对和校验，而是仅对可以确定账号是否越权的部分内容进行比对和校验。例如，在一个具体的实施例中，在用户登录网站之后，会在网站的网页视图上展示与登录的账号对应的标识(例如，Hi，Apple！)，从而用户可以通过该展示的账号标识来确定当前网页视图所对应的账号。在此种情况下，只需要对网页视图中展示的与登录的账号对应的账号标识进行判断，即可获知对与该网页视图对应的登录态信息中所随影的账号。
在一个具体的实施例中，根据匹配规则所确定的需要获取的响应内容的特征信息，获取第一响应内容的特征信息，然后根据该特征信息和匹配规则确定第一账号是否越权。
例如，上述确定第一账号是否越权的过程为：在所述第二响应内容的特征信息与所述第一账号匹配的情况下，确定所述第一账号未越权；在所述第二响应内容的特征信息与所述第二账号匹配的情况下，确定所述第一账号越权。
也就是说，若通过第二登录态信息发起对待测网站的访问请求的情况下，若服务器返回的响应内容中的预设的特征信息与第一账号匹配，则第一账号未 越权，若服务器返回的响应内容中的预设的特征信息与第一账号不匹配，例如，与第二账号是匹配的情况下，第一账号越权。
例如，特征信息反映的是服务器在接收到HTTP请求之后判断HTTP请求的发起者的身份以及对应的权限的过程中，确定的发起者的身份信息，例如发起者的UIN码；若服务器返回的响应内容中的特征信息所包含的UIN码与第一账号对应，则确定特征信息与第一账号匹配，反之，若服务器返回的响应内容中的特征信息所包含的UIN码与第二账号对应，则确定特征信息与第二账号匹配。
如图3所示，图3展示了实现上述账号权限的识别方法的终端与待测网站(目标网站)之间的交互关系。在终端上通过已注册的第一账号登录待测网站之后，可以通过登录态拉取接口获取登录的第一账号的登录态信息并发送给扫描器。扫描器首选需要确定与待测网站对应的测试地址，例如为购物网站中的一个账号登录地址或者支付链接。进一步地，还需要确定当前扫描器在判断第一账号是否发生账号越权的过程中需要的目标账号属性类型。目标账号属性类型为登录态信息中包含的至少一个属性项中的一个或者多个指定的属性项对应的属性项类型。例如，在图3中，A用户的目标账号属性类型为A用户的UIN码和A用户的cookie。然后，扫描器根据第二账号(例如B用户)在目标账号属性类型下的属性值(例如B用户的UIN码和B用户的cookie)修改所述第一登录态信息(例如A用户的UIN和A用户的cookie)，得到第二登录态信息。扫描器然后根据修改后的登录态信息以及待测网站的网址等有效数据(payload)进行封装生成相应的HTTP请求然后发送给待测网站对应的服务器，并接收由服务器返回的数据；扫描器针对接收到的数据进行分析，来判断是否存在越权漏洞，其中，扫描器生成HTTP请求的过程中的相关规则、以及对返回的数据进行分析的规则均为与扫描器对应的扫描规则，并且，扫描规则由于扫描器相连的规则引擎来提供和设置。
进一步的，在本申请实施例中，在检测第一账号是否可以越权与第二账号对应的数据之前，还需要判断当前网站是否具备账号识别功能，例如，若待测网站上的所有用户均具备待测网站上的所有数据的访问权限或操作权限，或者，在任意账号发起对待测网站上的数据的访问请求或者操作请求时，并不对 账号进行校验或者账号是否具备权限进行校验；在此种情况下，不存在账号是否越权的问题。
如图4所示，图4展示了一种账号权限的识别方法的流程示意图，在对第一账号是否存在越权的判断之前，还需要判断测试网址是否支持账号越权的检测和判断。
如图4所示，在图2的基础上，在步骤S102的在待测网站上登录第一账号，获取第一账号的第一登录态信息之后，步骤S104的获取预设的扫描规则之前，本申请实施例还包括步骤S112-S118。
步骤S112，访问所述待测网站。具体地，根据本申请实施例，在获取第一账号的第一登录态信息之后还包括：使用所述第一账号的登录态信息访问所述待测网站。
步骤S114，接收所述待测网站返回的第二响应内容。
步骤S116，判断第二响应内容中是否包含第一账号的特征信息。
在所述第二响应内容中包含所述第一账号的特征信息的情况下，执行所述获取预设的扫描规则的步骤S104；在所述第二响应内容中不包含所述第一账号的特征信息的情况下，确定所述待测网站的测试地址不具备账号权限的识别功能，执行步骤S118，切换所述待测网站的测试地址。
也就是说，如果待测网站中并不存在对账号进行权限判断的逻辑，也不存在后续的越权判断的逻辑，在使用第一账号的登录态信息访问待测网站时待测网站的服务器返回的响应内容中应该不包含任何与第一账号对应的相关数据。因此，在使用第一账号的登录态信息访问待测网站时，如果待测网站返回的响应内容中不包含有与第一账号对应的特征信息，则不需要继续对待测网站进行账号越权的检测，直接中止本方法的执行。
在一个实施例中，待测网站为购物网站，步骤S104中确定的待测网站的测试地址为购物网站中的一个商品链接；一般来讲，购物网站的商品链接对应的地址，一般不需要对用户的身份进行验证。若在此种情况下服务器返回的响应信息中不包含有第一账号对应的特征信息，则认为该待测网站的测试地址不具备账号越权的检测功能，需要切换测试地址。例如，切换至该待测网站的账 号登录地址或者支付链接等需要对用户身份进行校验的测试地址中，再次开始执行图4的步骤。
也就是说，待测网站的某一个测试地址不存在账号权限的检测功能的情况下，并不代表该待测网站的所有的测试地址都不具备账号权限的检测功能，为避免因为一个测试地址的检测结果而忽略其他地址下可能存在的账号越权漏洞的检测，需要切换至待测网站下其他测试地址进行账号越权的检测。
反之，若在返回的响应内容中包含有与第一账号对应的特征信息，则说明待测网站中存在对账号的身份进行校验的逻辑，后续可以对是否越权进行进一步的判断，因此，执行步骤S104-S110来判断第一账号是否越权。
根据本申请实施例，步骤S110具体可包括以下步骤：
步骤S120，根据扫描规则中定义的匹配规则获取第一响应内容的特征信息。
步骤S122，判断第一响应内容中包含的特征信息是否与第一账号匹配，如匹配，则确定第一账号越权，即到达步骤S126，然后检测流程结束；如不匹配，则确定第一账号未越权，即到达步骤S124，然后检测流程结束。
根据一个具体的实施例，在待测网站为即时通信应用网站的场景下，可以首先拉取A用户的登录态，然后选取另一用户B，此时不需要拉取B用户的登录态信息。将B用户的网站访问请求中的payload设置成A用户登录态，对网站发送请求，并判断网站上是否含有A用户特征信息。特征信息为预先设定的(例如：A用户的账号、A用户昵称(经过唯一化处理)等)。如果存在A用户特征信息，说明网站对用户的帐号体系有一定的识别功能，可以进行后续的越权检测逻辑，如果没有则直接跳出并中断扫描。
当检测到网站存在A用户的特征信息时，可以将A用户登录态中的UIN替换成B用户的UIN。此时再次组装http包发送至服务器，若网站仍然显示A用户特征信息，则说明网站不存在越权漏洞，当网站原有的A用户特征信息替换为B用户的特征信息时，说明网站存在越权漏洞。
通过本申请实施例，不需要检测人员手动的去对比和修改账号的身份识别参数，会根据扫描规则中确定的目标账号属性类型，自动的将目标账号属性类型下的第一账号的属性值修改为第二账号的属性值，也就是说，检测人员只需 要定义扫描规则中的目标账号属性类型即可自动完成对账号是否存在越权漏洞进行检测，减少了账号越权检测所耗费的时间，提高了账号越权检测的效率。
此外，在一个实施例中，如图5所示，还提出了一种账号权限的识别装置，包括登录态信息获取模块102、扫描规则获取模块104、登录态信息修改模块106、响应内容接收模块108以及越权判断模块110，其中：
登录态信息获取模块102，用于在待测网站上登录第一账号，获取第一账号的第一登录态信息；
扫描规则获取模块104，用于获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
登录态信息修改模块106，用于根据第二账号在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
响应内容接收模块108，用于使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
越权判断模块110，用于根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
在一个实施例中，如图5所示，上述装置还包括测试网站检测模块112，用于使用所述第一账号的登录态信息访问所述待测网站，接收所述待测网站发送的第二响应内容；在所述第二响应内容中包含所述第一账号的特征信息的情况下，调用所述扫描规则获取模块104。
在一个实施例中，越权判断模块110还用于在所述第二响应内容的特征信息与所述第一账号匹配的情况下，确定所述第一账号未越权；在所述第二响应内容的特征信息与所述第二账号匹配的情况下，确定所述第一账号越权。
在一个实施例中，测试网站检测模块112还用于在所述第二响应内容中不包含所述第一账号的特征信息的情况下，确定所述待测网站的测试地址不具备账号权限的识别功能，切换所述待测网站的测试地址。
在一个实施例中，登录态信息为UIN码、cookie或session ID。
采用了上述账号权限的识别方法和装置之后，再需要对某一个待测网站是否存在账号越权漏洞进行检测时，可以根据预设的扫描规则，将第一账号对应 的登录态信息中的身份信息修改为第二账号对应的身份信息，然后项待测网站请求数据，并根据扫描规则中定义的匹配规则来判断待测网站返回的数据中包含的账号特征信息是否发生了账号越权。也就是说，采用了本申请实施例之后，不需要检测人员手动的去对比和修改账号的身份识别参数，会自动根据扫描规则中确定的目标账号属性类型，自动的将目标账号属性类型下的第一账号的属性值修改为第二账号的属性值，也就是说，检测人员只需要定义扫描规则中的目标账号属性类型即可自动完成对账号是否存在越权漏洞进行检测，减少了账号越权检测所需要耗费的时间，提高了账号越权检测的效率。
在一个实施例中，如图6所示，图6展示了一种运行上述账号权限的识别方法的基于冯诺依曼体系的计算机系统的终端。该计算机系统可以是智能手机、平板电脑、掌上电脑、笔记本电脑或个人电脑等终端设备。具体地，可包括通过系统总线连接的外部输入接口1001、处理器1002、存储器1003和输出接口1004。其中，外部输入接口1001例如可至少包括网络接口10012。存储器1003可包括外存储器10032(例如硬盘、光盘或软盘等)和内存储器10034。输出接口1004可至少包括显示屏10042等设备。
在本申请实施例中，本方法的运行基于计算机程序，该计算机程序的程序文件存储于前述基于冯诺依曼体系的计算机系统的外存储器10032中，在运行时被加载到内存储器10034中，然后被编译为机器码之后传递至处理器1002中执行，从而使得基于冯诺依曼体系的计算机系统中形成逻辑上的登录态信息获取模块102、扫描规则获取模块104、登录态信息修改模块106、响应内容接收模块108、越权判断模块110以及测试网站检测模块112。且在上述账号权限的识别方法执行过程中，输入的参数均通过外部输入接口1001接收，并传递至存储器1003中缓存，然后输入到处理器1002中进行处理，处理的结果数据或缓存于存储器1003中进行后续地处理，或被传递至输出接口1004进行输出。
具体地，处理器1002用于执行如下操作：
在待测网站上登录第一账号，获取第一账号的第一登录态信息；
获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
在一个实施例中，处理器1002还用于使用所述第一账号的登录态信息访问所述待测网站，接收所述待测网站发送的第二响应内容；在所述第二响应内容中包含所述第一账号的特征信息的情况下，执行所述获取预设的扫描规则。
在一个实施例中，处理器1002还用于在所述第二响应内容的特征信息与所述第一账号匹配的情况下，确定所述第一账号未越权；在所述第二响应内容的特征信息与所述第二账号匹配的情况下，确定所述第一账号越权。
在一个实施例中，处理器1002还用于在所述第二响应内容中不包含所述第一账号的特征信息的情况下，确定所述待测网站的测试地址不具备账号权限的识别功能，切换所述待测网站的测试地址。
在一个实施例中，所述目标账号属性类型为所述第一登录态信息中包含的至少一个属性项中的一个或者多个指定的属性项对应的属性项类型，所述处理器1002通过以下步骤来执行所述根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息：确定第二账号的信息中在目标账号属性类型下的属性值；
在第一账号的信息中对应的第一登录态信息中包含的多个属性项中，将与目标账号属性类型对应的属性项的属性值，修改为第二账号在目标账号属性类型下的属性值，从而得到第二登录态信息。
以上所揭露的仅为本申请较佳实施例而已，当然不能以此来限定本申请之权利范围，因此依本申请权利要求所作的等同变化，仍属本申请所涵盖的范围。

Claims (19)

  1. 一种账号权限的识别方法，包括：
    在待测网站上登录第一账号，获取第一账号的第一登录态信息；
    获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
    根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
    使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
    根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
  2. 根据权利要求1所述的账号权限的识别方法，其中，所述获取第一账号的第一登录态信息之后还包括：
    使用所述第一账号的登录态信息访问所述待测网站，接收所述待测网站发送的第二响应内容；
    在所述第二响应内容中包含所述第一账号的特征信息的情况下，执行所述获取预设的扫描规则。
  3. 根据权利要求1所述的账号权限的识别方法，其中，所述根据所述特征信息和所述匹配规则确定所述第一账号是否越权包括：
    在所述第二响应内容的特征信息与所述第一账号匹配的情况下，确定所述第一账号未越权；
    在所述第二响应内容的特征信息与所述第二账号匹配的情况下，确定所述第一账号越权。
  4. 根据权利要求2所述的账号权限的识别方法，其中，所述接收所述待测网站发送的第二响应内容之后还包括：
    在所述第二响应内容中不包含所述第一账号的特征信息的情况下，确定所述待测网站的测试地址不具备账号权限的识别功能，切换所述待测网站的测试地址。
  5. 根据权利要求1至4任一所述的账号权限的识别方法，其中，所述登录态信息为UIN码、cookie或session ID。
  6. 根据权利要求1所述的账号权限的识别方法，其中，所述目标账号属性类型为所述第一登录态信息中包含的至少一个属性项中的一个或者多个指定的属性项对应的属性项类型，所述根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息包括：
    确定第二账号的信息中在目标账号属性类型下的属性值；
    在第一账号的信息中对应的第一登录态信息中包含的多个属性项中，将与目标账号属性类型对应的属性项的属性值，修改为第二账号在目标账号属性类型下的属性值，从而得到第二登录态信息。
  7. 一种账号权限的识别装置，包括：处理器和存储器，所述存储器上存储有计算机可读指令，所述计算机可读指令由所述处理器执行以完成以下操作：
    在待测网站上登录第一账号，获取第一账号的第一登录态信息；
    获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
    根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
    使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
    根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
  8. 根据权利要求7所述的账号权限的识别装置，其中，所述计算机可读指令进一步由所述处理器执行以完成以下操作：
    使用所述第一账号的登录态信息访问所述待测网站，接收所述待测网站发送的第二响应内容；
    在所述第二响应内容中包含所述第一账号的特征信息的情况下，执行所述预设的扫描规则。
  9. 根据权利要求7所述的账号权限的识别装置，其中，所述根据所述特征信息和所述匹配规则确定所述第一账号是否越权包括：
    在所述第二响应内容的特征信息与所述第一账号匹配的情况下，确定所述第一账号未越权；
    在所述第二响应内容的特征信息与所述第二账号匹配的情况下，确定所述第一账号越权。
  10. 根据权利要求8所述的账号权限的识别装置，其中，所述计算机可读指令由所述处理器执行以完成以下操作：
    在所述第二响应内容中不包含所述第一账号的特征信息的情况下，确定所述待测网站的测试地址不具备账号权限的识别功能，切换所述待测网站的测试地址。
  11. 根据权利要求7至10任一所述的账号权限的识别装置，其中，所述登录态信息为UIN码、cookie或session ID。
  12. 根据权利要求7所述的账号权限的识别装置，其中，所述目标账号属性类型为所述第一登录态信息中包含的至少一个属性项中的一个或者多个指定的属性项对应的属性项类型，所述根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息包括：
    确定第二账号的信息中在目标账号属性类型下的属性值；
    在第一账号的信息中对应的第一登录态信息中包含的多个属性项中，将与目标账号属性类型对应的属性项的属性值，修改为第二账号在目标账号属性类型下的属性值，从而得到第二登录态信息。
  13. 一种账号权限的识别方法，用于终端或服务器，所述终端或服务器包括：处理器和存储器，所述方法包括：
    在待测网站上登录第一账号，获取第一账号的第一登录态信息；
    获取预设的扫描规则，所述扫描规则包括待测网站的测试地址和目标账号属性类型；
    根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息；
    使用所述第二登录态信息访问所述待测网站，接收所述待测网站发送的第一响应内容；
    根据所述扫描规则中定义的匹配规则获取所述第一响应内容的特征信息，根据所述特征信息和所述匹配规则确定所述第一账号是否越权。
  14. 根据权利要求13所述的账号权限的识别方法，其中，所述获取第一账号的第一登录态信息之后还包括：
    使用所述第一账号的登录态信息访问所述待测网站，接收所述待测网站发送的第二响应内容；
    在所述第二响应内容中包含所述第一账号的特征信息的情况下，执行所述获取预设的扫描规则。
  15. 根据权利要求13所述的账号权限的识别方法，其中，所述根据所述特征信息和所述匹配规则确定所述第一账号是否越权包括：
    在所述第二响应内容的特征信息与所述第一账号匹配的情况下，确定所述第一账号未越权；
    在所述第二响应内容的特征信息与所述第二账号匹配的情况下，确定所述第一账号越权。
  16. 根据权利要求14所述的账号权限的识别方法，其中，所述接收所述待测网站发送的第二响应内容之后还包括：
    在所述第二响应内容中不包含所述第一账号的特征信息的情况下，确定所述待测网站的测试地址不具备账号权限的识别功能，切换所述待测网站的测试地址。
  17. 根据权利要求13至16任一所述的账号权限的识别方法，其中，所述登录态信息为UIN码、cookie或session ID。
  18. 根据权利要求13所述的账号权限的识别方法，其中，所述目标账号属性类型为所述第一登录态信息中包含的至少一个属性项中的一个或者多个指定的属性项对应的属性项类型，所述根据第二账号的信息中在目标账号属性类型下的属性值修改所述第一登录态信息，得到第二登录态信息包括：
    确定第二账号的信息中在目标账号属性类型下的属性值；
    在第一账号的信息中对应的第一登录态信息中包含的多个属性项中，将与目标账号属性类型对应的属性项的属性值，修改为第二账号在目标账号属性类型下的属性值，从而得到第二登录态信息。
  19. 一种计算机可读存储介质，其中，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述权利要求1-6中任一项账号权限的识别方法。
PCT/CN2018/082355 2017-04-11 2018-04-09 账号权限的识别方法及装置 WO2018188558A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710234539.7A CN108696490A (zh) 2017-04-11 2017-04-11 账号权限的识别方法及装置
CN201710234539.7 2017-04-11

Publications (1)

Publication Number Publication Date
WO2018188558A1 true WO2018188558A1 (zh) 2018-10-18

Family

ID=63793125

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/082355 WO2018188558A1 (zh) 2017-04-11 2018-04-09 账号权限的识别方法及装置

Country Status (2)

Country Link
CN (1) CN108696490A (zh)
WO (1) WO2018188558A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109902022A (zh) * 2019-03-14 2019-06-18 深圳壹账通智能科技有限公司 针对垂直越权漏洞自动进行测试的方法及相关设备
CN110287660A (zh) * 2019-05-21 2019-09-27 深圳壹账通智能科技有限公司 访问权限控制方法、装置、设备及存储介质
CN111241547A (zh) * 2018-11-28 2020-06-05 阿里巴巴集团控股有限公司 一种越权漏洞的检测方法、装置及系统
CN111414614A (zh) * 2020-03-20 2020-07-14 上海中通吉网络技术有限公司 越权检测方法和辅助装置
CN112464250A (zh) * 2020-12-15 2021-03-09 光通天下网络科技股份有限公司 越权漏洞自动检测方法、设备及介质
CN113014448A (zh) * 2021-02-23 2021-06-22 深信服科技股份有限公司 一种登录状态规则提取方法、装置及电子设备
CN113590461A (zh) * 2021-06-01 2021-11-02 的卢技术有限公司 一种基于fidder实现汽车用户数据越权的测试方法

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110084044A (zh) * 2019-03-14 2019-08-02 深圳壹账通智能科技有限公司 针对水平越权漏洞自动进行测试的方法及相关设备
CN110572417B (zh) * 2019-10-22 2021-11-09 腾讯科技（深圳）有限公司 用于提供登录票据的方法、装置、服务器以及存储介质
CN110881032B (zh) * 2019-11-06 2022-02-22 国网浙江武义县供电有限公司 账号越权操作的识别方法及装置
CN111125718A (zh) * 2019-12-24 2020-05-08 北京三快在线科技有限公司 越权漏洞的检测方法、装置、设备及存储介质
CN111324539A (zh) * 2020-02-28 2020-06-23 深圳壹账通智能科技有限公司 账号切换测试方法和系统
CN111683047B (zh) * 2020-04-30 2023-05-30 中国平安财产保险股份有限公司 越权漏洞检测方法、装置、计算机设备及介质
CN113986956B (zh) * 2021-12-29 2022-03-25 深圳红途科技有限公司 数据异常查询分析方法、装置、计算机设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8191117B2 (en) * 2007-10-25 2012-05-29 Anchorfree, Inc. Location-targeted online services
CN104519070A (zh) * 2014-12-31 2015-04-15 北京奇虎科技有限公司 网站权限漏洞检测方法和系统
CN105357195A (zh) * 2015-10-30 2016-02-24 深圳市深信服电子科技有限公司 web访问的越权漏洞检测方法及装置
CN106470132A (zh) * 2015-08-19 2017-03-01 阿里巴巴集团控股有限公司 水平权限测试方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1269286B1 (en) * 2000-03-03 2008-11-19 International Business Machines Corporation System for determining web application vulnerabilities
CN101964025B (zh) * 2009-07-23 2016-02-03 北京神州绿盟信息安全科技股份有限公司 Xss检测方法和设备
US10108801B2 (en) * 2012-11-15 2018-10-23 Qualys, Inc. Web application vulnerability scanning

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8191117B2 (en) * 2007-10-25 2012-05-29 Anchorfree, Inc. Location-targeted online services
CN104519070A (zh) * 2014-12-31 2015-04-15 北京奇虎科技有限公司 网站权限漏洞检测方法和系统
CN106470132A (zh) * 2015-08-19 2017-03-01 阿里巴巴集团控股有限公司 水平权限测试方法及装置
CN105357195A (zh) * 2015-10-30 2016-02-24 深圳市深信服电子科技有限公司 web访问的越权漏洞检测方法及装置

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111241547A (zh) * 2018-11-28 2020-06-05 阿里巴巴集团控股有限公司 一种越权漏洞的检测方法、装置及系统
CN111241547B (zh) * 2018-11-28 2023-05-12 阿里巴巴集团控股有限公司 一种越权漏洞的检测方法、装置及系统
CN109902022A (zh) * 2019-03-14 2019-06-18 深圳壹账通智能科技有限公司 针对垂直越权漏洞自动进行测试的方法及相关设备
CN110287660A (zh) * 2019-05-21 2019-09-27 深圳壹账通智能科技有限公司 访问权限控制方法、装置、设备及存储介质
CN111414614A (zh) * 2020-03-20 2020-07-14 上海中通吉网络技术有限公司 越权检测方法和辅助装置
CN111414614B (zh) * 2020-03-20 2024-04-05 上海中通吉网络技术有限公司 越权检测方法和辅助装置
CN112464250A (zh) * 2020-12-15 2021-03-09 光通天下网络科技股份有限公司 越权漏洞自动检测方法、设备及介质
CN113014448A (zh) * 2021-02-23 2021-06-22 深信服科技股份有限公司 一种登录状态规则提取方法、装置及电子设备
CN113014448B (zh) * 2021-02-23 2022-09-30 深信服科技股份有限公司 一种登录状态规则提取方法、装置及电子设备
CN113590461A (zh) * 2021-06-01 2021-11-02 的卢技术有限公司 一种基于fidder实现汽车用户数据越权的测试方法
CN113590461B (zh) * 2021-06-01 2024-04-23 的卢技术有限公司 一种基于fidder实现汽车用户数据越权的测试方法

Also Published As

Publication number Publication date
CN108696490A (zh) 2018-10-23

Similar Documents

Publication Publication Date Title
WO2018188558A1 (zh) 账号权限的识别方法及装置
US10164993B2 (en) Distributed split browser content inspection and analysis
US10270758B2 (en) Login method, server, and login system
CN107135073B (zh) 接口调用方法和装置
US10601865B1 (en) Detection of credential spearphishing attacks using email analysis
US8087088B1 (en) Using fuzzy classification models to perform matching operations in a web application security scanner
JP6559694B2 (ja) 自動ｓｄｋ受容
US11770385B2 (en) Systems and methods for malicious client detection through property analysis
CN108259514B (zh) 漏洞检测方法、装置、计算机设备和存储介质
CN103051630A (zh) 基于开放平台实现第三方应用授权的方法、装置及系统
CN107133516B (zh) 一种权限控制方法和系统
CN109547426B (zh) 业务响应方法及服务器
WO2020000749A1 (zh) 一种越权漏洞检测方法及装置
US20210006592A1 (en) Phishing Detection based on Interaction with End User
CN112671605B (zh) 一种测试方法、装置及电子设备
US20180039771A1 (en) Method of and server for authorizing execution of an application on an electronic device
CN112118238B (zh) 认证登录的方法、装置、系统、设备及存储介质
US10032027B2 (en) Information processing apparatus and program for executing an electronic data in an execution environment
US11595372B1 (en) Data source driven expected network policy control
CN113709136B (zh) 一种访问请求验证方法和装置
JP2016122262A (ja) 特定装置、特定方法および特定プログラム
US20230069731A1 (en) Automatic network signature generation
WO2018166365A1 (zh) 一种记录网站访问日志的方法和装置
CN112528286A (zh) 终端设备安全检测方法、关联设备以及计算机程序产品
US20170187716A1 (en) Service request modification

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18784556

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18784556

Country of ref document: EP

Kind code of ref document: A1