WO2020000749A1 - 一种越权漏洞检测方法及装置 - Google Patents

一种越权漏洞检测方法及装置 Download PDF

Info

Publication number
WO2020000749A1
WO2020000749A1 PCT/CN2018/108712 CN2018108712W WO2020000749A1 WO 2020000749 A1 WO2020000749 A1 WO 2020000749A1 CN 2018108712 W CN2018108712 W CN 2018108712W WO 2020000749 A1 WO2020000749 A1 WO 2020000749A1
Authority
WO
WIPO (PCT)
Prior art keywords
request
url
target
page content
server
Prior art date
Application number
PCT/CN2018/108712
Other languages
English (en)
French (fr)
Inventor
熊庆昌
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020000749A1 publication Critical patent/WO2020000749A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a method and a device for detecting unauthorized loopholes.
  • Unauthorized vulnerability is a common security vulnerability in World Wide Web (WEB) applications. It means that due to the negligence of the programmer, there is no strict restriction on the permissions or users required for an operation, which should lead to no operation. Authorized users can operate normally. The threat is that one account can control all user data of the website or server. For example, if an attacker uses a legitimate account, he can perform illegal operations on other account data with unauthorized loopholes, such as querying, deleting, and modifying conventional database commands.
  • WEB World Wide Web
  • the detection of unauthorized loopholes in the industry is basically manual detection.
  • testers perform penetration testing on WEB programs.
  • Manual testing takes a long time and is inefficient.
  • the embodiments of the present application provide a method and a device for detecting unauthorized loopholes, which can reduce manual processing steps, save time, and improve detection efficiency.
  • an embodiment of the present application provides a method for detecting unauthorized loopholes.
  • the method includes:
  • the server Sending a first request and a second request to the server, the first request including a target uniform resource locator URL, the second request including the target URL and a first identifier, the first identifier being used to identify identity information of the first user;
  • the page content returned by the server for the third request matches the page content returned for the second request, it is determined that the target URL has an unauthorized loophole.
  • an embodiment of the present application provides a device for detecting unauthorized loopholes.
  • the device includes:
  • a sending module configured to send a first request and a second request to the server, where the first request includes a target uniform resource locator URL, the second request includes the target URL and a first identifier, and the first identifier is used to identify the first User's identity information;
  • the sending module is further configured to send a third request to the server when the page content returned by the server for the first request does not match the page content returned for the second request, and the third request includes the target URL and A second identifier, which is used to identify identity information of the second user;
  • the first determining module is configured to determine that the target URL has an unauthorized loophole when the page content returned by the server for the third request matches the page content returned for the second request.
  • an embodiment of the present application provides a terminal, including a processor, an input device, an output device, and a memory.
  • the processor, the input device, the output device, and the memory are connected to each other.
  • the memory is used to store and support the execution of the terminal.
  • the computer program of the above method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method for detecting an unauthorized vulnerability in the first aspect.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute the foregoing first section.
  • a method for detecting unauthorized loopholes On the one hand, a method for detecting unauthorized loopholes.
  • FIG. 1 is a schematic flowchart of an unauthorized vulnerability detection method according to an embodiment of the present application
  • FIG. 2 is another schematic flowchart of a method for detecting unauthorized loopholes according to an embodiment of the present application
  • FIG. 3 is a schematic block diagram of an unauthorized vulnerability detection device according to an embodiment of the present application.
  • FIG. 4 is a schematic block diagram of a terminal provided by an embodiment of the present application.
  • the unauthorized loopholes in the embodiments of the present application may refer to any one of a vertical override, a horizontal override, or a cross override.
  • the vertical override is based on the control of the user, that is, the legitimate user with low authority obtains the ability of the user with high authority through some channels.
  • the rights owned by the first user and the second user in the embodiment of the application are different For example, if the first user is a legal user with low permissions, the second user is a legal user with high permissions.
  • Horizontal override is based on data-based control access, that is, legitimate users with the same rights can not only access their own private data, but also access the data privately owned by others with the same rights.
  • the first user and the second user in the embodiment of this application Users have the same permissions.
  • Cross overweight is the intersection of vertical overweight and horizontal overweight. The permission relationship between the first user and the second user in the embodiment of the present application is not limited.
  • the method for detecting unauthorized loopholes provided in the embodiments of the present application can be applied to terminals such as smart phones, tablet computers, and desktop computers.
  • the method for detecting unauthorized loopholes provided by the embodiments of the present application may be executed by any terminal of any of the types described above, or may be executed by a functional module (such as a browser, etc.) of any terminal of any of the types described above. No restrictions. For the convenience of description, the terminal will be described as an example below.
  • the first identifier and the second identifier may be represented by different cookies, for example, the first identifier is represented by cookie1 and the second identifier is represented by cookie2.
  • cookie refers to the data stored on the user's local terminal. Most WEB websites or servers use cookies to identify users. After a user logs in to a website or server with a username and password on the terminal, the website or server returns a cookie to the user's terminal. In subsequent visits, the When the terminal visits the website or server again, it will automatically bring the cookie, and the website or server can identify the user's identity information through the cookie.
  • the first identifier is cookie1 and the second identifier is cookie2.
  • Cookie1 is used to identify the identity information of the first user
  • cookie2 is used to identify the identity information of the second user.
  • the first user and the second user are respectively used to represent two different legal users.
  • FIG. 1 it is a schematic flowchart of a method for detecting unauthorized loopholes provided by an embodiment of the present application.
  • the method for detecting an unauthorized vulnerability can include steps:
  • the terminal sends a first request and a second request to the server.
  • the target user may use the terminal to register two different legal users on the WEB application provided by the server, such as the first user and the second user. After the first user and the second user are successfully registered, The server returns two identities to the terminal corresponding to the target user, which are cookie1 and cookie2. Cookie1 is used to identify the identity information of the first user, and cookie2 is used to identify the identity information of the second user.
  • the terminal can use cookie1 or cookie2 to log in to the server, and then use a crawling tool (such as a web crawler Heritrix, Scrapy, etc.) to crawl one or more target URLs in the server login state.
  • a crawling tool such as a web crawler Heritrix, Scrapy, etc.
  • the terminal may send to the server a first Hypertext Transfer Protocol (HTTP) request including the target URL and a second HTTP request including the target URL and cookie1.
  • HTTP Hypertext Transfer Protocol
  • the server receives the first HTTP request and the second HTTP request sent by the terminal, and may return the page content corresponding to the first HTTP request for the first HTTP request and return the page content corresponding to the second HTTP request for the second HTTP request. Page content.
  • some conditions for unauthorized vulnerability detection may be set on the terminal, such as setting at least one target parameter characteristic, and URLs that match any of the parameter characteristics of the at least one target parameter characteristic need to be subjected to unauthorized permission vulnerability detection.
  • the terminal may use cookie1 or cookie2 to log in to the server, and then use a crawler tool to crawl at least one original URL in the server login state.
  • the terminal may obtain a parameter part of each original URL in the at least one original URL, and detect whether the parameter part of each original URL includes one or more target parameter characteristics preset.
  • the terminal may send a first HTTP request including the target URL and a second HTTP request including the target URL and cookie1 to the server.
  • the server receives the first HTTP request and the second HTTP request sent by the terminal, and may return the page content corresponding to the first HTTP request for the first HTTP request and return the page content corresponding to the second HTTP request for the second HTTP request. Page content.
  • the preset target parameter characteristics may be fields such as ID, user_id, order_id, or userid in the URL parameter part, which are used to identify different users.
  • target URLs that need to be detected for unauthorized attacks are screened from all the crawled original URLs. While ensuring accuracy, the number of target URLs for unauthorized vulnerability detection is reduced, and the unauthorized permissions are improved. Processing efficiency of vulnerability detection.
  • the terminal logs in to Taobao's server using cookie1 and crawls all the original URLs of the login status. Assume that the crawled original URL has three URLs: URL1, URL4, and URL7. Check whether the parameter part of each URL crawled includes one or more fields such as ID, user_id, order_id, and userid. If the parameter part of URL1 Including the user_id field, and the parameter part of URL7 includes the ID and order_id fields, then the terminal can determine URL1 and URL7 as the target URLs respectively, that is, the target URLs that need to be detected for unauthorized exploits are filtered from the crawled original URLs. The terminal then sends an HTTP request containing URL1 and an HTTP request containing URL1 and cookie1 to the server for URL1, and sends an HTTP request containing URL7 and an HTTP request containing URL7 and cookie1 to the server for URL7.
  • the terminal sends an HTTP request containing URL1 and an HTTP request containing URL1 and cookie1 to the server for URL1, and
  • conditions for detecting an unauthorized vulnerability may be set on the terminal, such as at least one target page feature, and URLs corresponding to page content matching any page feature in the at least one target page feature need to be unauthorized.
  • Vulnerability detection before sending the first HTTP request and the second HTTP request to the server, the terminal may use cookie1 or cookie2 to log in to the server, and then use a crawler tool to crawl at least one original URL in the server login state. The terminal may obtain the page content corresponding to each original URL in the at least one original URL, and detect whether the page content corresponding to each original URL includes a preset one or more target page characteristics.
  • the terminal may send a first HTTP request including the target URL and a second HTTP request including the target URL and cookie1 to the server.
  • the server receives the first HTTP request and the second HTTP request sent by the terminal, and may return the page content corresponding to the first HTTP request for the first HTTP request and return the page content corresponding to the second HTTP request for the second HTTP request.
  • Page content The preset target page characteristics may be keywords related to user information, such as policy number, contact information, address, ID card ID, etc. in the page content. Because once the URL corresponding to the user's private information (such as policy number, contact information, address, ID card, etc.) has an unauthorized loophole, the user's private information may be leaked or changed. Therefore, the embodiment of this application uses page feature matching.
  • the target URLs that need to be detected for unauthorized exploits (that is, the URLs corresponding to the user's private information) are filtered. While ensuring accuracy, the number of target URLs for unauthorized exploit detection is reduced, and the number of targeted URLs is increased. Processing efficiency of unauthorized vulnerability detection.
  • the terminal logs in to Taobao's server using cookie1 and crawls all the original URLs of the login status. Assume that the crawled original URL includes three URLs: URL1, URL4, and URL7.
  • the page content corresponding to URL1 is C1
  • the page content corresponding to URL4 is C4
  • the page content corresponding to URL7 is C7.
  • the terminal uses the keyword detection method to detect whether the page content C1, C4, and C7 include one or more keywords such as the policy number, contact information, address, and ID card ID.
  • the terminal determines the URL 4 corresponding to the page content C4 as the target URL, that is, the target URL that needs to be detected for unauthorized loopholes is filtered from the crawled original URL.
  • the terminal then sends an HTTP request containing URL4 and an HTTP request containing URL4 and cookie1 to the server for URL4.
  • some conditions for unauthorized vulnerability detection may be set on the terminal, such as at least one target parameter feature and at least one target page feature, a URL that matches any parameter feature of the at least one target parameter feature, and / Or the URL corresponding to the content of the page that matches any of the page characteristics of the at least one target page characteristic needs to be subjected to an unauthorized vulnerability detection.
  • the terminal may use cookie1 or cookie2 to log in to the server, and then use a crawler tool to crawl at least one original URL in the server login state.
  • the terminal may obtain the parameter part of each original URL in the at least one original URL and the page content corresponding to each original URL, and may detect whether the parameter part of each original URL includes a preset one or more target parameter characteristics , And / or detect whether the page content corresponding to each original URL includes one or more target page characteristics that are preset, if a parameter portion of an original URL includes one or more target parameter characteristics that are preset, and / or The page content corresponding to the certain original URL includes one or more preset target page characteristics, and the terminal may determine the certain original URL as the target URL. For each target URL, the terminal may send a first HTTP request including the target URL and a second HTTP request including the target URL and cookie1 to the server.
  • the server receives the first HTTP request and the second HTTP request sent by the terminal, and may return the page content corresponding to the first HTTP request for the first HTTP request and return the page content corresponding to the second HTTP request for the second HTTP request.
  • Page content may be fields such as ID, user_id, order_id, or userid in the URL parameter section for identifying different users; the preset target page characteristics may be the policy number, contact information, and address in the page content. Keywords related to user information such as ID card ID.
  • target URLs that may have an unauthorized vulnerability by matching parameter characteristics and / or page characteristics, the target URLs that require unauthorized vulnerability detection are filtered from all the original URLs crawled, which can improve the accuracy of unauthorized vulnerability detection. Sex.
  • the terminal logs in to Taobao's server using cookie1 and crawls all the original URLs of the login status. Assume that the crawled original URLs are four URLs: URL1, URL4, URL7, and URL8.
  • the page content corresponding to URL1 is C1
  • the page content corresponding to URL4 is C4
  • the page content corresponding to URL7 is C7
  • the page content corresponding to URL8 is C8.
  • the terminal detects whether the parameter part of each crawled original URL includes one or more fields such as ID, user_id, order_id, and userid.
  • URL1 includes the user_id field and URL7 includes the ID and order_id fields
  • the terminal can directly change URL1 It is determined as the target URL with URL7, and the page content corresponding to URL1 is no longer detected, and whether the page content corresponding to URL7 includes keywords such as the policy number, contact information, address, and ID card.
  • the terminal uses the keyword detection method to detect whether the page content C4 and C8 include keywords such as policy number, contact information, address, and ID card. If the page content C4 includes two keywords: policy number and ID card ID, Then, the terminal determines the URL4 corresponding to the page content C4 as the target URL.
  • the parameter part of URL8 does not include any fields such as ID, user_id, order_id, userid, and the page content C8 corresponding to URL8 does not include any keywords such as policy number, contact information, address, ID card ID, so URL8 is not The destination URL.
  • the terminal sends a third request to the server.
  • the terminal may receive the page content returned by the server for the first HTTP request and the page content returned for the second HTTP request, and may detect whether the page content returned by the first HTTP request is consistent with the The content of the page returned by the second HTTP request is the same.
  • the target URL cannot be used by any user (here refers to legal users and tourists, and here visitors refer to Users registered on the web application provided by the server), then it can be further explained that the target URL is accessible only by legitimate users, there may be a legitimate user who has unauthorized modification or viewing information of another legitimate user, and the terminal can request
  • the server sends a third HTTP request including the above target URL and cookie2, the server receives the third HTTP request, and may return the page content corresponding to the third HTTP request for the third HTTP request.
  • the cookie 2 is used to identify identity information of the second user.
  • the terminal can directly determine that the target URL does not have an unauthorized loophole.
  • the embodiment of the present application determines whether the target URL is the same by comparing the page content returned by the first HTTP request (visitor identity) with the page content returned by the second HTTP request containing cookie1 (identity information used to identify a legitimate user).
  • the target URL does not have an unauthorized vulnerability, which can improve the accuracy and processing efficiency of unauthorized vulnerability detection .
  • the terminal determines that there is an unauthorized loophole in the target URL.
  • the terminal may receive the page content returned by the server for the third HTTP request, and may compare whether the page content returned by the third HTTP request is the same as the page content returned by the second HTTP request. If they are the same, it means that the content of the page returned by the third HTTP request matches the content of the page returned by the second HTTP request, that is, the content of the page returned by different legitimate users accessing the target URL is the same. . If they are not the same, it means that the page content returned by the third HTTP request does not match the page content returned by the second HTTP request, that is, the page content returned by different legal users accessing the target URL is different, and the terminal may determine the target URL. There are no unauthorized loopholes.
  • the page content returned by the first HTTP request is returned for tourists
  • the page content returned by the second HTTP request is returned for cookie1 (identity information used to identify the first user, and the first user is a legitimate user).
  • the page content returned by the first HTTP request is different from the page content returned by the second HTTP request, it indicates that the target URL cannot be accessed by any user.
  • the page content returned by the third HTTP request is returned for cookie2 (identity information used to identify the second user, the second user is a different legal user from the first user).
  • the target URL is in danger of leaking user information, and it can be determined that the target URL has an unauthorized loophole.
  • a first request including a target URL and a second request including a target URL and a first identifier are sent to a server.
  • the first identifier is used to identify identity information of a first user.
  • sending a third request including the target URL and a second identifier to the server, where the second identifier is used to identify identity information of the second user When the page content returned by the server for the third request matches the page content returned for the second request, it is determined that the target URL has an unauthorized loophole, which can reduce manual processing, save time, and improve the efficiency of the unauthorized loophole detection.
  • FIG. 2 another schematic flowchart of a method for detecting an unauthorized vulnerability is provided according to an embodiment of the present application.
  • the method for detecting an unauthorized vulnerability may include steps:
  • the terminal sends a first request and a second request to the server.
  • step S201 in the embodiment of the present application, reference may be made to the implementation manner provided by step S101 in the embodiment shown in FIG. 1, and details are not described herein again.
  • the terminal sends a third request to the server.
  • the terminal may receive the page content returned by the server for the first HTTP request and the page content returned for the second HTTP request, and may detect whether the page content returned by the first HTTP request is consistent with the The content of the page returned by the second HTTP request is the same.
  • the target URL cannot be used by any user (here refers to legal users and tourists, and here visitors refer to Users registered on the web application provided by the server), then it can be further explained that the target URL is accessible only by legitimate users, there may be a legitimate user who has unauthorized modification or viewing information of another legitimate user, and the terminal can request
  • the server sends a third HTTP request including the above target URL and cookie2, the server receives the third HTTP request, and may return the page content corresponding to the third HTTP request for the third HTTP request.
  • the cookie 2 is used to identify identity information of the second user.
  • the terminal can directly determine that the target URL does not have an unauthorized loophole, and the terminal can output security prompt information including the target URL.
  • the security prompt information is used to indicate that the target URL has been detected and there is no unauthorized loophole.
  • the embodiment of the present application determines whether the target URL is the same by comparing the page content returned by the first HTTP request (visitor identity) with the page content returned by the second HTTP request containing cookie1 (identity information used to identify a legitimate user).
  • the target URL does not have an unauthorized vulnerability, which can improve the accuracy and processing efficiency of unauthorized vulnerability detection .
  • the terminal may receive the page content returned by the server for the first HTTP request and the page content returned for the second HTTP request, and may use a page similarity algorithm (such as a local sensitive hash algorithm simhash or The minimum hash algorithm minhash, etc.) calculates the similarity value between the page content returned by the first HTTP request and the page content returned by the second HTTP request, and compares the similarity value with a preset first similarity threshold (such as 99%), if the similarity value is less than a preset first similarity threshold, it means that the page content returned by the first HTTP request does not match the page content returned by the second HTTP request, the terminal can A third HTTP request including the target URL and cookie 2 is sent to the server.
  • a page similarity algorithm such as a local sensitive hash algorithm simhash or The minimum hash algorithm minhash, etc.
  • the server receives the third HTTP request, and may return the page content corresponding to the third HTTP request for the third HTTP request. If the similarity value is greater than or equal to a preset first similarity threshold value, it means that the page content returned by the first HTTP request matches the page content returned by the second HTTP request, and the terminal can directly determine that the target URL does not exist with unauthorized rights Vulnerability, and the terminal can output security prompt information including the above target URL.
  • the security prompt information is used to indicate that the target URL has been detected and there is no unauthorized loophole.
  • the terminal obtains a similarity value between the page content returned by the server for the third request and the page content returned for the second request.
  • the terminal may receive the page content returned by the server for the third HTTP request, and may use a page similarity algorithm such as simhash or minhash to calculate the page content returned by the third HTTP request and the second HTTP request.
  • a page similarity algorithm such as simhash or minhash
  • the similarity value between the returned page content is requested, and the magnitude relationship between the similarity value and a preset second similarity threshold (such as 95%) is compared. If the similarity value is greater than or equal to the second similarity threshold , Indicating that the content of the page returned by the third HTTP request matches the content of the page returned by the second HTTP request, the terminal may determine that the target URL has an unauthorized loophole.
  • the terminal can determine that the target URL does not have an unauthorized loophole, and the terminal can The output includes the security prompt of the target URL.
  • the security prompt information is used to prompt the target user that the target URL has been detected and there is no unauthorized loophole.
  • the second similarity threshold may be the same as or different from the first similarity threshold.
  • the terminal may output alarm prompt information including the target URL.
  • the alarm prompt information is used to prompt the target user to deal with the unauthorized vulnerability of the target URL.
  • the target user receives the alarm prompt information and can increase the permissions required for the operation on the target URL to strictly limit the target URL. This unauthorized vulnerability has been fixed, thereby preventing information leakage and improving the user experience.
  • an alarm prompt message is output, so that the target user can be notified in time to repair the unauthorized loophole in the target URL, thereby ensuring the security of the information stored in the server.
  • a first request including a target URL and a second request including a target URL and a first identifier are sent to a server.
  • the first identifier is used to identify identity information of a first user.
  • sending a third request including the target URL and a second identifier to the server, where the second identifier is used to identify identity information of the second user When the page content returned by the server for the first request matches the page content returned for the second request, a security prompt message is output, and the page content returned by the server for the third request and the page returned for the second request are obtained
  • the similarity value between the contents and compare whether the similarity value is greater than the similarity threshold.
  • FIG. 3 it is a schematic block diagram of a device for detecting unauthorized loopholes according to an embodiment of the present application.
  • the device for detecting unauthorized loopholes in this embodiment of the present application includes:
  • the sending module 10 is configured to send a first request and a second request to the server, where the first request includes a target uniform resource locator URL.
  • the second request includes the target URL and a first identifier, and the first identifier is used to identify identity information of the first user.
  • the sending module 10 is further configured to send a third request to the server when the page content returned by the server for the first request does not match the page content returned for the second request.
  • the third request includes the target URL and a second identifier, and the second identifier is used to identify identity information of the second user;
  • the first determining module 20 is configured to determine that the target URL has an unauthorized loophole when the page content returned by the server for the third request matches the page content returned for the second request.
  • the apparatus further includes a first obtaining module 30, a second obtaining module 40, and a second determining module 50.
  • the first obtaining module 30 is configured to obtain at least one original URL;
  • the second obtaining module 40 is configured to obtain a parameter portion of each original URL in the at least one original URL, and detecting whether the parameter portion of each original URL is Matches the target parameter characteristic;
  • the second determining module 50 is configured to determine the original URL whose parameter part in the at least one original URL matches the target parameter characteristic as the target URL.
  • the apparatus further includes a third obtaining module 60, a fourth obtaining module 70, and a third determining module 80.
  • the third obtaining module 60 is configured to obtain at least one original URL
  • the fourth obtaining module 70 is configured to obtain page content corresponding to each of the original URLs in the at least one original URL, and detect the content corresponding to each of the original URLs. Whether the page content matches the characteristics of the target page
  • the third determining module 80 is configured to determine the original URL that matches the content of the page in the at least one original URL with the characteristics of the target page as the target URL.
  • the first determining module 20 includes an obtaining unit 201 and a determining unit 202.
  • the obtaining unit 201 is configured to obtain a similarity value between the page content returned by the server for the third request and the page content returned for the second request; and the determining unit 202 is used when the similarity value is greater than the similarity value.
  • the threshold value is exceeded, it is determined that the target URL has an unauthorized loophole.
  • the device further includes an output module 90, and the output module 90 is configured to output alarm prompt information.
  • the alert prompt information includes the target URL, and the alert prompt information is used to prompt a target user to deal with the unauthorized vulnerability of the target URL.
  • the output module 90 is further configured to output security prompt information when the page content returned by the server for the first request matches the page content returned for the second request.
  • the security prompt information includes the target URL, and the security prompt information is used to indicate that the target URL has been detected and the unauthorized loophole does not exist.
  • the above-mentioned first determining module 20 is further configured to determine that the target URL does not exceed the authority when the page content returned by the server for the third request does not match the page content returned for the second request. Loophole.
  • the output module 90 is further configured to output security prompt information when the page content returned by the server for the first request matches the page content returned for the second request, and the security prompt information is used for It is prompted that the target URL has been detected and there is no such unauthorized vulnerability.
  • the above-mentioned unauthorized vulnerability detection device may execute the implementation manners provided by the steps in the implementation manners provided in FIG. 1 or FIG. 2 through the foregoing modules to implement the functions implemented in the foregoing embodiments.
  • the above-mentioned unauthorized vulnerability detection device may execute the implementation manners provided by the steps in the implementation manners provided in FIG. 1 or FIG. 2 through the foregoing modules to implement the functions implemented in the foregoing embodiments.
  • the unauthorized vulnerability detection device may send a first request and a second request to the server, where the first request includes a target URL, and the second request includes the target URL and a first identifier.
  • the first request includes a target URL
  • the second request includes the target URL and a first identifier.
  • a third request is sent to the server, the third request includes the target URL and a second identifier, and when the server responds to the third request.
  • the returned page content matches the page content returned for the second request, it is determined that the target URL has an unauthorized loophole, which can reduce manual processing, save time, and improve the efficiency of the unauthorized loophole detection.
  • the terminal in the embodiment of the present application may include: one or more processors 401; one or more input devices 402, one or more output devices 403, and a memory 404.
  • the processor 401, the input device 402, the output device 403, and the memory 404 are connected through a bus 405.
  • the memory 402 is configured to store a computer program, the computer program includes program instructions, and the processor 401 is configured to execute the program instructions stored in the memory 402. among them:
  • the output device 403 is configured to send a first request and a second request to the service.
  • the first request includes a target uniform resource locator URL.
  • the second request includes the target URL and a first identifier.
  • the first identifier is used to identify the first A user's identity information.
  • the input device 402 is configured to receive the page content returned by the server for the first request and the page content returned for the second request.
  • the processor 401 is configured to call the program instruction to perform detection to check whether the page content returned by the server for the first request matches the page content returned for the second request.
  • the output device 403 is further configured to send a third request to the server, where the third request includes the target URL and A second identifier, which is used to identify identity information of the second user.
  • the input device 402 is further configured to receive the page content returned by the server for the third request.
  • the processor 401 is configured to call the program instruction to perform detection to check whether the page content returned by the server for the third request matches the page content returned for the second request.
  • the server returns the page content for the third request, When it matches the page content returned for the second request, it is determined that the target URL has an unauthorized loophole.
  • the processor 401 may be a central processing unit (CPU), and the processor may also be another general-purpose processor or a digital signal processor (DSP). , Application specific integrated circuit (ASIC), ready-made programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the input device 402 may include a receiver, a receiving program interface, and the like
  • the output device 403 may include a transmitter, a sending program interface, and the like.
  • the memory 404 may include a read-only memory and a random access memory, and provide instructions and data to the processor 401. A portion of the memory 404 may also include non-volatile random access memory. For example, the memory 404 may also store information of a device type.
  • the processor 401, the input device 402, and the output device 403 described in the embodiments of the present application may perform the implementation manner described in the method for detecting unauthorized loopholes provided in the embodiments of the present application, and may also perform the methods described in the embodiments of the present application The implementation of the described unauthorized vulnerability detection device is not repeated here.
  • An embodiment of the present application further provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program.
  • the computer program includes program instructions. When the program instructions are executed by a processor, the unauthorized rights shown in FIG. 1 or FIG. 2 are implemented.
  • the vulnerability detection method please refer to the description of the embodiment shown in FIG. 1 or FIG. 2, and details are not described herein again.
  • the computer-readable storage medium may be an unauthorized vulnerability detection device or an internal storage unit of a terminal according to any of the foregoing embodiments, such as a hard disk or a memory of the terminal.
  • the computer-readable storage medium may also be an external storage device of the terminal, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, and a flash memory card provided on the terminal. (flash card) and so on.
  • the computer-readable storage medium may include both an internal storage unit of the terminal and an external storage device.
  • the computer-readable storage medium is used to store the computer program and other programs and data required by the terminal.
  • the computer-readable storage medium may also be used to temporarily store data that has been or will be output.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种越权漏洞检测方法及装置，其中方法包括：终端向服务器发送第一请求和第二请求（S101），该第一请求包括目标URL，该第二请求包括该目标URL和第一标识，若服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配，终端向该服务器发送第三请求（S102），该第三请求包括该目标URL和第二标识，若服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配，则终端确定目标URL存在越权漏洞（S103）。可以减少人工处理环节，节约时间，提高越权漏洞检测的效率。

Description

一种越权漏洞检测方法及装置
本申请要求于2018年6月30日提交中国专利局、申请号为2018107060270、申请名称为“一种越权漏洞检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，尤其涉及一种越权漏洞检测方法及装置。
背景技术
随着近期爆发的各种高危漏洞，网络安全问题引起了越来越多的关注。越权漏洞，是万维网(world wide web，WEB)应用程序中一种常见的安全漏洞，是指由于程序员疏忽，没有对某个操作所需的权限或用户进行严格的限制，导致本应没有操作权限的用户可正常进行操作，其威胁在于一个账户即可控制网站或服务器的所有用户数据。例如攻击者使用一个合法账户，就可对存在越权漏洞的其他账户数据进行非法操作，例如查询、删除、修改等常规数据库命令。
目前业内对于越权漏洞的检测基本都是人工检测，如测试人员对WEB程序进行渗透测试，人工测试耗费时间长，效率低。
发明内容
本申请实施例提供一种越权漏洞检测方法及装置，可减少人工处理环节，节约时间，提高检测效率。
第一方面，本申请实施例提供了一种越权漏洞检测方法，该方法包括：
向服务器发送第一请求和第二请求，该第一请求包括目标统一资源定位符URL，该第二请求包括该目标URL和第一标识，该第一标识用于标识第一用户的身份信息；
若该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配，向该服务器发送第三请求，该第三请求包括该目标URL和第二标识，该第二标识用于标识第二用户的身份信息；
若该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配，则确定该目标URL存在越权漏洞。
第二方面，本申请实施例提供了一种越权漏洞检测装置，该装置包括：
发送模块，用于向服务器发送第一请求和第二请求，该第一请求包括目标统一资源定位符URL，该第二请求包括该目标URL和第一标识，该第一标识用于标识第一用户的身份信息；
该发送模块，还用于当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，向该服务器发送第三请求，该第三请求包括该目标URL和第二标识，该第二标识用于标识第二用户的身份信息；
第一确定模块，用于当该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配时，则确定该目标URL存在越权漏洞。
第三方面，本申请实施例提供了一种终端，包括处理器、输入设备、输出设备和存储器，该处理器、输入设备、输出设备和存储器相互连接，其中，该存储器用于存储支持终端执行上述方法的计算机程序，该计算机程序包括程序指令，该处理器被配置用于调用该程序指令，执行上述第一方面的越权漏洞检测方法。
第四方面，本申请实施例提供了一种计算机可读存储介质，该计算机存储介质存储有计算机程序，该计算机程序包括程序指令，该程序指令当被处理器执行时使该处理器执行上述第一方面的越权漏洞检测方法。
采用本申请实施例，可以减少人工处理环节，节约时间，提高越权漏洞检测的效率。
附图说明
图1是本申请实施例提供的越权漏洞检测方法的一示意流程图；
图2是本申请实施例提供的越权漏洞检测方法的另一示意流程图；
图3是本申请实施例提供的越权漏洞检测装置的一示意性框图；
图4是本申请实施例提供的终端的一示意性框图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例中的越权漏洞可以指垂直越权、水平越权或交叉越权中的任一种。其中，垂直越权是基于用户的控制，即低权限的合法用户通过一些途径，获得高权限用户的能力，此时本申请实施例中的第一用户和第二用户所拥有的权限也就不相同，如第一用户是低权限的合法用户，第二用户是高权限的合法用户。水平越权是基于数据的控制访问，即同等权限的合法用户不但能够访问自己私有的数据，还能访问与其同等权限的其他人私有的数据，此时本申请实施例中的第一用户和第二用户所拥有的权限也就相同。交叉越权是垂直越权和水平越权的交集。本申请实施例中第一用户和第二用户之间的权限关系不做限定。
本申请实施例提供的越权漏洞检测方法可适用于智能手机、平板电脑、台式电脑等终端。可选的，本申请实施例提供的越权漏洞检测方法可由上述任一类型的任一终端执行，也可为上述任一类型的任一终端中的功能模块(比如浏览器等)执行，在此不做限制。为方便描述，下面将以终端为例进行说明。
下面将结合图1至图4，对本申请实施例提供的越权漏洞检测方法及装置进行说明。
本申请实施例中的第一标识和第二标识可以用不同的cookie来表示，如第一标识用cookie1表示，第二标识用cookie2来表示。其中，cookie指存储在用户本地终端上的数据。大部分WEB网站或服务器都是使用cookie来标识用户身份，用户在终端上使用用户名和密码登陆网站或服务器后，网站或服务器会给该用户的终端返回一个cookie信息，在后续的访问中，该终端再次访问该网站或服务器就会自动带上该cookie，而该网站或服务器通过该cookie可以识别用户的身份信息。为了便于理解，本申请实施例以第一标识为cookie1，第二标识为cookie2为例，cookie1用于标识第一用户的身份信息，cookie2用于标识第二用 户的身份信息。其中，该第一用户和该第二用户分别用于表示两个不同的合法用户。
参见图1，是本申请实施例提供的越权漏洞检测方法的一示意流程图。如图1所示，该越权漏洞检测方法可包括步骤：
S101，终端向服务器发送第一请求和第二请求。
在一些可行的实施方式中，目标用户可利用终端在服务器提供的WEB应用程序上注册两个不同的合法用户，如第一用户和第二用户，在第一用户和第二用户注册成功后，服务器给该目标用户对应的终端返回两个标识，分别为cookie1和cookie2。其中cookie1用于标识第一用户的身份信息，cookie2用于标识第二用户的身份信息。终端可以使用cookie1或cookie2登录服务器，再利用爬虫工具(如WEB爬虫Heritrix、Scrapy等)爬取该服务器登录状态下的一个或多个目标URL。针对爬取到的每个目标URL，终端可以向该服务器发送包括该目标URL的第一超文本传输协议(hypertext transfer protocol，HTTP)请求以及包括该目标URL和cookie1的第二HTTP请求。服务器接收终端发送的该第一HTTP请求和该第二HTTP请求，并可以针对该第一HTTP请求返回该第一HTTP请求对应的页面内容和针对该第二HTTP请求返回该第二HTTP请求对应的页面内容。
在一些可行的实施方式中，可以在终端设置一些越权漏洞检测的条件，如设置至少一个目标参数特征，与该至少一个目标参数特征中的任一参数特征匹配的URL都需要进行越权漏洞检测。具体地，终端在向服务器发送上述第一HTTP请求和上述第二HTTP请求之前，可以使用cookie1或cookie2登录服务器，再利用爬虫工具爬取该服务器登录状态下的至少一个原始URL。终端可以获取该至少一个原始URL中每个原始URL的参数部分，并检测该每个原始URL的参数部分是否包括预设的一个或多个目标参数特征，若某个原始URL的参数部分包括预设的一个或多个目标参数特征，则可以说明该某个原始URL的参数部分与目标参数特征匹配，并可以将该至少一个原始URL中参数部分与该目标参数特征匹配的原始URL确定为目标URL。若某个原始URL的参数部分不包括任一目标参数特征，则说明该某个原始URL的参数部分与目标参数特征不匹配，则可以不作任何处理。针对每个目标URL，终端可以向服务器发送包括该目标URL的第一HTTP请求和包括该目标URL和cookie1的第二HTTP请求。服务器接收终端发送的该第一HTTP请求和该第二HTTP请求，并可以针对该第一HTTP请求返回该第一HTTP请求对应的页面内容和针对该第二HTTP请求返回该第二HTTP请求对应的页面内容。其中，预设的目标参数特征可以为URL参数部分中的ID、user_id、order_id或userid等用于标识不同用户的字段。本申请实施例通过参数特征匹配，从爬取到的所有原始URL中筛选出需要进行越权漏洞检测的目标URL，在保证准确性的同时，减少了越权漏洞检测的目标URL数量，同时提高了越权漏洞检测的处理效率。
例如，终端使用cookie1登录淘宝的服务器，爬取登录状态的所有原始URL。假设爬取到的原始URL有URL1、URL4、URL7这三个URL，检测爬取到的每个URL的参数部分是否包括ID、user_id、order_id、userid等一个或多个字段，若URL1的参数部分包括user_id字段，URL7的参数部分包括ID和order_id字段，则终端可以分别将URL1和URL7确定为目标URL，即从爬取到的原始URL中筛选出需要进行越权漏洞检测的目标URL。终端再针对URL1向服务器发送包含URL1的HTTP请求以及包含URL1和cookie1的HTTP 请求，针对URL7向服务器发送包含URL7的HTTP请求以及包含URL7和cookie1的HTTP请求。
在一些可行的实施方式中，可以在终端设置一些越权漏洞检测的条件，如至少一个目标页面特征，与该至少一个目标页面特征中的任一页面特征匹配的页面内容对应的URL都需要进行越权漏洞检测。具体地，终端在向服务器发送上述第一HTTP请求和上述第二HTTP请求之前，可以使用cookie1或cookie2登录服务器，再利用爬虫工具爬取该服务器登录状态下的至少一个原始URL。终端可以获取该至少一个原始URL中每个原始URL对应的页面内容，并检测该每个原始URL对应的页面内容是否包括预设的一个或多个目标页面特征，若某个原始URL对应的页面内容包括预设的一个或多个目标页面特征，则可以说明该某个原始URL对应的页面内容与目标页面特征匹配，并可以将该至少一个原始URL中页面内容与该目标页面特征匹配的原始URL确定为目标URL。若某个原始URL的页面内容不包括任一目标页面特征，则说明该某个原始URL对应的页面内容与目标页面特征不匹配，则可以不作任何处理。针对每个目标URL，终端可以向服务器发送包括该目标URL的第一HTTP请求和包括该目标URL和cookie1的第二HTTP请求。服务器接收终端发送的该第一HTTP请求和该第二HTTP请求，并可以针对该第一HTTP请求返回该第一HTTP请求对应的页面内容和针对该第二HTTP请求返回该第二HTTP请求对应的页面内容。其中，预设的目标页面特征可以为页面内容中的保单号、联系方式、地址、身份证ID等与用户信息相关的关键字。因为一旦与用户私密信息(如保单号、联系方式、地址、身份证ID等)对应的URL存在越权漏洞，就可能导致用户的私密信息被泄露或更改，所以本申请实施例通过页面特征匹配，从爬取到的所有原始URL中筛选出需要进行越权漏洞检测的目标URL(即与用户私密信息对应的URL)，在保证准确性的同时，减少了越权漏洞检测的目标URL数量，同时提高了越权漏洞检测的处理效率。
例如，终端使用cookie1登录淘宝的服务器，爬取登录状态的所有原始URL。假设爬取到的原始URL有URL1、URL4、URL7这三个URL，URL1对应的页面内容为C1，URL4对应的页面内容为C4，URL7对应的页面内容为C7。终端通过关键字检测的方法分别检测页面内容C1、C4以及C7中是否包括保单号、联系方式、地址、身份证ID等一个或多个关键字，若页面内容C4中包括保单号和身份证ID这两个关键字，终端就将页面内容C4对应的URL4确定为目标URL，即从爬取到的原始URL中筛选出需要进行越权漏洞检测的目标URL。终端再针对URL4向服务器发送包含URL4的HTTP请求以及包含URL4和cookie1的HTTP请求。
在一些可行的实施方式中，可以在终端设置一些越权漏洞检测的条件，如至少一个目标参数特征和至少一个目标页面特征，与该至少一个目标参数特征中的任一参数特征匹配的URL和/或与该至少一个目标页面特征中的任一页面特征匹配的页面内容对应的URL都需要进行越权漏洞检测。具体地，终端在向服务器发送上述第一HTTP请求和上述第二HTTP请求之前，可以使用cookie1或cookie2登录服务器，再利用爬虫工具爬取该服务器登录状态下的至少一个原始URL。终端可以获取该至少一个原始URL中每个原始URL的参数部分和该每个原始URL对应的页面内容，并可以检测该每个原始URL的参数部分是否包括预设的一个或多个目标参数特征，和/或检测该每个原始URL对应的页面内容是否 包括预设的一个或多个目标页面特征，若某个原始URL的参数部分包括预设的一个或多个目标参数特征，和/或该某个原始URL对应的页面内容包括预设的一个或多个目标页面特征，终端可以将该某个原始URL确定为目标URL。针对每个目标URL，终端可以向服务器发送包括该目标URL的第一HTTP请求和包括该目标URL和cookie1的第二HTTP请求。服务器接收终端发送的该第一HTTP请求和该第二HTTP请求，并可以针对该第一HTTP请求返回该第一HTTP请求对应的页面内容和针对该第二HTTP请求返回该第二HTTP请求对应的页面内容。其中，预设的目标参数特征可以为URL参数部分中的ID、user_id、order_id或userid等用于标识不同用户的字段；预设的目标页面特征可以为页面内容中的保单号、联系方式、地址、身份证ID等与用户信息相关的关键字。本申请实施例针对可能存在越权漏洞的目标URL，通过参数特征和/或页面特征匹配，从爬取到的所有原始URL中筛选出需要进行越权漏洞检测的目标URL，可以提高越权漏洞检测的准确性。
例如，终端使用cookie1登录淘宝的服务器，爬取登录状态的所有原始URL。假设爬取到的原始URL有URL1、URL4、URL7、URL8这四个URL，URL1对应的页面内容为C1，URL4对应的页面内容为C4，URL7对应的页面内容为C7，URL8对应的页面内容为C8。终端检测爬取到的每个原始URL的参数部分是否包括ID、user_id、order_id、userid等一个或多个字段，若URL1包括user_id字段，URL7包括ID和order_id这两个字段，终端可以直接将URL1和URL7确定为目标URL，不再检测URL1对应的页面内容、URL7对应的页面内容中是否包括保单号、联系方式、地址、身份证ID等关键字。终端再利用关键字检测方法分别检测页面内容C4和C8中是否包括保单号、联系方式、地址、身份证ID等关键字，若页面内容C4中包括保单号和身份证ID这两个关键字，则终端就将页面内容C4对应的URL4确定为目标URL。其中，URL8的参数部分不包括ID、user_id、order_id、userid等任一字段，且URL8对应的页面内容C8也不包括保单号、联系方式、地址、身份证ID等任一关键字，所以URL8不是目标URL。
S102，若服务器针对第一请求返回的页面内容与针对第二请求返回的页面内容不匹配，终端向服务器发送第三请求。
在一些可行的实施方式中，终端可以接收上述服务器针对上述第一HTTP请求返回的页面内容和针对上述第二HTTP请求返回的页面内容，并可以检测该第一HTTP请求返回的页面内容是否与该第二HTTP请求返回的页面内容相同。若不相同，则说明该第一HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容不匹配，即该目标URL不可以被任意用户(这里指合法用户和游客，这里的游客指未在服务器提供的WEB应用程序上注册的用户)访问，那么进一步可以说明该目标URL是合法用户才能访问的，就可能存在一个合法用户越权修改或查看另一合法用户的信息，则终端可以向该服务器发送包含上述目标URL和cookie2的第三HTTP请求，该服务器接收该第三HTTP请求，并可以针对该第三HTTP请求返回该第三HTTP请求对应的页面内容。该cookie2用于标识第二用户的身份信息。若相同，则说明该第一HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容匹配，即该目标URL可以被任意用户访问，那就不存在一个合法用户越权修改或查看另一合法用户的信息，终端就可以直接确定该目标URL不存在越权漏洞。本申请实施例通过比较第一HTTP请求(游客身份)返回的页面内容和包含cookie1(用于标识合法用户的 身份信息)的第二HTTP请求返回的页面内容之间是否相同，来判断该目标URL是否可以被任意用户(这里指合法用户和游客)访问，若相同，则说明该目标URL可以被任意用户访问，那么该目标URL就不存在越权漏洞，可以提高越权漏洞检测的准确性和处理效率。
S103，若服务器针对第三请求返回的页面内容与针对第二请求返回的页面内容匹配，则终端确定目标URL存在越权漏洞。
在一些可行的实施方式中，终端可以接收上述服务器针对上述第三HTTP请求返回的页面内容，并可以比较该第三HTTP请求返回的页面内容是否与上述第二HTTP请求返回的页面内容相同。若相同，说明该第三HTTP请求返回的页面内容与上述第二HTTP请求返回的页面内容匹配，即不同的合法用户访问该目标URL返回的页面内容相同，则终端可以确定上述目标URL存在越权漏洞。若不相同，说明该第三HTTP请求返回的页面内容与上述第二HTTP请求返回的页面内容不匹配，即不同的合法用户访问该目标URL返回的页面内容不相同，则终端可以确定上述目标URL不存在越权漏洞。可以理解，第一HTTP请求返回的页面内容是针对游客返回的，第二HTTP请求返回的页面内容是针对cookie1(用于标识第一用户的身份信息，第一用户是合法用户)返回的，当第一HTTP请求返回的页面内容与第二HTTP请求返回的页面内容不相同时，说明该目标URL不能被任意用户访问。第三HTTP请求返回的页面内容是针对cookie2(用于标识第二用户的身份信息，第二用户是与第一用户不同的合法用户)返回的，如果第二HTTP请求返回的页面内容和第三HTTP请求返回的页面内容匹配，说明第一用户和第二用户可以看到对方的信息，那么该目标URL就存在用户信息泄露的危险，则可以确定该目标URL存在越权漏洞。
本申请实施例通过向服务器发送包括目标URL的第一请求和包括该目标URL和第一标识的第二请求，该第一标识用于标识第一用户的身份信息，当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，向该服务器发送包括该目标URL和第二标识的第三请求，该第二标识用于标识第二用户的身份信息，当该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配时，则确定该目标URL存在越权漏洞，可以减少人工处理环节，节约时间，提高越权漏洞检测的效率。
参见图2，是本申请实施例提供的越权漏洞检测方法的另一示意流程图。如图2所示，该越权漏洞检测方法可包括步骤：
S201，终端向服务器发送第一请求和第二请求。
本申请实施例中上述步骤S201的实现方式可参考图1所示实施例的步骤S101所提供的实现方式，在此不再赘述。
S202，若服务器针对第一请求返回的页面内容与针对第二请求返回的页面内容不匹配，终端向服务器发送第三请求。
S203，若服务器针对第一请求返回的页面内容与针对第二请求返回的页面内容匹配，则终端输出安全提示信息。
在一些可行的实施方式中，终端可以接收上述服务器针对上述第一HTTP请求返回的页面内容和针对上述第二HTTP请求返回的页面内容，并可以检测该第一HTTP请求返回的页面内容是否与该第二HTTP请求返回的页面内容相同。若不相同，则说明该第一HTTP 请求返回的页面内容与该第二HTTP请求返回的页面内容不匹配，即该目标URL不可以被任意用户(这里指合法用户和游客，这里的游客指未在服务器提供的WEB应用程序上注册的用户)访问，那么进一步可以说明该目标URL是合法用户才能访问的，就可能存在一个合法用户越权修改或查看另一合法用户的信息，则终端可以向该服务器发送包含上述目标URL和cookie2的第三HTTP请求，该服务器接收该第三HTTP请求，并可以针对该第三HTTP请求返回该第三HTTP请求对应的页面内容。该cookie2用于标识第二用户的身份信息。若相同，则说明该第一HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容匹配，即该目标URL可以被任意用户访问，那就不存在一个合法用户越权修改或查看另一合法用户的信息，终端就可以直接确定该目标URL不存在越权漏洞，且终端可以输出包括上述目标URL的安全提示信息。该安全提示信息用于提示该目标URL已检测且不存在越权漏洞。本申请实施例通过比较第一HTTP请求(游客身份)返回的页面内容和包含cookie1(用于标识合法用户的身份信息)的第二HTTP请求返回的页面内容之间是否相同，来判断该目标URL是否可以被任意用户(这里指合法用户和游客)访问，若相同，则说明该目标URL可以被任意用户访问，那么该目标URL就不存在越权漏洞，可以提高越权漏洞检测的准确性和处理效率。
在一些可行的实施方式中，终端可以接收服务器针对上述第一HTTP请求返回的页面内容和针对上述第二HTTP请求返回的页面内容，并可以利用页面相似度算法(如局部敏感哈希算法simhash或最小哈希算法minhash等)计算该第一HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容之间的相似度值，比较该相似度值与预设的第一相似度阈值(如99％)之间的大小关系，若该相似度值小于预设的第一相似度阈值，说明该第一HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容不匹配，则终端可以向该服务器发送包含上述目标URL和cookie2的第三HTTP请求，该服务器接收该第三HTTP请求，并可以针对该第三HTTP请求返回该第三HTTP请求对应的页面内容。若该相似度值大于或等于预设的第一相似度阈值，说明该第一HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容匹配，终端就可以直接确定该目标URL不存在越权漏洞，且终端可以输出包括上述目标URL的安全提示信息。该安全提示信息用于提示该目标URL已检测且不存在越权漏洞。本申请实施例通过计算第一HTTP请求返回的页面内容和第二HTTP请求返回的页面内容之间的相似度值，可以防止页面内容之间的微小差异导致的检测结果不准确的情况，进一步提高越权漏洞检测的准确性。
S204，终端获取服务器针对第三请求返回的页面内容与针对第二请求返回的页面内容之间的相似度值。
S205，若相似度值大于相似度阈值，则终端确定目标URL存在越权漏洞。
在一些可行的实施方式中，终端可以接收服务器针对上述第三HTTP请求返回的页面内容，并可以利用页面相似度算法如simhash或minhash等计算该第三HTTP请求返回的页面内容与上述第二HTTP请求返回的页面内容之间的相似度值，比较该相似度值与预设的第二相似度阈值(如95％)之间的大小关系，若该相似度值大于或等于第二相似度阈值，说明该第三HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容匹配，则终端可以确定上述目标URL存在越权漏洞。若该相似度值小于第二相似度阈值，说明该第三 HTTP请求返回的页面内容与该第二HTTP请求返回的页面内容不匹配，则终端可以确定上述目标URL不存在越权漏洞，且终端可以输出包括上述目标URL的安全提示信息。该安全提示信息用于提示目标用户该目标URL已检测且不存在越权漏洞。。其中，该第二相似度阈值与上述第一相似度阈值可以相同，也可以不相同。本申请实施例通过计算第三HTTP请求返回的页面内容和第二HTTP请求返回的页面内容之间的相似度值，可以防止页面内容之间的微小差异导致的检测结果不准确的情况，进一步提高越权漏洞检测的准确性。
在一些可行的实施方式中，终端在确定上述目标URL存在越权漏洞之后，可以输出包括上述目标URL的报警提示信息。该报警提示信息用于提示目标用户处理该目标URL的该越权漏洞，该目标用户接收到该报警提示信息可以增加对该目标URL上的操作所需的权限进行严格的限制，以使该目标URL的该越权漏洞被修复，进而阻止信息泄露，提高用户体验。本申请实施例通过在确定该目标URL存在越权漏洞之后，输出报警提示信息，可以及时通知目标用户对该目标URL存在的越权漏洞进行修补，从而保证服务器中存储的信息的安全性。
本申请实施例通过向服务器发送包括目标URL的第一请求和包括该目标URL和第一标识的第二请求，该第一标识用于标识第一用户的身份信息，当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，向该服务器发送包括该目标URL和第二标识的第三请求，该第二标识用于标识第二用户的身份信息，当该服务器针对第一请求返回的页面内容与针对第二请求返回的页面内容匹配时，则输出安全提示信息，获取该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容之间的相似度值，比较该相似度值是否大于相似度阈值，若大于，则确定该目标URL存在越权漏洞，不仅可以减少人工处理环节，节约时间，提高越权漏洞检测的效率，还可以防止页面内容之间的微小差异给检测结果带来的影响，从而提高了越权漏洞检测的准确性。
参见图3，是本申请实施例提供的越权漏洞检测装置的一示意性框图。本申请实施例的越权漏洞检测装置包括：
发送模块10，用于向服务器发送第一请求和第二请求，该第一请求包括目标统一资源定位符URL。其中，该第二请求包括该目标URL和第一标识，该第一标识用于标识第一用户的身份信息；
该发送模块10，还用于当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，向该服务器发送第三请求。其中，该第三请求包括该目标URL和第二标识，该第二标识用于标识第二用户的身份信息；
第一确定模块20，用于当该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配时，则确定该目标URL存在越权漏洞。
在一些可行的实施方式中，该装置还包括第一获取模块30、第二获取模块40以及第二确定模块50。该第一获取模块30，用于获取至少一个原始URL；该第二获取模块40，用于获取该至少一个原始URL中每个原始URL的参数部分，并检测该每个原始URL的参数部分是否与目标参数特征匹配；该第二确定模块50，用于将该至少一个原始URL中参 数部分与该目标参数特征匹配的原始URL确定为目标URL。
在一些可行的实施方式中，该装置还包括第三获取模块60、第四获取模块70以及第三确定模块80。该第三获取模块60，用于获取至少一个原始URL；该第四获取模块70，用于获取针对该至少一个原始URL中每个原始URL对应的页面内容，并检测该每个原始URL对应的页面内容是否与目标页面特征匹配；该第三确定模块80，用于将该至少一个原始URL中页面内容与该目标页面特征匹配的原始URL确定为目标URL。
在一些可行的实施方式中，上述第一确定模块20包括获取单元201和确定单元202。该获取单元201，用于获取该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容之间的相似度值；该确定单元202，用于当该相似度值大于相似度阈值时，则确定该目标URL存在越权漏洞。
在一些可行的实施方式中，该装置还包括输出模块90，该输出模块90用于输出报警提示信息。其中，该报警提示信息包括该目标URL，该报警提示信息用于提示目标用户处理该目标URL的该越权漏洞。
在一些可行的实施方式中，上述输出模块90还用于当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容匹配时，则输出安全提示信息。其中，该安全提示信息包括该目标URL，该安全提示信息用于提示该目标URL已检测且不存在该越权漏洞。
在一些可行的实施方式中，上述第一确定模块20还用于当该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，确定该目标URL不存在越权漏洞。
在一些可行的实施方式中，上述输出模块90还用于当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容匹配时，输出安全提示信息，该安全提示信息用于提示该目标URL已检测且不存在该越权漏洞。
具体实现中，上述越权漏洞检测装置可通过上述各个模块执行上述图1或者图2所提供的实现方式中各个步骤所提供的实现方式，实现上述各实施例中所实现的功能，具体可参见上述图1或图2所示的方法实施例中各个步骤提供的相应描述，在此不再赘述。
在本申请实施例中，越权漏洞检测装置可通过向服务器发送第一请求和第二请求，该第一请求包括目标URL，该第二请求包括该目标URL和第一标识，当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，向该服务器发送第三请求，该第三请求包括该目标URL和第二标识，当该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配时，则确定该目标URL存在越权漏洞，可以减少人工处理环节，节约时间，提高越权漏洞检测的效率。
参见图4，是本申请实施例提供的终端的一示意性框图。如图4所示，本申请实施例中的终端可以包括：一个或多个处理器401；一个或多个输入设备402，一个或多个输出设备403和存储器404。上述处理器401、输入设备402、输出设备403和存储器404通过总线405连接。存储器402用于存储计算机程序，该计算机程序包括程序指令，处理器401用于执行存储器402存储的程序指令。其中：
上述输出设备403用于向服务发送第一请求和第二请求，该第一请求包括目标统一资源定位符URL，该第二请求包括该目标URL和第一标识，该第一标识用于标识第一用户的身份信息。
上述输入设备402用于接收该服务器针对该第一请求返回的页面内容和针对该第二请求返回的页面内容。
上述处理器401被配置用于调用该程序指令执行检测该服务器针对该第一请求返回的页面内容是否与针对该第二请求返回的页面内容匹配。
当该服务器针对该第一请求返回的页面内容与针对该第二请求返回的页面内容不匹配时，上述输出设备403还用于向该服务器发送第三请求，该第三请求包括该目标URL和第二标识，该第二标识用于标识第二用户的身份信息。
上述输入设备402还用于接收该服务器针对该第三请求返回的页面内容。
上述处理器401被配置用于调用该程序指令执行检测该服务器针对该第三请求返回的页面内容是否与针对该第二请求返回的页面内容匹配，当该服务器针对该第三请求返回的页面内容与针对该第二请求返回的页面内容匹配时，则确定该目标URL存在越权漏洞。
应当理解，在本申请实施例中，所称处理器401可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field-programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
输入设备402可以包括接收器、接收程序接口等，输出设备403可以包括发送器、发送程序接口等。
该存储器404可以包括只读存储器和随机存取存储器，并向处理器401提供指令和数据。存储器404的一部分还可以包括非易失性随机存取存储器。例如，存储器404还可以存储设备类型的信息。
具体实现中，本申请实施例中所描述的处理器401、输入设备402、输出设备403可执行本申请实施例提供的越权漏洞检测方法中所描述的实现方式，也可执行本申请实施例所描述的越权漏洞检测装置的实现方式，在此不再赘述。
本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，该计算机程序包括程序指令，该程序指令被处理器执行时实现图1或图2所示的越权漏洞检测方法，具体细节请参照图1或图2所示实施例的描述，在此不再赘述。
上述计算机可读存储介质可以是前述任一实施例所述的越权漏洞检测装置或终端的内部存储单元，例如终端的硬盘或内存。该计算机可读存储介质也可以是该终端的外部存储设备，例如该终端上配备的插接式硬盘，智能存储卡(smart media card,SMC)，安全数字(secure digital,SD)卡，闪存卡(flash card)等。进一步地，该计算机可读存储介质还可以既包括该终端的内部存储单元也包括外部存储设备。该计算机可读存储介质用于存储该计算机程序以及该终端所需的其他程序和数据。该计算机可读存储介质还可以用于暂时地存储已经输出或者将要输出的数据。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (20)

  1. 一种越权漏洞检测方法，其特征在于，包括：
    向服务器发送第一请求和第二请求，所述第一请求包括目标统一资源定位符URL，所述第二请求包括所述目标URL和第一标识，所述第一标识用于标识第一用户的身份信息；
    若所述服务器针对所述第一请求返回的页面内容与针对所述第二请求返回的页面内容不匹配，向所述服务器发送第三请求，所述第三请求包括所述目标URL和第二标识，所述第二标识用于标识第二用户的身份信息，所述第二用户为与所述第一用户不同的用户；
    若所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容匹配，则确定所述目标URL存在越权漏洞。
  2. 根据权利要求1所述的方法，其特征在于，所述向服务器发送第一请求和第二请求之前，所述方法还包括：
    获取至少一个原始URL；
    获取所述至少一个原始URL中每个原始URL的参数部分，并检测所述每个原始URL的参数部分是否与目标参数特征匹配；
    将所述至少一个原始URL中参数部分与所述目标参数特征匹配的原始URL确定为目标URL。
  3. 根据权利要求1所述的方法，其特征在于，向服务器发送第一请求和第二请求之前，所述方法还包括：
    获取至少一个原始URL；
    获取针对所述至少一个原始URL中每个原始URL对应的页面内容，并检测所述每个原始URL对应的页面内容是否与目标页面特征匹配；
    将所述至少一个原始URL中页面内容与所述目标页面特征匹配的原始URL确定为目标URL。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，所述若所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容匹配，则确定所述目标URL存在越权漏洞，包括：
    获取所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容之间的相似度值；
    若所述相似度值大于相似度阈值，则确定所述目标URL存在越权漏洞。
  5. 根据权利要求1-4任意一项所述的方法，其特征在于，所述确定所述目标URL存在越权漏洞之后，所述方法还包括：
    输出报警提示信息，所述报警提示信息包括所述目标URL，所述报警提示信息用于提示目标用户处理所述目标URL的所述越权漏洞。
  6. 根据权利要求1-5任意一项所述的方法，其特征在于，所述方法还包括：
    若所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容不匹配，则确定所述目标URL不存在越权漏洞。
  7. 根据权利要求1-6任意一项所述的方法，其特征在于，所述在向服务器发送第一请求和第二请求之后，所述方法还包括：
    若所述服务器针对所述第一请求返回的页面内容与针对所述第二请求返回的页面内容匹配，输出安全提示信息，所述安全提示信息用于提示所述目标URL已检测且不存在所述越权漏洞。
  8. 一种越权漏洞检测装置，其特征在于，包括：
    发送模块，用于向服务器发送第一请求和第二请求，所述第一请求包括目标统一资源定位符URL，所述第二请求包括所述目标URL和第一标识，所述第一标识用于标识第一用户的身份信息；
    所述发送模块，还用于当所述服务器针对所述第一请求返回的页面内容与针对所述第二请求返回的页面内容不匹配时，向所述服务器发送第三请求，所述第三请求包括所述目标URL和第二标识，所述第二标识用于标识第二用户的身份信息；
    第一确定模块，用于当所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容匹配时，则确定所述目标URL存在越权漏洞。
  9. 根据权利要求8所述的装置，其特征在于，其特征在于，所述装置还包括：
    第一获取模块，用于获取至少一个原始URL；
    第二获取模块，用于获取所述至少一个原始URL中每个原始URL的参数部分，并检测所述每个原始URL的参数部分是否与目标参数特征匹配；
    第二确定模块，用于将所述至少一个原始URL中参数部分与所述目标参数特征匹配的原始URL确定为目标URL。
  10. 根据权利要求8所述的装置，其特征在于，所述装置还包括：
    第三获取模块，用于获取至少一个原始URL；
    第四获取模块，用于获取针对所述至少一个原始URL中每个原始URL对应的页面内容，并检测所述每个原始URL对应的页面内容是否与目标页面特征匹配；
    第三确定模块，将所述至少一个原始URL中页面内容与所述目标页面特征匹配的原始URL确定为目标URL。
  11. 根据权利要求8-10任意一项所述的装置，其特征在于，所述第一确定模块，包括：
    获取单元，用于获取所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容之间的相似度值；
    确定单元，用于当所述相似度值大于相似度阈值时，确定所述目标URL存在越权漏洞。
  12. 根据权利要求8-11任意一项所述的装置，其特征在于，所述装置还包括：
    输出模块，用于输出报警提示信息，所述报警提示信息包括所述目标URL，所述报警提示信息用于提示目标用户处理所述目标URL的所述越权漏洞。
  13. 根据权利要求8-12任意一项所述的装置，其特征在于，所述第一确定模块还用于：
    当所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容不匹配时，确定所述目标URL不存在越权漏洞。
  14. 根据权利要求8-12任意一项所述的装置，其特征在于，所述输出模块还用于：
    当所述服务器针对所述第一请求返回的页面内容与针对所述第二请求返回的页面内容匹配时，输出安全提示信息，所述安全提示信息用于提示所述目标URL已检测且不存在所述越权漏洞。
  15. 一种终端，其特征在于，包括处理器、输入设备、输出设备和存储器，所述处理器、输入设备、输出设备和存储器相互连接，其中，所述存储器用于存储计算机程序，所述计算机程序包括程序指令，所述处理器用于执行所述存储器的所述程序指令，其中：
    所述输出设备，用于向服务器发送第一请求和第二请求，所述第一请求包括目标统一资源定位符URL，所述第二请求包括所述目标URL和第一标识，所述第一标识用于标识第一用户的身份信息；
    所述输入设备，用于接收所述服务器针对所述第一请求返回的页面内容与针对所述第二请求返回的页面内容；
    所述处理器，用于检测所述服务器针对所述第一请求返回的页面内容是否与针对所述第二请求返回的页面内容匹配；
    所述输出设备，还用于当所述服务器针对所述第一请求返回的页面内容与针对所述第二请求返回的页面内容不匹配时，向所述服务器发送第三请求，所述第三请求包括所述目标URL和第二标识，所述第二标识用于标识第二用户的身份信息，所述第二用户为与所述第一用户不同的用户；
    所述输入设备，还用于接收所述服务器针对所述第三请求返回的页面内容；
    所述处理器，还用于检测所述服务器针对所述第三请求返回的页面内容是否与针对所述第二请求返回的页面内容匹配，当所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容匹配时，则确定所述目标URL存在越权漏洞。
  16. 根据权利要求15所述的终端，其特征在于，所述处理器还用于：
    获取至少一个原始URL；
    获取所述至少一个原始URL中每个原始URL的参数部分，并检测所述每个原始URL的参数部分是否与目标参数特征匹配；
    将所述至少一个原始URL中参数部分与所述目标参数特征匹配的原始URL确定为目标URL。
  17. 根据权利要求15所述的终端，其特征在于，所述处理器还用于：
    获取至少一个原始URL；
    获取针对所述至少一个原始URL中每个原始URL对应的页面内容，并检测所述每个原始URL对应的页面内容是否与目标页面特征匹配；
    将所述至少一个原始URL中页面内容与所述目标页面特征匹配的原始URL确定为目标URL。
  18. 根据权利要求15-17任意一项所述的终端，其特征在于，所述处理器具体用于：
    获取所述服务器针对所述第三请求返回的页面内容与针对所述第二请求返回的页面内容之间的相似度值；
    若所述相似度值大于相似度阈值，则确定所述目标URL存在越权漏洞。
  19. 根据权利要求15-18任意一项所述的终端，其特征在于，所述输出设备还用于：
    在确定所述目标URL存在越权漏洞之后，输出报警提示信息，所述报警提示信息包括所述目标URL，所述报警提示信息用于提示目标用户处理所述目标URL的所述越权漏洞。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机 程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如权利要求1-7任一项所述的方法。
PCT/CN2018/108712 2018-06-30 2018-09-29 一种越权漏洞检测方法及装置 WO2020000749A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810706027.0 2018-06-30
CN201810706027.0A CN108769070A (zh) 2018-06-30 2018-06-30 一种越权漏洞检测方法及装置

Publications (1)

Publication Number Publication Date
WO2020000749A1 true WO2020000749A1 (zh) 2020-01-02

Family

ID=63975401

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/108712 WO2020000749A1 (zh) 2018-06-30 2018-09-29 一种越权漏洞检测方法及装置

Country Status (2)

Country Link
CN (1) CN108769070A (zh)
WO (1) WO2020000749A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109902022A (zh) * 2019-03-14 2019-06-18 深圳壹账通智能科技有限公司 针对垂直越权漏洞自动进行测试的方法及相关设备
CN110381017A (zh) * 2019-06-12 2019-10-25 微梦创科网络科技（中国）有限公司 一种非法请求识别方法及装置
CN110113366B (zh) * 2019-06-24 2022-12-27 深圳前海微众银行股份有限公司 Csrf漏洞的检测方法及装置，计算设备和存储介质
CN110489966A (zh) * 2019-08-12 2019-11-22 腾讯科技（深圳）有限公司 平行越权漏洞检测方法、装置、存储介质及电子设备
CN111274585B (zh) * 2020-01-19 2022-08-16 福建省农村信用社联合社 一种Web应用越权漏洞检测方法、装置、设备和介质
CN113259327A (zh) * 2021-04-20 2021-08-13 长沙市到家悠享网络科技有限公司 一种自动化接口检测方法、系统和计算机设备
CN113347270B (zh) * 2021-06-25 2022-12-23 中国银行股份有限公司 一种网络传输文件防水平越权方法和装置
CN114499960B (zh) * 2021-12-24 2024-03-22 深圳开源互联网安全技术有限公司 一种csrf漏洞识别方法、装置及计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104753730A (zh) * 2013-12-30 2015-07-01 腾讯科技（深圳）有限公司 一种漏洞检测的方法及装置
CN105357195A (zh) * 2015-10-30 2016-02-24 深圳市深信服电子科技有限公司 web访问的越权漏洞检测方法及装置
CN106354725A (zh) * 2015-07-15 2017-01-25 腾讯科技（深圳）有限公司 一种事件防刷方法、装置、服务器及系统
CN107332804A (zh) * 2016-04-29 2017-11-07 阿里巴巴集团控股有限公司 网页漏洞的检测方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105281963A (zh) * 2014-06-05 2016-01-27 腾讯科技（深圳）有限公司 nginx服务器的漏洞检测方法和装置
US9967277B2 (en) * 2014-11-24 2018-05-08 Paypal, Inc Digital dye packs
US9467467B2 (en) * 2014-12-08 2016-10-11 Ca, Inc. Detection of privilege escalation vulnerabilities using bag of words
CN106302337B (zh) * 2015-05-22 2020-12-04 腾讯科技（深圳）有限公司 漏洞检测方法和装置
CN106998335B (zh) * 2017-06-13 2020-09-18 深信服科技股份有限公司 一种漏洞检测方法、网关设备、浏览器及系统
CN107577949A (zh) * 2017-09-05 2018-01-12 郑州云海信息技术有限公司 一种Web越权漏洞检测方法与系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104753730A (zh) * 2013-12-30 2015-07-01 腾讯科技（深圳）有限公司 一种漏洞检测的方法及装置
CN106354725A (zh) * 2015-07-15 2017-01-25 腾讯科技（深圳）有限公司 一种事件防刷方法、装置、服务器及系统
CN105357195A (zh) * 2015-10-30 2016-02-24 深圳市深信服电子科技有限公司 web访问的越权漏洞检测方法及装置
CN107332804A (zh) * 2016-04-29 2017-11-07 阿里巴巴集团控股有限公司 网页漏洞的检测方法及装置

Also Published As

Publication number Publication date
CN108769070A (zh) 2018-11-06

Similar Documents

Publication Publication Date Title
US11343280B2 (en) System and method for identifying and controlling polymorphic malware
WO2020000749A1 (zh) 一种越权漏洞检测方法及装置
US10164993B2 (en) Distributed split browser content inspection and analysis
US8763071B2 (en) Systems and methods for mobile application security classification and enforcement
US8561182B2 (en) Health-based access to network resources
US10911438B2 (en) Secure detection and management of compromised credentials using a salt and a set model
KR102150742B1 (ko) 자동적인 거짓 디지털 인증서 검출 기법
WO2018099219A1 (zh) 一种钓鱼网站检测方法和装置
US8505102B1 (en) Detecting undesirable content
US9747455B1 (en) Data protection using active data
US10523699B1 (en) Privilege escalation vulnerability detection using message digest differentiation
JP2019511048A (ja) 検出された脅威イベントに基づく識別情報のセキュリティと封じ込め
US9058490B1 (en) Systems and methods for providing a secure uniform resource locator (URL) shortening service
WO2014175721A1 (en) A system and method for privacy management for internet of things services
CN112703496B (zh) 关于恶意浏览器插件对应用用户的基于内容策略的通知
US10860382B1 (en) Resource protection using metric-based access control policies
US11303670B1 (en) Pre-filtering detection of an injected script on a webpage accessed by a computing device
CN111294337A (zh) 一种基于令牌的鉴权方法及装置
US11595372B1 (en) Data source driven expected network policy control
CN115917541A (zh) web服务器风险认识的用户界面
WO2023151238A1 (zh) 一种勒索病毒检测方法及相关系统
US20230283632A1 (en) Detecting malicious url redirection chains
JP2016525750A (ja) 合法的オブジェクトの誤用の識別
US20200329056A1 (en) Trusted advisor for improved security
US9077748B1 (en) Embedded object binding and validation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18923980

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18923980

Country of ref document: EP

Kind code of ref document: A1