WO2020062644A1

WO2020062644A1 - Json hijack bug detection method, apparatus and device, and storage medium

Info

Publication number: WO2020062644A1
Application number: PCT/CN2018/122809
Authority: WO
Inventors: 何双宁
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-09-25
Filing date: 2018-12-21
Publication date: 2020-04-02
Also published as: CN109672658A; CN109672658B

Abstract

Disclosed are a JSON hijack bug detection method, apparatus and device, and a storage medium. The method comprises the steps of: after a uniform resource locator (URL) and a website login state of a website to be tested are acquired, executing the URL in the website to be tested by means of the website login state to obtain a first response result (S10); if it is detected that the first response result can be utilized in a cross-domain manner, not executing the URL in the website to be tested by means of the website login state to obtain a second response result (S20); and if the second response result is different from the first response result, determining that there is a JS object notation (JSON) hijack bug in the website to be tested (S30). The method determines whether there is a JSON hijack bug in a website to be tested by means of a URL execution dynamic simulation method, thereby improving the accuracy of detecting whether there is the JSON hijack bug in the website.

Description

Detection method, device, equipment and storage medium of JSON hijacking vulnerability Ranch

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on September 25, 2018, with application number 201811112893.3, and the invention name is "JSON Hijacking Vulnerability Detection Method, Device, Device, and Storage Medium." Citations are incorporated in the application.

Technical field

The present application relates to the field of communication technologies, and in particular, to a method, a device, a device, and a storage medium for detecting a JSON hijacking vulnerability.

Background technique

JSON (JavaScript Object Notation, JavaScript Object Notation) is a lightweight data exchange format, and hijacking is stealing data (or should be called robbery or interception). The malicious attacker intercepts the JSON data that should be returned to the user through some specific means, and then sends the data back to the malicious attacker. This is the approximate meaning of JSON hijacking. Generally, the JSON data that is hijacked contains sensitive information or valuable data. Currently, a static character analysis method is used to determine whether the response result can be used across domains, and then to detect whether a website has a JSON hijacking vulnerability. This method has a low accuracy in detecting JSON hijacking.

Summary of the Invention

The main purpose of this application is to provide a method, device, device and storage medium for detecting a JSON hijacking vulnerability, which aims to solve the existing technical problem of low accuracy in detecting a JSON hijacking vulnerability.

To achieve the above purpose, the present application provides a method for detecting a JSON hijacking vulnerability. The method for detecting a JSON hijacking vulnerability includes steps:

After obtaining the uniform resource locator URL and the website login status of the website to be tested, executing the URL in the website to be tested through the website login status to obtain a first response result;

If it is detected that the first response result can be used across domains, execute the URL in the website to be tested without using the website login status to obtain a second response result;

If the second response result is different from the first response result, it is determined that the website to be tested has a JS object notation JSON hijacking vulnerability.

In addition, in order to achieve the above object, the present application also provides a JSON hijacking vulnerability detection device. The JSON hijacking vulnerability detection device includes:

An execution module, configured to obtain the first response result by executing the URL in the website to be tested through the website login status after obtaining the uniform resource locator URL and website login status of the website to be tested; The first response result can be used across domains, and the URL is executed in the website to be tested without using the website login status to obtain a second response result;

A determining module, configured to determine, if the second response result is different from the first response result, that the website to be tested has a JS object notation JSON hijacking vulnerability.

In addition, in order to achieve the above purpose, the present application also provides a JSON hijacking vulnerability detection device. The JSON hijacking vulnerability detection device includes a memory, a processor, and a processor that is stored on the memory and can run on the processor. Computer-readable instructions that, when executed by the processor, implement the steps of the method for detecting a JSON hijacking vulnerability as described above.

In addition, in order to achieve the above object, the present application also provides a computer-readable storage medium, where the computer-readable instructions are stored, and when the computer-readable instructions are executed by a processor, the above-mentioned implementation is implemented. Steps of JSON Hijacking Detection Method.

This application first executes a URL on a website to be tested through a website login status to obtain a corresponding first response result. After determining that the first response result can be used across domains, the URL is executed on the website to be tested without using a website login status. For the corresponding second response result, if it is determined that the second response result is different from the first response result, it is determined that the website to be tested has a JSON hijacking vulnerability. The method of dynamically simulating the execution URL is implemented to determine whether the website to be tested has a JSON hijacking vulnerability, and the accuracy of detecting whether a website has a JSON hijacking vulnerability is improved.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic flowchart of a first embodiment of a JSON hijacking vulnerability detection method of the present application;

2 is a schematic flowchart of a second embodiment of a method for detecting a JSON hijacking vulnerability in this application;

3 is a schematic flowchart of a third embodiment of a method for detecting a JSON hijacking vulnerability of the present application;

4 is a functional schematic block diagram of a preferred embodiment of a detection device for JSON hijacking vulnerability in this application;

FIG. 5 is a schematic structural diagram of a hardware operating environment involved in the solution of the embodiment of the present application.

The implementation, functional features and advantages of the purpose of this application will be further described with reference to the embodiments and the drawings.

detailed description

It should be understood that the specific embodiments described herein are only used to explain the application, and are not used to limit the application.

This application provides a method for detecting a JSON hijacking vulnerability. Referring to FIG. 1, FIG. 1 is a schematic flowchart of a first embodiment of a method for detecting a JSON hijacking vulnerability in this application.

The embodiment of the present application provides an embodiment of a method for detecting a JSON hijacking vulnerability. It should be noted that although the logical sequence is shown in the flowchart, in some cases, the execution may be performed in an order different from that shown here. Out or describe the steps.

The detection method of the JSON hijacking vulnerability is applied to a server or a terminal, and the terminal may include a mobile phone, a tablet computer, a laptop computer, a palmtop computer, a personal digital assistant (Personal Digital Assistant (PDA, PDA) and other mobile terminals, as well as fixed terminals such as digital TV, desktop computers. In each embodiment of the method for detecting a JSON hijacking vulnerability, for convenience of description, the execution main body is omitted to describe each embodiment. The detection methods of JSON hijacking vulnerability include:

In step S10, after the uniform resource locator URL and the website login status of the website to be tested are obtained, the URL is executed on the website to be tested through the website login status to obtain a first response result.

After obtaining the URL of the website to be tested and the website login status, execute the URL (Uniform) on the website to be tested through the website login status. Resource Location (Uniform Resource Locator), get the response result of the execution URL, and record it as the first response result. It can be understood that the URL is executed in the website to be tested through the website login status, that is, the URL is executed in the website to be tested with the website login status. URL is the address of a resource in the website to be tested. The website login status can be entered by the user in the website to be tested as required, or the website login status can be stored in the memory in advance. When needed, the website login status can be directly extracted from the memory. It should be noted that web browsers follow the same-origin policy security mechanism. If a web browser allows cross-domain use, the web browser should allow cross-domain use of Javascript code; or a JSONP solution is extracted. The response result must be cross-domain exploitable by URLs of other domain names, in order to form a JSON hijacking vulnerability attack.

In this embodiment, the website to be tested is WEB (World Wide Web), the global wide area network, also known as the World Wide Web, commonly known as the website; it is based on Hypertext and HTTP (Hyper Text Transfer Protocol (Hypertext Transfer Protocol), global, dynamic interactive, cross-platform distributed graphical information system. URL is a concise representation of the location and access method of resources that can be obtained from the Internet, and is the address of standard resources on the Internet. The website login status is identification data used to identify the currently logged-in user in the website; the website login status can prove the uniqueness and legality of the website user. The website login status refers to: Cookie, Session Id and Token, etc. Cookie refers to the data (usually encrypted) stored on the user's local terminal by some websites in order to identify users and track sessions; sessions Ids identify users by recording information on the server side. Token is a string generated by the server as a token requested by the client. After the first login, the server generates a token and returns this token to the client. In the future, the client only needs to bring this Token can come to request data, no need to bring username and password again.

In step S20, if it is detected that the first response result can be used across domains, the URL is executed in the website to be tested without using the website login status to obtain a second response result.

After obtaining the first response result, if it is detected that the first response result can be used across domains, the URL is not executed in the website to be tested through the website login status, that is, the URL is not executed in the website to be tested without the website login status. The response result of the execution URL is recorded as the second response result. It should be noted that when a browser requests a resource of another domain name from a webpage of one domain name, any one of the different domain names, ports, and protocols is cross-domain. The first response result can be used across domains, that is, the first response result can be executed across domains. At this time, the data of another page can be obtained through the response result.

In step S30, if the second response result is different from the first response result, it is determined that the website to be tested has a JS object notation JSON hijacking vulnerability.

When the second response result is obtained, it is determined whether the second response result is the same as the first response result. If the second response result is different from the first response result, it is determined that the website to be tested has a JSON hijacking vulnerability. JSON hijacking vulnerability also known as JSON Hijacking vulnerability. CGI (Common Gateway of the website under test) Interface (public gateway interface) to output data in JSON format. When the website under test has a JSON hijacking vulnerability, the third-party site controlled by a malicious attacker uses CSRF (Cross-site request (forgery, cross-site request forgery) method to force the user's browser to request CGI to obtain JSON data. At this time, a malicious attacker can obtain sensitive information. It can be understood that executing the URL will obtain corresponding response data. If the response data corresponding to the first response result and the second response result are different, it is determined that the first response result is different from the second response result; If the response data corresponding to the two response results are the same, it is determined that the first response result and the second response result are the same.

In this embodiment, the URL is first executed on the website to be tested through the website login status to obtain the corresponding first response result. After determining that the first response result can be used across domains, the URL is not executed on the website to be tested through the website login status. A corresponding second response result is obtained. If it is determined that the second response result is different from the first response result, it is determined that the website to be tested has a JSON hijacking vulnerability. The method of dynamically simulating the execution URL is implemented to determine whether the website to be tested has a JSON hijacking vulnerability, and the accuracy of detecting whether a website has a JSON hijacking vulnerability is improved.

Further, a second embodiment of a method for detecting a JSON hijacking vulnerability in the present application is proposed.

The difference between the second embodiment of the JSON hijacking vulnerability detection method and the first embodiment of the JSON hijacking vulnerability detection method is that, referring to FIG. 2, the JSON hijacking vulnerability detection method further includes:

In step S40, if the second response result is the same as the first response result, it is detected whether there is sensitive information in the first response result.

If it is determined that the second response result is the same as the first response result, it is detected whether there is sensitive information in the first response result. Sensitive information includes, but is not limited to, bank card account number, ID card number, user ID, mobile phone number, email account number, intranet address, and home address.

Further, step S40 includes:

Step a: if the second response result is the same as the first response result, obtain a regular expression corresponding to the preset sensitive information, and perform regular matching on the first response result and the regular expression.

Specifically, when it is determined that the second response result is the same as the first response result, a regular expression corresponding to the preset sensitive information is acquired, and the first response result is regular matched with the regular expression of the sensitive information. Among them, the regular expression of sensitive information is set in advance and stored in the memory. Each kind of sensitive information corresponds to a regular expression. It should be noted that in the process of regular matching the first response result with the regular expression, the data contained in the first response result is regularly matched with all the regular expressions stored in the memory one by one until the first response result When it fails to match all regular expressions, it can be determined that no sensitive information exists in the first response result.

In step b, if the first response result and the regular expression regular match are successful, it is determined that sensitive information exists in the first response result.

After regular matching is performed on the first response result and the regular expression corresponding to the sensitive information, it is determined whether the first response result matches the regular expression successfully. When it is determined that the first response result matches the regular expression successfully, it is determined that sensitive information exists in the first response result.

It can be understood that when the expression form of some data in the first response result meets the regular expression, it indicates that the first response result matches the regular expression regular match successfully; when the expression form of no data in the first response result matches When the regular expression indicates that the first response result fails to match the regular expression. For example, the regular expression corresponding to the mobile phone number is: network identification number + 8 digits, where the network identification number is the first three digits of the mobile phone number, that is, 138, 189, and 188. If some data in the first response result is 138 followed by 8 digits, it can be determined that the first response result matches the regular expression of the mobile phone number successfully.

In step c, if the first response result fails to match the regular expression, it is determined that no sensitive information exists in the first response result.

If the first response result fails to match the regular expression, it is determined that no sensitive information exists in the first response result.

Further, in this embodiment, a sensitive database may be preset in the memory, and sensitive data is stored in the sensitive database. When it is determined that the second response result is the same as the first response result, each piece of data in the first response result is extracted, and the extracted data is compared with the sensitive data in the sensitive database. If the sensitive data is consistent with the data, it is determined that there is sensitive information in the first response result; if no sensitive data consistent with the extracted data is found in the sensitive database, it is determined that there is no sensitive information in the first response result.

In step S50, if the sensitive information is detected in the first response result, it is determined that the JSON hijacking vulnerability exists in the website to be tested.

If sensitive information is detected in the first response result, it is determined that the website to be tested has a JSON hijacking vulnerability. Further, after it is determined that a JSON hijacking vulnerability exists in the website to be tested, a prompt message can be output through the website to be tested to prompt the corresponding operation and maintenance personnel to repair the JSON hijacking vulnerability in the website to be tested according to the prompt information, and the prompt information is output. The methods include, but are not limited to, text or voice.

In step S60, if it is detected that the sensitive information does not exist in the first response result, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.

If no sensitive information is detected in the first response result, it is determined that there is no JSON hijacking vulnerability in the website to be tested.

This embodiment uses a method of dynamically simulating the execution of a URL to determine whether the website under test has a JSON hijacking vulnerability, and further determines whether the website under test has a JSON hijacking vulnerability by detecting whether there is sensitive information in the response result. The method of combining information and website login status to detect whether a test website has a JSON hijacking vulnerability. Compared with a method that uses only sensitive keyword analysis to detect whether a website has a JSON hijacking vulnerability, this embodiment improves the versatility of JSON hijacking vulnerability detection. , While reducing the false positive rate and false negative rate of JSON hijacking vulnerability detection. It should be noted that the use of sensitive keyword analysis to detect whether a website has a JSON hijacking vulnerability has low universality. False positive is that during the process of website vulnerability detection, if a URL of a website does not have a vulnerability originally, it is incorrectly detected as a vulnerability, which is called a false positive. Underreporting is the process of detecting a vulnerability in a website. If a URL of a website is originally leaked but not detected, it is called a false negative.

Further, a third embodiment of a method for detecting a JSON hijacking vulnerability in the present application is proposed.

The third embodiment of the method for detecting a JSON hijacking vulnerability is different from the first or second embodiment of the method for detecting a JSON hijacking vulnerability in that, referring to FIG. 3, the method for detecting a JSON hijacking vulnerability further includes:

In step S70, it is detected whether the first response result can be used across domains.

When the first response result is obtained, it is detected whether the first response result can be used across domains.

Further, step S70 includes:

Step d, detecting whether the first response result is a Hypertext Markup Language HTML document.

Specifically, after the first response result is obtained, it is detected whether the first response result is HTML (Hyper Text Markup). Language) document. It should be noted that the web browser corresponding to the website follows the security mechanism of the same-origin policy. The same-origin policy is an important concept in the security model of web applications. Under this policy, the web browser allows script access of the first page The data on the second page, but only if the two pages have the same source, the source is the URI (Uniform Resource Identifier (Uniform Resource Identifier), host name, port number combination, this strategy can prevent malicious scripts on a page from passing through the page's DOM (Document Object Model (Document Object Model) object gains access to sensitive information on another page. However, for the convenience of website use, web browsers have proposed two schemes to allow cross-domain exploitation: first, allowing cross-domain exploitation of Javascript code; second, JSONP (JSON with Padding). JSONP is JSON A "use mode" allows web pages to obtain information from other domain names (websites), that is, to read data across domains. Usually JavaScript scripts implement their own functions by embedding them in HTML.

Further, step d includes:

Step d1, detecting whether an HTML tag is carried in the first response result.

Specifically, detecting whether an HTML tag is carried in the first response result, wherein the HTML DOM defines accessing and manipulating the HTML The standard method for documents; the DOM expresses HTML documents as a tree structure. Therefore, it should be noted that the HTML tags are stored in advance according to the HTML document in the form of a tree structure.

Step d2: if it is detected that the first response result carries the HTML tag, determine that the first response result is an HTML document.

If it is detected that the first response result carries an HTML tag, it is determined that the first response result is an HTML document.

In step d3, if it is detected that the HTML response is not carried in the first response result, it is determined that the first response result is not an HTML document.

If it is detected that the first response result does not carry an HTML tag, it is determined that the first response result is not an HTML document.

In step e, if it is detected that the first response result is the HTML document, it is determined that the first response result cannot be used across domains.

When it is detected that the first response result is an HTML document, it is determined that the first response result cannot be used across domains.

In step f, if it is detected that the first response result is not the HTML document, the first response result is simulated and executed by a Javascript virtual machine to obtain a corresponding execution result.

When it is detected that the first response result is not an HTML document, the first response result is dynamically simulated and executed by a Javascript virtual machine to obtain a corresponding execution result. Among them, the Javascript virtual machine includes, but is not limited to, Node.JS, PhantomJS, and so on. Node.JS is a Javascript runtime environment (runtime environment); PhantomJS is a WebKit-based server-side JavaScript API (Application Programming Interface). It fully supports the Web without the need for a browser, and its fast, native support for various Web standards.

In step g, after determining that the first response result is successfully executed according to the execution result, it is determined that the first response result can be used across domains.

After determining that the first response result is successfully executed according to the execution result, it is determined that the first response result can be used across domains. It should be noted that if the Javascript virtual machine simulates the execution of the first response result and the execution is successful, it indicates that the first response result is an executable piece of Javascript code and can be used across domains. After the Javascript virtual machine simulates the execution of the first response result, if the first response result is successfully executed, the virtual machine returns an identification of successful execution, and the execution result is an identification of successful execution; if the first response result fails to execute, the virtual machine An error message is returned. At this time, the execution result is an error message. Therefore, whether the first execution result is successfully executed can be determined according to whether the execution result is an identification of successful execution or error information. In this embodiment, there is no limitation on the specific expression form of the identification that is successfully executed.

Step h, after determining that the execution of the first response result fails according to the execution result, detecting whether the first response result is in a JSONP format.

After determining that the execution of the first response result fails according to the execution result, it is detected whether the first response result is in a JSONP format. When the execution of the first response result fails, it indicates that the first response result is not a piece of executable Javascript code.

Further, step h includes:

Step h1: After determining that the execution of the first response result fails according to the execution result, determine a format of the first response result, and determine whether the format of the first response result is consistent with a preset JSONP format.

When it is determined that the execution of the first response result fails in the Javascript virtual machine according to the execution result, a pre-stored JSONP data format parsing engine is obtained, the format of the first response result is parsed according to the JSONP data format parsing engine, and the first response result is obtained. Compare the format of the JSONP with the preset JSONP format to determine whether the format of the first response result is consistent with the preset JSONP format.

Step h2: If the format of the first response result is consistent with the JSONP format, determine that the format of the first response result is the JSONP format.

If it is determined that the format of the first response result is consistent with the preset JSONP format, then it is determined that the format of the first response result is a JSONP format.

Step h3: If the format of the first response result is inconsistent with the JSONP format, determine that the format of the first response result is not a JSONP format.

If it is determined that the format of the first response result is inconsistent with the preset JSONP format, then it is determined that the format of the first response result is not a JSONP format.

In step i, if the format of the first response result is a JSONP format, it is determined that the first response result can be used across domains.

If it is determined that the format of the first response result is a JSONP format, it is determined that the first response result can be used across domains.

Step j: if the format of the first response result is not a JSONP format, determine that the first response result cannot be used across domains.

If it is determined that the format of the first response result is not a JSONP format, then it is determined that the first response result cannot be used across domains.

In step S80, if it is detected that the first response result cannot be used across domains, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.

If it is detected that the first response result cannot be used across domains, it is determined that the website to be tested does not have a JSON hijacking vulnerability. Further, if it is determined that the website to be tested does not have a JSON hijacking vulnerability, a prompt message may be output through the website to be tested to prompt the user that the website to be tested is in a safe state according to the prompt information.

This embodiment uses multiple methods to detect whether the first response result can be used across domains. When it is determined that the first response result cannot be used across domains, it is determined that the website to be tested does not have a JSON hijacking vulnerability, which further improves the detection of whether the website to be tested is Accuracy of JSON hijacking vulnerability.

In addition, referring to FIG. 4, the present application also provides a JSON hijacking vulnerability detection device. The JSON hijacking vulnerability detection device includes:

The execution module 10 is configured to: after obtaining the uniform resource locator URL and the website login status of the website to be tested, execute the URL in the website to be tested through the website login status to obtain a first response result; When the first response result can be used across domains, the URL is executed in the website to be tested without using the website login status, and a second response result is obtained;

A determining module 20 is configured to determine that, if the second response result is different from the first response result, the website to be tested has a JS object notation JSON hijacking vulnerability.

Further, the detection device for the JSON hijacking vulnerability further includes:

A first detection module, configured to detect whether there is sensitive information in the first response result if the second response result is the same as the first response result;

The determining module 20 is further configured to: if the sensitive information is detected in the first response result, determine that the JSON hijacking vulnerability exists in the website to be tested; if it is detected that the first response result does not exist For the sensitive information, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.

Further, the first detection module includes:

An obtaining unit, configured to obtain a regular expression corresponding to preset sensitive information if the second response result is the same as the first response result;

A matching unit, configured to perform regular matching between the first response result and the regular expression;

A first determining unit, configured to determine that, if the first response result and the regular expression regular match succeed, sensitive information exists in the first response result; if the first response result matches the regular expression If the regular matching fails, it is determined that no sensitive information exists in the first response result.

A second detection module, configured to detect whether the first response result can be used across domains;

The determining module 20 is further configured to determine that the JSON hijacking vulnerability does not exist on the website to be tested if it is detected that the first response result cannot be used across domains.

Further, the second detection module includes:

A detecting unit, configured to detect whether the first response result is a Hypertext Markup Language HTML document;

A second determining unit, configured to, if it is detected that the first response result is the HTML document, determine that the first response result cannot be used across domains;

An execution unit configured to, if it is detected that the first response result is not the HTML document, simulate and execute the first response result through a Javascript virtual machine to obtain a corresponding execution result;

The second determining unit is further configured to determine that the first response result can be used across domains after determining that the first response result is successfully executed according to the execution result;

The detecting unit is further configured to detect whether the first response result is in a JSONP format after determining that the execution of the first response result fails according to the execution result;

The second determining unit is further configured to determine that the first response result can be used across domains if the format of the first response result is a JSONP format; if the format of the first response result is not a JSONP format, then It is determined that the first response result cannot be used across domains.

Further, the detection unit includes:

A detection subunit, configured to detect whether an HTML tag is carried in the first response result;

A first determining subunit, configured to determine that the first response result is an HTML document if it is detected that the HTML response is carried in the first response result; if it is detected that the HTML is not carried in the first response result Tag, it is determined that the first response result is not an HTML document.

Further, the detection unit further includes:

A second determining subunit, configured to determine a format of the first response result after determining that the execution of the first response result fails according to the execution result;

A judging unit, configured to judge whether the format of the first response result is consistent with a preset JSONP format;

The second determining subunit is further configured to determine that the format of the first response result is a JSONP format if the format of the first response result is consistent with the JSONP format; if the format of the first response result is the same as If the JSONP format is inconsistent, it is determined that the format of the first response result is not a JSONP format.

It should be noted that various embodiments of the JSON hijacking vulnerability detection device are basically the same as the above embodiments of the JSON hijacking vulnerability detection method, and are not described in detail here.

In addition, this application also provides a detection device for a JSON hijacking vulnerability. As shown in FIG. 5, FIG. 5 is a schematic structural diagram of a hardware operating environment involved in the solution of the embodiment of the present application.

It should be noted that FIG. 5 is a schematic structural diagram of a hardware operating environment of a detection device for a JSON hijacking vulnerability. The detection device for the JSON hijacking vulnerability in the embodiment of the present application may be a terminal device such as a PC or a portable computer.

As shown in FIG. 5, the detection device for the JSON hijacking vulnerability may include: a processor 1001, such as a CPU, a memory 1005, a user interface 1003, a network interface 1004, and a communication bus 1002. The communication bus 1002 is used to implement connection and communication between these components. The user interface 1003 may include a display, an input unit such as a keyboard, and the optional user interface 1003 may further include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a non-volatile memory. memory), such as disk storage. The memory 1005 may optionally be a storage device independent of the foregoing processor 1001.

Optionally, the detection device for the JSON hijacking vulnerability may further include a camera, RF (Radio Frequency) circuits, sensors, audio circuits, WiFi modules, and more.

Those skilled in the art can understand that the structure of the detection device for the JSON hijacking vulnerability shown in FIG. 5 does not constitute a limitation on the detection device for the JSON hijacking vulnerability, and may include more or fewer components than shown, or a combination of some Components, or different component arrangements.

As shown in FIG. 5, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and computer-readable instructions. Among them, the operating system is a program that manages and controls the hardware and software resources of the detection device for the JSON hijacking vulnerability, and supports the operation of computer-readable instructions and other software or programs.

In the detection device for the JSON hijacking vulnerability shown in FIG. 5, the user interface 1003 can be used for the terminal held by the user to perform data communication with the terminal held by the user; the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the processor 1001 can be used to call the computer-readable instructions stored in the memory 1005 and execute the steps of the JSON hijacking vulnerability detection method described above.

The specific implementation manner of the detection device for the JSON hijacking vulnerability in this application is basically the same as the above embodiments of the method for detecting a JSON hijacking vulnerability, and details are not described herein again.

In addition, an embodiment of the present application further provides a computer-readable storage medium, where computer-readable instructions are stored, and the computer-readable instructions implement the JSON hijacking vulnerability described above when executed by a processor. Steps of the detection method.

The specific implementation manner of the computer-readable storage medium of the present application is basically the same as each embodiment of the method for detecting a JSON hijacking vulnerability described above, and details are not described herein again.

It should be noted that, in this article, the terms "including", "including" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, It also includes other elements not explicitly listed, or elements inherent to such a process, method, article, or device. Without more restrictions, an element limited by the sentence "including a ..." does not exclude that there are other identical elements in the process, method, article, or device that includes the element.

The above-mentioned serial numbers of the embodiments of the present application are merely for description, and do not represent the superiority or inferiority of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods in the above embodiments can be implemented by means of software plus a necessary universal hardware platform, and of course, also by hardware, but in many cases the former is better. Implementation. Based on such an understanding, the technical solution of this application that is essentially or contributes to the existing technology can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, The optical disc) includes several instructions for causing a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in the embodiments of this application.

The above are only preferred embodiments of the present application, and thus do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made by using the contents of the specification and drawings of the present application, or directly or indirectly used in other related technical fields Are included in the scope of patent protection of this application.

Claims

A method for detecting a JSON hijacking vulnerability is characterized in that the method for detecting a JSON hijacking vulnerability includes the following steps:

After obtaining the uniform resource locator URL and the website login status of the website to be tested, executing the URL in the website to be tested through the website login status to obtain a first response result;

If it is detected that the first response result can be used across domains, execute the URL in the website to be tested without using the website login status to obtain a second response result;

If the second response result is different from the first response result, it is determined that the website to be tested has a JS object notation JSON hijacking vulnerability.
The method for detecting a JSON hijacking vulnerability according to claim 1, characterized in that, if the first response result is detected to be cross-domain exploitable, it is not in the website to be tested through the website login status After the step of executing the URL to obtain a second response result, the method further includes:

If the second response result is the same as the first response result, detecting whether there is sensitive information in the first response result;

If the sensitive information is detected in the first response result, determining that the JSON hijacking vulnerability exists in the website to be tested;

If it is detected that the sensitive information does not exist in the first response result, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.
The method for detecting a JSON hijacking vulnerability according to claim 2, wherein if the second response result is the same as the first response result, detecting whether there is sensitive information in the first response result The steps include:

If the second response result is the same as the first response result, obtaining a regular expression corresponding to the preset sensitive information, and performing regular matching on the first response result and the regular expression;

If the first response result and the regular expression regular match are successful, determining that sensitive information exists in the first response result;

If the first response result fails to match the regular expression, it is determined that no sensitive information exists in the first response result.
The method for detecting a JSON hijacking vulnerability according to claim 1, wherein after obtaining the URL of the website to be tested and the website login status, the method is executed in the website to be tested through the website login status. The URL, after the step of obtaining the first response result, further includes:

Detecting whether the first response result can be used across domains;

If it is detected that the first response result cannot be used across domains, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.
The method for detecting a JSON hijacking vulnerability according to claim 4, wherein the step of detecting whether the first response result can be used across domains comprises:

Detecting whether the first response result is a Hypertext Markup Language HTML document;

If it is detected that the first response result is the HTML document, determining that the first response result cannot be used across domains;

If it is detected that the first response result is not the HTML document, simulating and executing the first response result through a Javascript virtual machine to obtain a corresponding execution result;

After determining that the first response result is successfully executed according to the execution result, determining that the first response result can be used across domains;

After determining that the execution of the first response result fails according to the execution result, detecting whether the first response result is in a JSONP format;

If the format of the first response result is a JSONP format, determining that the first response result can be used across domains;

If the format of the first response result is not a JSONP format, it is determined that the first response result cannot be used across domains.
The method for detecting a JSON hijacking vulnerability according to claim 5, wherein the step of detecting whether the first response result is an HTML document comprises:

Detecting whether an HTML tag is carried in the first response result;

If it is detected that the first response result carries the HTML tag, determining that the first response result is an HTML document;

If it is detected that the HTML response is not carried in the first response result, it is determined that the first response result is not an HTML document.
The method for detecting a JSON hijacking vulnerability according to claim 5, wherein the step of detecting whether the first response result is in the JSONP format after determining that the first response result fails to be executed according to the execution result include:

After determining that the execution of the first response result fails according to the execution result, determining a format of the first response result, and determining whether the format of the first response result is consistent with a preset JSONP format;

If the format of the first response result is consistent with the JSONP format, determining that the format of the first response result is a JSONP format;

If the format of the first response result is inconsistent with the JSONP format, it is determined that the format of the first response result is not a JSONP format.
The method for detecting a JSON hijacking vulnerability according to claim 2, characterized in that after obtaining the URL of the website to be tested and the login status of the website, the execution is performed on the website to be tested through the website login status. The URL, after the step of obtaining the first response result, further includes:

Detecting whether the first response result can be used across domains;

If it is detected that the first response result cannot be used across domains, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.
The method for detecting a JSON hijacking vulnerability according to claim 8, wherein the step of detecting whether the first response result can be used across domains comprises:

Detecting whether the first response result is a Hypertext Markup Language HTML document;

If it is detected that the first response result is the HTML document, determining that the first response result cannot be used across domains;

If it is detected that the first response result is not the HTML document, simulating and executing the first response result through a Javascript virtual machine to obtain a corresponding execution result;

After determining that the first response result is successfully executed according to the execution result, determining that the first response result can be used across domains;

After determining that the execution of the first response result fails according to the execution result, detecting whether the first response result is in a JSONP format;

If the format of the first response result is a JSONP format, determining that the first response result can be used across domains;

If the format of the first response result is not a JSONP format, it is determined that the first response result cannot be used across domains.
The method for detecting a JSON hijacking vulnerability according to claim 9, wherein the step of detecting whether the first response result is an HTML document comprises:

Detecting whether an HTML tag is carried in the first response result;

If it is detected that the first response result carries the HTML tag, determining that the first response result is an HTML document;

If it is detected that the HTML response is not carried in the first response result, it is determined that the first response result is not an HTML document.
The method for detecting a JSON hijacking vulnerability according to claim 9, wherein the step of detecting whether the first response result is in the JSONP format after determining that the first response result fails to be executed according to the execution result include:

After determining that the execution of the first response result fails according to the execution result, determining a format of the first response result, and determining whether the format of the first response result is consistent with a preset JSONP format;

If the format of the first response result is consistent with the JSONP format, determining that the format of the first response result is a JSONP format;

If the format of the first response result is inconsistent with the JSONP format, it is determined that the format of the first response result is not a JSONP format.
The method for detecting a JSON hijacking vulnerability according to claim 3, wherein after obtaining the URL of the website to be tested and the website login status, the method is executed on the website to be tested through the website login status. The URL, after the step of obtaining the first response result, further includes:

Detecting whether the first response result can be used across domains;

If it is detected that the first response result cannot be used across domains, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.
The method for detecting a JSON hijacking vulnerability according to claim 12, wherein the step of detecting whether the first response result can be used across domains comprises:

Detecting whether the first response result is a Hypertext Markup Language HTML document;

If it is detected that the first response result is the HTML document, determining that the first response result cannot be used across domains;

If it is detected that the first response result is not the HTML document, simulating and executing the first response result through a Javascript virtual machine to obtain a corresponding execution result;

After determining that the first response result is successfully executed according to the execution result, determining that the first response result can be used across domains;

After determining that the execution of the first response result fails according to the execution result, detecting whether the first response result is in a JSONP format;

If the format of the first response result is a JSONP format, determining that the first response result can be used across domains;

If the format of the first response result is not a JSONP format, it is determined that the first response result cannot be used across domains.
The method for detecting a JSON hijacking vulnerability according to claim 13, wherein the step of detecting whether the first response result is an HTML document comprises:

Detecting whether an HTML tag is carried in the first response result;

If it is detected that the first response result carries the HTML tag, determining that the first response result is an HTML document;

If it is detected that the HTML response is not carried in the first response result, it is determined that the first response result is not an HTML document.
The method for detecting a JSON hijacking vulnerability according to claim 13, wherein the step of detecting whether the first response result is in a JSONP format after determining that the first response result fails to be executed according to the execution result include:

After determining that the execution of the first response result fails according to the execution result, determining a format of the first response result, and determining whether the format of the first response result is consistent with a preset JSONP format;

If the format of the first response result is consistent with the JSONP format, determining that the format of the first response result is a JSONP format;

If the format of the first response result is inconsistent with the JSONP format, it is determined that the format of the first response result is not a JSONP format.
A detection device for a JSON hijacking vulnerability is characterized in that the detection device for a JSON hijacking vulnerability includes:

An execution module, configured to obtain the first response result by executing the URL in the website to be tested through the website login status after obtaining the uniform resource locator URL and website login status of the website to be tested; The first response result can be used across domains, and the URL is executed in the website to be tested without using the website login status to obtain a second response result;

A determining module, configured to determine, if the second response result is different from the first response result, that the website to be tested has a JS object notation JSON hijacking vulnerability.
The device for detecting a JSON hijacking vulnerability according to claim 16, wherein the device for detecting a JSON hijacking vulnerability further comprises:

A first detection module, configured to detect whether there is sensitive information in the first response result if the second response result is the same as the first response result;

The determining module is further configured to: if the sensitive information is detected in the first response result, determine that the JSON hijacking vulnerability exists in the website to be tested; if it is detected that the first response result does not exist, The sensitive information, it is determined that the website to be tested does not exist the JSON hijacking vulnerability.
The device for detecting a JSON hijacking vulnerability according to claim 17, wherein the first detection module comprises:

An obtaining unit, configured to obtain a regular expression corresponding to preset sensitive information if the second response result is the same as the first response result;

A matching unit, configured to perform regular matching between the first response result and the regular expression;

A first determining unit, configured to determine that, if the first response result and the regular expression regular match succeed, sensitive information exists in the first response result; if the first response result matches the regular expression If the regular matching fails, it is determined that no sensitive information exists in the first response result.
A detection device for a JSON hijacking vulnerability, characterized in that the detection device for a JSON hijacking vulnerability includes a memory, a processor, and computer-readable instructions stored on the memory and executable on the processor. The computer-readable instructions, when executed by the processor, implement the following steps:

After obtaining the uniform resource locator URL and the website login status of the website to be tested, executing the URL in the website to be tested through the website login status to obtain a first response result;

If it is detected that the first response result can be used across domains, execute the URL in the website to be tested without using the website login status to obtain a second response result;

If the second response result is different from the first response result, it is determined that the website to be tested has a JS object notation JSON hijacking vulnerability.
A computer-readable storage medium is characterized in that computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the following steps are implemented:

After obtaining the uniform resource locator URL and the website login status of the website to be tested, executing the URL in the website to be tested through the website login status to obtain a first response result;

If it is detected that the first response result can be used across domains, execute the URL in the website to be tested without using the website login status to obtain a second response result;

If the second response result is different from the first response result, it is determined that the website to be tested has a JS object notation JSON hijacking vulnerability.