WO2020181841A1

WO2020181841A1 - Method for automatically testing horizontal over-permission vulnerabilities and related device

Info

Publication number: WO2020181841A1
Application number: PCT/CN2019/122940
Authority: WO
Inventors: 唐新玉
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2019-03-14
Filing date: 2019-12-04
Publication date: 2020-09-17
Also published as: CN110084044A

Abstract

Disclosed are a method for automatically testing horizontal over-permission vulnerabilities and a related device, relating to the field of comparison testing. The method comprises: creating a first account and a second account with the same account operation permission list, wherein the account operation permission list shows all account operation permissions owned by a corresponding account (S100); using the first account to execute a reference test request for each of the account operation permissions, so as to obtain a corresponding reference test request URL (S110); based on the reference test request URL, using the second account to execute a contrast test request for each of the account operation permissions, so as to obtain a corresponding contrast test request result (S120); and based on the corresponding contrast test request result, determining whether there are horizontal over-permission vulnerabilities (S130). The method improves the efficiency for testing horizontal unauthorized vulnerabilities.

Description

Automatic testing method and related equipment for horizontal unauthorized vulnerability

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on March 14, 2019, the application number is 201910195290.2, and the application name is "Methods and related equipment for automatic testing of horizontal unauthorized vulnerabilities", the entire content of which is by reference Incorporated in this application.

Technical field

This application relates to the field of comparative testing, and particularly relates to a method and related equipment for automatic testing for horizontal unauthorized vulnerabilities.

Background technique

A system with a complete structure and secure rules should first determine the authority of the user who sent the request for each request received, and then provide corresponding services to it. However, in real life, due to the omissions of the engineers who set up the system, the system does not determine the authority of the user who sends the request for the authority in certain permissions, but directly serves the user who sends the request. As a result, users who do not have the permission can also use the permission, that is, the permission is exceeded. In ultra vires, there is a kind of ultra vires that is horizontal, that is, the attacker and the attacked belong to the same authority group, and each person should only be able to operate the content of their own account, but in fact the attacker passes the request sent to the system The identity of the victim is modified to that of the attacked person, thus successfully operating the authority content of the attacked person. For example: User A changes his identity in the request to the system to the identity of user B, thereby successfully modifying the password of user B. This situation is an overreach.

In the prior art, the testing for horizontal unauthorized vulnerabilities is performed manually by testers based on their own experience. In this process, there will be human omissions and human errors, and the efficiency is low.

Summary of the invention

Based on this, in order to solve the technical problem of how to automatically test for horizontal unauthorized vulnerabilities from a technical level in related technologies, this application provides a method and related equipment for automatically testing for horizontal unauthorized vulnerabilities.

In the first aspect, it provides a method to automatically test for horizontal unauthorized vulnerabilities, including:

Create a first account and a second account with the same account operation permission list, the account operation permission list displays all account operation permissions owned by the corresponding account;

Use the first account to perform a reference test request for the operation authority of each account to obtain a corresponding reference test request URL;

Based on the reference test request URL, use the second account to perform a comparison test request for each of the account operation permissions, and obtain a corresponding comparison test request result;

Based on the result of the corresponding comparison test request, it is determined whether there is a horizontal overriding vulnerability.

According to the second aspect of the present disclosure, there is provided a device for automatically testing against horizontal unauthorized vulnerabilities, including:

The creation module is used to create a first account and a second account with the same account operation permission list, the account operation permission list displays all account operation permissions owned by the corresponding account;

The reference test request module is configured to use the first account to make a reference test request for the operation authority of each of the accounts to obtain the corresponding reference test request URL;

The control test request module is configured to use the second account to perform a control test request for the operation authority of each account based on the reference test request URL, and obtain a corresponding control test request result;

The determining module is used to determine whether there is a horizontal overreach vulnerability based on the corresponding comparison test request result.

According to the third aspect of the present disclosure, there is provided an electronic device that automatically tests for horizontal unauthorized vulnerabilities, including:

Memory, configured to store executable instructions;

The processor is configured to execute executable instructions stored in the memory to implement the above-mentioned method.

According to a fourth aspect of the present disclosure, there is provided a computer-readable storage medium, which stores computer program instructions, and when the computer instructions are executed by a computer, the computer executes the method described above. Optionally, the computer-readable storage medium may be a non-volatile computer-readable storage medium.

Compared with the traditional technology that automatically tests for horizontal unauthorized vulnerabilities manually by testers, the embodiments of the present disclosure automatically create a first account and a second account, and use the second account to test account operation permissions, which improves the The level of efficiency of testing over vulnerabilities.

Description of the drawings

Fig. 1 shows a flowchart of automatic testing for horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure.

Fig. 2 shows a block diagram of an apparatus for automatically testing horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure.

Fig. 3 shows a detailed flow chart of creating a first account and a second account with the same account operation authority list according to an exemplary embodiment of the present disclosure.

FIG. 4 shows a detailed flow chart of a comparison test request for each account operation authority based on the reference test request URL and the use of the second account according to an exemplary embodiment of the present disclosure to obtain the corresponding comparison test request result .

Fig. 5 shows a detailed flow chart of determining the corresponding comparison test request URL based on the identification parameter value corresponding to the first account for each account operation authority according to an exemplary embodiment of the present disclosure.

Fig. 6 shows a system architecture diagram for automatic testing of horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure.

Fig. 7 shows a diagram of an electronic device that automatically tests for horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure.

FIG. 8 shows a diagram of a computer-readable storage medium that automatically tests for horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure.

detailed description

Example embodiments will now be described more fully with reference to the accompanying drawings.

Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in the form of software, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and/or processor devices and/or microcontroller devices.

The purpose of the present disclosure is to automatically test against horizontal unauthorized vulnerabilities from the technical aspect, and to provide testing efficiency. According to an embodiment of the present disclosure, a method for automatically testing a horizontal unauthorized vulnerability includes: creating a first account and a second account with the same account operation permission list, the account operation permission list displays all accounts owned by the corresponding account Operation authority; use the first account to make a reference test request for the operation authority of each account to obtain the corresponding reference test request URL; based on the reference test request URL, use the second account to perform a reference test on each account The operation authority performs a comparison test request to obtain a corresponding comparison test request result; based on the corresponding comparison test request result, it is determined whether there is a horizontal override vulnerability. Compared with the traditional technology that automatically tests for horizontal unauthorized vulnerabilities manually by testers, the embodiments of the present disclosure automatically create a first account and a second account, and use the second account to test account operation permissions, which improves the The level of efficiency of testing over vulnerabilities.

Fig. 1 shows a flowchart of automatic testing for horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure:

Step S100: Create a first account and a second account with the same account operation authority list, where the account operation authority list displays all account operation authority owned by the corresponding account;

Step S110: Use the first account to make a reference test request for the operation authority of each account, and obtain a corresponding reference test request URL;

Step S120: Based on the reference test request URL, use the second account to perform a comparison test request for the operation authority of each account, and obtain a corresponding comparison test request result;

Step S130: Based on the corresponding comparison test request result, it is determined whether there is a horizontal unauthorized vulnerability.

In the following, detailed explanations and descriptions will be given of the above-mentioned steps of automatic testing for horizontal unauthorized vulnerabilities in this exemplary embodiment with reference to the accompanying drawings.

In step S100, a first account and a second account having the same account operation authority list are created, and the account operation authority list displays all account operation authority owned by the corresponding account.

In this way, the first account and the second account have the same status as the operating authority of any account, so that the horizontal unauthorized vulnerability test can be further performed.

In an embodiment, as shown in FIG. 3, step S100 includes:

Step S1001: Create the first account;

Step S1002: creating the second account;

Step S1003: Assign all account operation permissions in the summary account operation permission list to the first account and the second account.

In one embodiment, the first account and the second account are created first. In order to test as many account operation permissions as possible for horizontal unauthorized vulnerabilities, the aggregated account operating permissions are opened to the first account and the second account, so that the server can perform horizontal unauthorized vulnerabilities on each account operating authority in the aggregated account operating permissions. Detection.

In step S110, the first account is used to perform a reference test request for the operation authority of each account, and the corresponding reference test request URL is obtained.

The reference test request URL refers to the request URL sent by the first account to the system under test with the operating authority of the account to be tested.

By using the first account to make a reference test request, the second account can refer to the reference test request URL, thereby further detecting the horizontal unauthorized vulnerability of the account operation authority.

In an embodiment, the using the first account to perform a reference test request for the operating authority of each of the accounts includes: using the first account to send the corresponding legal request URL for the operating authority of each of the accounts, The legal request URL is determined as the corresponding reference test request URL.

The legal request URL refers to the request URL sent by the account when it requests its own permission content with its own identity.

In step S120, based on the reference test request URL, the second account is used to perform a comparison test request for the operation authority of each account, and a corresponding comparison test request result is obtained.

The control test request URL refers to the request URL sent by the second account to the system under test with reference to the reference test request URL.

The control test request result refers to the corresponding response message returned by the system under test in response to the control test request.

Performing a comparison test request through the second account makes it possible to determine whether the corresponding account operation authority has a horizontal override vulnerability based on the content of the corresponding comparison test request.

In an embodiment, as shown in FIG. 4, step S120 includes:

Step S1201: Determine each identification parameter in the reference test request URL and the identification parameter value corresponding to the first account from the reference test request URL sent by the first account;

Step S1202: For each account operation authority, determine a corresponding comparison test request URL based on the identification parameter value corresponding to the first account;

Step S1203: For each account operation authority, use the second account to send the corresponding comparison test request URL, and determine the corresponding return message as the corresponding comparison test request result.

The identification parameter refers to the parameter that is preset by the tested system to identify the identity of each account or a certain attribute according to the unique parameter value, for example: "userID" corresponds to the identity of the account user, and "addressID" corresponds to the account user The address identification.

In this way, the second account can use the identification parameter value of the first account to pretend to be the first account, thereby attempting to perform operations on the account operation authority content of the first account.

In an embodiment, as shown in FIG. 5, step S1202 includes:

Step S12021: For each account operation authority, replace the identification parameter value in the legal request URL corresponding to the second account with the identification parameter value corresponding to the first account to obtain the corresponding illegal request URL;

Step S12022: Determine the illegal request URL as the corresponding comparison test request URL.

Illegal request URL refers to a request URL sent when an account pretends to be another account and tries to request permission content of another account.

By using the second account to perform the control test request, the server can determine whether the system under test recognizes that the control test request is an illegal request based on the return message of the control test request from the system under test. In this way, it is determined whether the system under test has horizontal overreach vulnerabilities in the configuration of the corresponding account operation authority.

In one embodiment, the first account sends a series of legal request URLs to the tested system, which are expressed in natural language, for example: "My userID is 02, my password is xxx, I want to log in to the account", "I want Delete the address information with addressID 34", "My userID is 02, I want to change the avatar"... It can be determined from this that the parameter value of the identification parameter "userID" of the first account is "02", and the identification parameter "addressID" is The parameter value is "34".

At the same time, the parameter value of the identification parameter "userID" of the second account is "03", and the parameter value of the identification parameter "addressID" is "57". For the account operation permission of "View Personal Information", the legal request URL that the second account should send to the tested system is: "I want to view the personal information of the user whose userID is 03." To test the "View Personal Information" Whether there is a horizontal overreach vulnerability in the operation authority of the first account, the control test request for the second account should be: "I want to view the personal information of the user with userID 02." Similarly, for the account operation authority of "change delivery address" , The legal request URL that the second account should send to the tested system is: "I want to change the address information with addressID 57", and the corresponding control test request should be: "I want to change the address information with addressID 34".

In step S130, based on the corresponding comparison test request result, it is determined whether there is a horizontal override vulnerability.

By judging the content of the returned message of the control test request by the system under test, the server can determine whether the system under test has determined the authority of the sender of the control test request, thereby determining the operating authority of the corresponding account Is there a loophole in horizontal ultra vires?

In an embodiment, the determining whether there is a horizontal unauthorized vulnerability based on the corresponding control test request result includes: operating permissions for each of the accounts, if the corresponding control test request result, the corresponding return report If the control test request is confirmed in the article, it is determined that there is a horizontal overreach vulnerability in the account operation authority.

For example, the parameter value of the identification parameter "userID" of the first account is "02", and the parameter value of the identification parameter "userID" of the second account is "03". For the account operation authority of "View Personal Information", the control test request sent by the second account is: "I want to view the personal information of the user with userID 02." If the tested system operates on the account "View Personal Information" If the permission configuration is safe and complete, the tested system will verify whether the userID of the second account is indeed "02" according to the session table or other reliable verification methods. Once verified, the tested system will find the The second account does not have the authority to view the personal information of the account whose userID is "02", and the tested system will reject the comparison test request of the second account, and return information that rejects the comparison test request.

If the tested system has a horizontal overreach vulnerability in the configuration of the account operation authority of "View personal information", the tested system will not verify whether the userID of the second account is indeed "02", but Directly confirm the comparison test request of the second account, and return the corresponding personal information of the first account. Therefore, by viewing the content of the result of the control test request, it is determined whether the system under test has a horizontal overreach vulnerability in the configuration of the corresponding account operation authority.

In one embodiment, after determining whether there is a horizontal overreach vulnerability based on the corresponding comparison test request result, the method includes: sending the information of the account operation authority with the horizontal overreach vulnerability to the management terminal. That is, after it is determined that there is a horizontal overreach vulnerability in an account operation authority, the information that the account operation authority has a horizontal overreach vulnerability is sent to the management terminal.

In an embodiment, as shown in FIG. 2, a device for automatically testing for horizontal unauthorized vulnerabilities is provided, which specifically includes:

The creation module 210 is configured to create a first account and a second account with the same account operation authority list, and the account operation authority list displays all account operation authority owned by the corresponding account;

The reference test request module 220 is configured to use the first account to make a reference test request for the operation authority of each account to obtain a corresponding reference test request URL;

The comparison test request module 230 is configured to use the second account to perform a comparison test request for each account operation authority based on the reference test request URL, and obtain a corresponding comparison test request result;

The determining module 240 is configured to determine whether there is a level unauthorized vulnerability based on the corresponding comparison test request result.

For the implementation process of the functions and roles of each module in the above-mentioned device, please refer to the implementation process of corresponding steps in the above-mentioned method for automatically testing horizontal unauthorized vulnerabilities, which will not be repeated here.

It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of a module or unit described above can be further divided into multiple modules or units to be embodied.

In addition, although the various steps of the method of the present disclosure are described in a specific order in the drawings, this does not require or imply that these steps must be performed in the specific order, or that all the steps shown must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc.

Through the description of the foregoing embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiment of the present disclosure.

Fig. 6 shows a system architecture diagram for automatic testing of horizontal unauthorized vulnerabilities according to an exemplary embodiment of the present disclosure. The system architecture includes: a system to be tested 310, a database 320, a first virtual client 330, and a second virtual client 340. Among them, the first virtual client 330 uses the first account to perform the test operation, and the second virtual client 340 uses the second account to perform the test operation.

In an embodiment, the first virtual client 330 sends a reference test request URL to the system under test 310, the database 320 sends the stored reference test request URL to the second virtual client 340, and the second virtual client 340 sends The received reference test request URL is used as a reference, the system to be tested 310 performs a comparison test request, and the result of the comparison test request returned by the system to be tested 310 is received.

Through the above description of the system architecture, those skilled in the art can easily understand that the system architecture described here can realize the functions of each module in the device for automatic testing for horizontal unauthorized vulnerabilities as shown in FIG. 2.

In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

Those skilled in the art can understand that various aspects of the present application can be implemented as a system, method, or program product. Therefore, each aspect of the present application can be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to herein as "Circuit", "Module" or "System".

The electronic device 400 according to this embodiment of the present application will be described below with reference to FIG. 7. The electronic device 400 shown in FIG. 7 is only an example, and should not bring any limitation to the function and scope of use of the embodiments of the present application.

As shown in FIG. 7, the electronic device 400 takes the form of a general-purpose computing device. The components of the electronic device 400 may include but are not limited to: the aforementioned at least one processing unit 410, the aforementioned at least one storage unit 420, and a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410).

Wherein, the storage unit stores program code, and the program code can be executed by the processing unit 410, so that the processing unit 410 executes the various exemplary methods described in the "Exemplary Method" section of this specification. Implementation steps. For example, the processing unit 410 may perform step S100 as shown in FIG. 1: create a first account and a second account with the same account operation authority list, the account operation authority list displays all account operations owned by the corresponding account Step S110: Use the first account to make a reference test request for each of the account operation permissions to obtain the corresponding reference test request URL; Step S120: Use the second account based on the reference test request URL, A comparison test request is performed on each of the account operation permissions to obtain a corresponding comparison test request result; Step S130: Based on the corresponding comparison test request result, it is determined whether there is a horizontal override vulnerability.

The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and/or a cache storage unit 4202, and may further include a read-only storage unit (ROM) 4203.

The storage unit 420 may also include a program/utility tool 4204 having a set of (at least one) program module 4205. Such program module 4205 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.

The bus 430 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.

The electronic device 400 can also communicate with one or more external devices 500 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable a user to interact with the electronic device 400, and/or communicate with Any device (such as a router, modem, etc.) that enables the electronic device 400 to communicate with one or more other computing devices. This communication can be performed through an input/output (I/O) interface 450. Moreover, the electronic device 400 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 460. As shown in the figure, the network adapter 460 communicates with other modules of the electronic device 400 through the bus 430. It should be understood that although not shown in the figure, other hardware and/or software modules can be used in conjunction with the electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.

Through the description of the foregoing embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiments of the present disclosure.

In the exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium on which is stored a program product capable of implementing the above method in this specification. In some possible implementation manners, each aspect of the present application can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to make the The terminal device executes the steps according to various exemplary embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

Referring to FIG. 8, a program product 600 for implementing the above method according to an embodiment of the present application is described. It can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be installed in a terminal device, For example, running on a personal computer. However, the program product of this application is not limited to this. In this document, the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or combined with an instruction execution system, device, or device.

The program product can use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

The computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.

The program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

The program code used to perform the operations of this application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural Programming language-such as "C" language or similar programming language. The program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on. In the case of a remote computing device, the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using Internet service providers) Business to connect via the Internet).

The processing shown in the above drawings does not indicate or limit the time sequence of these processings. In addition, it is easy to understand that these processes can be executed synchronously or asynchronously in multiple modules, for example.

This application is intended to cover any variations, uses, or adaptive changes of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or conventional technical means in the technical field not disclosed in the present disclosure .

Claims

A method for automatically testing against horizontal unauthorized vulnerabilities, which is characterized by including:

Creating a first account and a second account with the same account operation permission list, the account operation permission list displays all account operation permissions owned by the corresponding account;

Use the first account to perform a reference test request for the operation authority of each account to obtain a corresponding reference test request URL;

Based on the reference test request URL, use the second account to perform a comparison test request for each of the account operation permissions, and obtain a corresponding comparison test request result;

Based on the result of the corresponding comparison test request, it is determined whether there is a horizontal overriding vulnerability.
The method according to claim 1, wherein the creating the first account and the second account with the same account operation authority list comprises:

Create the first account;

Create the second account;

Assign all account operation permissions in the summary account operation permission list to the first account and the second account.
The method according to claim 1, wherein said using said first account to perform a reference test request for the operating authority of each said account to obtain a corresponding reference test request URL, comprising:

For each account operation authority, use the first account to send a corresponding legal request URL, and determine the legal request URL as the corresponding reference test request URL.
The method according to claim 1, wherein the second account is used to perform a comparison test request for each of the account operation permissions based on the reference test request URL, to obtain a corresponding comparison test request result, include:

Determining each identification parameter in the reference test request URL and the identification parameter value corresponding to the first account from the reference test request URL sent by the first account;

For each account operation authority, determine a corresponding comparison test request URL based on the identification parameter value corresponding to the first account;

For each account operation authority, use the second account to send the corresponding comparison test request URL, and determine the corresponding return message as the corresponding comparison test request result.
The method according to claim 4, wherein the determining the corresponding control test request URL based on the identification parameter value corresponding to the first account for each of the account operation permissions comprises:

For each account operation authority, replace the identification parameter value in the legal request URL corresponding to the second account with the identification parameter value corresponding to the first account to obtain the corresponding illegal request URL;

The illegal request URL is determined as the corresponding control test request URL.
The method according to claim 1, wherein the determining whether there is a horizontal unauthorized vulnerability based on the corresponding control test request result comprises:

For each account operation authority, if the corresponding comparison test request result and the corresponding return message confirm the comparison test request, it is determined that there is a horizontal overriding vulnerability in the account operation authority.
The method according to claim 1, characterized in that, after determining whether there is a horizontal override vulnerability based on the corresponding comparison test request result, the method comprises:

The information of the operating authority of the account with the horizontal unauthorized vulnerability is sent to the management terminal.
A device for automatically testing against horizontal unauthorized vulnerabilities, which is characterized in that it includes:

The creation module is used to create a first account and a second account with the same account operation permission list, the account operation permission list displays all account operation permissions owned by the corresponding account;

The reference test request module is configured to use the first account to make a reference test request for the operation authority of each of the accounts to obtain the corresponding reference test request URL;

The control test request module is configured to use the second account to perform a control test request for the operation authority of each account based on the reference test request URL, and obtain a corresponding control test request result;

The determining module is used to determine whether there is a horizontal overreach vulnerability based on the corresponding comparison test request result.
The device according to claim 8, wherein the creation module is specifically configured to:

Create the first account;

Create the second account;

Assign all account operation permissions in the summary account operation permission list to the first account and the second account.
The device according to claim 8, wherein the reference test request module is specifically used for:

For each account operation authority, use the first account to send a corresponding legal request URL, and determine the legal request URL as the corresponding reference test request URL.
The device according to claim 8, wherein the comparison test request module is specifically configured to:

Determining each identification parameter in the reference test request URL and the identification parameter value corresponding to the first account from the reference test request URL sent by the first account;

For each account operation authority, determine a corresponding comparison test request URL based on the identification parameter value corresponding to the first account;

For each account operation authority, use the second account to send the corresponding comparison test request URL, and determine the corresponding return message as the corresponding comparison test request result.
The device according to claim 11, wherein the comparison test request module determines the corresponding comparison test request URL based on the identification parameter value corresponding to the first account based on the operation authority of each of the accounts. Used for:

For each account operation authority, replace the identification parameter value in the legal request URL corresponding to the second account with the identification parameter value corresponding to the first account to obtain the corresponding illegal request URL;

The illegal request URL is determined as the corresponding control test request URL.
The device according to claim 8, wherein the determining module is specifically configured to:

For each account operation authority, if the corresponding comparison test request result and the corresponding return message confirm the comparison test request, it is determined that there is a horizontal overriding vulnerability in the account operation authority.
The device according to claim 8, wherein:

The determining module is further configured to, after determining whether there is a horizontal override vulnerability based on the corresponding comparison test request result, send the information of the account operation authority with the horizontal override vulnerability to the management terminal.
An electronic device that automatically tests for horizontal unauthorized vulnerabilities, which is characterized in that it includes:

Memory, configured to store executable instructions;

The processor is configured to execute executable instructions stored in the memory to implement the following steps:

Creating a first account and a second account with the same account operation permission list, the account operation permission list displays all account operation permissions owned by the corresponding account;

Use the first account to perform a reference test request for the operation authority of each account to obtain a corresponding reference test request URL;

Based on the reference test request URL, use the second account to perform a comparison test request for each of the account operation permissions, and obtain a corresponding comparison test request result;

Based on the result of the corresponding comparison test request, it is determined whether there is a horizontal overriding vulnerability.
The electronic device according to claim 15, wherein the processor specifically executes the following steps when executing the creation of the first account and the second account with the same account operation authority list:

Create the first account;

Create the second account;

Assign all account operation permissions in the summary account operation permission list to the first account and the second account.
The electronic device according to claim 15, wherein the processor is executing the reference test request URL based on the reference test and uses the second account to perform a comparison test request for each of the account operation permissions to obtain When the corresponding control test request results, the following steps are specifically performed:

Determining each identification parameter in the reference test request URL and the identification parameter value corresponding to the first account from the reference test request URL sent by the first account;

For each account operation authority, determine a corresponding comparison test request URL based on the identification parameter value corresponding to the first account;

For each account operation authority, use the second account to send the corresponding comparison test request URL, and determine the corresponding return message as the corresponding comparison test request result.
The electronic device according to claim 17, wherein the processor determines the corresponding control test request URL based on the identification parameter value corresponding to the first account when executing the operation authority for each of the account , Perform the following steps:

For each account operation authority, replace the identification parameter value in the legal request URL corresponding to the second account with the identification parameter value corresponding to the first account to obtain the corresponding illegal request URL;

The illegal request URL is determined as the corresponding control test request URL.
The electronic device according to claim 15, wherein the processor specifically executes the following steps when determining whether there is a horizontal override vulnerability based on the corresponding comparison test request result:

For each account operation authority, if the corresponding comparison test request result and the corresponding return message confirm the comparison test request, it is determined that there is a horizontal overriding vulnerability in the account operation authority.
A computer-readable storage medium, characterized in that it stores computer program instructions, and when the computer instructions are executed by a computer, the computer executes the method according to any one of claims 1-7.