Application program vulnerability detection method and device

Abstract

The invention relates to an application program vulnerability detection method. The method includes: obtaining a configured detection range of to-be-detected code; reading vulnerability detection logic which is in a preset rule library and corresponds to the to-be-detected code; and inserting a detection function in the to-be-detected code, executing the to-be-detected code in which the detectionfunction is inserted, in a code execution process, detecting, according to the vulnerability detection logic, whether vulnerability exists in the to-be-detected code, and if yes, outputting a detection result. By using the method, a false positive rate of application program vulnerability detection can be decreased. In addition, the invention also provides an application program vulnerability detection device.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a method and device for detecting application loopholes. Background technique [0002] An application program refers to a computer program developed to run on an operating system in order to complete one or several specific tasks. A PHP (Hypertext Preprocessor, hypertext markup language) application is one of many application programs. As more and more websites are developed using PHP, it has become an essential link to perform security performance testing on websites developed with PHP. In traditional technologies, PHP white-box auditing technology is mainly used for security vulnerability detection for PHP applications. PHP white box audit, also known as PHP code audit, is an important part of security testing. Testers can analyze and read the code through manual identification or automated tools, and find hidden security holes in the code. However, the current aut...

AI Technical Summary

Problems solved by technology

However, the current automated PHP white-box audit technology is mainly based on static scanning. In the analysis process, only regular matching is used, the source code will not be executed, and there is no contextual execution environment association. Usually, the logic of interfaces such as entry filtering and database interaction cannot be ruled out. As a result, false positives are caused, and some vulnerabilities that require complex logic cannot be effectively detected, resulting in a high rate of false negatives

Images