Security test method, device and system, equipment and storage medium

Abstract

The invention discloses a security test method, device and system, equipment and a storage medium. The security testing method comprises the following steps: a test end sends a test request, the testrequest is used for requesting a tested application to execute a vulnerability test command and sending a communication message to an appointed server through a first channel, the first channel is located between the tested application and the appointed server, and the first channel is a data transmission channel outside a test request response channel of the tested application; and in response toreceiving processing information for the communication message from the specified server, a judgment is made that the tested application has a security vulnerability. According to the security test method provided by the embodiment of the invention, whether the tested application has security holes or not is judged, and the problem of report omission in the application security test is solved.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a security testing method, device, system, equipment and storage medium. Background technique [0002] Application security testing is an important part of the testing work of the application system before it goes online. Through application security testing, the security loopholes in the application system can be found, so as to help enterprise personnel repair the security loopholes in time, and ensure that the application system put into production can be safe and stable. run. [0003] Application security testing in the prior art, such as black-box automated testing, usually builds a test environment after the system development is completed, and uses automated testing tools to simulate hacker attacks to initiate specific requests with vulnerability characteristics to the application system, and the application system receives Specific request, and after...

AI Technical Summary

Problems solved by technology

[0004] In practical applications, after the application system receives a specific request and executes relevant actions according to the vulnerability test logic, it does not return a specific execution result to the automated testing tool, which leads to the automated testing tool judging that the application system does not have security vulnerabilities, resulting in security testing leaks. Report a problem

Images