Method, device and equipment for detecting service logic vulnerability and medium

Abstract

The invention provides a method for detecting a service logic vulnerability, which comprises the following steps: in response to obtaining a service message sent to a server by a client, determining service scene information based on the service message; determining a target parameter and a test case corresponding to the service scene information; replacing the value of the target parameter in theservice message with the value of the target parameter in the test case, generating a test message, and sending the test message to the server; receiving first response information for the test message from the server; processing the first response information to obtain a detection result of whether the service logic vulnerability exists or not; and outputting the detection result. The inventionfurther provides a device for detecting the service logic vulnerability, electronic equipment and a computer readable storage medium.

Description

technical field [0001] The present disclosure relates to the technical field of automated testing, and in particular to a method, device, equipment and medium for detecting business logic loopholes. Background technique [0002] Business logic loopholes refer to that some logic branches cannot be processed normally or handle errors due to lax control of program logic or too complex logic, such as arbitrary amount payment, unauthorized access, authentication bypass, etc. Different from traditional security vulnerabilities, logic vulnerabilities are complex and inconsistent in business scenarios. At present, there is no tool that can automatically detect logic vulnerabilities, and security testers can only detect them manually. The general test method for security testers is: intercept the interactive messages between the client and server through packet capture tools, construct test data outside the scope of normal business rules, tamper with the parameter values ​​in the int...

AI Technical Summary

Problems solved by technology

[0003] 1. Incomplete coverage of test scenarios and missed reports of vulnerabilities: Some business functions have many scenarios and complex business logic, such as the purchase of financial management transactions in online banking. Because there are various financial products and the processing logic of each product is different, security testers do not know enough about business functions. In-depth, relying entirely on one's own test experience to test, it is easy to lead to incomplete coverage of test scenarios and missed reports of vulnerabilities

[0004] 2. Manual testing is inefficient: For complex business functions, there are dozens or even hundreds of parameters in the interactive message. If the parameter values ​​in the message are manually tampered with, a business function will take a long time. Test efficiency is very low

Images