A gray box testing method, device, equipment and readable storage medium

Abstract

This application discloses a gray-box testing method, which is applied to the agent, including: receiving the request sent by the browser; generating an attack test package according to the URL and data package carried in the request; sending the attack test package to the server under test, so that The gray-box testing engine deployed on the server under test uses the target program to process the attack test package to obtain tracking information; the tracking information is the operating logic information of key functions in the target program; the target program is obtained by modifying the source code that processes the request; Obtain trace information and use fuzzing tools to detect security holes in trace information. This method can improve the comprehensiveness, accuracy and detection efficiency of gray box testing. Correspondingly, a gray-box testing device, equipment, and readable storage medium disclosed in the present application also have the above-mentioned technical effects.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a gray box testing method, device, equipment and readable storage medium. Background technique [0002] In the existing technology, compared with black-box testing and white-box testing, gray-box testing can not only ensure the focus of black-box testing but also control the internal structure of white-box testing without requiring internal program functions and operations. Do a detailed understanding, so gray box testing can not only detect software quality, but also improve detection efficiency. [0003] At present, the existing gray box testing relies on the quality of the input source of the web application to be tested. If the URL in the input source is not complete, some code fragments are likely to be missed, resulting in a lack of comprehensiveness, accuracy and efficiency in the detection results. will also be affected. [0004] Therefore, how to rea...

AI Technical Summary

Problems solved by technology

[0003] At present, the existing gray box testing relies on the quality of the input source of the web application to be tested. If the URL in the input source is not complete, some code fragments are likely to be missed, resulting in a lack of comprehensiveness, accuracy and efficiency in the detection results. will also be affected

Images