Web application test data flow tracking method and system

Abstract

The invention discloses a web application test data flow tracking method and system based on an IAST test platform, wherein the data flow tracking method includes: installing an agent program on the server where the application program under test is located, and the agent program is used to run the The virtual machine of the application program communicates. After the application program is started, the monitoring code is inserted into the key functions in the input phase and output phase of the application program through the agent program and the bytecode instrumentation tool. When monitoring the code, pass in the class file name, method name, method parameter and return value of the function to be inserted in the monitoring code, and obtain the propagation path of the tainted data in the application program through the monitoring code, and the The tainted data is the data input by the user during the testing process; sampling the above data flow tracking method can not only realize the real-time tracking of the tainted data, but also accurately obtain the execution method chain in the request-response process based on the actual request.

Description

technical field [0001] The invention relates to the technical field of software testing, in particular to a method and system for tracking web application testing data flow based on an IAST testing platform. Background technique [0002] With the development of network technology, the data of web applications is also growing rapidly, and the number of application interfaces is also increasing. In order to ensure the normal operation of applications, products need to be fully tested before going online, including judging Whether there is an overreach vulnerability. Web application security testing technology Currently commonly used technologies in the industry include DAST (Dynamic Application Security Testing), SAST (Static Application Security Testing) and IAST (Interactive Application Security Testing). In testing, data flow tracking is a variety of security The foundation of vulnerability detection (including SQL injection, command line injection, and directory traversal...

AI Technical Summary

Problems solved by technology

This technology is mainly based on the system level and needs to obtain system instructions. For users who need to detect the security of web applications, it is impossible to accurately locate specific code files, line numbers or functions and parameters.

Images