Out-of-authority vulnerability detection method, apparatus and device, and storage medium

Abstract

The invention discloses an unauthorized vulnerability detection method, apparatus and device, and a storage medium. The method is applied to the field of computers, and comprises the steps of acquiring a sample request and a sample response wherein the sample response is a response result corresponding to the sample request, authentication information in the sample request is first authenticationinformation, and the first authentication information is authentication information with the right to acquire the sample response; editing the first authentication information in the sample request togenerate a test request; obtaining a test response corresponding to the test request; and calculating an unauthorized risk value of the sample request through the similarity between the sample response and the test response. The problems that the work is too complicated when the unauthorized bugs are manually detected, and the unauthorized bugs cannot be accurately judged due to subjective factors existing in the manually judged result can be solved.

Description

technical field [0001] The present application relates to the field of computers, and in particular to a detection method, device, equipment and storage medium for unauthorized leaks. Background technique [0002] Privilege violation vulnerability is a common logical security vulnerability. To exceed one's authority is to exceed one's authority or authority. Most applications have permission division and control, but if there are flaws in the design of permission control functions, users can use these flaws to access unauthorized functions or data, which is a privilege violation vulnerability. After the user exceeds the authority, he can perform some operations, such as viewing sensitive information, performing some operations such as adding, deleting, modifying, and checking. [0003] In related technologies, security engineers need to manually detect unauthorized vulnerabilities. Manual detection of unauthorized access vulnerabilities is to replace the authentication in...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present application provides a detection method, device, equipment and storage medium for an unauthorized loophole, which can solve the detection method for an unauthorized loophole in the related art. It is manually judged whether there is an unauthorized loophole for each request, which has subjective factors and cannot be accurate. Judging the issue of unauthorized access

Images