Fiddler-based batch test method and device for security unauthorized problems

Abstract

The invention relates to a fiddler-based batch test method and device for security unauthorized problems. The method comprises the following steps: acquiring interface information of a to-be-tested interface through a fiddler; configuring parameter information of the test case set and assertion of the public unauthorized interface; replacing the original authentication information of the to-be-tested interface with the configured parameter information in batches to obtain replaced authentication information; triggering and accessing each to-be-tested interface in batches according to the replaced authentication information, so that the to-be-tested interface executes the access request; obtaining response data returned by the server according to the access request, and comparing the response data with the assertion content; and determining a test result according to a comparison result. The to-be-tested interface information is obtained through the fiddler, and the change of interface content does not need to be paid attention to different interfaces, so that the test efficiency is improved; and by replacing the parameter information and the assertion content in batches, the configuration operation of test execution is simplified, so that a tester can test more simply and conveniently.

Description

technical field [0001] The invention relates to the technical field of computer applications, in particular to a fiddler-based batch testing method and device for security overreach issues. Background technique [0002] Privilege violation vulnerability is a common security vulnerability in web applications. During the testing process of the project, after the basic function test is completed, in order to ensure that a certain level of interface has authority restrictions, to prevent non-authorized personnel from operating the functional interface, and to eliminate unauthorized loopholes, it is also necessary to conduct authority access tests on these interfaces. [0003] Some permission tests in the existing technology capture all the information of the interface through browser development tools, and then perform simulation verification through interface management tools (postman, jmeter, or the company's internal self-developed interface automation tools); some use fiddle...

AI Technical Summary

Problems solved by technology

[0004] The existing technology captures the interface first, and then conducts a simulation test through the interface management tool, which requires a lot of manpower to write and maintain the interface use cases in the early stage; in addition, the single interface is verified one by one, the number of interfaces is large, the execution time is long, and the efficiency is very low; fiddler Capture packets at the break point, adopt the method of current measurement and capture, the data after verification cannot be used, which is not conducive to the later management and regression testing of the interface

Images