Vulnerability detection method and device based on background RPC interface

Abstract

The invention belongs to the technical field of big data, and provides a vulnerability detection method and device based on a background RPC interface, and the method comprises the steps: receiving RPC interface configuration data sent by a user; collecting data of a to-be-detected system according to the RPC interface configuration data; and carrying out a payload attack on the collected data, and generating a test result of the to-be-detected system. According to the method and device, the security test threshold can be greatly reduced, manual test by development testers is not needed, the security index condition of the system, finer-grained vulnerability description, specific vulnerability detailed information and a vulnerability rectification scheme can be obtained, the obtained data can be subjected to overall data analysis and data mining, and manual inspection and analysis of the security vulnerability test are not needed.

Description

technical field [0001] This application can be used in the field of big data technology, and specifically relates to a method and device for detecting vulnerabilities based on a background RPC interface. Background technique [0002] At present, there are a large number of RPC service interfaces for data transmission in application business scenarios, and the widely used testing tools in the prior art are all automated tests for the http interface, and there is a lack of automated testing methods for the RPC interface. Therefore, in the prior art, only Use manual testing methods to test the RPC interface, specifically: the existing solutions basically rely on manpower, waste manpower, and cannot efficiently mine and predict security vulnerabilities, often only when a component has exposed clear vulnerability characteristics , only to artificially adopt the method of manually constructing and running the payload for vulnerability investigation, which is relatively inefficient...

AI Technical Summary

Problems solved by technology

[0002] At present, there are a large number of RPC service interfaces for data transmission in application business scenarios, and the widely used testing tools in the prior art are all automated tests for the http interface, and there is a lack of automated testing methods for the RPC interface. Therefore, in the prior art, only Use manual testing methods to test the RPC interface, specifically: the existing solutions basically rely on manpower, waste manpower, and cannot efficiently mine and predict security vulnerabilities, often only when a component has exposed clear vulnerability characteristics , only to manually construct and run the payload to check for vulnerabilities, the efficiency is relatively low, and the test progress is obviously lagging behind

Images