Vulnerability detection method and device for web application program and computer readable storage medium

Abstract

The invention provides a vulnerability detection method and device for a web application program and a computer readable storage medium; the method comprises the steps: obtaining request data of a to-be-detected web application program; then propagating the request data through n propagation functions to obtain n pieces of new request data, wherein, the n is a positive integer larger than 1, the output of the propagation functions is the new request data, and the input of the nth propagation function is the output of the (n-1) th propagation function; before the nth propagation function obtains the output of the (n-1) th propagation function, copying the (n-1) th propagation function and the corresponding output from the current thread variable to the global variable, and when the nth propagation function does not obtain the output of the (n-1) th propagation function, obtaining the output of the (n-1) th propagation function from the global variable; obtaining execution parameters; and according to the execution parameters, the request data and the new request data, determining whether the web application program to be tested has vulnerabilities or not. According to the method and the device, the comprehensiveness and the accuracy during vulnerability detection of the web application program to be detected can be improved.

Description

[Technical field] [0001] The present invention relates to the field of computer technology, and more particularly to a vulnerability detection method, a device, and a computer readable storage medium of a web application. 【Background technique】 [0002] In the relevant technologies, the security test technology of web applications generally includes Dast (Dynamic ApplicationSecurity Testing, Dynamic Application Security Test) technology, Sast (Static Application SecurityTesting, Static Application Security Test) Technology and IAST (Intective Application SecurityTesting, Interactive App) Program security test) technology. In an IAST technology, when the WEB application is detected, the stain data and the corresponding stream are usually tracked; where the stain data refers to the data entered by the user at the front end of the WEB application to be tested. During the tracking process, due to the stain data and the corresponding function streams are stored in the current thread v...

AI Technical Summary

Problems solved by technology

[0004] The present invention provides a web application loophole detection method, device and computer-readable storage medium, aiming to solve the problem of low comprehensiveness and accuracy in loophole detection of the web application to be tested in the related art

Images