Interface permission test method and system, equipment and medium

Abstract

The invention discloses an interface permission test method, which comprises the following steps of: obtaining an interface permission table in which a plurality of test parameters of each to-be-tested interface are recorded; obtaining values corresponding to a plurality of parameters in the plurality of parameters of each to-be-tested interface; generating a request by using the plurality of parameters of each to-be-tested interface and the values corresponding to the plurality of parameters, and sending the request to the corresponding to-be-tested interface; and in response to the received response returned by the corresponding to-be-tested interface, obtaining a matching rule of the corresponding to-be-tested interface and an expected response, and verifying the response returned by the corresponding to-be-tested interface according to the matching rule and the expected response. The invention further discloses a system, computer equipment and a readable storage medium. According to the scheme provided by the invention, through interface request parameter customization and response matching rule customization, accurate detection of interface transverse and longitudinal unauthorized is realized, manual detection of a complex transverse unauthorized problem is replaced, and the automation degree and the detection efficiency of the interface unauthorized problem are improved.

Description

technical field [0001] The invention relates to the field of testing, in particular to an interface authority testing method, system, equipment and storage medium. Background technique [0002] Broken Access Control (BAC) is a common vulnerability in web applications. Due to its wide range of existence and great harm, it is listed as the second among the top ten security risks of web applications by OWASP. This vulnerability means that there is a flaw in the application's authorization check, which allows an attacker to use some methods to bypass the authorization check after obtaining a user account with low authorization, and access or operate other users or higher authorization. The main cause of the unauthorized access vulnerability is that the developer has too much confidence in the data requested by the client when adding, deleting, modifying, and querying data and neglects to determine the authority. Once the authority verification is insufficient, it is easy to caus...

AI Technical Summary

Problems solved by technology

The consideration of horizontal unauthorized access is not limited to this point, but also whether users with different permissions have access to the same resource, so the detection of horizontal unauthorized access is more complicated

[0004] However, the existing interface authority detection method is only applicable to the problem of vertical authority violation, and it is almost impossible to detect the complex horizontal authority violation problem. Therefore, for the actual security evaluation, it can only help to cover the vertical authority part of the interface, and the remaining horizontal authority authority It still needs to be done manually by security evaluation engineers, and the test efficiency is low

Images