Weak password cracking method and device, electronic equipment and readable storage medium

Abstract

The embodiment of the invention provides a weak password cracking method and device, electronic equipment and a readable storage medium, and the method comprises the steps: dynamically positioning a target login component in a target interface through combining image recognition, character recognition, source code analysis and cross-modal verification technologies; automatically capturing a target login request based on a target character string corresponding to the preset account information; for any target password in the weak password dictionary, automatically replacing a user name field in the target login request based on the to-be-tested user name, and automatically replacing a password field in the target login request based on the target password; and when a login success response corresponding to the target login request after field replacement is detected, determining that an original user password corresponding to the to-be-tested user name is a weak password. Through automatic integration of login box dynamic positioning, login request real-time capture, field intelligent replacement and response result verification, dependence on technical experience of testers is reduced, and test efficiency and test accuracy are improved to a certain extent.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, electronic device and readable storage medium for cracking weak passwords. Background Art

[0002] With the rapid development of internet technology, the security of login functions, as the core entry point of web application systems, is of paramount importance. Weak password cracking is a key method for testing the security of login functions. It aims to automatically verify whether user accounts use simple, easy-to-guess passwords, thereby discovering potential security vulnerabilities.

[0003] In related technologies, web application login interfaces are highly diverse, with varying placement of login account fields, password fields, and submit buttons. Traditional web login testing typically requires manual identification of the login box and submit button locations, followed by manual capture of login request packets using packet capture tools (such as Burp Suite), and then cracking weak passwords. This manual approach is inefficient and error-prone. Summary of the Invention

[0004] To overcome the problems existing in the related art, the present invention provides a method, device, electronic device and readable storage medium for cracking weak passwords.

[0005] In a first aspect, the present invention provides a method for cracking a weak password, the method comprising:

[0006] By combining image recognition, text recognition, source code analysis and cross-modal verification technologies, the target login component in the target interface can be dynamically located;

[0007] Automatically capture a target login request based on a target string corresponding to preset account information; the target login request is generated after the preset account information is input to the target login component;

[0008] For any target password in the weak password dictionary, automatically replace the username field in the target login request based on the user name to be tested, and automatically replace the password field in the target login request based on the target password;

[0009] When a successful login response corresponding to the target login request after field replacement is detected, it is determined that the original user password corresponding to the user name to be tested is a weak password.

[0010] Optionally, the method further includes:

[0011] Based on the coordinate information corresponding to the target login component, identifying the account input box, password input box and login submit button in the target login component;

[0012] Automatically input the preset account information into the account input box and the preset password information into the password input box;

[0013] In response to a login trigger operation on the login submit button, the target login request is generated.

[0014] Optionally, automatically capturing a target login request based on a target character string corresponding to preset account information includes:

[0015] Parse the performance log to obtain the request package to be filtered;

[0016] Filtering the request packet to be filtered based on the target character string corresponding to the preset account information to capture the target login request;

[0017] The method further comprises:

[0018] The target login request is automatically parsed to obtain a user name field and a password field in the target login request.

[0019] Optionally, the dynamically locating the target login component in the target interface by combining image recognition, text recognition, source code parsing, and cross-modal verification technology includes:

[0020] Performing image recognition on the target interface to determine at least two candidate component areas in the target interface;

[0021] When the confidence information corresponding to each candidate component area is less than a preset confidence level, identifying at least two input box elements that match the target attribute label based on the interface source code corresponding to the target interface;

[0022] Determining a target input box based on the layout presentation characteristics of each of the input box elements;

[0023] If the target component area of ​​the target input box in the target interface successfully matches any of the candidate component areas, determining the target input box as the target login component;

[0024] In the case that the target component area fails to match any of the candidate component areas, performing text recognition on the target interface image corresponding to the target interface to determine a target text that matches a preset keyword;

[0025] Determine a candidate text area corresponding to the target text based on the position information of the target text on the target interface;

[0026] In the case that the candidate text area successfully matches any of the candidate component areas or the target component area, the candidate text area is determined as the target login component.

[0027] Optionally, the method further includes:

[0028] Based on the interface feature library corresponding to the target interface and the target fingerprint feature corresponding to the target interface, the target login component in the target interface is directly located.

[0029] Optionally, the method further includes:

[0030] Based on the login request features in the interface feature library, the target login request is captured.

[0031] In a second aspect, the present invention provides a weak password cracking device, the device comprising:

[0032] The first positioning module is used to dynamically locate the target login component in the target interface by combining image recognition, text recognition, source code parsing and cross-modal verification technology;

[0033] A first capture module is configured to automatically capture a target login request based on a target character string corresponding to preset account information; the target login request is generated after the target login component inputs the preset account information;

[0034] A first replacement module is configured to automatically replace the username field in the target login request based on the user name to be tested, and automatically replace the password field in the target login request based on the target password, for any target password in the weak password dictionary;

[0035] The first determining module is configured to determine that the original user password corresponding to the user name to be tested is a weak password when a successful login response corresponding to the target login request after field replacement is detected.

[0036] Optionally, the device further comprises:

[0037] A first identification module is configured to identify an account input box, a password input box, and a login submit button in the target login component based on coordinate information corresponding to the target login component;

[0038] A first input module, configured to automatically input preset account information into the account input box and preset password information into the password input box;

[0039] The first generating module is configured to generate the target login request in response to a login triggering operation on the login submit button.

[0040] Optionally, the first grabbing module includes:

[0041] The first parsing module is used to parse the performance log and obtain the request packet to be filtered;

[0042] A first filtering module is configured to filter the request packet to be filtered based on a target character string corresponding to the preset account information, and capture the target login request;

[0043] The device further comprises:

[0044] The second parsing module is used to automatically parse the target login request to obtain the user name field and the password field in the target login request.

[0045] Optionally, the first positioning module includes:

[0046] A first recognition submodule is configured to perform image recognition on the target interface and determine at least two candidate component areas in the target interface;

[0047] A second identification submodule is configured to identify at least two input box elements that match a target attribute label based on the interface source code corresponding to the target interface when the confidence information corresponding to each candidate component area is less than a preset confidence level;

[0048] A first determination submodule, configured to determine a target input box based on layout presentation features of each input box element;

[0049] A second determining submodule is configured to determine the target input box as a target login component if the target component area of ​​the target input box in the target interface successfully matches any of the candidate component areas;

[0050] A third recognition submodule is configured to, if the target component area fails to match any of the candidate component areas, perform text recognition on the target interface image corresponding to the target interface to determine a target text that matches a preset keyword;

[0051] A third determining submodule is configured to determine a candidate text region corresponding to the target text based on position information of the target text on the target interface;

[0052] The fourth determining submodule is configured to determine the candidate text region as a target login component if the candidate text region successfully matches any of the candidate component regions or the target component region.

[0053] Optionally, the device further comprises:

[0054] The second positioning module is used to directly locate the target login component in the target interface based on the interface feature library corresponding to the target interface and the target fingerprint feature corresponding to the target interface.

[0055] Optionally, the device further comprises:

[0056] The second capture module is used to capture the target login request based on the login request features in the interface feature library.

[0057] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the weak password cracking method described in any one of the first aspects above when executing the program.

[0058] In a fourth aspect, the present invention provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can perform the steps in the weak password cracking method in any one of the embodiments of the first aspect above.

[0059] In an embodiment of the present invention, by combining image recognition, text recognition, source code parsing and cross-modal verification technology, the target login component in the target interface is dynamically located; based on the target character string corresponding to the preset account information, the target login request is automatically captured; the target login request is generated after the preset account information is input into the target login component; for any target password in the weak password dictionary, based on the user name to be tested, the user name field in the target login request is automatically replaced, and based on the target password, the password field in the target login request is automatically replaced; when a successful login response corresponding to the target login request after the field replacement is detected, it is determined that the original user password corresponding to the user name to be tested is a weak password. In this way, through the automatic integration of dynamic positioning of the login box, real-time capture of login requests, intelligent field replacement and response result verification, the attack chain from interface interaction to network request analysis is completely covered, avoiding the efficiency bottleneck caused by operation breakpoints in traditional manual testing, while reducing the dependence on the technical experience of testers, and improving the test efficiency and test accuracy to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0061] Figure 1This is a flowchart of a method for cracking a weak password provided by an embodiment of the present invention;

[0062] Figure 2 This is a flowchart of the specific steps of a weak password cracking method provided by an embodiment of the present invention;

[0063] Figure 3 This is a structural diagram of a weak password cracking device provided by an embodiment of the present invention;

[0064] Figure 4 This is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0066] Figure 1 This is a flowchart of a weak password cracking method provided by an embodiment of the present invention. Figure 1 As shown, the method may include:

[0067] Step 101: Dynamically locate the target login component in the target interface by combining image recognition, text recognition, source code parsing and cross-modal verification technology.

[0068] In an embodiment of the present invention, a target login component is dynamically located within a target interface by combining image recognition, text recognition, source code parsing, and cross-modal verification techniques. The target interface can be a web application interface, such as a login interface. The target interface can be composed of multiple component areas, including a target login component. Each component area within the target login component can collaborate to implement user authentication through a structured layout. The target login component may specifically include but is not limited to: an authentication information input area, located in the main body of the target login component, including a user name input box, a password input box and a dynamic verification code input component, used to collect user identity credential data; an interactive operation area, set below the input area, integrating a login submit button, a reset button and a third-party authentication entrance (such as an OAuth quick login icon), supporting users to trigger the verification process or switch authentication methods; a status feedback area, dynamically displayed in the adjacent area of ​​the input component, and providing users with feedback on operation results or system response status through real-time prompt text (such as "Wrong password format") or icon identification (such as loading animation, error warning symbol); an auxiliary function area, distributed at the edge or bottom of the interface, including a "Forgot password" hyperlink, a new account registration guide entrance, language switching options and a privacy policy statement, used to provide supplementary functions or compliance information.

[0069] Combining image recognition, text recognition, and source code parsing modules, the system performs multimodal recognition of the target interface. Using cross-modal verification technology, the system matches the image recognition, text recognition, and source code parsing results to verify their accuracy. Based on these verification results, the system dynamically locates the target login component within the target interface.

[0070] Optionally, step 101 may include the following steps:

[0071] Step 201: Perform image recognition on the target interface to determine at least two candidate component areas in the target interface.

[0072] The image recognition module identifies at least two candidate component areas in the target interface. This module can use a multi-threshold edge detection and contour screening algorithm for image recognition. It uses different grayscale thresholds to binarize the login interface screenshot, combines Canny edge detection to extract contours, and selects valid candidate component areas based on geometric features.

[0073] Step 202: When the confidence information corresponding to each candidate component area is less than a preset confidence, at least two input box elements matching the target attribute label are identified based on the interface source code corresponding to the target interface.

[0074] In an embodiment of the present invention, after determining at least two candidate component regions, confidence information for each candidate component region is calculated. For any candidate component region, the confidence information corresponding to the candidate component region is calculated based on the region area ratio corresponding to the candidate component region, the first weight corresponding to the region area ratio, the threshold occurrence frequency, the second weight corresponding to the threshold occurrence frequency, the region center offset, and the third weight corresponding to the region center offset. The confidence information corresponding to the candidate component region is used to characterize the accuracy of the candidate component region as the login component. The region area ratio can be the normalized ratio of the candidate component region's outline area to the interface area of ​​the target interface screenshot, the threshold occurrence frequency can be the number of times the candidate component region appears in the first candidate outline, the second candidate outline, and the third candidate outline. The region center offset can be the horizontal offset of the candidate component region's outline circumscribed rectangle relative to the page coordinate system. The first, second, and third weights can be set according to actual needs, for example, the first weight can be 0.4, the second weight can be 0.3, and the third weight can be 0.3. At the same time, the third weight can be dynamically determined based on the value of the region center offset. The closer to the center of the page, that is, the smaller the region center offset, the higher the third weight.

[0075] Exemplarily, the confidence information may be calculated based on the following first formula:

[0076] C i =α·S i +β·T i +γ·H i

[0077] Among them, C i Used to represent the confidence information of the candidate component region i, S i It is used to indicate the area ratio, and α is used to indicate S i The corresponding first weight, T i It is used to indicate the frequency of occurrence of the threshold, and β is used to indicate T i The corresponding second weight, H i It is used to indicate the deviation of the center of the region, and γ is used to indicate H i The corresponding third weight.

[0078] Based on the preset confidence, the confidence information corresponding to each candidate component area is screened. When the confidence information corresponding to the candidate component area is greater than or equal to the preset confidence, the accuracy of characterizing the candidate component area as the target login component is higher. Therefore, the candidate component area corresponding to the highest confidence information can be determined as the target login component to improve the efficiency of interface recognition.

[0079] If the confidence information corresponding to each candidate component area is less than a preset confidence level, the accuracy of characterizing each candidate component area as the target login component is low, and further auxiliary identification based on the interface source code can be performed. The interface source code corresponding to the target interface is obtained, and based on the interface source code corresponding to the target interface, at least two input box elements that match the target attribute tag are identified through a hierarchical structure positioning method or a CSS style positioning method.

[0080] Step 203: Determine a target input box based on the layout presentation characteristics of each input box element.

[0081] In an embodiment of the present invention, a target input box is determined based on the layout presentation characteristics of each input box element, and the target input box is determined as a target login component. Among them, the layout presentation characteristics can be structural characteristics or style characteristics. The structural characteristics refer to the hierarchical characteristics of the input box elements in the DOM tree. The hierarchical structure of the DOM (Document Object Model) describes the nested relationships between HTML elements such as parent-child and siblings, and is the skeleton of the page content. Style characteristics refer to CSS (Cascading Style Sheets) style attributes. The CSS style attributes define the visual expression of the elements (such as color, layout, animation, etc.) and are the skin of the page content. The hierarchical structure and style attributes jointly determine the final presentation effect of the page in the browser (that is, the interface seen by the user).

[0082] Step 204: When the target component area of ​​the target input box in the target interface successfully matches any of the candidate component areas, the target input box is determined as the target login component.

[0083] In an embodiment of the present invention, after at least two candidate component areas are identified based on the image recognition module and the target input box is determined based on the analysis of the interface source code, the target input box can be matched with at least two candidate component areas. By verifying whether the target input box is successfully matched with any candidate component area, it can be ensured that the positioning result has been recognized and verified by both image recognition and DOM source code positioning, thereby further improving the accuracy of the recognition result.

[0084] The target component area of ​​the target input box in the target interface is matched with at least two candidate component areas. The matching method can be to compare the target component area with the at least two candidate component areas one by one to obtain the overlap between the target component area and the candidate component areas. If the target component area is successfully matched with any candidate component area, indicating that the overlap between the target component area and any candidate component area is greater than a preset overlap, the target input box can be determined as the target login component. The preset overlap can be 50%.

[0085] Step 205: If the target component area fails to match any of the candidate component areas, perform text recognition on the target interface image corresponding to the target interface to determine a target text that matches a preset keyword.

[0086] In an embodiment of the present invention, if the target component area fails to match any candidate component area, text recognition can be performed on the target interface image corresponding to the target interface, and the login box area can be inferred based on the keyword position to determine the target text that matches the preset keyword. The preset keywords may include "login", "LOGIN", "SignIn", "password", "username", "account", etc. For example, a keyword library for login scenarios can be constructed, which can contain a mixture of Chinese and English login-related words, such as {"login", "LOGIN", "Sign In", "password", "username", "account"}, etc., to fully cover login prompt information in different language environments. Subsequently, OCR technology is used to perform text recognition on the target interface image corresponding to the target interface, and high-confidence text information with a confidence level of more than 80% in the recognition results is extracted as the target text.

[0087] Step 206: Determine a candidate text region corresponding to the target text based on the position information of the target text on the target interface.

[0088] In an embodiment of the present invention, based on the position information of the target text in the target interface, the candidate text area corresponding to the target text is determined by taking the text area of ​​the target text as the center and expanding outward by a preset multiple. The preset multiple can be set according to actual needs, for example, 1.5 times or 2 times. Exemplarily, for each identified target text, the text area in which it is located is taken as the center and the area range is expanded outward by 1.5 times as the potential candidate area for the input box, that is, the candidate text area. Through semantic matching and spatial expansion strategies, the search range of the login box is effectively expanded, and the positioning success rate under complex interface layouts is improved.

[0089] Step 207: If the candidate text region successfully matches any of the candidate component regions or the target component region, the candidate text region is determined as a target login component.

[0090] In an embodiment of the present invention, the candidate text area is matched again with the candidate component area and the target component area. If the candidate text area is successfully matched with any candidate component area or target component area, and the overlap between the candidate text area and any candidate component area or target component area is greater than the preset overlap, the candidate text area can be determined as the target login component. For example, the candidate area (candidate text area) obtained by OCR positioning can be matched with the contour area (candidate component area) obtained by image recognition, and the element area (target component area) obtained by DOM parsing in spatial position. By calculating the overlap between each area, that is, the ratio of the intersection area between the OCR candidate area and the image contour area and the DOM element area to the total area of ​​each area, when the overlap exceeds the preset 50% threshold, the OCR candidate area (candidate text area) is determined to be a valid login box position as the target login component. This cross-modal verification mechanism effectively filters out false detections and noise in OCR recognition by integrating visual, semantic and structured information, ensuring the accuracy and robustness of the target login component positioning result.

[0091] In an embodiment of the present invention, image recognition technology is used to perform a preliminary analysis of the target interface and quickly locate at least two candidate component areas. When the confidence of the candidate area is lower than a preset confidence threshold, auxiliary recognition is performed based on the interface source code. When the overlap between the image recognition and DOM parsing results is low, text recognition is used to further assist in positioning. Through the synergistic effect of automated detection and cross-modal information fusion, a comprehensive upgrade of login component recognition from visual perception to semantic understanding and then to semantic matching is achieved. Through multimodal collaborative positioning, the accuracy and robustness of the target login component positioning results are ensured.

[0092] Step 102: Automatically capture a target login request based on a target character string corresponding to the preset account information; the target login request is generated after the preset account information is input into the target login component.

[0093] In an embodiment of the present invention, after determining the target login component in the target interface, the coordinate information corresponding to the target login component is obtained, and the preset account information is automatically input into the target login component based on the coordinate information to perform automated interaction and automated security detection.

[0094] After generating a target login request, the target string corresponding to the preset account information can be used to filter and capture all network requests generated by the browser during page loading or interactive operations. For example, network requests can be monitored, performance logs can be obtained, and all network request information can be extracted from the performance logs. Request packets containing the target string can then be filtered from all network request information. The target string corresponding to the preset account information can be determined based on the preset account information, and the target string can be the preset account information and / or encoded information obtained by encoding the preset account information.

[0095] Optionally, before step 102, the embodiment of the present invention may include the following steps:

[0096] Step 301: Based on the coordinate information corresponding to the target login component, identify the account input box, password input box and login submission button in the target login component.

[0097] In an embodiment of the present invention, the account input box, password input box, and login submit button in the target login component are identified based on the coordinate information corresponding to the target login component. For example, the control layout of the account input box, password input box, and login submit button can be determined based on at least two candidate component areas, input box elements, or candidate text areas determined during the process of locating the target login component. Type determination is then performed for each area or element, such as by performing text recognition or keyword recognition in the source code, to determine the account input box, password input box, and login submit button in the target login component.

[0098] Step 302: Automatically input the preset account information into the account input box and the preset password information into the password input box.

[0099] In an embodiment of the present invention, one or more groups of test accounts with characteristic identifiers are predefined as preset account information (such as keyword_words=['usertest002']), wherein the account naming can follow specific rules (such as including a fixed prefix usertest and an increasing numeric suffix). The send_keys method of the Selenium automated testing tool is utilized to accurately input the preset account information and the preset password information into each located control element. Combining page loading status monitoring (such as WebDriverWait) with user behavior simulation (such as typing character by character and randomizing input intervals), the operation rhythm of real users is simulated, and the preset account information is input into the account input box and the preset password information is input into the password input box to reduce the risk of being identified by the anti-crawler mechanism. Among them, the preset password information can be the password corresponding to the preset account information, which can be set according to actual needs.

[0100] Step 303: In response to the login trigger operation on the login submit button, generate the target login request.

[0101] In an embodiment of the present invention, based on a login trigger operation on a login submit button, a target login request is generated to complete the login operation. During the generation of the target login request, the preset account information is reversibly encoded. For example, the preset account information is encoded using Base64 encoding. After encoding, the encoding information corresponding to the preset account information usertest002 can be dXNlcnRlc3QwMDI. Correspondingly, after decoding this encoding information, the preset account information usertest002 is obtained. By encoding the preset account information, it can be used as a filtering condition during the subsequent target login request request packet filtering process. This reduces the probability of the request packet being filtered by simple rules through the encoding format while maintaining account reproducibility, while also providing a decoding anchor point for the subsequent parsing stage.

[0102] For example, automated interactive operations can be implemented based on Selenium's ActionChains. For the outline center coordinates (x, y) of the target login component determined based on image recognition, move_by_offset(x, y).click() is executed to solve the adaptation problem of absolute coordinates under different resolutions. For the target login component determined based on DOM source code positioning, location_once_scrolled_into_view can be used to scroll to the visible area and then automatically click. By directly transmitting Unicode encoding through send_keys, the content of Chinese account can be entered. When entering password information, the character-by-character typing can be simulated to circumvent the keyboard monitoring and anti-climbing mechanism of some systems. When submitting the login, the button element with type="submit" is identified first. If it does not exist, the keyboard is simulated and the submit event is triggered based on the Enter key.

[0103] In an embodiment of the present invention, the automatic account input and automatic request submission technologies are combined to form a complete technical chain from test account configuration, automatic input to request generation, which significantly improves the automation level of security testing and the credibility of the results.

[0104] Optionally, step 102 may include the following steps:

[0105] Step 401: parse the performance log to obtain the request packet to be screened.

[0106] In the embodiment of the present invention, network requests are monitored and performance logs are obtained, the start and end of the performance logs are parsed, network request information is extracted therefrom, and a plurality of request packets to be screened are obtained.

[0107] For example, the network request monitoring function of CDP can be used to monitor network requests through the Chrome DevTools Protocol to capture all network requests generated by the browser when loading a page or performing interactive operations. By calling the get_log method provided by the browser driver (such as Selenium WebDriver) and specifying the log type as 'performance', for example, obtaining the performance log based on driver.get_log('performance'). The performance log records various performance-related events of the browser during the execution process, including but not limited to the initiation of network requests, the receipt of responses, and the loading of resources. By parsing the performance log, detailed network request information can be extracted, laying the foundation for subsequent sensitive information extraction. From the obtained performance log, a parsing algorithm can be used to extract the key network request information of each request, which may include but not limited to the requested URL, request method (such as GET, POST), request header (Headers), request body (Body), and response status.

[0108] Step 402: Filter the request packet to be filtered based on the target character string corresponding to the preset account information, and capture the target login request.

[0109] In an embodiment of the present invention, all extracted request packets to be filtered are traversed and their request bodies or request headers are checked to see whether they contain a target string corresponding to the preset account information. For example, filtering can be performed directly based on the encoded information of the preset account information, for example, by directly checking whether the request body or request header contains dXNlcnRlc3QwMDI to filter out target login requests.

[0110] In one possible implementation, the plain text and encoded form of the preset account information can be used as filtering conditions for multi-mode matching filtering. For the parameter values, request bodies or URL fragments in the request packet, plain text matching (such as usertest002) and Base64 decoded matching (such as detecting dXNlcnRlc3QwMDI= and decoding verification) are performed simultaneously to ensure that no form of sensitive field transmission is missed. Furthermore, the request parameters marked with Base64 encoding can also be automatically restored to the original test account through preset decoding rules, and cross-verified with the plain text mark (i.e., the preset account information) to ensure the accuracy of the target string recognition result. It can be understood that the target string and the corresponding filtering conditions can be set according to actual needs.

[0111] Accordingly, the embodiment of the present invention may further include the following steps:

[0112] Step 403: Automatically parse the target login request to obtain the username field and password field in the target login request.

[0113] In an embodiment of the present invention, the target login request is automatically parsed to obtain the username and password fields in the target login request. For example, association analysis can be performed in conjunction with the request context, and the target login request packet containing the target string can be deeply parsed in conjunction with the HTTP method, target path, and response status to extract sensitive information such as the associated username field, password field, and token parameters. For example, the common "user" and "username" represent the username field, and "pass" and "password" represent the password field.

[0114] In the embodiment of the present invention, by taking the target character string as a filtering condition and combining it with an intelligent parsing algorithm, rapid positioning and accurate parsing of the target login request are achieved.

[0115] Step 103: For any target password in the weak password dictionary, the username field in the target login request is automatically replaced based on the user name to be tested, and the password field in the target login request is automatically replaced based on the target password.

[0116] In an embodiment of the present invention, after identifying the username field and the password field, the username to be tested is filled into the username field to replace the original content, and the target password is filled into the password field to replace the original content. The username to be tested can be a user account that needs to undergo login permission security testing.

[0117] Build a weak password dictionary containing common weak passwords. This dictionary contains widely used password combinations that are easily guessed or cracked, such as "123456," "admin," and "password." Based on the field names extracted in the previous step, use an automated script to iterate through the weak password dictionary and replace the values ​​of the password fields in the request packets with weak passwords from the weak password dictionary. The target password can be any weak password in the weak password dictionary.

[0118] Step 104: When a successful login response corresponding to the target login request after field replacement is detected, determine that the original user password corresponding to the user name to be tested is a weak password.

[0119] In an embodiment of the present invention, an automated script can be used to cyclically send modified target login requests, each time carrying a different target password. At the same time, a response status monitoring mechanism is set to capture and analyze the server's response data in real time. When a successful login response is detected corresponding to a target login request carrying any target password, it is determined whether the target login request has successfully passed identity authentication and responded successfully, specifically through a preset response feature matching rule (such as the response contains keywords such as "successful login" and "Welcome"). If in a certain round of requests, the server response status is a successful login response, indicating that the login is successful, then it is determined that the original user password corresponding to the user name to be tested is a weak password, and there is a weak password vulnerability, that is, there is an unsafe phenomenon that the user account uses a password in the weak password dictionary.

[0120] Once a weak password vulnerability is detected, the system automatically generates a detailed vulnerability report, including the affected user accounts, weak passwords used, and detailed information about requests and responses. It also provides targeted remediation suggestions, such as forcing users to change their passwords, implementing password complexity policies, and enabling multi-factor authentication, to help target systems promptly eliminate security risks and improve overall security protection.

[0121] In summary, in an embodiment of the present invention, by combining image recognition, text recognition, source code parsing and cross-modal verification technology, the target login component in the target interface is dynamically located; based on the target character string corresponding to the preset account information, the target login request is automatically captured; the target login request is generated after the preset account information is input into the target login component; for any target password in the weak password dictionary, the username field in the target login request is automatically replaced based on the user name to be tested, and the password field in the target login request is automatically replaced based on the target password; when a successful login response corresponding to the target login request after the field replacement is detected, it is determined that the original user password corresponding to the user name to be tested is a weak password. In this way, through the automatic integration of dynamic positioning of the login box, real-time capture of login requests, intelligent replacement of fields and verification of response results, the attack chain from interface interaction to network request analysis is completely covered, avoiding the efficiency bottleneck caused by operation breakpoints in traditional manual testing, while reducing the dependence on the technical experience of testers, and improving the test efficiency and test accuracy to a certain extent.

[0122] Optionally, the embodiment of the present invention may further include the following steps:

[0123] Step 501: directly locate a target login component in the target interface based on an interface feature library corresponding to the target interface and a target fingerprint feature corresponding to the target interface.

[0124] In an embodiment of the present invention, technical fingerprints of the web pages corresponding to the target interface (such as the front-end framework Vue / React, the CSS framework Bootstrap, and the JS script file unique to the login page), page features (such as the login page URL path contains keywords such as "login", "auth", and "signin", and the page title contains "login" and "Sign In"), and element features (such as the XPath path pattern of the submit button / / form[@id="loginForm"] / button) are collected, and an interface feature library corresponding to the target interface is pre-built. At the same time, each fingerprint entry in the interface feature library can be associated with the login component positioning rule (such as directly locating the account box through id="username" and locating the password box through name="password").

[0125] For example, HTTP response header analysis (such as the X-Powered-By field), page source code parsing (such as detecting Vue / React-specific component syntax or Bootstrap class name prefixes), and static resource feature matching (such as the URL path or hash value of a specific JS / CSS file) can be used to extract information about the front-end framework, CSS framework, and core script library used by the target website. Using regular expressions or natural language processing technology, the URL path of the login page (such as containing keywords such as login and auth) and the HTML title (such as containing words such as "login" and "Sign In") are semantically parsed to establish page-level feature identifiers. For key elements of the login page (such as the account input box, password input box, and submit button), their DOM attribute features (such as attribute values ​​such as id, name, and class) and layout features (such as the XPath path pattern / / form[@id="loginForm"] / button) are extracted to form a reusable element positioning template.

[0126] Furthermore, for each fingerprint entry associated with the login component, the positioning rules can be used to use the technical fingerprint as the first index, the page features as the second index, and the element features as the third index, forming a multi-level associated index structure. A predefined positioning rule set is bound to each fingerprint entry, including direct attribute positioning (such as locating the account box using id="username"), combined attribute positioning (such as / / input[@type="password" and @name="pwd"] locating the password box), and layout path positioning (such as locating a button using relative XPath). The specific settings can be based on the actual characteristics of the target interface, and the embodiments of the present invention do not impose any restrictions on this.

[0127] Based on the pre-built interface feature library and the target fingerprint features corresponding to the target interface, the target login component in the target interface is directly matched and located.

[0128] For example, for the target interface, the current technical fingerprint (such as parsing the response header, grabbing the page source code, extracting DOM element features) is dynamically collected as the target fingerprint feature. The collected target fingerprint features are matched with the interface feature library step by step, and high-confidence features (such as specific JS script files) are matched first. If the first-level match fails, it falls back to low-confidence features (such as page title keywords) to ensure the matching coverage and efficiency. For the fingerprint entry that is successfully matched, the positioning rule set associated with the fingerprint entry is directly called, and the positioning logic is parsed and executed through the rule engine (such as executing XPath queries or CSS selector matching) to quickly locate the target login component and obtain element references of the account input box, password input box, and login submit button.

[0129] In an embodiment of the present invention, by constructing an interface feature library and directly matching and locating the target login component in the target interface based on the pre-constructed interface feature library and the target fingerprint features corresponding to the target interface, the positioning logic can be decoupled from the fingerprint features. By constructing the interface feature library and associating the positioning rules, "one-time collection and multiple reuse" can be achieved, avoiding the performance overhead of re-parsing the page for each test, and at the same time reducing the dependence on complex calculations (such as deep learning models), further improving the positioning efficiency.

[0130] Accordingly, the interface feature library may further include login request features. Accordingly, the embodiment of the present invention may further include the following steps:

[0131] Step 601: Capture the target login request based on the login request features in the interface feature library.

[0132] In an embodiment of the present invention, a login request feature dimension can be further introduced into the interface feature library to achieve automatic capture and precise association of login requests. The login request feature corresponding to the target interface is obtained, and the login request feature is associated and bound with the corresponding constructed fingerprint entry according to the actual status. Among them, the login request feature may include network protocol features, request path and parameter features, request header features, and response association features. For example, the login request feature can be determined by recording the HTTP method, path pattern, request header field, and response features of the login request for the target interface.

[0133] After locating the target login component based on the target fingerprint feature, the login request feature associated with the target fingerprint feature in the interface feature library can be directly matched with the current login request feature of the target interface (such as intercepting the request through a proxy tool and parsing its protocol, path and parameters). If a match is found, a request template carrying the login request feature can be directly generated, and based on the request template, login requests that meet the feature can be monitored and captured in real time as the target login request.

[0134] It is understandable that the interface feature library can be dynamically updated according to actual needs, and the embodiment of the present invention does not impose any limitation on this.

[0135] In an embodiment of the present invention, by further decoupling and associating login request features with technical fingerprints, page features and element features, flexible generation and capture of requests are supported, thereby improving the versatility of target login component positioning and target login request capture scenarios.

[0136] For example, Figure 2 A flowchart showing the specific steps of a weak password cracking method is shown in FIG. Figure 2 As shown, first locate the login box and determine the target login component in the target interface. Inject a special string (target string) into the target login request, and based on the special string, capture the request packet in all network requests, parse each network request packet to determine whether the special string (target string) exists. If so, determine the request as the target login request. Parse the target login request to obtain the username field and password field. Based on the username to be tested, automatically replace the username field in the target login request, and based on the target password, automatically replace the password field in the target login request. At the same time, send the modified request in an automated script loop to detect the server's response status. If the response contains information about a successful login, it is determined that a weak password vulnerability exists.

[0137] In an embodiment of the present invention, an automatic login box positioning step based on multimodal information fusion and a dynamic feature library dynamically positions a target login component of a target interface by combining image recognition, OCR, DOM parsing, and cross-modal verification technologies; an automatic target string injection step based on semantic analysis and dynamic generation dynamically generates and injects a special string by identifying the input box type; an automatic request packet capture step based on protocol parsing and dynamic triggering automatically captures login request packets by parsing the network protocol and dynamically triggering the capture conditions; an intelligent weak password blasting step based on dynamic generation of a weak password dictionary and optimization of a blasting strategy dynamically generates a weak password dictionary and optimizes the blasting strategy by combining a network-wide leaked password library and user behavior analysis; wherein, each step realizes intelligent collaboration through data interaction and strategy linkage to efficiently and accurately crack weak passwords.

[0138] Figure 3 This is a schematic diagram of the structure of a weak password cracking device provided by an embodiment of the present invention. Figure 3 As shown, the device may specifically include:

[0139] The first positioning module 701 is used to dynamically locate the target login component in the target interface by combining image recognition, text recognition, source code analysis and cross-modal verification technology;

[0140] The first capture module 702 is configured to automatically capture a target login request based on a target string corresponding to preset account information; the target login request is generated after the target login component inputs the preset account information;

[0141] A first replacement module 703 is configured to automatically replace the username field in the target login request based on the user name to be tested, and automatically replace the password field in the target login request based on the target password, for any target password in the weak password dictionary;

[0142] The first determining module 704 is configured to determine that the original user password corresponding to the user name to be tested is a weak password when a successful login response corresponding to the target login request after field replacement is detected.

[0143] Optionally, the device further comprises:

[0144] A first identification module is configured to identify an account input box, a password input box, and a login submit button in the target login component based on coordinate information corresponding to the target login component;

[0145] A first input module, configured to automatically input preset account information into the account input box and preset password information into the password input box;

[0146] The first generating module is configured to generate the target login request in response to a login triggering operation on the login submit button.

[0147] Optionally, the first capture module 702 includes:

[0148] The first parsing module is used to parse the performance log and obtain the request packet to be filtered;

[0149] A first filtering module is configured to filter the request packet to be filtered based on a target character string corresponding to the preset account information, and capture the target login request;

[0150] The device further comprises:

[0151] The second parsing module is used to automatically parse the target login request to obtain the user name field and the password field in the target login request.

[0152] Optionally, the first positioning module 701 includes:

[0153] A first recognition submodule is configured to perform image recognition on the target interface and determine at least two candidate component areas in the target interface;

[0154] A second identification submodule is configured to identify at least two input box elements that match a target attribute label based on the interface source code corresponding to the target interface when the confidence information corresponding to each candidate component area is less than a preset confidence level;

[0155] A first determination submodule, configured to determine a target input box based on layout presentation features of each input box element;

[0156] A second determining submodule is configured to determine the target input box as a target login component if the target component area of ​​the target input box in the target interface successfully matches any of the candidate component areas;

[0157] A third recognition submodule is configured to, if the target component area fails to match any of the candidate component areas, perform text recognition on the target interface image corresponding to the target interface to determine a target text that matches a preset keyword;

[0158] A third determining submodule is configured to determine a candidate text region corresponding to the target text based on position information of the target text on the target interface;

[0159] The fourth determining submodule is configured to determine the candidate text region as a target login component if the candidate text region successfully matches any of the candidate component regions or the target component region.

[0160] Optionally, the device further comprises:

[0161] The second positioning module is used to directly locate the target login component in the target interface based on the interface feature library corresponding to the target interface and the target fingerprint feature corresponding to the target interface.

[0162] Optionally, the device further comprises:

[0163] The second capture module is used to capture the target login request based on the login request features in the interface feature library.

[0164] The present invention also provides an electronic device, see Figure 4 , including: a processor 801, a memory 802, and a computer program 8021 stored in the memory and executable on the processor, wherein when the processor executes the program, the weak password cracking method of the aforementioned embodiment is implemented.

[0165] The present invention also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the weak password cracking method of the aforementioned embodiment.

[0166] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0167] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0168] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0169] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the present invention.

[0170] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0171] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the sorting device according to the present invention. The present invention may also be implemented as an apparatus or device program for performing a portion or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0172] It should be noted that the above embodiments illustrate rather than limit the invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0173] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0174] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0175] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0176] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for cracking weak passwords, characterized in that: The method comprises: By combining image recognition, text recognition, source code analysis and cross-modal verification technologies, the target login component in the target interface can be dynamically located; Automatically capture a target login request based on a target string corresponding to preset account information; the target login request is generated after the preset account information is input to the target login component; For any target password in the weak password dictionary, automatically replace the username field in the target login request based on the user name to be tested, and automatically replace the password field in the target login request based on the target password; When a successful login response corresponding to the target login request after field replacement is detected, it is determined that the original user password corresponding to the user name to be tested is a weak password.

2. The method according to claim 1, characterized in that The method further comprises: Based on the coordinate information corresponding to the target login component, identifying the account input box, password input box and login submit button in the target login component; Automatically input the preset account information into the account input box and the preset password information into the password input box; In response to a login trigger operation on the login submit button, the target login request is generated.

3. The method according to claim 1, characterized in that The method of automatically capturing a target login request based on a target character string corresponding to preset account information includes: Parse the performance log to obtain the request package to be filtered; Filtering the request packet to be filtered based on the target character string corresponding to the preset account information to capture the target login request; The method further comprises: The target login request is automatically parsed to obtain a user name field and a password field in the target login request.

4. The method according to claim 1, wherein The method of dynamically locating the target login component in the target interface by combining image recognition, text recognition, source code parsing and cross-modal verification technologies includes: Performing image recognition on the target interface to determine at least two candidate component areas in the target interface; When the confidence information corresponding to each candidate component area is less than a preset confidence level, identifying at least two input box elements that match the target attribute label based on the interface source code corresponding to the target interface; Determining a target input box based on the layout presentation characteristics of each of the input box elements; If the target component area of ​​the target input box in the target interface successfully matches any of the candidate component areas, determining the target input box as the target login component; In the case that the target component area fails to match any of the candidate component areas, performing text recognition on the target interface image corresponding to the target interface to determine a target text that matches a preset keyword; Determine a candidate text area corresponding to the target text based on the position information of the target text on the target interface; In the case that the candidate text area successfully matches any of the candidate component areas or the target component area, the candidate text area is determined as the target login component.

5. The method according to claim 1, wherein The method further comprises: Based on the interface feature library corresponding to the target interface and the target fingerprint feature corresponding to the target interface, the target login component in the target interface is directly located.

6. The method according to claim 5, characterized in that The method further comprises: Based on the login request features in the interface feature library, the target login request is captured.

7. A weak password cracking device, characterized in that: The device comprises: The first positioning module is used to dynamically locate the target login component in the target interface by combining image recognition, text recognition, source code parsing and cross-modal verification technology; A first capture module is configured to automatically capture a target login request based on a target character string corresponding to preset account information; the target login request is generated after the target login component inputs the preset account information; A first replacement module is configured to automatically replace the username field in the target login request based on the user name to be tested, and automatically replace the password field in the target login request based on the target password, for any target password in the weak password dictionary; The first determining module is configured to determine that the original user password corresponding to the user name to be tested is a weak password when a successful login response corresponding to the target login request after field replacement is detected.

8. The device according to claim 7, characterized in that The device further comprises: A first identification module is configured to identify an account input box, a password input box, and a login submit button in the target login component based on coordinate information corresponding to the target login component; A first input module, configured to automatically input preset account information into the account input box and preset password information into the password input box; The first generating module is configured to generate the target login request in response to a login triggering operation on the login submit button.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for cracking a weak password according to any one of claims 1 to 6 is implemented.

10. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the weak password cracking method described in any one of claims 1 to 6.

Images