Testing method, device, electronic device and medium based on hidden parameter mining

Abstract

The present disclosure provides a test method, device, electronic device, medium and computer program product based on hidden parameter mining. The test method and device can be used in the field of information security technology. The test method includes: determining the application address of the application to be tested; obtaining m response pages according to the application address; matching the page tag with the standard tag in the hidden tag library, and using the page tag that matches the standard tag in the hidden tag library as the hidden tag; extracting the parameters of the field under the hidden tag as the page hidden parameter; adding the page hidden parameter to the first parameter message; adding n types of attack loads as the value of the page hidden parameter to the first parameter message, respectively, to obtain n first test messages; sending each first test message to the application to be tested to obtain a first response message; and judging whether there is a vulnerability in the page hidden parameter according to each first response message.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and more specifically, to a testing method, device, electronic device, medium and computer program product based on hidden parameter mining. Background Art

[0002] Nowadays, rapid iteration of application systems has become the norm, and the size of application systems is also growing. In these large codes, due to coding omissions by developers, failure to delete non-essential parameter processing logic when reusing codes, or the development framework requiring developers to follow some parameters specified in the development rules, there are some hidden parameters in the application systems that are difficult to find. These hidden parameters are often hidden in the application systems and are unknown to people. It is difficult for testers to cover these hidden parameters through traditional manual or automated testing, and these hidden parameters are often not securely filtered and processed on the back end. Once attacked, they will cause great damage to the application system, greatly affecting the security of the application system. Summary of the invention

[0003] In view of this, the present disclosure provides a low-cost, high-security testing method, device, electronic device, computer-readable storage medium and computer program product based on hidden parameter mining.

[0004] One aspect of the present disclosure provides a testing method based on hidden parameter mining, including: determining an application address of an application to be tested; obtaining m response pages according to the application address, wherein each of the response pages includes at least one page tag, and m is an integer greater than or equal to 1; matching the page tag with a standard tag in a hidden tag library, and using the page tag that matches the standard tag in the hidden tag library as a hidden tag; extracting parameters of a field under the hidden tag as page hidden parameters; adding the page hidden parameters to a first parameter message; adding n types of attack payloads as values ​​of the page hidden parameters to the first parameter message, respectively, to obtain n first test messages; sending each of the first test messages to the application to be tested to obtain a first response message; and judging whether there is a vulnerability in the page hidden parameters according to each of the first response messages.

[0005] According to the testing method based on hidden parameter mining in the embodiment of the present disclosure, the hidden parameters of the page in the application to be tested can be effectively mined, and the mined hidden parameters of the page can be automatically security tested. Therefore, while being able to fully disclose the potential risks of the application to be tested, it can also reduce the testing cost and the requirements for testers, thereby improving the security of the application to be tested.

[0006] In some embodiments, the method further includes: establishing a hidden parameter library, wherein the hidden parameter library includes preset hidden parameters; adding the preset hidden parameters to the second parameter message; using n types of attack payloads as values ​​of the preset hidden parameters to add to the second parameter message, respectively, to obtain n second test messages; sending each of the second test messages to the application to be tested, to obtain a second response message; and judging whether the preset hidden parameters have a vulnerability based on each of the second response messages.

[0007] In some embodiments, the second parameter message is the first parameter message.

[0008] In some embodiments, obtaining m response pages according to the application address includes: obtaining m page links of the application to be tested through the application address; and sending requests to the m page links respectively to obtain m response pages.

[0009] In some embodiments, obtaining the m page links of the application to be tested through the application address includes: obtaining the main page link of the application to be tested corresponding to the application address through the application address; obtaining t first sub-page links connected to the main page link according to the main page link, where t is an integer greater than or equal to 0; obtaining s first sub-page links connected to each of the first sub-page links according to the t first sub-page links. i Second sub-page links, where s i is an integer greater than or equal to 0, i is an integer greater than or equal to 0 and less than or equal to t; until the last sub-page link connected to the previous sub-page link is obtained; and the main page link and all the obtained sub-page links are used as the m page links.

[0010] In some embodiments, obtaining m page links of the application to be tested through the application address includes: according to the application address, crawling multiple times, each time obtaining a page link connected to the previous page link; setting a threshold for the number of crawling times, and when the number of crawling times is greater than or equal to the threshold, the crawler terminates; and adding the page links obtained by each crawling as the m page links.

[0011] In some embodiments, determining whether there is a vulnerability in the hidden parameter of the page based on each of the first response messages includes: setting a vulnerability library, wherein the vulnerability library includes vulnerabilities corresponding to the n types of attack loads respectively; matching the first response message with the vulnerability in the vulnerability library; and when the vulnerability is matched, using the vulnerability as the vulnerability of the hidden parameter of the page corresponding to the first response message.

[0012] Another aspect of the present disclosure provides a testing device based on hidden parameter mining, including: a determination module, the determination module is used to determine a test task, wherein the test task includes an application address of an application to be tested; an acquisition module, the acquisition module is used to obtain m response pages according to the application address, wherein each of the response pages includes at least one page tag, and m is an integer greater than or equal to 1; a matching module, the matching module is used to match the page tag with a standard tag in a hidden tag library, and use the page tag matched to the standard tag in the hidden tag library as a hidden tag; an extraction module, the extraction module is used to extract the parameters of the field under the hidden tag as a page hidden parameter; a first adding module, the first adding module is used to add the page hidden parameter to a first parameter message; a second adding module, the second adding module is used to add n types of attack payloads as values ​​of the page hidden parameter to the first parameter message, respectively, to obtain n first test messages; a sending module, the sending module is used to send each of the first test messages to the application to be tested to obtain a first response message; and a judgment module, the judgment module is used to judge whether the page hidden parameter has a vulnerability according to each of the first response messages.

[0013] Another aspect of the present disclosure provides an electronic device, comprising one or more processors and one or more memories, wherein the memories are used to store executable instructions, and when the executable instructions are executed by the processors, the above-mentioned method is implemented.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, comprising a computer program, wherein the computer program comprises computer executable instructions, and the instructions are used to implement the method as described above when executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 An exemplary system architecture to which the method and apparatus according to an embodiment of the present disclosure can be applied is schematically shown;

[0018] Figure 2 A flowchart of a testing method based on hidden parameter mining according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3Schematically shows a flow chart of obtaining m response pages according to an application address according to an embodiment of the present disclosure;

[0020] Figure 4 A flowchart schematically illustrates how to obtain m page links of an application to be tested through an application address according to some embodiments of the present disclosure;

[0021] Figure 5 A flowchart schematically illustrates how to obtain m page links of an application to be tested through an application address according to other embodiments of the present disclosure;

[0022] Figure 6 A flowchart of judging whether a hidden parameter of a page has a vulnerability according to each first response message according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 7 A flowchart of a testing method based on hidden parameter mining according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 8 A block diagram of a testing device based on hidden parameter mining according to an embodiment of the present disclosure is schematically shown;

[0025] Fig. 9 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is obvious that one or more embodiments may be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure. In the technical solution of the present disclosure, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] When using expressions such as "at least one of A, B or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the said features.

[0029] Nowadays, rapid iteration of application systems has become the norm, and the size of application systems is also growing. In these large codes, due to coding omissions by developers, failure to delete non-essential parameter processing logic when reusing codes, or the development framework requiring developers to follow some parameters specified in the development rules, there are some hidden parameters in the application systems that are difficult to find. These hidden parameters are often hidden in the application systems and are unknown to people. It is difficult for testers to cover these hidden parameters through traditional manual or automated testing, and these hidden parameters are often not securely filtered and processed on the back end. Once attacked, they will cause great damage to the application system, greatly affecting the security of the application system.

[0030] The embodiments of the present disclosure provide a test method, device, electronic device, computer-readable storage medium and computer program product based on hidden parameter mining. The test method based on hidden parameter mining includes: determining the application address of the application to be tested; obtaining m response pages according to the application address, wherein each response page includes at least one page tag, and m is an integer greater than or equal to 1; matching the page tag with the standard tag in the hidden tag library, and using the page tag that matches the standard tag in the hidden tag library as the hidden tag; extracting the parameters of the field under the hidden tag as the page hidden parameter; adding the page hidden parameter to the first parameter message; adding n types of attack loads as the value of the page hidden parameter to the first parameter message, respectively, to obtain n first test messages; sending each first test message to the application to be tested to obtain a first response message; and judging whether there is a vulnerability in the page hidden parameter according to each first response message.

[0031] It should be noted that the test method, device, electronic device, computer-readable storage medium and computer program product based on hidden parameter mining disclosed in the present invention can be used in the field of information security, and can also be used in any field other than the field of information security, such as the financial field. The field of the present invention is not limited here.

[0032] Figure 1The exemplary system architecture 100 to which the test method, apparatus, electronic device, computer-readable storage medium and computer program product based on hidden parameter mining according to the embodiment of the present disclosure can be applied is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0033] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0034] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0035] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0036] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0037] It should be noted that the test method based on hidden parameter mining provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the test device based on hidden parameter mining provided in the embodiment of the present disclosure can generally be set in the server 105. The test method based on hidden parameter mining provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the test device based on hidden parameter mining provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0039] The following will be based on Figure 1 The scene described by Figure 2 to Figure 7 The testing method based on hidden parameter mining according to an embodiment of the present disclosure is described in detail.

[0040] Figure 2 The flowchart of the testing method based on hidden parameter mining according to the embodiment of the present disclosure is schematically shown.

[0041] like Figure 2 As shown, the testing method based on hidden parameter mining of this embodiment includes operations S210 to S280.

[0042] In operation S210, the application address of the application to be tested is determined. It is understandable that each application to be tested has a corresponding application address, and the application to be tested can be entered by logging in the application address, so as to complete the test of the application to be tested.

[0043] In operation S220, m response pages are obtained according to the application address, wherein each response page includes at least one page tag, and m is an integer greater than or equal to 1. For example, a crawler may be performed on the application to be tested according to the application address to obtain m response pages.

[0044] As a specific example, Figure 3 As shown, operation S220 of obtaining m response pages according to the application address includes operation S221 and operation S222.

[0045] In operation S221, m page links of the application to be tested are obtained through the application address.

[0046] As a possible way to achieve this, Figure 4As shown, operation S221 of obtaining m page links of the application to be tested through the application address may include operations S2211 to S2215.

[0047] In operation S2211, a main page link of the application to be tested corresponding to the application address is obtained through the application address; wherein the application address may be logged in to obtain the main page link of the application to be tested corresponding to the application address.

[0048] In operation S2212, according to the main page link, t first sub-page links connected to the main page link are obtained, where t is an integer greater than or equal to 0. For example, a main page of a financial product application to be tested has transfer, financial management, deposit and income and expenditure modules. Under the financial management module, there are financial products A, B and C. Under the deposit module, there are deposits of type A and deposits of type B. Under the income and expenditure module, there are income and expenditure.

[0049] After logging into the application address of the financial product application to be tested, the main page link of the financial product main page can be obtained. The t first sub-page links connected to the main page link are transfer, financial management, deposit and income and expenditure modules respectively, and t is 4 at this time.

[0050] In operation S2213, according to the t first sub-page links, s connected to each first sub-page link are obtained. i Second sub-page links, where s i is an integer greater than or equal to 0, and i is an integer greater than or equal to 0 and less than or equal to t.

[0051] Let's continue to use the financial product application to be tested as an example. The first sub-page links are respectively the transfer, financial management, deposit and income and expenditure modules. The second sub-page link connected to the first sub-page link of the transfer is to confirm the transfer. At this time, the s corresponding to the first sub-page link of the transfer 1 is 1; the second sub-page link that is connected to the first financial management sub-page link is A financial management product, B financial management product and C financial management product. At this time, the s corresponding to the first financial management sub-page link is 2 3; the second sub-page link connected to the first sub-page link of deposits is A-type deposits and B-type deposits. At this time, the s corresponding to the first sub-page link of deposits 3 is 2; the second sub-page link connected to the first sub-page link of income and expenditure is income and expenditure. At this time, the s corresponding to the first sub-page link of income and expenditure is 4 is 2.

[0052] In operation S2214, until the last sub-page link connected to the previous sub-page link is obtained. Continuing with the above-mentioned example of the financial product application to be tested, under the second sub-page link of determining the transfer, there is no next sub-page link connected to the second sub-page link of determining the transfer, so the transfer is determined to be the last sub-page link; under the second sub-page link of financial product A, the third sub-page link connected to the second sub-page link of financial product A is to determine the amount of financial product A, and there is no next sub-page link connected to the third sub-page link of determining the amount of financial product A, so the amount of financial product A is determined to be the last sub-page link.

[0053] Under the second sub-page link of financial product B, the third sub-page link connected to the second sub-page link of financial product B is to determine the amount of financial product B. There is no next sub-page link connected to the third sub-page link to determine the amount of financial product B, so determining the amount of financial product B is the last sub-page link. Under the second sub-page link of financial product C, the third sub-page link connected to the second sub-page link of financial product C is to determine the amount of financial product C. There is no next sub-page link connected to the third sub-page link to determine the amount of financial product C, so determining the amount of financial product C is the last sub-page link.

[0054] Under the second subpage link of Class A deposits, the third subpage link connected to the second subpage link of Class A deposits is to determine the amount of Class A deposits. There is no next subpage link connected to the third subpage link to determine the amount of Class A deposits. Therefore, determining the amount of Class A deposits is the last subpage link. Under the second subpage link of Class B deposits, the third subpage link connected to the second subpage link of Class B deposits is to determine the amount of Class B deposits. There is no next subpage link connected to the third subpage link to determine the amount of Class B deposits. Therefore, determining the amount of Class B deposits is the last subpage link.

[0055] Under the second sub-page link of income, the third sub-page link connected to the second sub-page link of income is to determine the income amount, and there is no next sub-page link connected to the third sub-page link to determine the income amount, so the last sub-page link is to determine the income amount. Under the second sub-page link of expenditure, the third sub-page link connected to the second sub-page link of expenditure is to determine the expenditure amount, and there is no next sub-page link connected to the third sub-page link to determine the expenditure amount, so the last sub-page link is to determine the expenditure amount.

[0056] In operation S2215, the main page link and all the obtained sub-page links are used as m page links. Therefore, the m page links of the above-mentioned financial product application to be tested are the main page link, the first sub-page link of transfer connected to the main page link, the first sub-page link of financial management, the first sub-page link of deposit and the first sub-page link of income and expenditure, the second sub-page link of transfer connected to the first sub-page link, the second sub-page link of A financial product, the second sub-page link of B financial product, the second sub-page link of C financial product, the second sub-page link of A deposit, the second sub-page link of B deposit, the second sub-page link of income and the second sub-page link of expenditure, and the third sub-page link of A financial product amount connected to the second sub-page link, the third sub-page link of B financial product amount, the third sub-page link of C financial product amount, the third sub-page link of A deposit amount, the third sub-page link of B deposit amount, the third sub-page link of income amount and the third sub-page link of expenditure amount. At this time, m is 20.

[0057] In operation S222, requests are sent to the m page links respectively to obtain m response pages. Therefore, after obtaining the m page links, requests can be sent to the m page links respectively, and m response pages can be obtained in response to the request information.

[0058] It is understandable that the financial products to be tested here are applications as well as transfer, financial management, deposit and income and expenditure modules. Under the financial management module, there are financial products A, B and C. Under the deposit module, there are Class A deposits and Class B deposits. Under the income and expenditure module, there are income and expenditure only for exemplary purposes, and the applications to be tested and page links mentioned in this disclosure are not limited thereto and cannot be understood as limitations on this disclosure.

[0059] As another possible implementation, Figure 5 As shown, operation S221 of obtaining m page links of the application to be tested through the application address may include operations S2216 to S2218.

[0060] In operation S2216, according to the application address, after multiple crawls, a page link connected to the previous page link is obtained each time.

[0061] In operation S2217, a threshold of the number of crawling times is set, and when the number of crawling times is greater than or equal to the threshold, the crawling is terminated.

[0062] In operation S2218, the page links obtained by the crawler each time are added together to form m page links.

[0063] For example, the main page of a financial product application to be tested has transfer, financial management, deposit and income and expenditure modules. Under the financial management module, there are financial products A, B and C. Under the deposit module, there are Class A deposits and Class B deposits. Under the income and expenditure module, there are income and expenditure. After logging into the application address of the financial product application to be tested, that is, the first crawler can obtain the main page link of the financial product main page; the second crawler can obtain the first sub-page link connected to the main page link, which are transfer, financial management, deposit and income and expenditure; the third crawler can obtain the second sub-page link connected to the first sub-page link, which are respectively determining transfer, financial product A, financial product B, financial product C, Class A deposit, Class B deposit, income and expenditure; the fourth crawler can obtain the third sub-page link connected to the second sub-page link, which are respectively determining the amount of financial product A, the amount of financial product B, the amount of financial product C, the amount of Class A deposit, the amount of Class B deposit, the income amount and the expenditure amount.

[0064] Assuming that the threshold of the number of crawling times is set to 2, the crawling operation can be stopped after the second crawling is completed. Of course, the crawling operation can also be stopped after the third crawling is completed, but it is not limited to this, as long as the number of crawling stops is greater than or equal to the threshold. The following takes the threshold of 2 and the second crawling is completed as an example for explanation.

[0065] Among them, for the financial product application to be tested, the first crawler obtains the main page link, and the second crawler obtains four page links of transfer, financial management, deposit and income and expenditure. Therefore, the main page link and the four page links of transfer, financial management, deposit and income and expenditure can be added together to obtain five page links.

[0066] Operations S2211 to S2215 or operations S2216 to S2218 can facilitate obtaining m page links of the application to be tested through the application address, thereby facilitating obtaining a response page corresponding to each page link.

[0067] In operation S230, the page tag is matched with the standard tag in the hidden tag library, and the page tag that matches the standard tag in the hidden tag library is used as the hidden tag. It can be understood that each response page includes at least one page tag, and the format of the response page can be shown as follows:

[0068] <input type="hidden" name="code1" value="a" / >

[0069] <input type="hidden" name="code2" value="@n" / >

[0070] <input name="txt" type="text" value="@value" / >

[0071] Among them, hidden under input type and txt under input name can be understood as page tags. The hidden tag library can store standard tags, which can be understood as the standard value of the hidden tag. The page tag is matched with the standard tag. If a match is found, it can be said that the page tag is a hidden tag. Here, it is assumed that the standard tags in the hidden tag library include hidden, display, etc., but it is not limited to this. Therefore, in the above response page example, the hidden tag hidden can be obtained.

[0072] In operation S240, the parameters of the fields under the hidden tag are extracted as page hidden parameters. Continuing to take the above response page as an example, the response page has two hidden tags hidden. The field under the first hidden tag hidden is name, and the parameter of name is code1; the field under the second hidden tag hidden is name, and the parameter of name is code2. Therefore, code1 and code2 can be extracted as page hidden parameters.

[0073] In operation S250, the page hiding parameters are added to the first parameter message. The first parameter message may be a message, and the page hiding parameters code1 and code2 obtained in operation S240 may be added to the first parameter message.

[0074] In operation S260, n types of attack loads are added to the first parameter message as the value of the page hidden parameter, and n first test messages are obtained. For example, n types of attack loads may include but are not limited to attack load A for xxs vulnerability, attack load B for sql injection vulnerability, attack load C for ssrf vulnerability and attack load D for csrf vulnerability. Here, there are several types of attack loads, n is a number, and n can be any integer greater than or equal to 1. Attack loads a, b, c and d can be assigned to the page hidden parameter code1 respectively, and attack loads a, b, c and d can be assigned to the page hidden parameter code2 respectively. The attack loads are assigned once to obtain a first test message.

[0075] For example: First test message 1: code1=a; code2=a.

[0076] First test message 2: code1=b; code2=b.

[0077] First test message 3: code1=c; code2=c.

[0078] First test message 4: code1=d; code2=d.

[0079] In operation S270, each first test message is sent to the application under test to obtain a first response message. It is understandable that the first test message 1, the first test message 2, the first test message 3 and the first test message 4 in the above example can be sent to the application under test respectively to obtain a first response message fed back by the application under test.

[0080] In operation S280, it is determined whether there is a vulnerability in the hidden parameters of the page according to each first response message.

[0081] As an implementable approach, Figure 6 As shown, operation S280 determines whether there is a vulnerability in the hidden parameters of the page according to each first response message, and includes operations S281 to S283.

[0082] In operation S281, a vulnerability library is set, wherein the vulnerability library includes vulnerabilities corresponding to n types of attack payloads. Here, the vulnerability library may include xxs vulnerability, sql injection vulnerability, ssrf vulnerability and csrf vulnerability, attack payload a corresponds to xxs vulnerability, attack payload b corresponds to sql injection vulnerability, attack payload c corresponds to ssrf vulnerability, and attack payload d corresponds to csrf vulnerability.

[0083] In operation S282, the first response message is matched with the vulnerabilities in the vulnerability library.

[0084] In operation S283, when a vulnerability is matched, the vulnerability is used as a vulnerability of the hidden parameters of the page corresponding to the first response message. Continuing with the above example, the first test message 1, the first test message 2, the first test message 3 and the first test message 4 are respectively sent to the application to be tested, and the first response message fed back by the application to be tested is obtained as an example for explanation. The first response message 1 fed back by the first test message 1 can be no attack or can be attacked by the xxs vulnerability. Therefore, the first response message 1 can be matched with the vulnerability in the vulnerability library. When the first response message 1 is no attack, no vulnerability can be matched in the vulnerability library; when the first response message 1 is attacked by the xxs vulnerability, the xxs vulnerability can be matched in the vulnerability library, so the xxs vulnerability can be used as the vulnerability of the hidden parameters code1 and code2 of the page corresponding to the first response message 1.

[0085] The method for matching the vulnerability of the first test message 2, the first test message 3 and the first test message 4 is the same as that of the first test message 1, which will not be repeated here.

[0086] According to the testing method based on hidden parameter mining in the embodiment of the present disclosure, the hidden parameters of the page in the application to be tested can be effectively mined through operations S210 to S250, and the mined hidden parameters of the page can be automatically tested for security testing through operations S260 to S280. Therefore, while fully revealing the potential risks of the application to be tested, it can also reduce the testing cost and the requirements for testers, thereby improving the security of the application to be tested.

[0087] In some embodiments of the present disclosure, Figure 6 As shown, operation S280 determines whether there is a vulnerability in the hidden parameters of the page according to each first response message and also includes operation S284.

[0088] In operation S284, when no vulnerability is matched, it is determined that there is no vulnerability in the page hidden parameters.

[0089] In some embodiments of the present disclosure, Figure 2 As shown, the testing method based on hidden parameter mining also includes operation S290.

[0090] In operation S290, the result of whether there is a vulnerability in the hidden parameters of the page is displayed, so that the user can intuitively obtain the vulnerability information and take remedial measures in time.

[0091] Figure 7 The flowchart of the testing method based on hidden parameter mining according to the embodiment of the present disclosure is schematically shown.

[0092] like Figure 7 As shown, the testing method based on hidden parameter mining of this embodiment includes operations S310 to S350.

[0093] In operation S310, a hidden parameter library is established, wherein the hidden parameter library includes preset hidden parameters. Here, the preset hidden parameters may be common hidden parameters in the application to be tested and common hidden parameters in the computer field, and the above hidden parameters may be maintained in the hidden parameter library.

[0094] In operation S320, the preset hidden parameter is added to the second parameter message. The second parameter message may be a message, and the preset hidden parameter obtained in operation S310 may be added to the second parameter message.

[0095] In operation S330, n types of attack payloads are added to the second parameter message as the value of the preset hidden parameter, and n second test messages are obtained. For example, the n types of attack payloads may include but are not limited to attack payload a for xxs vulnerability, attack payload b for sql injection vulnerability, attack payload c for ssrf vulnerability, and attack payload d for csrf vulnerability. Attack payloads a, b, c, and d may be assigned to the preset hidden parameter, respectively, and a second test message may be obtained by assigning the attack payload once.

[0096] For example: Second test message 1: preset hidden parameter = a.

[0097] Second test message 2: preset hidden parameter = b.

[0098] Second test message 3: preset hidden parameter = c.

[0099] Second test message 4: preset hidden parameter = d.

[0100] In operation S340, each second test message is sent to the application under test to obtain a second response message. It is understandable that the second test message 1, the second test message 2, the second test message 3 and the second test message 4 in the above example can be sent to the application under test respectively to obtain a second response message fed back by the application under test.

[0101] In operation S350, it is determined whether there is a vulnerability in the preset hidden parameter according to each second response message. For example, a vulnerability library may be set, wherein the vulnerability library includes vulnerabilities corresponding to n types of attack payloads. Here, the vulnerability library may include xxs vulnerability, sql injection vulnerability, ssrf vulnerability and csrf vulnerability, attack payload a corresponds to xxs vulnerability, attack payload b corresponds to sql injection vulnerability, attack payload c corresponds to ssrf vulnerability, and attack payload d corresponds to csrf vulnerability.

[0102] Continue to use the second test message 1, the second test message 2, the second test message 3, and the second test message 4 in the above example to send them to the application to be tested respectively, and obtain the second response message fed back by the application to be tested as an example for explanation. The second response message 1 fed back by the second test message 1 can be no attack, or it can be attacked by the xxs vulnerability, so the second response message 1 can be matched with the vulnerability in the vulnerability library. When the second response message 1 is no attack, no vulnerability can be matched in the vulnerability library; when the second response message 1 is attacked by the xxs vulnerability, the xxs vulnerability can be matched in the vulnerability library, so that the xxs vulnerability can be used as the vulnerability of the preset hidden parameter corresponding to the second response message 1.

[0103] The method for matching the vulnerability of the second test message 2, the second test message 3 and the second test message 4 is the same as that of the second test message 1, which will not be repeated here.

[0104] Through operations S310 to S350, an automated security test can be performed on the preset hidden parameters to improve the security of the application to be tested.

[0105] Furthermore, the second parameter message is the first parameter message. In other words, the second parameter message and the first parameter message are one message. Therefore, the page hidden parameters and the preset hidden parameters can be combined into one message for testing, thereby saving test procedures and test time, saving human and material resources, and thus reducing test costs.

[0106] Based on the above-mentioned testing method based on hidden parameter mining, the present disclosure also provides a testing device 10 based on hidden parameter mining. Figure 8 A testing device 10 based on hidden parameter mining is described in detail.

[0107] Figure 8 The structural block diagram of a testing device 10 based on hidden parameter mining according to an embodiment of the present disclosure is schematically shown.

[0108] The testing device 10 based on hidden parameter mining includes a determination module 1, a crawler module 2, a matching module 3, an extraction module 4, a first adding module 5, a second adding module 6, a sending module 7 and a judgment module 8.

[0109] Determining module 1, the determining module 1 is used to perform operation S210: determining a test task, wherein the test task includes an application address of an application to be tested.

[0110] The acquisition module 2 is used to perform operation S220: obtain m response pages according to the application address, wherein each response page includes at least one page tag, and m is an integer greater than or equal to 1.

[0111] The matching module 3 is used to perform operation S230: matching the page tag with the standard tag in the hidden tag library, and using the page tag matched with the standard tag in the hidden tag library as the hidden tag.

[0112] Extraction module 4, the extraction module 4 is used to perform operation S240: extract the parameters of the field under the hidden tag as page hidden parameters.

[0113] The first adding module 5 is used to perform operation S250: adding a page hiding parameter to the first parameter message.

[0114] The second adding module 6 is used to perform operation S260: adding n types of attack payloads as values ​​of page hidden parameters to the first parameter message to obtain n first test messages.

[0115] The sending module 7 is used to perform operation S270: send each first test message to the application to be tested to obtain a first response message.

[0116] The judgment module 8 is used to perform operation S280: judging whether there is a vulnerability in the hidden parameters of the page according to each first response message.

[0117] Since the above-mentioned testing device 10 based on hidden parameter mining is set based on the testing method based on hidden parameter mining, the beneficial effects of the above-mentioned testing device 10 based on hidden parameter mining are the same as those of the testing method based on hidden parameter mining, which will not be repeated here.

[0118] In addition, according to the embodiments of the present disclosure, any multiple modules among the determination module 1, the acquisition module 2, the matching module 3, the extraction module 4, the first adding module 5, the second adding module 6, the sending module 7 and the judgment module 8 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0119] According to an embodiment of the present disclosure, at least one of the determination module 1, the acquisition module 2, the matching module 3, the extraction module 4, the first adding module 5, the second adding module 6, the sending module 7 and the judgment module 8 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them.

[0120] Alternatively, at least one of the determination module 1, the acquisition module 2, the matching module 3, the extraction module 4, the first adding module 5, the second adding module 6, the sending module 7 and the judgment module 8 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0121] Fig. 9 A block diagram of an electronic device suitable for implementing a testing method based on hidden parameter mining according to an embodiment of the present disclosure is schematically shown.

[0122] like Fig. 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0123] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0124] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0125] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0126] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0127] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method of the embodiment of the present disclosure.

[0128] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0129] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0130] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0131] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0132] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0133] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0134] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A testing method based on hidden parameter mining, characterized in that: include: Determine the application address of the application to be tested; Obtain m response pages according to the application address, wherein each of the response pages includes at least one page tag, and m is an integer greater than or equal to 1; Matching the page tag with a standard tag in a hidden tag library, and using the page tag that matches the standard tag in the hidden tag library as a hidden tag; Extracting the parameters of the field under the hidden tag as page hidden parameters; Adding the page hidden parameter to the first parameter message; Adding n types of attack payloads as values ​​of the page hidden parameters to the first parameter message to obtain n first test messages; Sending each of the first test messages to the application to be tested to obtain a first response message; and Determine whether there is a vulnerability in the hidden parameters of the page according to each of the first response messages.

2. The method according to claim 1, characterized in that: Also includes: Establishing a hidden parameter library, wherein the hidden parameter library includes preset hidden parameters; Adding the preset hidden parameter to the second parameter message; Using n types of attack payloads as the values ​​of the preset hidden parameters respectively added to the second parameter message to obtain n second test messages; Sending each of the second test messages to the application to be tested to obtain a second response message; and Determine whether the preset hidden parameter has a vulnerability according to each of the second response messages.

3. The method according to claim 2, characterized in that The second parameter message is the first parameter message.

4. The method according to claim 1, characterized in that: The obtaining m response pages according to the application address comprises: Obtain m page links of the application to be tested through the application address; Requests are sent to the m page links respectively to obtain m response pages.

5. The method according to claim 4, characterized in that The acquiring m page links of the application to be tested through the application address includes: Obtaining, through the application address, a main page link of the application to be tested corresponding to the application address; According to the main page link, obtaining t first sub-page links connected to the main page link, where t is an integer greater than or equal to 0; According to t first sub-page links, obtain s connected to each first sub-page link i Second sub-page links, where s i is an integer greater than or equal to 0, i is an integer greater than or equal to 0 and less than or equal to t; Until the last sub-page link connected to the previous sub-page link is obtained; and The main page link and all the acquired sub-page links are used as the m page links.

6. The method according to claim 4, characterized in that The acquiring m page links of the application to be tested through the application address includes: According to the application address, after multiple crawls, each time a page link connected to the previous page link is obtained; Setting a threshold for the number of crawling times, when the number of crawling times is greater than or equal to the threshold, the crawling is terminated; and The page links obtained by the crawler each time are added together to form the m page links.

7. The method according to any one of claims 1 to 6, characterized in that The determining, according to each of the first response messages, whether there is a vulnerability in the hidden parameter of the page comprises: Setting a vulnerability library, wherein the vulnerability library includes vulnerabilities corresponding to the n types of attack payloads respectively; Matching the first response message with the vulnerability in the vulnerability library; and When the vulnerability is matched, the vulnerability is used as the vulnerability of the page hidden parameter corresponding to the first response message.

8. A testing device based on hidden parameter mining, characterized in that: include: A determination module, the determination module is used to determine a test task, wherein the test task includes an application address of an application to be tested; An acquisition module, the acquisition module is used to obtain m response pages according to the application address, wherein each of the response pages includes at least one page tag, and m is an integer greater than or equal to 1; A matching module, the matching module is used to match the page tag with a standard tag in a hidden tag library, and use the page tag that matches the standard tag in the hidden tag library as a hidden tag; An extraction module, the extraction module is used to extract the parameters of the field under the hidden tag as page hidden parameters; A first adding module, the first adding module is used to add the page hidden parameter to the first parameter message; A second adding module, the second adding module is used to add n types of attack payloads as values ​​of the page hidden parameters to the first parameter message, to obtain n first test messages; a sending module, the sending module being used to send each of the first test messages to the application to be tested to obtain a first response message; and A judgment module is used to judge whether there is a vulnerability in the hidden parameters of the page according to each of the first response messages.

9. An electronic device, characterized in that: include: one or more processors; One or more memories, used to store executable instructions, wherein when the executable instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The storage medium stores executable instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The method comprises a computer program, wherein the computer program comprises one or more executable instructions, and when the executable instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images