Vulnerability detection method, device, electronic device and storage medium

Abstract

The present application provides a vulnerability detection method, device, electronic device and storage medium, which relates to the field of network security technology. The method includes: inputting the attack program of the target vulnerability into the target application through the vulnerability detection application, and sending the attack program to the corresponding server through the target application; wherein the attack program includes the access address information of the vulnerability detection platform; if the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine the trigger page of the attack program in the target application; crawling the trigger page and executing the attack program through the vulnerability detection application to send the first execution information of the attack program to the vulnerability detection platform; receiving the alarm information of the attack program returned by the vulnerability detection platform through the vulnerability detection application, and determining the target vulnerability in the target application according to the alarm information. The above scheme of the present application can improve the detection capability of the vulnerability detection application for the target vulnerability and improve the detection rate of the target vulnerability.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a vulnerability detection method, device, electronic device and storage medium. Background Art

[0002] Web (World Wide Web, Global Wide Area Network) application vulnerability scanner detection technology is a hot topic in the security industry. Web application vulnerability scanners can detect cross-site scripting (Cross Site Script Attack, XSS) vulnerabilities.

[0003] XSS vulnerabilities are the most common web application security vulnerabilities. The fundamental reason for XSS vulnerabilities is that web applications do not effectively filter user input data, allowing attackers to embed malicious script codes into pages that normal users visit. When normal users visit the page, the embedded malicious script codes will be executed, causing a series of harms to normal users, such as stealing user cookies, phishing, hijacking sessions, etc.

[0004] XSS vulnerabilities include stored XSS vulnerabilities, which are serious and difficult to detect. Stored XSS vulnerabilities store malicious script code submitted by attackers in the Web application server. Whenever a user visits a page containing malicious code, the malicious script code will be executed, thereby achieving the purpose of the attack.

[0005] The current Web application vulnerability scanners have weak detection capabilities for stored XSS vulnerabilities and have a low detection rate. Summary of the invention

[0006] The embodiments of the present disclosure provide a vulnerability detection method, device, electronic device and storage medium for improving the detection capability of a Web application vulnerability scanner for stored XSS vulnerabilities and improving the detection rate of stored XSS vulnerabilities.

[0007] To achieve the above purpose, the technical solution of the embodiment of the present application is implemented as follows:

[0008] In a first aspect, an embodiment of the present application provides a vulnerability detection method, including:

[0009] Inputting the attack program of the target vulnerability into the target application through the vulnerability detection application, and sending the attack program to the corresponding server through the target application; wherein the attack program includes the access address information of the vulnerability detection platform;

[0010] If the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine the triggering page of the attack program in the target application;

[0011] crawling the trigger page and executing the attack program through the vulnerability detection application to send first execution information of the attack program to the vulnerability detection platform;

[0012] The alarm information of the attack program returned by the vulnerability detection platform is received through the vulnerability detection application, and the target vulnerability is determined to exist in the target application according to the alarm information.

[0013] In an optional embodiment, inputting the attack program of the target vulnerability into the target application through the vulnerability detection application includes:

[0014] Inputting the attack program of the target vulnerability into the content input position of the target page of the target application through the vulnerability detection application; or

[0015] Inputting the attack program of the target vulnerability into the external link position in the page tag corresponding to the target page of the target application through the vulnerability detection application; or

[0016] The attack program of the target vulnerability is input into a designated attribute position in a page tag corresponding to a target page of the target application through the vulnerability detection application.

[0017] In an optional embodiment, parsing the response content to determine a triggering page of the attack program in the target application includes:

[0018] Parsing the response content, and determining the triggering page of the attack program in the target application according to the parsed page address information; or

[0019] The response content is parsed, and according to the parsed attack program, an input page of the attack program in the target application is determined as the trigger page.

[0020] In an optional embodiment, the method further includes:

[0021] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is received, it is determined that the target application has the target vulnerability;

[0022] Among them, the warning information of the attack program is obtained by the vulnerability detection platform when receiving the second execution information of the attack program sent by the second terminal device.

[0023] In an optional embodiment, the method further includes:

[0024] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is not received, it is determined that the target application does not have the target vulnerability.

[0025] In a second aspect, an embodiment of the present application provides a vulnerability detection method, which is applied to a vulnerability detection platform, including:

[0026] If first execution information of an attack program sent by a first terminal device through a vulnerability detection application is received, alarm information of the attack program is generated; wherein the first execution information of the attack program is sent after the first terminal device triggers the attack program of the target vulnerability in the target application through the vulnerability detection application, and the attack program includes access address information of the vulnerability detection platform;

[0027] Sending warning information of the attack program to a vulnerability detection application of the first terminal device, so that the vulnerability detection application determines that the target application has the target vulnerability.

[0028] In an optional embodiment, the attack program includes identification information, and sending warning information of the attack program to the vulnerability detection application of the terminal device based on the first execution information of the attack program includes:

[0029] Acquire identification information of the attack program from first execution information of the attack program;

[0030] After the identification information is verified, the warning information of the attack program is sent to the vulnerability detection application of the terminal device.

[0031] In an optional embodiment, the method further includes:

[0032] If the second execution information of the attack program sent by the second terminal device is received, the alarm information of the attack program is generated; wherein the second execution information of the attack program is sent after the second terminal device triggers the attack program in the target application.

[0033] In a third aspect, an embodiment of the present application provides a vulnerability detection device, applied to a first terminal device, including:

[0034] An input module, used to input an attack program of a target vulnerability into a target application through a vulnerability detection application, and send the attack program to a corresponding server through the target application; wherein the attack program includes access address information of a vulnerability detection platform;

[0035] A determination module, configured to parse the response content returned by the server and determine a triggering page of the attack program in the target application if the response content is obtained through the vulnerability detection application;

[0036] A trigger module, used to crawl the trigger page and execute the attack program through the vulnerability detection application, so as to send first execution information of the attack program to the vulnerability detection platform;

[0037] The detection module is used to receive the warning information of the attack program returned by the vulnerability detection platform through the vulnerability detection application, and determine whether the target vulnerability exists in the target application according to the warning information.

[0038] In an optional embodiment, the input module is further used for:

[0039] Inputting the attack program of the target vulnerability into the content input position of the target page of the target application through the vulnerability detection application; or

[0040] Inputting the attack program of the target vulnerability into the external link position in the page tag corresponding to the target page of the target application through the vulnerability detection application; or

[0041] The attack program of the target vulnerability is input into a designated attribute position in a page tag corresponding to a target page of the target application through the vulnerability detection application.

[0042] In an optional embodiment, the determining module is further used to:

[0043] Parsing the response content, and determining the triggering page of the attack program according to the parsed page address information; or

[0044] The response content is parsed, and according to the parsed attack program, an input page of the attack program is determined as the trigger page.

[0045] In an optional embodiment, the device further includes a vulnerability determination module, configured to:

[0046] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is received, it is determined that the target application has the target vulnerability;

[0047] The warning information of the attack program is obtained when the vulnerability detection platform receives the second execution information of the attack program sent by the second terminal device.

[0048] In an optional embodiment, the device further includes a non-vulnerability determination module, configured to:

[0049] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is not received, it is determined that the target application does not have the target vulnerability.

[0050] In a fourth aspect, an embodiment of the present application provides a vulnerability detection device, which is applied to a vulnerability detection platform, including:

[0051] A receiving module, configured to generate warning information of an attack program if first execution information of the attack program is received from a first terminal device through a vulnerability detection application; wherein the first execution information of the attack program is sent by the first terminal device after triggering the attack program of the target vulnerability in the target application through the vulnerability detection application, and the attack program includes access address information of the vulnerability detection platform;

[0052] The alarm sending module is used to send alarm information to the vulnerability detection application of the first terminal device, so that the vulnerability detection application determines that the target application has the target vulnerability.

[0053] In an optional embodiment, the attack program includes identification information, and the alarm sending module is further used to:

[0054] Acquire identification information of the attack program from first execution information of the attack program;

[0055] After the identification information is verified, the warning information of the attack program is sent to the vulnerability detection application of the terminal device.

[0056] In an optional embodiment, the device further includes a second receiving module, configured to:

[0057] If the second execution information of the attack program sent by the second terminal device is received, the alarm information of the attack program is generated; wherein the second execution information of the attack program is sent after the second terminal device triggers the attack program in the target application.

[0058] In a fifth aspect, an embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, the processor implements any one of the vulnerability detection methods of the first aspect and the second aspect.

[0059] In a sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any one of the vulnerability detection methods of the first aspect and the second aspect is implemented.

[0060] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0061] An attack program for a target vulnerability is input into a target application through a vulnerability detection application, and the attack program is sent to a corresponding server through the target application; after the response content returned by the server is obtained through the vulnerability detection application, a trigger page of the attack program in the target application can be parsed from the response content; further, the trigger page is crawled and the attack program is executed through the vulnerability detection application to send first execution information of the attack program to the vulnerability detection platform, so that the vulnerability detection platform determines that the attack program is successfully executed based on the first execution information of the attack program and then sends an alarm information of the attack program to the vulnerability detection application, and then, after the alarm information of the attack program returned by the vulnerability detection platform is received through the vulnerability detection application, it is determined that the target application has a target vulnerability.

[0062] In this way, by specifying the access address information of the vulnerability detection platform in the attack program and inserting the attack program into the target application, when the attack program is executed in the target application, the first execution information of the attack program can be sent to the vulnerability detection platform based on the above-mentioned access address information. When the vulnerability detection platform receives the first execution information of the attack program, it can be proved that the attack program inserted into the target application is executed, that is, the target vulnerability exists in the server of the target application; wherein, the target application can be a Web application, and the target vulnerability can be a stored XSS vulnerability. Accordingly, the attack program can be an attack program for a stored XSS vulnerability. Therefore, the present application can improve the detection capability of the Web application vulnerability detection application for stored XSS vulnerabilities and improve the detection rate of stored XSS vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0064] Figure 1 A schematic diagram of an application scenario of a vulnerability detection method provided in an embodiment of the present application;

[0065] Figure 2 A flowchart of a vulnerability detection method provided in an embodiment of the present application;

[0066] Figure 3 A flowchart of another vulnerability detection method provided in an embodiment of the present application;

[0067] Figure 4 A logical schematic diagram of a vulnerability detection method provided in an embodiment of the present application;

[0068] Figure 5 A schematic diagram of the structure of a vulnerability detection device provided in an embodiment of the present application;

[0069] Figure 6 A schematic diagram of the structure of another vulnerability detection device provided in an embodiment of the present application;

[0070] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0071] Figure 8 A schematic diagram of the structure of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0073] Application: An application program refers to a computer program installed on a terminal device that can complete one or more services, and generally needs to cooperate with a server to run. The target application in the embodiment of the present disclosure can be a Web application, that is, an application program accessed through the Web.

[0074] Stored XSS: Stored XSS stores the malicious script code submitted by the attacker on the Web application server. Whenever a user visits a page containing malicious code, the code execution is triggered, thereby achieving the purpose of the attack. Unlike reflected XSS, which can only attack once after writing a code, the malicious script of stored XSS can be used multiple times once it is stored on the server, which is also called "persistent XSS".

[0075] WebKit: is an open source browser engine, the core part of the browser, also known as the browser kernel, responsible for interpreting the syntax of web pages and rendering web pages, such as HTML (HyperText Markup Language), JavaScript, etc.

[0076] Web crawler: A web crawler is a program or script that scans or "crawls" web pages according to a certain logic. The workflow is generally to request access to the set initial URL (Uniform Resource Locator) to obtain the response content, extract the required information and URL from the response content, and then repeat the previous work based on the newly extracted URL. The vulnerability scanning application in the embodiment of the present application can use a web crawler based on the WebKit engine, so that the web crawler can execute web scripts (such as JavaScript) and render web pages to present web pages in the target application (such as a browser), and then the URL in the web page can be extracted.

[0077] Payload: malicious script code submitted to the Web application server. The attack program in the embodiment of the present application can be represented as Payload.

[0078] Blind typing technology: When detecting whether a server has a vulnerability, the usual practice is to send a specific Payload request to the server and determine whether the vulnerability exists by judging the server's response status and content. This is an intuitive echo. In other special scenarios, the server cannot echo immediately or has no echo (that is, when any request is sent to the server, the server returns the same status code and response message). At this time, it is impossible to directly determine whether a vulnerability exists through the response status. For vulnerability detection applications, it is like a blind person who cannot observe directly with his eyes, but can judge through other senses.

[0079] For example, you can try to make a server (or browser) with a vulnerability execute such a payload: initiate a DNS (Domain Name Server) query request, and listen to the NS (Name Server) server of the domain name. If the NS server does receive the resolution request, it can be indirectly judged that the payload is executed, which means that the vulnerability exists. On the contrary, if the resolution request is not received, it means that the vulnerability does not exist or the network is unreachable. In addition to initiating the above DNS query request, you can also initiate a CURL (Command Line Uniform Resource Locator, a file transfer tool that uses URL syntax to work in the command line) request, or initiate an ICMP (Internet Control Message Protocol) request, etc. In short, as long as the server with a vulnerability can make some "actions" that can be captured, and the server without a vulnerability does not do these "actions", it can be judged whether the vulnerability exists. This is the idea of ​​blind typing technology.

[0080] The word “exemplary” is used hereinafter to mean “serving as an example, example, or illustration.” Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0081] The terms "first" and "second" in this document are used for descriptive purposes only and should not be understood as explicitly or implicitly indicating relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0082] The design ideas of the embodiments of the present application are described below.

[0083] Stored XSS vulnerabilities are serious and difficult to detect. They store malicious scripts submitted by attackers in the Web application server. Whenever a user visits a page containing malicious code, the malicious scripts are executed, thereby achieving the purpose of the attack. However, current Web application vulnerability scanners have weak detection capabilities for stored XSS vulnerabilities and have a low detection rate.

[0084] In view of this, the embodiments of the present application propose a vulnerability detection method, device, electronic device and storage medium. By specifying the access address information of the vulnerability detection platform in the attack program of the stored XSS vulnerability and inserting the attack program into the Web application, when the attack program is executed in the Web application, the first execution information of the attack program can be sent to the vulnerability detection platform based on the above-mentioned access address information. When the vulnerability detection platform receives the first execution information of the attack program, it can be proved that the attack program inserted into the Web application is executed, that is, the server of the Web application has a stored XSS vulnerability. Therefore, the present application can improve the detection capability of the Web application vulnerability detection application for stored XSS vulnerabilities and improve the detection rate of stored XSS vulnerabilities.

[0085] The following is an illustrative introduction to the application scenarios of the embodiments of the present application in conjunction with the accompanying drawings.

[0086] like Figure 1 As shown, an application scenario of a vulnerability detection method includes multiple terminal devices 110, a server 120 and a vulnerability detection platform 130. Figure 1 In the figure, three terminal devices 110 are taken as an example, but in practice, the number of terminal devices 110 is not limited.

[0087] The terminal device 110 includes but is not limited to tablet computers, laptop computers, desktop computers, smart home appliances and other devices; the target application and the vulnerability detection application can be installed in the terminal device 110, for example, the target application can be a browser application, an information application, a shopping application or a social application, etc. The server 120 can be a background server corresponding to the target application, and the vulnerability detection platform 130 can also be a background server corresponding to the vulnerability detection application; the server 120 and the vulnerability detection platform 130 can be implemented by a single server or multiple servers, and can also be implemented by a physical server or a virtual server.

[0088] The terminal device 110 and the server 120 can communicate through a communication network, and the terminal device 110 and the vulnerability detection platform 130 can also communicate through a communication network; the communication network can be a wireless network or a wired network, which is not limited in the embodiments of the present application.

[0089] In an embodiment of the present application, the terminal device 110 obtains an attack program for a target vulnerability, which includes access address information of a vulnerability detection platform; the attack program for the target vulnerability is input into a target application through a vulnerability detection application, and the attack program is sent to a server 120 through the target application; if the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine a trigger page for the attack program in the target application; the trigger page is crawled and the attack program is executed through the vulnerability detection application to send first execution information of the attack program to the vulnerability detection platform 130, so that the vulnerability detection platform 130 determines that the attack program is executed based on the first execution information of the attack program, and sends an alarm information of the attack program to the vulnerability detection application; after the terminal device 110 receives the alarm information of the attack program returned by the vulnerability detection platform through the vulnerability detection application, it can be determined that the target vulnerability exists in the target application.

[0090] Above Figure 1 The application scenario is only an example of an application scenario for implementing the embodiment of the present application. The embodiment of the present application is not limited to the above Figure 1 The application scenarios described above are, in fact, embodiments of the present application can be applied to any applicable scenarios.

[0091] Figure 2 A flowchart of a vulnerability detection method is provided for an embodiment of the present application. The method can be applied to a first terminal device, for example Figure 1 The terminal device 110 in FIG. Figure 2 As shown, the vulnerability detection method may include the following steps:

[0092] S201, inputting an attack program of a target vulnerability into a target application through a vulnerability detection application, and sending the attack program to a corresponding server through the target application; wherein the attack program includes access address information of a vulnerability detection platform.

[0093] Among them, the target application can be an application installed on the first terminal device, such as a browser application, an information application, a shopping application or a social application, etc., and specifically can be a Web application. The vulnerability detection application can be installed on the first terminal device, and is used to detect whether there is a security vulnerability in the target application on the first terminal device. The target vulnerability can be a security vulnerability that needs to be detected, such as a stored XSS vulnerability; the attack program can be a malicious script code for the target vulnerability (for example, it can be a JavaScript script), which is used to attack the target application to determine whether the target application has the target vulnerability, and can usually be represented by Payload; and the attack program includes the access address information of the vulnerability detection platform, so that when the attack program is executed, an access request can be sent to the vulnerability detection platform, and the access request includes the first execution information of the attack program; in addition, the attack program can also include identification information for uniquely identifying the attack program.

[0094] For example, the access address information of the vulnerability detection platform is: http: / / mangdatest.com / , and the attack program can be: <script src＝"http: mangdatest.com ">< / script> ,Since the attack program input into the target application is the access address information of the ,vulnerability detection platform, it is not easily intercepted by the protection ,application, and has high concealment, so as to detect the target vulnerability.

[0095] When detecting whether a target application has a target vulnerability, the attack program of the target vulnerability may be input into the target application, specifically, into the target page of the target application. The following describes several optional ways of inputting into the target page.

[0096] The first method is to input the attack program of the target vulnerability into the content input location of the target page of the target application through the vulnerability detection application.

[0097] The content input position of the target page may be a position where input is allowed, such as an input or textarea text box; for example, if the target application is a forum for posting posts, the content input position of the target page may be a text box position for inputting posted content.

[0098] The second method is to input the attack program of the target vulnerability into the external link position in the page tag corresponding to the target page of the target application through the vulnerability detection application.

[0099] Among them, the page tag of the target page can be a script tag, and the external link location can be the src link location in the src attribute in the script tag. The src attribute is used to specify the URL of the external script file. The src connection points to the location of the external resource, and the pointed content will be applied to the location of the current tag in the document.

[0100] The third method is to input the attack program of the target vulnerability into the designated attribute position in the page tag corresponding to the target page of the target application through the vulnerability detection application.

[0101] The page tag may be an HTML tag, and the attribute position in the HTML tag may be detected to determine the specified attribute position, such as the on event position. The attack program may replace the on event execution content, or the on event may be dynamically introduced to load the attack program through the on event.

[0102] It should be noted that the attack programs input at different positions on the target page may have different identification information to distinguish the attack programs at different positions.

[0103] S202: If the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine the triggering page of the attack program in the target application.

[0104] In an embodiment of the present application, the vulnerability detection application can parse the response content returned by the server based on a scanning engine. The scanning engine can be a scanning engine of the Webkit kernel, and can capture page address information and attack programs and other content from the response content, wherein the page address information can be the address information of the trigger page of the attack program; in addition, if the response content includes the attack program but does not include the page address information, it can be determined that the trigger page of the attack program is the attack program input page.

[0105] Therefore, in some embodiments, the above S202 parses the response content to determine the triggering page of the attack program in the target application, which may include the following two possible situations:

[0106] In the first case, after parsing the response content, the page address information and the content of the attack program are obtained, and the triggering page of the attack program in the target application is determined according to the parsed page address information.

[0107] For example, after an attack program is input into a target page of a target application, a server of the target application publishes the attack program into a trigger page, and the attack program needs to be executed in the trigger page.

[0108] In the second case, the response content is parsed to obtain the content of the attack program, and according to the parsed content of the attack program, the input page of the attack program in the target application is determined to be the trigger page.

[0109] For example, after an attack program is input into a target page of a target application, a server of the target application publishes the attack program into the target page, and the attack program can be executed in the target page.

[0110] S203, crawling the trigger page and executing the attack program through the vulnerability detection application to send the first execution information of the attack program to the vulnerability detection platform.

[0111] In this step, the Webkit scanning engine of the vulnerability detection application can be used to perform a web crawler to crawl the trigger page and trigger the attack program. Since the attack program includes the access address information of the vulnerability detection platform, after the attack program is triggered, an access request can be sent to the vulnerability detection platform, which includes the first execution information of the attack program, such as: the content of the attack program, the page address information where the attack program is executed, etc.

[0112] After receiving the first execution information of the attack program, the vulnerability detection platform can determine that the attack program is successfully executed, and obtain the page address information where the attack program is executed, and then send the warning information of the attack program and the page address information where the attack program is executed to the vulnerability detection application. In addition, the vulnerability detection platform can also verify the identification information of the attack program to determine the location of the target page where the attack program is input into the target application.

[0113] S204, receiving the warning information of the attack program returned by the vulnerability detection platform through the vulnerability detection application, and determining the target vulnerability exists in the target application according to the warning information.

[0114] Specifically, the alarm information of the attack program is used to indicate that the attack program has been successfully executed. The vulnerability detection application can determine the existence of a target vulnerability in the target application based on the alarm information of the attack program. Specifically, the target vulnerability exists at the location where the attack program is input in the target page of the target application. A detection report of the target vulnerability can also be generated.

[0115] The embodiment of the present application uses blind typing technology to input the attack program of the target vulnerability into the target application, so that the target application submits the attack program to the server. If the vulnerability detection application obtains the response content of the server, the trigger page of the attack program can be determined based on the response content, and then the trigger page can be crawled and the attack program can be executed through the vulnerability detection application to send an access request to the vulnerability detection platform, so that the vulnerability detection platform (which can be understood as a blind typing platform) determines that the attack program is successfully executed, and then determines that the target vulnerability exists in the target application.

[0116] Considering that the input page and trigger page of the attack program of the target vulnerability may not be the same page, or there may be multiple trigger pages, and different trigger pages may have different filtering conditions for the output content, if only the input page is used to judge whether the server's response content to the attack program is received, there may be missed detections. In addition, the triggering of the attack program may rely on the authority of the administrator or other privileged users. For example, the message board function of the website requires the administrator to review the message after the user posts it. If there is a target vulnerability in the message location, after the attack program is entered in the message location and the message is successfully left, only the administrator with the message review authority can trigger the attack program; if only the user who posted the message is used to judge whether the server's response content to the attack program is received, it will lead to missed detections.

[0117] In order to avoid missed detections caused by the above situation, on the one hand, after submitting the attack program to the server of the target application, if the response content returned by the server is obtained and the trigger page of the attack program is parsed, the trigger page is crawled and the attack program is executed through the vulnerability detection application to send an access request to the vulnerability detection platform, so that the vulnerability detection platform determines that the attack program is successfully executed, and then determines that the target vulnerability exists in the target application.

[0118] On the other hand, considering that the attack program may need to be triggered in the target application on the second terminal device, the embodiment of the present application can monitor the execution of the attack program through the vulnerability detection application. Optionally, the embodiment of the present application can also include the following steps:

[0119] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is received, it is determined that the target application has the target vulnerability;

[0120] The warning information of the attack program is obtained when the vulnerability detection platform receives the second execution information of the attack program sent by the second terminal device.

[0121] Among them, the target application is installed in the second terminal device. When the user enters the attack program in the target application on the first terminal device, the server can publish the attack program to the target application, and other users can trigger the attack program through the target application on the second terminal device; other users can be administrators of the target application, such as reviewing the content published in the target application, or they can be ordinary users who can publish content or browse content in the target application.

[0122] Based on the above embodiments of the present application, it can be known that after the attack program is submitted to the server of the target application, if the response content returned by the server is obtained through the vulnerability detection application, and after the attack program is triggered, the vulnerability detection platform returns the alarm information of the attack program, it can be determined that the target application has a target vulnerability; on the contrary, if the response content returned by the server is not obtained through the vulnerability detection application, and the alarm information of the attack program returned by the vulnerability detection platform is not received, it can be explained that the attack program is intercepted and the target application does not have the target vulnerability.

[0123] Therefore, in some embodiments, the embodiments of the present application may further include the following steps:

[0124] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is not received, it is determined that the target application does not have the target vulnerability.

[0125] The following is an exemplary introduction to the vulnerability detection method on the vulnerability detection platform side.

[0126] like Figure 3 As shown, the embodiment of the present application provides a vulnerability detection method, which is applied to a vulnerability detection platform and includes the following steps:

[0127] S301, if first execution information of an attack program sent by a first terminal device through a vulnerability detection application is received, generating warning information of the attack program;

[0128] The first execution information of the attack program is sent after the first terminal device triggers the attack program of the target vulnerability in the target application through the vulnerability detection application, and the attack program includes the access address information of the vulnerability detection platform.

[0129] S302, sending warning information of the attack program to a vulnerability detection application of the terminal device, so that the vulnerability detection application determines that a target vulnerability exists in a target application.

[0130] In some embodiments, the attack program includes identification information, and based on the first execution information of the attack program, sending warning information of the attack program to the vulnerability detection application of the terminal device includes:

[0131] Acquire identification information of the attack program from first execution information of the attack program;

[0132] After the identification information is verified, an alarm message of the attack program is sent to the vulnerability detection application of the terminal device.

[0133] Among them, the attack programs input into different positions of the target application have different identification information. By verifying the identification information of the attack program, the input position of the attack program in the target application can be determined, and then it can be determined whether the corresponding input position of the target application has the target vulnerability.

[0134] In some embodiments, the method further comprises the following steps:

[0135] If the second execution information of the attack program sent by the second terminal device is received, the warning information of the attack program is generated; wherein the second execution information of the attack program is sent after the second terminal device triggers the attack program in the target application.

[0136] Furthermore, the trigger page address information of the attack program in the second execution information can also be obtained, and the trigger page address information can be sent to the vulnerability detection application of the first terminal device, so that the vulnerability detection application generates a detection report of the target vulnerability.

[0137] Combine the following Figure 4 The vulnerability detection method of the embodiment of the present application is exemplarily introduced.

[0138] like Figure 4 As shown in the figure, taking the target vulnerability to be detected as a stored XSS vulnerability and the target application as a Web application as an example, when detecting whether a Web application has a stored XSS vulnerability, the vulnerability detection process is as follows:

[0139] (1) Implant a payload in a Web application to submit the payload to the Web application server.

[0140] In the first implantation method, the vulnerability detection application can implant a payload in the input, textarea text box and other locations where input is allowed in the Web application. The payload is the attack program in the above-mentioned embodiment of the present application, which includes the blind typing address information of the blind typing platform. The blind typing platform can be understood as being higher than that in the above-mentioned embodiment of the present application, and can improve the vulnerability detection rate.

[0141] In the second implantation method, the vulnerability detection application can also replace the src link in the controllable position of the src attribute of the script tag of the web application page to introduce the payload.

[0142] The third implantation method is that the vulnerability detection application can also detect the attribute position in the HTML tag of the Web application, replace the on event execution content or dynamically introduce the on event, and load the payload through the on event.

[0143] (2) After the payload is implanted, the scanning engine of the Webkit kernel of the vulnerability detection application will parse the response content of the Web application server, capture the returned trigger page URL, payload and other content, and actively trigger the payload by virtually loading the trigger page through Webkit. At this point, the first part: the blind typing process triggered by the Webkit crawler is completed.

[0144] (3) Some payloads need to wait for other users to passively trigger them due to their hidden locations or insufficient execution permissions. This process takes a certain period of time. The blind typing platform will continue to monitor and immediately issue an alarm once it receives a request for successful execution of the blind typing payload, notifying the vulnerability detection application to generate a scan report. This process completes the second part: the natural environment triggering process.

[0145] (4) Both of the above blind typing technologies (2) and (3) require the use of a blind typing platform. In addition to monitoring whether the blind typing payload is successfully executed and notifying the vulnerability scanning product with an alarm, the blind typing platform also performs functions such as automatic deduplication of blind typing payloads and payload management. In certain scenarios, it will also maintain the user permissions of the vulnerability detection application to avoid problems such as being unable to reproduce after receiving an alarm.

[0146] In the embodiment of the present application, a blind typing payload is submitted to the server of the Web application, and a Webkit engine crawler is used to actively crawl related pages to trigger the execution of the payload. Then, the log is analyzed on the blind typing platform to prove the existence of a stored XSS vulnerability.

[0147] By combining the blind typing technology with the Webkit virtual execution of the vulnerability detection application, the blind typing technology is adopted to implant a script link (blind typing platform address information) that can be parsed by Webkit, and this script link can not only be executed by the Webkit virtual execution of the vulnerability detection application, but also can be actively triggered by normal users. The vulnerability detection application can detect a relatively direct storage XSS vulnerability by virtual execution after scanning, and some payloads that need to be triggered by users with certain permissions or hidden positions need to rely on other users to trigger to supplement. Let ordinary users become the subject of vulnerability detection, giving full play to this advantage of blind typing technology. The execution subject of the blind typing payload in the embodiment of the present application is the vulnerability detection application and the ordinary user. By expanding the execution subject of the blind typing payload, the vulnerability detection effect can be improved, and the problem of low storage type XSS vulnerability detection rate is alleviated.

[0148] Based on the same inventive concept as the above-mentioned method embodiment of the present application, a vulnerability detection device is also provided in the embodiment of the present application. The principle of solving the problem by the device is similar to that of the method in the above-mentioned embodiment. Therefore, the implementation of the device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated.

[0149] like Figure 5 As shown, the embodiment of the present application provides a vulnerability detection device, which is applied to a first terminal device. The vulnerability detection device 50 includes:

[0150] An input module 51 is used to input an attack program of a target vulnerability into a target application through a vulnerability detection application, and send the attack program to a corresponding server through the target application; wherein the attack program includes access address information of the vulnerability detection platform;

[0151] The determination module 52 is used to parse the response content returned by the server and determine the triggering page of the attack program in the target application if the response content is obtained by the vulnerability detection application;

[0152] A trigger module 53, used to crawl a trigger page through a vulnerability detection application and execute an attack program to send first execution information of the attack program to the vulnerability detection platform;

[0153] The detection module 54 is used to receive the warning information of the attack program returned by the vulnerability detection platform through the vulnerability detection application, and determine whether the target application has a target vulnerability according to the warning information.

[0154] In an optional embodiment, the input module is further used for:

[0155] Input the attack program of the target vulnerability into the content input location of the target page of the target application through the vulnerability detection application; or

[0156] Enter the attack program of the target vulnerability into the external link position in the page tag corresponding to the target page of the target application through the vulnerability detection application; or

[0157] The attack program of the target vulnerability is input into the designated attribute position in the page tag corresponding to the target page of the target application through the vulnerability detection application.

[0158] In an optional embodiment, the determination module is further configured to:

[0159] Parse the response content and determine the triggering page of the attack program based on the parsed page address information; or

[0160] The response content is parsed, and the input page of the attack program is determined as the trigger page according to the parsed attack program.

[0161] In an optional embodiment, the device further includes a vulnerability determination module, which is used to:

[0162] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is received, it is determined that the target application has the target vulnerability;

[0163] The warning information of the attack program is obtained by the vulnerability detection platform when the vulnerability detection platform receives the second execution information of the attack program sent by the second terminal device.

[0164] In an optional embodiment, the device further includes a non-vulnerability determination module, configured to:

[0165] If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is not received, it is determined that the target application does not have the target vulnerability.

[0166] Based on the same inventive concept as the above-mentioned method embodiment of the present application, a vulnerability detection device is also provided in the embodiment of the present application. The principle of solving the problem by the device is similar to that of the method in the above-mentioned embodiment. Therefore, the implementation of the device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated.

[0167] like Figure 6 As shown, an embodiment of the present application provides a vulnerability detection device 60 , which is applied to a vulnerability detection platform and includes a first receiving module 61 and an alarm sending module 62 .

[0168] The first receiving module 61 is used to generate warning information of the attack program if first execution information of the attack program sent by the first terminal device through the vulnerability detection application is received; wherein the first execution information of the attack program is sent by the first terminal device after triggering the attack program of the target vulnerability in the target application through the vulnerability detection application, and the attack program includes access address information of the vulnerability detection platform;

[0169] The alarm sending module 62 is used to send alarm information to the vulnerability detection application of the first terminal device, so that the vulnerability detection application determines that the target application has a target vulnerability.

[0170] In an optional embodiment, the attack program includes identification information, and the alarm sending module is further used to:

[0171] Acquire identification information of the attack program from first execution information of the attack program;

[0172] After the identification information is verified, an alarm message of the attack program is sent to the vulnerability detection application of the terminal device.

[0173] In an optional embodiment, the device further includes a second receiving module, configured to:

[0174] If the second execution information of the attack program sent by the second terminal device is received, the warning information of the attack program is generated; wherein the second execution information of the attack program is sent after the second terminal device triggers the attack program in the target application.

[0175] Furthermore, the alarm sending module 62 may also obtain the triggering page address information of the attack program in the second execution information, and send the triggering page address information to the vulnerability detection application of the first terminal device.

[0176] After introducing a vulnerability detection method and device according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0177] The present application embodiment provides an electronic device 700, Figure 7 As shown, it includes: a memory 720 and a processor 710:

[0178] The memory 720 is used to store computer programs that can be executed on the processor;

[0179] The processor 710 is used to execute a computer program to implement any vulnerability detection method in the above embodiments.

[0180] In some possible implementations, the electronic device according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the animation effect detection method according to various exemplary implementations of the present application described above in this specification. For example, the processor may execute Figure 2 or Figure 3 Follow the steps shown in .

[0181] In an exemplary embodiment, a storage medium including instructions is also provided, such as a memory including instructions, and the instructions can be executed by the processor 710 to complete the vulnerability detection method. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a tape, a floppy disk, an optical data storage device, etc.

[0182] In an exemplary embodiment, the electronic device may also be an electronic device with a communication function, so the electronic device may include other components in addition to the processor and memory described above. Figure 8As shown, it may include: a radio frequency (RF) circuit 810, a wireless fidelity (Wi-Fi) module 820, a communication interface 830, a display unit 840, a power supply 850, a processor 860, a memory 870 and other components. Those skilled in the art will understand that Figure 8 The structure of the electronic device shown in the figure does not constitute a limitation on the electronic device. The electronic device provided in the embodiment of the present application may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0183] Combine the following Figure 8 The components of the electronic device 800 are described in detail:

[0184] The electronic device 800 can obtain the alarm information generated by the security device within a preset time period through the RF circuit 810, the Wi-Fi module 820, and the communication module of the communication interface 830.

[0185] The RF circuit 810 can be used for receiving and sending data during the communication process. In particular, after receiving the downlink data from the base station, the RF circuit 810 sends it to the processor 860 for processing; in addition, the uplink data to be sent is sent to the base station. Generally, the RF circuit 810 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc.

[0186] In addition, the RF circuit 810 can also communicate with the network and other electronic devices through wireless communication. The wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0187] Wi-Fi technology is a short-range wireless transmission technology. The electronic device 800 can connect to an access point (AP) through a Wi-Fi module 820 to access a data network. The Wi-Fi module 820 can be used for receiving and sending data during the communication process.

[0188] The electronic device 800 can be physically connected to other electronic devices through the communication interface 830. Optionally, the communication interface 830 is connected to the communication interface of the other electronic device through a cable to achieve data transmission between the electronic device 800 and the other electronic device.

[0189] Since in the embodiment of the present application, the electronic device 800 can implement communication services and send information to other contacts, the electronic device 800 needs to have a data transmission function, that is, the electronic device 800 needs to include a communication module. Figure 8 Communication modules such as the RF circuit 810, the Wi-Fi module 820, and the communication interface 830 are shown, but it is understandable that at least one of the above components or other communication modules (such as a Bluetooth module) for implementing communication exist in the electronic device 800 to perform data transmission.

[0190] For example, when the electronic device 800 is a computer, the electronic device 800 may include the communication interface 830 and may also include the Wi-Fi module 820; when the electronic device 800 is a tablet computer, the electronic device 800 may include the Wi-Fi module.

[0191] The display unit 840 can be used to display the page of the target application. The display unit 840 is the display system of the electronic device 800, which is used to present an interface and realize human-computer interaction.

[0192] The display unit 840 may include a display panel 841. Optionally, the display panel 841 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0193] The memory 870 may be used to store software programs and modules. The processor 860 executes various functional applications and data processing of the electronic device 800 by running the software programs and modules stored in the memory 870. The memory 870 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0194] The processor 860 is the control center of the electronic device 800. It connects various components using various interfaces and lines, executes various functions of the electronic device 800 and processes data by running or executing software programs and / or modules stored in the memory 870, and calls data stored in the memory 870, thereby realizing various services based on the electronic device. The processor 860 includes Figure 8 The functions of the processor 860 in the embodiment of the present invention are as follows. Optionally, the processor 860 may include one or more processing units. Optionally, the processor 860 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understood that the modem processor may not be integrated into the processor 860.

[0195] The electronic device 800 also includes a power supply 850 (such as a battery) for supplying power to various components. Optionally, the power supply 850 can be logically connected to the processor 860 through a power management system, so that the power management system can manage functions such as charging, discharging, and power consumption.

[0196] In some possible implementations, various aspects of a vulnerability detection method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a vulnerability detection method according to various exemplary implementations of the present application described above in this specification. For example, the program code may enable the computer device to execute the following steps: Figure 2 Steps 201-204 shown in .

[0197] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access computer storage medium (RAM), a read-only computer storage medium (ROM), an erasable programmable read-only computer storage medium (EPROM or flash memory), an optical fiber, a portable compact disk read-only computer storage medium (CD-ROM), an optical computer storage medium, a magnetic computer storage medium, or any suitable combination thereof.

[0198] It should be noted that, although several modules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be embodied.

[0199] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0200] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0201] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0202] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0203] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0204] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A vulnerability detection method, characterized in that: Applied to the first terminal device, including: Inputting the attack program of the target vulnerability into the target application through the vulnerability detection application, and sending the attack program to the corresponding server through the target application; wherein the attack program includes the access address information of the vulnerability detection platform; If the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine the triggering page of the attack program in the target application; crawling the trigger page and executing the attack program through the vulnerability detection application to send first execution information of the attack program to the vulnerability detection platform; The alarm information of the attack program returned by the vulnerability detection platform is received through the vulnerability detection application, and the target vulnerability is determined to exist in the target application according to the alarm information.

2. The method according to claim 1, characterized in that The step of inputting the attack program of the target vulnerability into the target application through the vulnerability detection application includes: Inputting the attack program of the target vulnerability into the content input position of the target page of the target application through the vulnerability detection application; or Inputting the attack program of the target vulnerability into the external link position in the page tag corresponding to the target page of the target application through the vulnerability detection application; or The attack program of the target vulnerability is input into a designated attribute position in a page tag corresponding to a target page of the target application through the vulnerability detection application.

3. The method according to claim 1 or 2, characterized in that: The step of parsing the response content to determine a triggering page of the attack program in the target application includes: Parsing the response content, and determining the triggering page of the attack program in the target application according to the parsed page address information; or The response content is parsed, and according to the parsed attack program, an input page of the attack program in the target application is determined as the trigger page.

4. The method according to claim 1 or 2, characterized in that: The method further comprises: If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is received, it is determined that the target application has the target vulnerability; The warning information of the attack program is obtained when the vulnerability detection platform receives the second execution information of the attack program sent by the second terminal device.

5. The method according to claim 1 or 2, characterized in that: The method further comprises: If the response content returned by the server is not obtained through the vulnerability detection application, and the warning information of the attack program returned by the vulnerability detection platform is not received, it is determined that the target application does not have the target vulnerability.

6. A vulnerability detection method, characterized in that: Applied to vulnerability detection platforms, including: If the first execution information of the attack program sent by the first terminal device through the vulnerability detection application is received, an alarm information of the attack program is generated; wherein the first execution information of the attack program is that the first terminal device inputs the attack program of the target vulnerability into the target application through the vulnerability detection application, and sends the attack program to the corresponding server through the target application, if the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine the trigger page of the attack program in the target application, and the trigger page is crawled by the vulnerability detection application and the attack program is executed and then sent, and the attack program includes the access address information of the vulnerability detection platform; Sending warning information of the attack program to a vulnerability detection application of the first terminal device, so that the vulnerability detection application determines that the target application has the target vulnerability.

7. The method according to claim 6, characterized in that The attack program includes identification information, and the step of sending warning information of the attack program to the vulnerability detection application of the first terminal device includes: Acquire identification information of the attack program from first execution information of the attack program; After the identification information is verified, alarm information of the attack program is sent to the vulnerability detection application of the first terminal device.

8. The method according to claim 6, characterized in that The method further comprises: If the second execution information of the attack program sent by the second terminal device is received, the alarm information of the attack program is generated; wherein the second execution information of the attack program is sent after the second terminal device triggers the attack program in the target application.

9. A vulnerability detection device, characterized in that: Applied to the first terminal device, including: An input module, used to input an attack program of a target vulnerability into a target application through a vulnerability detection application, and send the attack program to a corresponding server through the target application; wherein the attack program includes access address information of a vulnerability detection platform; A determination module, configured to parse the response content returned by the server and determine a triggering page of the attack program in the target application if the response content is obtained through the vulnerability detection application; A trigger module, used to crawl the trigger page and execute the attack program through the vulnerability detection application, so as to send first execution information of the attack program to the vulnerability detection platform; The detection module is used to receive the warning information of the attack program returned by the vulnerability detection platform through the vulnerability detection application, and determine whether the target vulnerability exists in the target application according to the warning information.

10. A vulnerability detection device, characterized in that: Applied to vulnerability detection platforms, including: A first receiving module is used to generate alarm information of the attack program if first execution information of the attack program sent by the first terminal device through the vulnerability detection application is received; wherein the first execution information of the attack program is that the first terminal device inputs the attack program of the target vulnerability into the target application through the vulnerability detection application, and sends the attack program to the corresponding server through the target application, if the response content returned by the server is obtained through the vulnerability detection application, the response content is parsed to determine the trigger page of the attack program in the target application, and the trigger page is crawled by the vulnerability detection application and the attack program is executed and then sent, and the attack program includes access address information of the vulnerability detection platform; The alarm sending module is used to send alarm information to the vulnerability detection application of the first terminal device, so that the vulnerability detection application determines that the target application has the target vulnerability.

11. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, the processor implements the method described in any one of claims 1 to 5 and 6 to 8.

12. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, characterized in that: When the computer program is executed by a processor, the method described in any one of claims 1 to 5 and 6 to 8 is implemented.

Images