API interface vulnerability analysis methods, devices, terminal equipment, and storage media

Abstract

This application relates to the field of signal transmission technology and provides an API interface vulnerability analysis method and apparatus, terminal device, and storage medium. The API interface vulnerability analysis method includes: firstly, obtaining at least one application installation package; determining the application corresponding to each application installation package; performing static analysis on the application to obtain multiple running components corresponding to the application; driving a webpage to connect to and launch the application; for each application, setting up a web proxy and installing a digital root certificate on the webpage; obtaining log files generated by the multiple running components of each application through the webpage; and determining the vulnerability information of the API interface corresponding to the application based on the log files. Through the above solution, this application solves the technical problem that existing API interface vulnerability mining methods can cause risks to APP operation.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to API interface vulnerability analysis methods and apparatus, terminal devices and storage media. Background Technology

[0002] API (Application Programming Interface) is a backend API service used by terminal APP (Application). This type of interface is generally a data interface that returns data in JSON (JavaScript Object Notation, a readable data collection) format. In real-world application environments, terminal APPs typically have multiple API interfaces. Current technology for discovering APP vulnerabilities generally involves injecting specific code and then obtaining the returned data. This method can only identify vulnerabilities specific to a single type of vulnerability or a single APP, which is rather one-sided. It also heavily relies on the quality of the injected code. Furthermore, since vulnerability discovery is done through code injection, it modifies the APP's code, potentially causing risks to the APP's subsequent operation. Summary of the Invention

[0003] This application provides an API interface vulnerability analysis method and apparatus, terminal device and storage medium, which can solve the technical problem that existing API interface vulnerability mining methods may cause APP operation risks.

[0004] In a first aspect, embodiments of this application provide an API interface vulnerability analysis method, including:

[0005] In one possible implementation of the first aspect, an API interface vulnerability analysis method includes:

[0006] Obtain at least one application installation package;

[0007] Identify the application corresponding to each of the aforementioned application installation packages;

[0008] Perform static analysis on the application to obtain multiple runtime components corresponding to the application;

[0009] The application is launched after the webpage is linked to it.

[0010] For each of the aforementioned applications, web proxy settings and digital root certificate installation are performed on the webpage;

[0011] The webpage is used to obtain log files generated by multiple running components of each application, and the vulnerability information of the API interface corresponding to the application is determined based on the log files.

[0012] Optionally, the step of determining the application corresponding to each application installation package comprises:

[0013] decompressing and / or decompiling each application installation package to obtain each application and a plurality of directory files of each application;

[0014] Optionally, the plurality of directory files comprises a program global configuration file, a bytecode file, a binary resource file, signature information, a resource file, and other configuration files.

[0015] Optionally, the step of performing static analysis on the application to obtain a plurality of running components corresponding to the application comprises:

[0016] determining the code of each application through each application installation package;

[0017] running the code of each application in a static analysis tool to determine a plurality of running components corresponding to each application.

[0018] Optionally, the step of obtaining a log file generated by the running of each application through the webpage to determine the vulnerability of each API interface comprises:

[0019] obtaining a log file generated by the running of the component through the webpage;

[0020] performing dynamic analysis on the log file to obtain a Web API list in a preset format;

[0021] performing automatic fuzzing detection on the Web API list to obtain a Web scenario vulnerability.

[0022] Optionally, the step of driving the application to be started after the webpage is hooked comprises:

[0023] the step of driving the application to be started after the webpage is hooked comprises:

[0024] building a detection service framework in an Android emulator;

[0025] the detection service framework detects the Android emulator and automatically connects to the Android virtual environment software;

[0026] the detection service framework injects a webpage process into the Android emulator;

[0027] starting the application to be detected;

[0028] forcing the webpage to be started and hooked to the currently started application.

[0029] Optionally, the dynamic analysis includes a regular expression.

[0030] In a second aspect, the embodiments of the present application provide an API interface vulnerability analysis device, comprising:

[0031] A compiling unit acquires at least one application installation package and determines an application corresponding to each application installation package;

[0032] A static analysis unit performs static analysis on the application to acquire a plurality of running components corresponding to the application;

[0033] A dynamic analysis unit drives the application started after web hooking, performs web proxy setting and digital root certificate installation in the web for each application, acquires log files generated by a plurality of running components of each application through the web, and determines vulnerability information of an API interface corresponding to the application according to the log files.

[0034] In a third aspect, the embodiments of the present application provide a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the API interface vulnerability analysis method as described above when executing the computer program.

[0035] In a fourth aspect, the embodiments of the present application provide a storage medium, which stores a computer program, and the computer program is executed by a processor to implement the API interface vulnerability analysis method as described above.

[0036] It can be understood that the beneficial effects of the above-mentioned second aspect to fourth aspect can be referred to the related description in the first aspect, which will not be repeated here.

[0037] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0038] After the application program is statically processed, the application program is run and connected with the web, the log files of the running application program are stably captured through web proxy setting and digital root certificate installation, so that the effective log files generated by a plurality of running components of the application program can be acquired, and the vulnerability of each application program running in the web can be acquired through dynamic analysis on the log files. Since the above-mentioned vulnerability mining method does not need to inject code into the application program, that is, the code of the application program does not need to be changed, the stability of the subsequent application program can be ensured, and the technical problem that the existing API interface vulnerability mining method causes APP running risk is solved. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0040] Figure 1 is a flowchart of the API interface vulnerability mining method provided by an embodiment of the present application;

[0041] Figure 2 is a flowchart of the API interface vulnerability mining method provided by an embodiment of the present application;

[0042] Figure 3 is a flowchart of the API interface vulnerability analysis method provided by an embodiment of the present application;

[0043] Figure 4 is a flowchart of the API interface vulnerability analysis method provided by an embodiment of the present application;

[0044] Figure 5 is a structural diagram of the API interface vulnerability analysis apparatus provided by another embodiment of the present application;

[0045] Figure 6 is a structural diagram of the terminal device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0046] In the following description, specific details are set forth in order to provide a thorough understanding of embodiments of the present application. However, persons of ordinary skill in the art will readily recognize that embodiments of the present application can be practiced without these specific details. In other instances, well-known structures, devices, circuits, and processes have not been described in detail so as not to unnecessarily obscure aspects of the present application.

[0047] It should be understood that, when used in the specification and the appended claims of the present application, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0048] It should also be understood that the term "and / or" used in the specification and the appended claims of the present application means any combination of one or more of the associated listed items and all possible combinations thereof, and includes these combinations.

[0049] As used in the specification and in the claims, the term “if’ can be interpreted as meaning “when” or “upon” or “in response to determining” or “in response to detecting” depending on the context. Similarly, the phrase “if it is determined” or “if [the described condition or event] is detected” can be interpreted to mean “upon determining” or “in response to determining” or “upon detecting [the described condition or event]” or “in response to detecting [the described condition or event]” depending on the context.

[0050] In addition, in the description of the present application and the appended claims, the terms “first”, “second”, “third”, etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0051] In the present application, the reference “one embodiment” or “some embodiments” and the like means that the specific features, structures or characteristics described in connection with the embodiment are included in one or more embodiments of the present application. Therefore, the statements “in one embodiment”, “in some embodiments”, “in other some embodiments”, “in further some embodiments” and the like appearing in different places in the specification are not necessarily all referring to the same embodiment, but mean “one or more but not all embodiments”, unless otherwise specifically emphasized. The terms “include”, “contain”, “have” and their variants mean “include but not limited to”, unless otherwise specifically emphasized.

[0052] The API interface vulnerability analysis method provided by the embodiments of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, notebook computers, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA) and the like. The embodiments of the present application do not make any limitation on the specific type of terminal device.

[0053] For example, the terminal device can be a station (STATION, STA) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a vehicle networking terminal, a computer, a laptop, a handheld communication device, a handheld computing device, a satellite radio device, a wireless modem card, a television set top box (STB), a customer premise equipment (CPE), and / or other devices for communicating over a wireless system, and a next-generation communication system, such as a mobile terminal in a 5G network or a mobile terminal in a future evolved Public Land Mobile Network (PLMN) network, and the like.

[0054] By way of example and not limitation, when the terminal device is a wearable device, the wearable device can also be a general term for smart design and development of daily wear using wearable technology, such as glasses, gloves, watches, clothing, and shoes, etc. The wearable device is a portable device that is directly worn on the body or integrated into the user's clothes or accessories. The wearable device is not only a hardware device, but also has powerful functions through software support and data interaction, cloud interaction. The broad sense of wearable smart devices includes full-featured, large-size devices that can realize complete or partial functions without relying on a smart phone, such as smart watches or smart glasses, and devices that focus on a certain type of application function and need to be used in cooperation with other devices, such as smart bands, smart jewelry, and the like.

[0055] In an embodiment, as shown in Figure 1 An API interface vulnerability analysis method includes:

[0056] S1, obtaining at least one application installation package;

[0057] An application package (APK, Android application package) is a file format used by the Android operating system for distributing and installing mobile apps and middleware. The code of an Android application wants to run on an Android device must first be compiled, and then packaged into a file that can be recognized by the Android system before it can be run, and this file format that can be recognized and run by the Android system is "APK". An APK file contains compiled code files (.dex files), file resources, native resource files (assets), certificates and manifest files.

[0058] S2, determining the application program corresponding to each application program installation package;

[0059] In the above steps, the application program corresponding to the application program installation package can be determined in various ways to determine the code file, file resource, native resource file, certificate and manifest file of the application program, ensuring the correct execution of the subsequent application program.

[0060] S3, performing static analysis on the application program to obtain a plurality of running components corresponding to the application program;

[0061] By performing static analysis on the application program, i.e. static analysis on the code file of the application program, the plurality of running components corresponding to the application program can be determined.

[0062] S4, driving the application program started by the web hook to start;

[0063] The above steps separate the started application program from the web page, but at the same time maintain the real-time running and debugging of the application program, so as to ensure the reliability of the running data of the subsequent application program.

[0064] S5, for each application program, performing Web (World Wide Web, global wide area network) proxy setting and digital root certificate installation in the web page;

[0065] Through the Web proxy setting and digital root certificate installation, a stable running environment can be provided for the application program, and the subsequent web page can obtain the log files generated by the plurality of running components of each application program through a stable information transmission protocol, ensuring the reliability and integrity of the subsequent log files.

[0066] S6, obtaining log files generated by the running components of each application program through the webpage, and determining vulnerability information of the API interface corresponding to the application program according to the log files.

[0067] First of all, it should be pointed out that the API interface (Application Programming Interface) is a set of pre-defined interfaces (such as functions, HTTP interfaces) for providing a set of routines for application programs to access based on certain software or hardware without accessing the source code. Through the API interface, the mutual communication between computer software can be realized. The API interface is also a kind of middleware, which provides data sharing for various platforms. A good API interface can reduce the mutual dependence of each part of the system, improve the cohesion of the constituent unit, reduce the coupling degree between the constituent units, and thus improve the maintainability and scalability of the system.

[0068] In the technical solution of the present application, after the application program is statically processed and runs and is connected with the webpage, the running log files of the application program are stably captured through the Web proxy setting and the digital root certificate installation, so that the effective and comprehensive log files generated by the running components of the application program can be obtained. The vulnerability of each application program running in the webpage can be obtained by dynamically analyzing the log files. Since the above vulnerability mining method does not need to inject code into the application program, that is, the code of the application program does not need to be changed, the stability of the subsequent application program can be guaranteed, and the technical problem that the existing API interface vulnerability mining method may cause APP running risk is solved. It should be pointed out that due to the particularity of the webpage running program, all log files of the application program can be captured, so that it can be comprehensively analyzed which API interface of the application program has a problem. The vulnerability mining by injecting code is more effective and comprehensive. Moreover, since the webpage can run multiple application programs at the same time, the present application can simultaneously implement comprehensive, effective and stable vulnerability mining for multiple programs.

[0069] In an embodiment, the step of determining the application program corresponding to each application program installation package comprises:

[0070] Decompressing and / or decompiling each application program installation package to obtain each application program and a plurality of directory files of each application program.

[0071] In the above embodiment, the decompression and or decompilation can use the apktool (decompilation tool) tool to realize the decompression and decompilation of the APK file, and the corresponding decompression and or decompilation command can be: apktook d example.apk. After executing the command, the AndroidManifest.xml, classes.dex, resources.arsc, META-INF, res and other directory files are obtained. After the above steps, the code files, file resources, native resource files, certificates and manifest files of the application program can be accurately determined, thereby ensuring the correct execution of the subsequent application program.

[0072] Optionally, the plurality of directory files include a program global configuration file, a bytecode file, a binary resource file, signature information, a resource file and other configuration files.

[0073] Among them, the plurality of directory files, i.e., the APK file after decompression and or decompilation, can generally see the following contents:

[0074] The program global configuration file (AndroidManifest.xml): describes the name, version, permission, referenced library file and other information of the application program;

[0075] The bytecode file (classes.dex): Dalvik (virtual machine) bytecode, java bytecode file generated after java source code compilation, which can be decompiled into java code by using a decompilation tool;

[0076] The binary resource file (resources.arsc): the compiled binary resource file, which is used for theme beautification;

[0077] Signature information (META-INF): the signature information stored in this directory, which has three signature files to ensure the integrity of the APK package and the security of the system;

[0078] Resource file (res): the directory stores resource files, including pictures, internationalization and other configurations;

[0079] Other configuration files (asssets): the directory can store some configuration files.

[0080] In an example, referring to Figure 2 The steps of driving the application program after the web page hook connection is started include:

[0081] S41, a detection service framework is built in an Android emulator;

[0082] In the above steps, the Android virtual environment software can use the existing multiple Android virtual environment software simulators. For example, an Android simulator, Genymotion (Android emulator), is used to create an Android simulator, which is the Android simulator in the above steps, and a detection service framework is built in the Android simulator. The detection service framework is used to provide a smooth signal interaction channel for subsequent acquisition of log files of the application. It should be noted that the detection service framework can achieve the corresponding function by installing frida-server (a test tool). Frida-server can provide dynamic detection through its powerful instrument core Gum (core engine). When developing using Frida-server, only scripts need to be used. Using scripts to develop can greatly shorten the development cycle. For example, GumJS (core engine) in Frida-server can pull up an execution environment containing a JavaScript runtime environment with only a few lines of C code. In this environment, you can access Gum API, Hook functions, enumerate modules, memory enumeration, and even call exported functions. Therefore, by building a detection service framework, i.e., installing Frida-server, the user can easily and conveniently achieve the functions of hooking functions, enumerating loaded libraries, implementing imported and exported functions, reading and writing memory, scanning memory, code injection tools, and the like.

[0083] S42, the detection service framework detects the Android simulator and automatically connects to the Android virtual environment software.

[0084] The above steps are executed as follows: when the detection service framework detects the Android simulator, it automatically connects to the Android virtual environment software.

[0085] S43, the detection service framework injects a web process into the Android simulator.

[0086] S44, start the application to be detected.

[0087] S45, forcibly start the web page and hook to the currently started application.

[0088] In the above embodiment, by building a basic detection service framework and connecting the web page in the Android simulator to the application, the acquisition architecture of the application log file is perfected, so that the user can conveniently acquire the log file of an application or even multiple applications at the same time. Through the above steps, the integrity of the log file can be fully guaranteed, the reliability of the original data in the later dynamic analysis process is greatly improved, in addition, this embodiment combines the Web proxy setting and certificate installation to provide the necessary running environment for the subsequent application running and traffic log grabbing, ensuring the reliability of the transmission method used during data transmission, further avoiding data loss and garbled code.

[0089] In an embodiment, as shown in Figure 3 the step of performing static analysis on the application to obtain a plurality of running components corresponding to the application comprises:

[0090] S31, determining the code of each application through each application installation package;

[0091] After the application installation package is decompressed or decompiled, the code of the application can be acquired through the static analysis unit. Taking the Manifest file in the application as an example, manifest is a kind of software, which belongs to the AndroidManifest.xml (program global configuration file) file. The Manifest software names the Java package of the application, and the package name serves as the unique identifier of the application. Moreover, the Manifest software describes the activities, services, broadcast receivers, content providers, and application components of the application. By extracting and analyzing the Manifest file, the list of four components used by the application can be obtained.

[0092] The AndroidManifest.xml file is used to record the application manifest, and each application root directory must contain one, and the main content is as follows:

[0093] 1) Name the Java software package of the application. The package name serves as the unique identifier of the application;

[0094] 2) Describe the components of the application, including Activity, service, broadcast receiver, and content provider that constitute the application;

[0095] 3) Determine the process that hosts the application components;

[0096] 4) Declare which permissions the application must have to access protected parts of the API and interact with other applications;

[0097] 5) Instrumentation classes are listed, which provide analysis and other information at runtime of the application;

[0098] 6) The minimum Android API level required by the application is declared;

[0099] 7) Libraries that the application must link to are listed.

[0100] S32, running the code of each of the application programs in the static analysis tool to determine a plurality of running components corresponding to each application program.

[0101] The static analysis tool parses the AndroidManifest.xml file by running the code of each of the application programs, and the command can take the form of: java-jar AXMLPrinter2.jar AndroidManifest.xml, and the static analysis tool is controlled to perform static analysis by the command. After execution is completed, four components of Activity, Services, Broadcast Receiver, and Content Provider are obtained.

[0102] Through the above steps, a basis is provided for obtaining the log file, the functions implemented by the API interface are basically located, so that the subsequent log file acquisition is faster, and the accuracy of vulnerability analysis is further improved.

[0103] In an embodiment, as shown in Figure 4 the log file generated by the web page acquiring each of the plurality of running components of each of the application programs to determine the vulnerability of each of the API interfaces comprises:

[0104] S61, acquiring the log file generated by the running of the components through the web page;

[0105] The system can automatically run the components of the application program through the adb am start command according to the name and path of the components. After the components are started, the traffic and log file automatically initiated by the components are automatically hooked (intercepted) and recorded into the log file.

[0106] S62, dynamically analyzing the log file to obtain a Web API (Web Application Programming Interface) list in a preset format;

[0107] Through regular expression analysis of the WebTraffic (Web traffic information) and Logcat log (log information) hooked, the Web API list requested by the application is dynamically counted.

[0108] Wherein, the system matches the WebTraffic and Logcat log content with the URL (for example: var match = / ^((ht|f)tps?):\ / \ / ([\w-]+(\.[\w-]+)*\ / )*[\w-]+(\.[\w-]+)*\ / ?(\?([\w\-

[0109] The regular matching expression can match the list of Web APIs, and the list of Web APIs can be stored in a CSV file (Common-Separated Values, a pure text form), that is, the CSV file stores tabular data in a pure text form (note: the separator character can also be other characters). The pure text indicates that the file is a sequence of characters, and does not contain data that must be interpreted like binary digits). The above process can automatically obtain data, and the tabular data storage in a pure text form can ensure the accuracy and reliability of data storage, and can be quickly applied to various vulnerability analysis methods.

[0110] S63, performing automatic fuzz detection on the list of Web APIs to obtain Web scenario vulnerabilities.

[0111] It should be noted that the automatic fuzz detection to obtain Web scenario vulnerabilities can be obtained by a dynamic analysis unit, and here the dynamic analysis unit is taken as an API Fuzzer (fuzzer) dynamic analysis unit as an example. Through automatic fuzz testing of the statistical Web API, the automatic discovery of Web scenario vulnerabilities such as directory traversal, SSRF, RCE, and sensitive information leakage is realized. Wherein, the running principle of API Fuzzer is to take the list of Web APIs as the fuzz (vulnerability mining) target, and in each fuzz process, the input parameter value in the current fuzz target API is randomized and mutated to initiate an http request, and whether the current fuzz causes the server to be abnormal is judged by detecting whether the http response status code is 200 or other status fields are abnormal. Finally, automatic fuzzing of all API lists is realized, and this method can realize automatic testing of all parameters of each API.

[0112] Therefore, through the above embodiments, the CSV file storing the Web API can be obtained, imported into the API Fuzzer fuzz testing module or dynamic analysis unit through the API interface, and the automatic discovery of Web scenario vulnerabilities is realized. It should be noted that the list of Web APIs requested by the dynamic statistical application and the storage of the list of Web APIs in a CSV file can realize comprehensive and efficient mining of Web scenario vulnerabilities.

[0113] Optionally, the log file includes Web Traffic and Logcat log information.

[0114] Optionally, the dynamic analysis includes regular expression analysis.

[0115] In the system, the Web Traffic and Logcat log content are matched by using a URL (for example, var match = / ^((ht|f)tps?):\ / \ / ([\w-]+(\.[\w-]+)*\ / )*[\w-]+(\.[\w-]+)*\ / ?(\?([\w\-

[0116] The regular expression analysis can realize the counting of the list of Web APIs and the storage of the list of Web APIs in a CSV file (Common-Separated Values, pure text form), that is, the CSV file stores table data in the form of pure text (note: the separator character can also be other characters).

[0117] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0118] Figure 6 A structural schematic diagram of a terminal device provided by an embodiment of the present application is shown in FIG. 6. As shown in the figure, the terminal device 6 of the embodiment includes at least one processor 60 (only one processor is shown in the figure), a memory 61, and a computer program 62 stored in the memory 61 and executable on the at least one processor 60, and the processor 60 implements the steps in any of the above API interface vulnerability analysis method embodiments when executing the computer program 62. Figure 6 Figure 6 A terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the API interface vulnerability analysis method as described above when executing the computer program.

[0119] A terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the API interface vulnerability analysis method as described above when executing the computer program.

[0120] The terminal device can be a desktop computer, a notebook computer, a palm computer, a cloud server, and other computing devices. The terminal device can include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that the terminal device can also include other components, and the components are not limited to the above. Figure 6 ​The terminal device is merely an example and does not constitute a limitation on the terminal device, and can include more or fewer components than shown, or combine certain components, or include different components, for example, can also include an input / output device, a network access device, and the like.

[0121] The processor 60 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0122] The memory 61 can be an internal storage unit of the terminal device 6 in some embodiments, for example, a hard disk or a memory of the terminal device 6. The memory 61 can also be an external storage device of the terminal device 6 in other embodiments, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 61 can include both an internal storage unit and an external storage device of the terminal device 6. The memory 61 is used to store an operating system, an application program, a boot loader, data, and other programs, for example, program codes of the computer program, etc. The memory 61 can also be used to temporarily store data that has been output or will be output.

[0123] According to the API interface vulnerability analysis method of the above embodiments, Figure 5 A structure block diagram of an API interface vulnerability analysis apparatus provided by an embodiment of the present application is shown, and only parts related to the embodiments of the present application are shown for ease of illustration.

[0124] Referring to Figure 5 The API interface vulnerability analysis apparatus includes:

[0125] A compiling unit acquires at least one application installation package and determines an application corresponding to each application installation package;

[0126] The static analysis unit performs static analysis on the application program to obtain a plurality of running components corresponding to the application program;

[0127] The dynamic analysis unit drives the application program after the web hook is started. For each application program, a web proxy setting and a digital root certificate installation are performed in the web page. Log files generated by a plurality of running components of each application program are obtained through the web page. And vulnerability information of an API interface corresponding to the application program is determined according to the log files.

[0128] It should be noted that the information interaction, execution process and the like between the above devices / units, since the same concept as the method embodiments of the present application, the specific functions and the technical effects brought about, specific can be seen from the method embodiments, this will not be repeated here.

[0129] Optionally, the API interface vulnerability analysis device further comprises a system storage unit:

[0130] The system storage unit realizes permanent storage of the application risk list and the vulnerability list by recording the results of static and dynamic analysis.

[0131] Optionally, the API interface vulnerability analysis device further comprises a MySQL module, and the output application risk and vulnerability list information is associated with the identification of each fuzzy test and stored in the MySQL module of the system.

[0132] Optionally, the API interface vulnerability analysis device further comprises a web front-end display unit, and the complete risk and vulnerability list is displayed on the web by reading the records of the storage module.

[0133] The web front-end uses Vue technology, calls the API interface of the system, reads the risk and vulnerability data stored in the MySQL module, and finally realizes the display of these data on the web page.

[0134] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or software. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the unit and module in the above system can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

[0135] The embodiment of the present application further provides a storage medium, which stores a computer program. The computer program is executed by a processor to realize the steps in each method embodiment.

[0136] The embodiment of the present application provides a computer program product. When the computer program product is run on a mobile terminal, the mobile terminal is caused to execute the steps in each method embodiment.

[0137] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the embodiment of the present application realizes all or part of the processes in the above-mentioned method, which can be completed by a computer program instructing related hardware. The computer program can be stored in a storage medium. The computer program, when executed by a processor, can realize the steps in each method embodiment. The computer program includes computer program code, which can be in the form of source code, object code, executable files or some intermediate forms, etc. The computer-readable medium at least includes any entity or device capable of carrying the computer program code to the photographing device / terminal equipment, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium. For example, U disk, mobile hard disk, magnetic disk or optical disk, etc. In some jurisdictions, according to legislation and patent practice, the computer-readable medium cannot be an electrical carrier signal and a telecommunication signal.

[0138] In the above embodiments, the description of each embodiment focuses on different aspects, and the parts not described or recorded in a certain embodiment can be referred to the relevant description of other embodiments.

[0139] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0140] In the embodiments provided in the present application, it should be understood that the disclosed apparatus / network device and method can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely schematic, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0141] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0142] The above described embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. An API interface vulnerability analysis method, characterized by, The application comprises the following steps: Obtaining at least one application installation package; Determining the application corresponding to each application installation package; Performing static analysis on the application to obtain a plurality of running components corresponding to the application; Driving the application started by the webpage to hook; For each application, performing Web proxy setting and digital root certificate installation in the webpage; Obtaining the log files generated by a plurality of running components of each application through the webpage, and determining the vulnerability information of the API interface corresponding to the application according to the log files; Wherein, The step of performing static analysis on the application to obtain a plurality of running components corresponding to the application comprises: Determining the code of each application through each application installation package; Running the code of each application in a static analysis tool to determine a plurality of running components corresponding to each application; The step of obtaining the log files generated by a plurality of running components of each application through the webpage to determine the vulnerability information of each API interface comprises: Obtaining the log files generated by the running of the running components through the webpage, and realizing the automatic running of the running components of the application through the adb am start command; Performing dynamic analysis on the log files to obtain a Web API list in a preset format, analyzing the website traffic information and log information hooked through a regular expression, and realizing dynamic statistics of the Web API list of application requests, wherein the system matches the website traffic information and log information log content through a URL regular matching expression to realize statistics of the list of Web APIs, and stores the Web API list in a CSV file; Performing automatic fuzzing detection on the Web API list to obtain Web scenario vulnerabilities, taking a dynamic analysis unit as an API Fuzzer, and taking the Web API list as a vulnerability mining target, in each fuzzing process, randomizing and mutating the input parameter values in the target API of the current fuzzing to initiate an HTTP request, and judging whether the current fuzzing causes server exception by detecting whether the HTTP response status code is abnormal, to realize automatic discovery of Web scenario vulnerabilities; The step of driving the application started by the webpage to hook comprises: Building a detection service framework in an Android emulator; The detection service framework detects the Android emulator and automatically connects to the Android virtual environment software; The detection service framework injects a webpage process into the Android emulator; Starting the application to be detected; Forcibly starting the webpage and hooking to the currently started application.

2. The API interface vulnerability analysis method of claim 1, wherein, The step of determining the application corresponding to each application installation package comprises: Decompressing and / or decompiling each application installation package to obtain each application and a plurality of directory files of each application.

3. The API interface vulnerability analysis method of claim 2, wherein, The plurality of catalog files include a program global configuration file, a bytecode file, a binary resource file, signature information, a resource file, and other configuration files.

4. An API interface vulnerability analysis apparatus of claim 1, wherein The method comprises: a compiling unit, which acquires at least one application installation package and determines an application corresponding to each application installation package; a static analysis unit, which determines the code of each application through each application installation package; running the code of each application in a static analysis tool to determine a plurality of running components corresponding to each application; a dynamic analysis unit, which builds a detection service framework in an Android emulator, detects the Android emulator through the detection service framework, and automatically connects to an Android virtual environment software, starts the application to be detected, forcibly starts a webpage, and hooks to the currently started application when injecting the webpage process into the Android emulator; for each application, performing Web proxy setting and digital root certificate installation in the webpage, acquiring a log file generated by a plurality of running components of each application through the webpage, automatically running the running components of the application through an adb am start command, and then performing dynamic analysis according to the log file to obtain a Web API list in a preset format, analyzing website traffic information and log information hooked down through a regular expression, matching the website traffic information and the log information log content through a URL regular matching expression, dynamically counting the Web API list of application requests, and storing the Web API list in a CSV file; performing automatic fuzzing detection on the Web API list, taking the dynamic analysis unit as an API Fuzzer, taking the Web API list as a vulnerability mining target, randomly mutating the input parameter values in the target API in each fuzzing process after initiating an http request, judging whether the current fuzzing causes server exception by detecting whether the http response status code is abnormal, automatically discovering Web scene vulnerabilities, and determining vulnerability information of an API interface corresponding to the application.

5. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the API interface vulnerability analysis method of any one of claims 1 to 3.

6. A storage medium storing a computer program, characterized by The computer program is executed by the processor to implement the API interface vulnerability analysis method of any one of claims 1 to 3.

Images