Vulnerability detection methods, devices and storage media

Abstract

The present disclosure provides a vulnerability detection method, device and storage medium, which relate to the field of network security technology. The vulnerability detection method disclosed in the present disclosure includes: determining a potential vulnerability location in a target page; screening a target injection location according to the potential vulnerability location; injecting attack data into the target injection location, so as to determine the vulnerability in the target page according to the attack result. By using such a method, the efficiency of XSS vulnerability detection can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a vulnerability detection method, device and storage medium. Background Art

[0002] With the development of the Internet, application systems based on the Web (World Wide Web) have been widely used. While providing us with great convenience, they also face huge security challenges. Among the Web security risks, the principle of XSS (CrossSite Scripting) is that attackers insert malicious script codes into Web pages. When users browse these web pages, the embedded malicious script codes will be executed, thereby achieving the purpose of attacking users.

[0003] XSS is highly concealed, has a low attack cost, and has a strong ability to spread. This vulnerability can be exploited to steal user cookies (data stored on the user's local terminal), hijack sessions, conduct phishing, etc., which is very harmful. Summary of the invention

[0004] One purpose of the present disclosure is to improve the efficiency of XSS vulnerability detection.

[0005] According to one aspect of some embodiments of the present disclosure, a vulnerability detection method is proposed, including: determining potential vulnerabilities in a target page; screening target injection locations based on potential vulnerabilities; and injecting attack data into the target injection locations to determine the vulnerabilities in the target page based on the attack results.

[0006] In some embodiments, the method further includes: after determining the target injection location, determining corresponding attack data according to the context of the target injection location.

[0007] In some embodiments, the method further includes: generating update data according to the response of the target web page to the attack data; and injecting the update data into the target injection location so as to determine the vulnerability in the target page according to the attack result of the update data.

[0008] In some embodiments, determining a potential vulnerability in a target page includes: obtaining each URL (Uniform Resource Locator) in the target page, and generating a potential vulnerability URL set.

[0009] In some embodiments, screening target injection locations according to potential vulnerabilities includes: inputting detection data for each input point of the URL; and determining that the corresponding input point belongs to the target injection location when the detection data appears in the target page.

[0010] In some embodiments, inputting detection data for each input point of a URL includes: for each input point of each URL in the set of potential vulnerability URLs, randomly generating a character string and inputting the corresponding input point.

[0011] In some embodiments, obtaining each URL in the target page includes at least one of the following: scanning the target page through a web crawler to obtain a static URL; or extracting the JavaScript script of the page and the events added through JavaScript, and compiling and executing using a JavaScript engine to obtain a dynamic URL.

[0012] In some embodiments, determining corresponding attack data according to the context of the target injection location includes: generating corresponding attack data according to at least one of a context code structure or content of the target injection location.

[0013] In some embodiments, generating update data according to the target webpage's response to the attack data includes: obtaining the target webpage's response to the attack data; and performing a predetermined mutation process on the attack data according to the response to obtain update data.

[0014] In some embodiments, the predetermined mutation process includes at least one of encoding the attack data, converting uppercase and lowercase letters, inserting predetermined symbols, or regenerating the attack vector.

[0015] In some embodiments, the method further includes: if the attack result is that the attack is successful, determining that a vulnerability exists at the corresponding attack location.

[0016] According to one aspect of some embodiments of the present disclosure, a vulnerability detection device is proposed, including: a potential vulnerability determination unit, configured to determine potential vulnerabilities in a target page; an injection position screening unit, configured to screen target injection positions according to potential vulnerabilities; and an attack unit, configured to inject attack data into the target injection position, so as to determine the vulnerability in the target page according to the attack result.

[0017] In some embodiments, the apparatus further includes: an attack data determination unit configured to determine corresponding attack data according to a context of the target injection position after determining the target injection position.

[0018] In some embodiments, the device also includes: an update data generation unit configured to generate update data based on the target web page's response to the attack data; and an attack unit configured to inject the update data into the target injection location so as to determine the vulnerability in the target page based on the attack result of the update data.

[0019] In some embodiments, the device further includes: a vulnerability detection unit configured to determine that a vulnerability exists at a corresponding attack location when the attack result is that the attack is successful.

[0020] According to one aspect of some embodiments of the present disclosure, a vulnerability detection device is proposed, including: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the above vulnerability detection methods based on instructions stored in the memory.

[0021] According to one aspect of some embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the steps of any one of the vulnerability detection methods described above are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0023] Figure 1 The following is a flowchart of some embodiments of the vulnerability detection method disclosed in the present invention.

[0024] Figure 2 Flowcharts of other embodiments of the vulnerability detection method disclosed herein.

[0025] Figure 3 Flowcharts of some further embodiments of the vulnerability detection method disclosed herein.

[0026] Figure 4 Schematic diagrams of some embodiments of the vulnerability detection device disclosed herein.

[0027] Figure 5 Schematic diagrams of other embodiments of the vulnerability detection device disclosed in the present invention.

[0028] Figure 6 Schematic diagrams of some further embodiments of the vulnerability detection device disclosed herein. DETAILED DESCRIPTION

[0029] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments.

[0030] The inventors found that the method of dynamically detecting XSS vulnerabilities in the related art has a large redundancy of attack vectors, a large number of invalid detections, and a lack of efficiency; more information needs to be collected to establish a data set, and the detection effect is relatively dependent on the quality of the training data set, and the detection quality is unstable.

[0031] The flowcharts of some embodiments of the vulnerability detection method disclosed in the present invention are as follows: Figure 1 shown.

[0032] In step 120, a vulnerability detection device is executed to determine potential vulnerabilities in the target page. In some embodiments, the vulnerability detection device may be a device that executes a computer program.

[0033] In some embodiments, each URL in the target page may be obtained to generate a potential vulnerability URL set as a potential vulnerability that needs to be processed later.

[0034] In some embodiments, a crawler may be used to scan a page, or a URL in a page may be extracted through script or event analysis.

[0035] In step 140, the target injection position of the attack data in the subsequent detection is screened according to the potential vulnerability. In some embodiments, the target injection position belongs to the position of the input point in each potential vulnerability, and the input point includes the input position of the parameter, form, etc. In some embodiments, each potential vulnerability URL may have multiple vulnerabilities. By further disassembling and analyzing the potential vulnerability, multiple target injection positions are obtained, thereby improving reliability. In some embodiments, each input point in the potential vulnerability URL is extracted as a screening space for the target injection position.

[0036] In some embodiments, some potential vulnerability URLs may not have input points that can affect the target page, or not every input point can affect the target page. By disassembling and analyzing the potential vulnerabilities, it is possible to obtain multiple feasible input points of attack data, and then screen them, exclude input points that do not affect the target page, and obtain the target injection position, thereby reducing the subsequent workload and improving detection efficiency. In some embodiments, detection data can be generated for each input point, and the detection data can be input into the corresponding input point to detect whether the input detection data appears in the target page. If the input detection data appears, the input point belongs to the target injection position; otherwise, the input point is excluded. In some embodiments, the detection data can be a randomly generated string, and whether the input detection data appears in the target page is determined by detecting whether the corresponding string appears in the target page, thereby improving the accuracy of input point screening and reducing the probability of screening errors.

[0037] In some embodiments, the above detection can be performed on each input point in the potential vulnerability URL set to screen out the input points that are the target injection locations, and then perform subsequent operations to reduce the number of business types that are processed in parallel and reduce processing pressure.

[0038] In other embodiments, after each target injection position is determined, subsequent operations may be performed for the target injection position. Subsequent operations for the current target injection position may be performed in parallel with operations for screening other target injection positions. By using such a method, vulnerabilities can be detected as early as possible, which facilitates subsequent security protection operations for the vulnerabilities and improves the security of the target page.

[0039] In step 160, attack data is injected into the target injection position so as to determine the vulnerability in the target page according to the attack result. In some embodiments, any XSS attack method in the related art can be used to insert the attack data into the target injection position.

[0040] In some embodiments, if the attack result is a successful attack, it is determined that a vulnerability exists in the corresponding attack location. In some embodiments, corresponding vulnerability elimination operations can be performed for the determined vulnerability, such as modifying the page code or upgrading the security protection device. In some embodiments, after the attack data is injected, the response of the page can be obtained, and the page response can be parsed based on one or more parsers in the related technology to determine whether the attack is successful.

[0041] Based on the method in the above embodiment, the target page can be preprocessed to reduce the processing pressure caused by large detection redundancy, reduce the amount of worthless vulnerability detection, and improve the efficiency of vulnerability detection.

[0042] Flowcharts of other embodiments of the vulnerability detection method disclosed herein are as follows: Figure 2 shown.

[0043] In step 220, potential vulnerabilities in the target page are determined. In some embodiments, the potential vulnerabilities include at least one of a static URL and a dynamic URL. In some embodiments, the target page can be scanned by a web crawler to obtain a static URL. In some embodiments, the JavaScript script of the page and the events added by JavaScript are extracted, and the JavaScript engine is used to compile and execute to obtain a dynamic URL.

[0044] In some embodiments, static URLs and dynamic URLs may be aggregated to generate a potential vulnerability URL set, and then each URL in the potential vulnerability URL set may be processed in subsequent steps.

[0045] In step 240, the target injection location is screened according to the potential vulnerability. In some embodiments, the target injection location can be screened in the manner described in any of the embodiments in step 140 above.

[0046] In step 250, after the target injection position is determined, the corresponding attack data is determined according to the context of the target injection position, so that the attack data is more targeted to the target injection position, thereby improving the attack capability and attack efficiency.

[0047] In some embodiments, corresponding attack data may be generated according to at least one of the context code structure or content of the target injection location.

[0048] In some embodiments, multiple XSS attack data can be preset, and associations can be established with one or more types of injection point context characteristics. When determining the corresponding attack data based on the context of the target injection position, the corresponding attack data can be determined by matching the characteristics of the context of the target injection position with the pre-stored information. Through such a method, the efficiency of generating attack data can be improved. In some embodiments, when the match is unsuccessful, attack data can be generated in real time based on the context of the target injection position, such as manually generated or generated through a pre-trained machine learning algorithm, so as to ensure that corresponding attack data is generated for each target injection position, thereby improving the comprehensiveness of vulnerability detection.

[0049] In step 260, the attack data is injected into the target injection position so as to determine the vulnerability in the target page according to the attack result. If the attack result is that the attack is successful, it is determined that the corresponding attack position has a vulnerability.

[0050] Through this method, targeted attack data can be generated for each target injection location, increasing the probability of successful attack, thereby further reducing the proportion of invalid detections and improving vulnerability detection rate and efficiency.

[0051] In some embodiments, if the attack result is that the attack is unsuccessful, it can be considered that the current target injection position has no vulnerability. In other embodiments, steps 270-280 can be further performed.

[0052] In step 270, update data is generated according to the response of the target webpage to the attack data. In some embodiments, step 270 may be performed only for target injection positions that failed to be attacked, thereby reducing the amount of detection calculations. In other embodiments, step 270 may be performed for all target injection positions, thereby facilitating obtaining more characteristic information for the discovered vulnerabilities and providing more data support for subsequent security upgrades.

[0053] In some embodiments, the response of the target webpage to the attack data can be obtained first, and then the attack data can be subjected to a predetermined mutation process according to the response to obtain the updated data. In some embodiments, the predetermined mutation process includes at least one of encoding the attack data, converting the uppercase and lowercase characters, inserting predetermined symbols, or regenerating the attack vector. Through such a method, the attack data can be updated by compiling and processing based on the existing attack data, thereby reducing the amount of computation required to generate the attack data; the probability of bypassing the security protection strategy of the target webpage can be increased through mutation processing, thereby increasing the detection rate of vulnerabilities.

[0054] In step 280, the update data is injected into the target injection position so as to determine the vulnerability existing in the target page according to the attack result of the update data. If the attack result is a successful attack, it is determined that the corresponding attack position has a vulnerability. In some embodiments, if the attack result is a failed attack, it can be determined that the corresponding target injection position has no vulnerability. In other embodiments, the attack data can also be further mutated as needed and injected into the target injection position again to further improve the detection rate of the vulnerability.

[0055] Based on the method in the above embodiment, the target injection position can be further detected by means of a secondary attack so as to bypass the protection mechanism and improve the detection rate of vulnerabilities, thereby providing more data support for the security upgrade of the target page.

[0056] Flowcharts of some other embodiments of the vulnerability detection method disclosed herein are as follows: Figure 3 shown.

[0057] In step 320, each URL in the target page is obtained to generate a potential vulnerability URL set. In some embodiments, a web crawler is used to scan the target page, and JavaScript scripts and events added by JavaScript in the page are extracted, and the extracted scripts and events are parsed to obtain a dynamic URL. Static and dynamic URLs are combined to generate a potential vulnerability URL set. In some embodiments, the obtained potential vulnerability URL set can be stored in a hash table for further processing.

[0058] In some embodiments, the potential vulnerability URL set can be further screened to determine whether each URL in the potential vulnerability URL set has an HTML (Hyper Text Markup Language) request, and URLs without HTML requests are excluded, so that the potential vulnerability URL set only includes URLs with HTML requests as the address space to be processed in subsequent steps, thereby further reducing invalid operations in subsequent processing and improving detection efficiency.

[0059] For each input point of each URL in the potential vulnerability URL set, the operations in steps 341 to 344 are performed.

[0060] In step 341, for each input point of each URL, a random string is generated and input into the corresponding input point. In some embodiments, for each URL in the potential vulnerability URL set, a random string is used to perform injection detection on the input points such as parameters and forms therein, and further in step 342, it is determined whether the corresponding random string appears in the response content of the page.

[0061] In step 342 , if the corresponding random string appears in the response content of the page, execute step 343 ; otherwise, execute step 344 .

[0062] In step 343, it is determined that the corresponding input point belongs to the target injection position, and the operation in step 350 is performed on the input point.

[0063] In step 344, the corresponding input point is excluded, and the operation in step 350 is not performed on the input point.

[0064] In step 350, corresponding attack data is generated according to at least one of the context code structure or content of the target injection location. In some embodiments, by parsing the HTML structure of the page, extracting the smallest object at the location of the input point, detecting the relative position of the content, the context code structure, applying the filtering mechanism, etc., attack data that can bypass the filtering mechanism is generated. In some embodiments, the attack data can be an access request that is offensive to the target page.

[0065] In step 360, the attack data is injected into the target injection location. In some embodiments, a browser may be used to submit an access request that carries the attack data and is offensive to the target page, and then determine whether a vulnerability is detected from the content returned by the page. In some embodiments, determining whether a vulnerability is detected may be performed using any method in the relevant technology.

[0066] Based on the method in the embodiment shown above, the attack position can be screened before the attack, the number of invalid attacks can be reduced, and the attack efficiency can be improved; targeted attack data can be generated, the adaptive adjustment capability of the attack position can be improved, and the detection rate and efficiency of the vulnerability can be improved.

[0067] In some embodiments, Figure 3 As shown, the vulnerability detection method of the present disclosure may further include steps 371-380.

[0068] In step 371, a response of the target webpage to the attack data is obtained. In some embodiments, the response of the target webpage to the attack data may be page response content.

[0069] In step 372, a predetermined mutation process is performed on the attack data according to the response to obtain updated data. In some embodiments, the protection filtering rules are analyzed according to the response, and then the attack data is subjected to mutation process in a targeted manner. In some embodiments, the predetermined mutation process may include character encoding, case conversion, null bytes, keyword deformation, etc., and one or more of the predetermined mutation processes may be selected to process the attack data. In some embodiments, the mutation process may also be randomly selected.

[0070] In step 380, the update data is injected into the target injection position so as to determine the vulnerability existing in the target page according to the attack result of the update data. If the attack result is a successful attack, it is determined that the corresponding attack position has a vulnerability. In some embodiments, if the attack result is a failed attack, it can be determined that the corresponding target injection position has no vulnerability. In other embodiments, the attack data can also be further mutated as needed and injected into the target injection position again to further improve the detection rate of the vulnerability.

[0071] Through this method, we can try to bypass application filtering mechanisms and website protection software, increase the detection rate of vulnerabilities, and thus carry out targeted protection upgrades to improve the security of the target page.

[0072] Schematic diagrams of some embodiments of the vulnerability detection device 40 of the present disclosure are as follows Figure 4 shown.

[0073] The potential vulnerability determination unit 41 can determine the potential vulnerability in the target page. In some embodiments, each URL in the target page can be obtained to generate a potential vulnerability URL set as a potential vulnerability to be processed later. In some embodiments, a crawler can be used to scan the page, or the URL in the page can be extracted by script or event analysis.

[0074] The injection position determination unit 42 can filter the target injection position according to the potential vulnerability. In some embodiments, the target injection position belongs to the position of the input point in each potential vulnerability, and the input point includes input positions such as parameters and forms. In some embodiments, each potential vulnerability URL may have multiple vulnerabilities. By further disassembling and analyzing the potential vulnerabilities, multiple target injection positions are obtained, thereby improving reliability. In some embodiments, each input point in the potential vulnerability URL is extracted as a screening space for the target injection position. In some embodiments, some potential vulnerability URLs may not have input points that can affect the target page, or not every input point can affect the target page. By disassembling and analyzing the potential vulnerabilities, multiple feasible input points of the attack data can be obtained, and then screened to exclude input points that do not affect the target page, and obtain the target injection position, thereby reducing the subsequent workload and improving detection efficiency.

[0075] The attack unit 43 can inject attack data into the target injection position so as to determine the vulnerability existing in the target page according to the attack result.

[0076] Such a device can pre-process the target page, reduce the processing pressure caused by large detection redundancy, reduce the amount of worthless attacks, and improve vulnerability detection efficiency.

[0077] In some embodiments, Figure 4 As shown, the vulnerability detection device may further include an attack data determination unit 44, which can determine corresponding attack data according to the context of the target injection position after determining the target injection position, so that the attack data is more targeted to the target injection position, thereby improving the attack capability and attack efficiency.

[0078] In some embodiments, corresponding attack data can be generated according to at least one of the context code structure or content of the target injection position. In some embodiments, multiple XSS attack data can be preset, and association relationships can be established with one or more types of injection point context characteristics. When determining the corresponding attack data according to the context of the target injection position, the corresponding attack data can be determined by matching the characteristics of the context of the target injection position with pre-stored information. Through such a method, the efficiency of generating attack data can be improved. In some embodiments, when the match is unsuccessful, attack data can be generated in real time according to the context of the target injection position, such as manually generated or generated by a pre-trained machine learning algorithm, so as to ensure that corresponding attack data is generated for each target injection position, thereby improving the comprehensiveness of vulnerability detection.

[0079] Such a device can generate targeted attack data for each target injection location, increasing the probability of a successful attack, thereby further reducing the proportion of invalid detections and improving vulnerability detection rates and efficiency.

[0080] In some embodiments, Figure 4 As shown, the vulnerability detection device may further include an update data generation unit 45 capable of generating update data according to the response of the target webpage to the attack data. In some embodiments, the response of the target webpage to the attack data may be obtained first, and then a predetermined mutation process may be performed on the attack data according to the response to obtain the update data. In some embodiments, the predetermined mutation process includes at least one of encoding the attack data, converting the uppercase and lowercase characters, inserting predetermined symbols, or regenerating the attack vector.

[0081] The attack unit 43 can inject update data into the target injection position, so as to determine the vulnerability existing in the target page according to the attack result of the update data.

[0082] Such a device can further attack the target injection location through secondary vulnerability detection in order to bypass the protection mechanism and improve the vulnerability detection rate, thereby providing more data support for the security upgrade of the target page.

[0083] In some embodiments, Figure 4 As shown, the vulnerability detection device may also include a vulnerability detection unit 46, which can determine that a vulnerability exists at the corresponding attack position when the attack result is a successful attack. In some embodiments, the vulnerability detection unit 46 can obtain a response to the page, parse the page response based on one or more parsers in the relevant technology, and determine whether the attack is successful. In some embodiments, when the attack fails, the vulnerability detection unit 46 can determine that no vulnerability is detected at the corresponding position, or trigger the update data generation unit 45 to generate data required for a secondary attack. In some embodiments, the vulnerability detection unit 46 can also perform vulnerability feature analysis based on the obtained page response and the adopted attack data, and provide more comprehensive information for subsequent vulnerability elimination, so as to perform targeted repairs and improve repair efficiency.

[0084] Based on the method in the above embodiment, it is possible to determine whether a vulnerability exists according to the response of the page, and trigger a secondary attack in time or output the result of undetected vulnerability if the vulnerability cannot be detected, thereby improving the integrity of vulnerability detection and providing a data basis for subsequent vulnerability elimination.

[0085] A schematic diagram of the structure of an embodiment of the vulnerability detection device disclosed in the present invention is as follows Figure 5As shown. The vulnerability detection device includes a memory 501 and a processor 502. Wherein: the memory 501 can be a disk, a flash memory or any other non-volatile storage medium. The memory is used to store the instructions in the corresponding embodiment of the vulnerability detection method above. The processor 502 is coupled to the memory 501 and can be implemented as one or more integrated circuits, such as a microprocessor or a microcontroller. The processor 502 is used to execute the instructions stored in the memory, which can improve the efficiency of vulnerability detection.

[0086] In one embodiment, it is also possible to Figure 6 As shown, the vulnerability detection device 600 includes a memory 601 and a processor 602. The processor 602 is coupled to the memory 601 via a BUS bus 603. The vulnerability detection device 600 can also be connected to an external storage device 605 via a storage interface 604 to call external data, and can also be connected to a network or another computer system (not shown) via a network interface 606. No further detailed description will be given here.

[0087] In this embodiment, the efficiency of vulnerability detection can be improved by storing data instructions in a memory and processing the instructions through a processor.

[0088] In another embodiment, a computer-readable storage medium stores thereon computer program instructions, which, when executed by a processor, implement the steps of the method in the corresponding embodiment of the vulnerability detection method. It should be understood by those skilled in the art that the embodiments of the present disclosure may be provided as methods, devices, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0092] So far, the present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0093] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present disclosure rather than to limit it. Although the present disclosure has been described in detail with reference to the preferred embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present disclosure can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present disclosure, which should be included in the scope of the technical solution for protection of the present disclosure.

Claims

1. A vulnerability detection method, comprising: Identify potential vulnerabilities in the target page; The target injection position screened according to the potential vulnerability includes: inputting detection data for each input point of the uniform resource locator URL of the target page, the input point including a parameter input position and a form input position; when the detection data appears in the target page, determining that the corresponding input point belongs to the target injection position; Determining corresponding attack data according to the context of the target injection position, including: matching the characteristics of the context of the target injection position with pre-stored information to determine the corresponding attack data, and when the match is unsuccessful, generating attack data in real time according to the context of the target injection position through a pre-trained machine learning algorithm, wherein the pre-stored information includes a correlation relationship between multiple cross-site scripting attack XSS attack data and one or more types of injection point context characteristics; and Attack data is injected into the target injection position so as to determine the vulnerability existing in the target page according to the attack result.

2. The method according to claim 1, further comprising: generating update data according to a response of the target webpage to the attack data; and The update data is injected into the target injection position, so as to determine the vulnerability existing in the target page according to the attack result of the update data.

3. The method according to claim 1, wherein: Determining the potential vulnerability in the target page includes: acquiring each uniform resource locator URL in the target page, and generating a potential vulnerability URL set.

4. The method according to claim 3, wherein: Inputting detection data for each input point of the URL includes: randomly generating a character string for each input point of each URL in the potential vulnerability URL set, and inputting the corresponding input point.

5. The method according to claim 3, wherein: The step of obtaining each URL in the target page includes at least one of the following: Scan the target page through a web crawler to obtain a static URL; or Extract the JavaScript scripts of the page and the events added by JavaScript, compile and execute them using the JavaScript engine, and obtain the dynamic URL.

6. The method according to claim 1, wherein: The determining corresponding attack data according to the context of the target injection position includes: Corresponding attack data is generated according to at least one of the context code structure or content of the target injection position.

7. The method according to claim 2, wherein: The generating of update data according to the response of the target webpage to the attack data comprises: Obtaining a response of the target webpage to the attack data; and A predetermined mutation process is performed on the attack data according to the response to obtain the update data.

8. The method according to claim 7, wherein: The predetermined variation processing includes at least one of encoding the attack data, converting uppercase and lowercase letters, inserting predetermined symbols, or regenerating an attack vector.

9. The method according to claim 1, further comprising: If the attack result is that the attack is successful, it is determined that a vulnerability exists at the corresponding attack location.

10. A vulnerability detection device, comprising: a potential vulnerability determination unit configured to determine a potential vulnerability in a target page; The injection position screening unit is configured to screen the target injection position according to the potential vulnerability, including: inputting detection data for each input point of the uniform resource locator URL of the target page, the input point including a parameter input position and a form input position; when the detection data appears in the target page, determining that the corresponding input point belongs to the target injection position; an attack data determination unit, configured to determine corresponding attack data according to the context of the target injection position, including: matching the characteristics of the context of the target injection position with pre-stored information to determine the corresponding attack data, and when the match is unsuccessful, generating attack data in real time according to the context of the target injection position through a pre-trained machine learning algorithm, wherein the pre-stored information includes associations between multiple XSS attack data and one or more types of injection point context characteristics; and The attack unit is configured to inject attack data into the target injection position so as to determine the vulnerability existing in the target page according to the attack result.

11. The apparatus according to claim 10, further comprising: an update data generating unit, configured to generate update data according to a response of the target webpage to the attack data; The attack unit is configured to inject the update data into the target injection position, so as to determine the vulnerability existing in the target page according to the attack result of the update data.

12. The apparatus according to claim 10, further comprising: The vulnerability detection unit is configured to determine that a vulnerability exists at the corresponding attack position when the attack result is a successful attack.

13. A vulnerability detection device, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method according to any one of claims 1 to 9 based on instructions stored in the memory.

14. A non-transitory computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 9.

Images