Application credential storage vulnerability detection method and device

Abstract

The present invention provides a method and device for detecting application credential storage vulnerabilities, wherein the method includes: comparing memory snapshots before and after a login operation to determine differential data between the post-login memory snapshot and the pre-login memory snapshot, wherein the login operation refers to logging into a target application using preset credentials; processing the preset credentials separately according to multiple processing modes formed by a combination of known encryption storage mechanisms to obtain multiple credential processing results corresponding to the multiple processing modes; matching the data segments corresponding to each credential processing result with the data segments corresponding to the differential data one by one, and outputting the storage vulnerability detection results of the target application based on the matching results, wherein each data segment corresponds to a storage location. This solution can detect application credential storage vulnerabilities.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of detection technology, and in particular to a method and device for detecting application credential storage vulnerabilities. Background Art

[0002] Currently, vulnerability detection for application credentials primarily focuses on checking for credential length and complexity. Fragile credential storage mechanisms can also pose security issues. However, there is currently no method for detecting application credential storage vulnerabilities. Summary of the Invention

[0003] The embodiments of the present invention provide a method and device for detecting application credential storage vulnerabilities, which can detect application credential storage vulnerabilities.

[0004] In a first aspect, an embodiment of the present invention provides a method for detecting application credential storage vulnerabilities, comprising:

[0005] Comparing memory snapshots before and after a login operation is performed to determine difference data between the memory snapshot after the login and the memory snapshot before the login, wherein the login operation refers to logging into the target application using preset credentials;

[0006] Processing the preset credentials respectively according to multiple processing modes formed by combining known encryption storage mechanisms to obtain multiple credential processing results corresponding to the multiple processing modes;

[0007] The data segments corresponding to the credential processing results are matched one by one with the data segments corresponding to the difference data, and the storage vulnerability detection results of the target application are output according to the matching results, wherein each data segment corresponds to a storage location.

[0008] In a possible implementation, the known encryption storage mechanism included in each of the processing modes includes at least one of a compression method, an encoding method, and an encryption algorithm.

[0009] In a possible implementation, before matching the data segments corresponding to the credential processing results with the data segments corresponding to the difference data one by one, the method further includes:

[0010] If the differential data corresponds to multiple differential data segments, the information entropy of each differential data segment is calculated separately, and the differential data segments greater than the preset entropy value are screened as the differential data segments at the estimated storage location of the preset voucher, and the screened differential data segments are used as the data segments corresponding to the differential data and matched with the data segments corresponding to each voucher processing result.

[0011] In a possible implementation, matching the data segments corresponding to the credential processing results with the data segments corresponding to the difference data one by one includes:

[0012] For each voucher processing result, the following steps are performed: determining the voucher data segment corresponding to the voucher processing result, and determining the difference data segment corresponding to the difference data; matching the voucher data segment with each difference data segment one by one, and determining whether the voucher processing result is matched in the difference data based on the matching result.

[0013] In a possible implementation, before outputting the storage vulnerability detection result of the target application according to the matching result, the method further includes:

[0014] Restarting the target application and performing the memory snapshot comparison and data segment matching steps again;

[0015] Compare the result obtained after the re-execution with the result obtained before the restart, combine the comparison result with the matching result, and output the storage vulnerability detection result of the target application.

[0016] In one possible implementation, comparing the result obtained after the re-execution with the result obtained before the restart includes:

[0017] Comparing the difference data obtained again with the difference data obtained before the restart to see if they are the same, to obtain a first comparison result;

[0018] and / or,

[0019] If the matching result obtained by the data segment matching step executed again and the matching result obtained by the data segment matching step executed before restart both match the credential processing result, then compare whether the matched credential processing results in the two matching results correspond to the same storage address to obtain a second comparison result.

[0020] In a possible implementation, whether the difference data obtained again is the same as the difference data obtained before the restart includes: whether the data content is the same and / or whether the storage address is the same.

[0021] In a second aspect, an embodiment of the present invention further provides an application credential storage vulnerability detection device, comprising:

[0022] a comparison and determination unit, configured to compare memory snapshots before and after a login operation is performed to determine difference data between the memory snapshot after login and the memory snapshot before login, wherein the login operation refers to logging into a target application using preset credentials;

[0023] a processing unit, configured to process the preset credentials respectively according to a plurality of processing modes formed by combining known encryption storage mechanisms, and obtain a plurality of credential processing results corresponding to the plurality of processing modes;

[0024] A matching detection unit is used to match the data segments corresponding to each credential processing result with the data segments corresponding to the difference data one by one, and output the storage vulnerability detection result of the target application according to the matching result, wherein each data segment corresponds to a storage location.

[0025] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0026] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in any embodiment of this specification.

[0027] An embodiment of the present invention provides a method and device for detecting application credential storage vulnerabilities. By comparing memory snapshots before and after a login operation, differential data of the memory snapshot after login relative to the memory snapshot before login can be determined, wherein the differential data includes credentials called and stored in the memory by the target application during the credential verification process. Multiple processing modes formed by combining known encryption storage mechanisms are used to process the preset credentials of the target application for logging in, and the data segments corresponding to the processing results of each credential are matched one by one with the data segments corresponding to the differential data, so as to detect whether the storage address of the credential can be accurately located, and then the vulnerability of the target application in storing the credential can be determined. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] Figure 1 This is a flow chart of a method for detecting application credential storage vulnerabilities provided by one embodiment of the present invention;

[0030] Figure 2 This is a hardware architecture diagram of an electronic device provided by one embodiment of the present invention;

[0031] Figure 3This is a structural diagram of an application credential storage vulnerability detection device provided by an embodiment of the present invention;

[0032] Figure 4 This is a structural diagram of another application credential storage vulnerability detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0034] Application credentials are typically stored in a database. When a user logs in to an application using their credentials, the application extracts the credentials from the database, encrypts them, and stores them in memory for comparison with the credentials entered during login. However, if the credential storage mechanism in memory is fragile—for example, if the storage location is the same each time, or the encryption method is simple—they can still be compromised by attackers, compromising the security of the credentials.

[0035] Based on the above problems, it is necessary to provide a method for detecting application credential storage vulnerabilities. The inventive concept of the present invention is to use registered credentials to log in to the application, and compare snapshots of the memory space before and after login to determine the difference data between the memory space before and after login. Whether the credentials can be detected in the difference data can be used to determine whether the credential storage mechanism is vulnerable.

[0036] The specific implementation of the above concept is described below.

[0037] Please refer to Figure 1 An embodiment of the present invention provides a method for detecting application credential storage vulnerabilities, the method comprising:

[0038] Step 100, comparing memory snapshots before and after a login operation is performed to determine difference data between the memory snapshot after login and the memory snapshot before login, wherein the login operation refers to logging into a target application using preset credentials;

[0039] Step 102: Process the preset credentials respectively according to multiple processing modes formed by combining known encryption storage mechanisms to obtain multiple credential processing results corresponding to the multiple processing modes;

[0040] Step 104 , matching the data segments corresponding to the credential processing results with the data segments corresponding to the difference data one by one, and outputting the storage vulnerability detection result of the target application according to the matching result, wherein each data segment corresponds to a storage location.

[0041] In an embodiment of the present invention, by comparing the memory snapshots before and after the login operation, the difference data of the memory snapshot after login relative to the memory snapshot before login can be determined, wherein the difference data includes the credentials called and stored in the memory by the target application during the credential verification process. The preset credentials of the target application for logging in are processed respectively by multiple processing modes formed by combining known encryption storage mechanisms, and the data segments corresponding to the processing results of each credential are matched one by one with the data segments corresponding to the difference data, so as to detect whether the storage address of the credential can be accurately located, and then the vulnerability of the target application in storing the credential can be determined.

[0042] Described below Figure 1 How to perform the steps shown.

[0043] First, for step 100, memory snapshots before and after a login operation are compared to determine difference data between the memory snapshot after login and the memory snapshot before login, wherein the login operation refers to logging into a target application using preset credentials.

[0044] Different applications may have different credential encryption storage mechanisms. Therefore, the detection method of this embodiment needs to be executed separately for each application to be detected.

[0045] To detect credential storage vulnerabilities in the target application, you need to register with the target application in advance and obtain pre-set credentials. This credential can be a combination of an account and password. Register according to the target application's account and password requirements.

[0046] When you enter your credentials into the target application and log in, the application verifies them, loads them, and encrypts them before storing them in memory. Therefore, the memory data after logging in to the target application differs from the memory data before logging in. In other words, the memory snapshot after logging in to the target application contains different data from the memory snapshot before logging in.

[0047] In the embodiment of the present invention, the difference data may be a continuous difference data segment or multiple discontinuous difference data segments. However, regardless of whether the difference data corresponds to a single difference data segment or multiple difference data segments, each difference data segment corresponds to a storage location, such as a starting address.

[0048] Then, for step 102, the preset credentials are processed respectively according to a plurality of processing modes formed by combining known encryption storage mechanisms to obtain a plurality of credential processing results corresponding to the plurality of processing modes.

[0049] Known encryption storage mechanisms may include: at least one of compression methods, encoding methods, and encryption algorithms. Therefore, by arbitrarily selecting at least one of these three storage mechanisms and combining known methods from the selected at least one storage mechanism, a processing mode can be obtained, that is, the known encryption storage mechanisms contained in each of the processing modes include: at least one of compression methods, encoding methods, and encryption algorithms. For example, known compression methods may include compression methods A1, A2, and A3, known encoding methods may include encoding methods B1, B2, and B3, and known encryption algorithms may include encryption algorithms C1, C2, and C3. Then one of the processing modes may be compression method A1 and encryption algorithm C2, and another processing mode may be compression method A2, encoding method B1, and encryption algorithm C1. By combining the known methods corresponding to the above-mentioned at least one storage mechanism, multiple processing modes can be obtained.

[0050] For each of all processing modes, the preset credentials are processed separately. For example, the preset credentials are encoded using the B1 encoding method, compressed using the A2 compression method, and then encrypted using the encryption algorithm C2 to obtain the credential processing result corresponding to the processing mode.

[0051] Finally, for step 104, the data segments corresponding to the credential processing results are matched one by one with the data segments corresponding to the differential data, and the storage vulnerability detection results of the target application are output based on the matching results, wherein each data segment corresponds to a storage location.

[0052] In one embodiment of the present invention, in order to reduce the amount of differential data that needs to be detected, before executing this step, the following may be included: if the differential data corresponds to multiple differential data segments, the information entropy of each differential data segment is calculated separately, and the differential data segments greater than the preset entropy value are filtered as the differential data segments at the estimated storage location of the preset voucher, and the filtered differential data segments are used as the data segments corresponding to the differential data and matched with the data segments corresponding to each voucher processing result.

[0053] For example, the differential data corresponds to 10 differential data segments, and the 10 differential data segments need to be matched and detected separately. Generally, the encoding of the differential data segments storing the credentials is balanced. Therefore, a preset entropy value can be set in advance. If the information entropy of the differential data segment is greater than the preset entropy value, it indicates that the differential data segment is likely to include the credential content. In this way, the differential data segments at the estimated storage location are screened out, thereby reducing the number of matches of the differential data segments and improving the detection efficiency.

[0054] In one embodiment, matching the data segments corresponding to the credential processing results with the data segments corresponding to the difference data one by one may include:

[0055] For each voucher processing result, the following steps are performed: determining the voucher data segment corresponding to the voucher processing result, and determining the difference data segment corresponding to the difference data; matching the voucher data segment with each difference data segment one by one, and determining whether the voucher processing result is matched in the difference data based on the matching result.

[0056] If the credential processing result includes multiple credential data segments, and the differential data includes multiple differential data segments, such as credential data segments D1 and D2, and differential data segments E1 and E2, then it is necessary to match the credential data segment D1 with the differential data segments E1 and E2 respectively, and to match the credential data segment D2 with the differential data segments E1 and E2 respectively.

[0057] Specifically, matching rules can be pre-configured to determine whether the credential processing result is matched in the differential data. For example, if more than a set proportion (e.g., 80%) of the data content of the credential data segment is located in the differential data segment, then the credential data segment is determined to be matched in the differential data segment. Furthermore, if all credential data segments are matched, then the credential processing result is determined to be matched in the differential data.

[0058] In one implementation of outputting the storage vulnerability detection result, the matching result is output as the storage vulnerability detection result. Furthermore, if the matching result determines that one of the credential processing results is matched, the processing mode corresponding to the matched credential processing result is output, and a prompt indicating that the storage is relatively vulnerable is provided.

[0059] It should be noted that when the credential processing result includes multiple credential data segments, it indicates that the credential is expected to be stored in segments after being split during the encoding process.

[0060] Furthermore, in order to improve the accuracy of the output storage vulnerability detection result, before outputting the storage vulnerability detection result of the target application, the following steps may be further included:

[0061] Restart the target application and perform the memory snapshot comparison and data segment matching steps again (steps 100 to 104);

[0062] Compare the result obtained after the re-execution with the result obtained before the restart, combine the comparison result with the matching result, and output the storage vulnerability detection result of the target application.

[0063] In one embodiment of the present invention, the comparison process may include at least the following three comparison methods:

[0064] Method 1: Compare the difference data obtained again with the difference data obtained before the restart to see if they are the same, and obtain a first comparison result.

[0065] Method 2: If the matching result obtained by the data segment matching step executed again and the matching result obtained by the data segment matching step executed before the restart both match the credential processing result, then compare whether the matched credential processing results in the two matching results correspond to the same storage address to obtain a second comparison result.

[0066] Method 3, method 1 and method 2 obtain the first comparison result and the second comparison result.

[0067] The following describes each of the above methods.

[0068] In the first approach, whether the difference data obtained again is the same as the difference data obtained before the restart may include: whether the data content is the same and / or whether the storage address is the same.

[0069] If the data content or storage address is the same, it means that the encryption storage mechanism may be the same each time, which may cause security issues.

[0070] If only the data content or storage address is different, it means that the encryption storage mechanism will change each time, and the security is slightly higher, but the storage vulnerability needs to be further determined.

[0071] Therefore, in Method 1, the first comparison result and the matching result before the restart can be determined as the storage vulnerability detection result output. If the first comparison result is the same and the matching result before the restart is a match, the output storage vulnerability detection result of the target application may also include: outputting the processing mode corresponding to the matched credential processing result, and indicating that the encryption storage mechanism is the same each time and the storage is relatively vulnerable.

[0072] In method 2, the second matching result may be the same as or different from the matching result before restart. If they are the same, and both are matched, and the matched credential processing results are the same, then the output storage vulnerability detection result of the target application may also include: outputting the processing mode corresponding to the matched credential processing result, and prompting that the encryption storage mechanism is the same each time and the storage is relatively vulnerable.

[0073] In the third approach, both the first comparison result and the second comparison result may be output as storage vulnerability detection results.

[0074] It should be noted that the number of times steps 100 to 104 are restarted and executed again can be once or multiple times. Based on the comparison results output by multiple comparisons, the matching results before the restart are integrated to output the storage vulnerability detection results, thereby further improving the detection accuracy.

[0075] Regardless of which of the above methods is used, if the matching result is no match, it indicates that the encryption storage mechanism used by the target application is not known. The output storage vulnerability detection result of the target application may also include: the credential storage location cannot be detected, and the storage security is relatively high.

[0076] In the embodiment of the present invention, the following effects are achieved:

[0077] 1. Good versatility: applicable to various operating systems such as Windows and Linux, and applicable to various types of applications (such as web, exe, elf);

[0078] 2. Good scalability: Provides users with a configurable rule detection method, allowing users to quickly customize the matching rules of the application;

[0079] 3. Good compatibility: The security of application credential storage can be tested without modifying the application itself or configuration information;

[0080] 4. Supports multiple types of detection content: Applicable to the security detection of various credential information such as the application's own login credentials, remote login credentials, encryption credentials, etc., and can also be used for application sensitive information detection.

[0081] like Figure 2 、 Figure 3 As shown, an embodiment of the present invention provides an application credential storage vulnerability detection device. The device embodiment can be implemented by software, hardware, or a combination of software and hardware. From the hardware level, such as Figure 2 As shown in FIG, a hardware architecture diagram of an electronic device where an application credential storage vulnerability detection device provided by an embodiment of the present invention is located, except for Figure 2In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a logical device, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it. This embodiment provides an application credential storage vulnerability detection device, including:

[0082] a comparison and determination unit 301 configured to compare memory snapshots before and after a login operation is performed to determine difference data between the memory snapshot after login and the memory snapshot before login, wherein the login operation refers to logging into a target application using preset credentials;

[0083] The processing unit 302 is configured to process the preset credentials according to a plurality of processing modes formed by combining known encryption storage mechanisms, and obtain a plurality of credential processing results corresponding to the plurality of processing modes;

[0084] The matching detection unit 303 is used to match the data segments corresponding to each credential processing result with the data segments corresponding to the difference data one by one, and output the storage vulnerability detection result of the target application according to the matching result, wherein each data segment corresponds to a storage location.

[0085] In one embodiment of the present invention, the known encryption storage mechanism included in each of the processing modes includes at least one of a compression method, an encoding method, and an encryption algorithm.

[0086] In one embodiment of the present invention, the matching detection unit is further used to: if the differential data corresponds to multiple differential data segments, calculate the information entropy of each differential data segment respectively, filter the differential data segments greater than the preset entropy value as the differential data segments at the estimated storage location of the preset voucher, and match the filtered differential data segments as the data segments corresponding to the differential data with the data segments corresponding to each voucher processing result.

[0087] In one embodiment of the present invention, the matching detection unit is specifically used to: for each voucher processing result, perform the following: determine the voucher data segment corresponding to the voucher processing result, determine the difference data segment corresponding to the difference data; match the voucher data segment with each difference data segment one by one, and determine whether the voucher processing result is matched in the difference data based on the matching result.

[0088] In one embodiment of the present invention, please refer to Figure 4 The application credential storage vulnerability detection device may further include:

[0089] A restart unit 304 is configured to restart the target application and trigger the comparison and determination unit and the processing unit to perform the memory snapshot comparison and data segment matching steps again;

[0090] The comparison unit 305 is configured to compare the result obtained after the re-execution with the result obtained before the restart, combine the comparison result with the matching result, and output a storage vulnerability detection result of the target application.

[0091] In one embodiment of the present invention, when the comparison unit compares the result obtained after the re-execution with the result obtained before the restart, it is specifically configured to:

[0092] Comparing the difference data obtained again with the difference data obtained before the restart to see if they are the same, to obtain a first comparison result;

[0093] and / or,

[0094] If the matching result obtained by the data segment matching step executed again and the matching result obtained by the data segment matching step executed before restart both match the credential processing result, then compare whether the matched credential processing results in the two matching results correspond to the same storage address to obtain a second comparison result.

[0095] In one embodiment of the present invention, when the comparison unit is used to compare whether the difference data obtained again is the same as the difference data obtained before the restart, it is specifically used to compare whether the data contents are the same and / or whether the storage addresses are the same.

[0096] It should be understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on an application credential storage vulnerability detection device. In other embodiments of the present invention, an application credential storage vulnerability detection device may include more or fewer components than illustrated, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0097] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0098] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, an application credential storage vulnerability detection method according to any embodiment of the present invention is implemented.

[0099] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes an application credential storage vulnerability detection method according to any embodiment of the present invention.

[0100] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0101] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0102] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0103] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0104] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0105] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0106] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting application credential storage vulnerabilities, characterized in that: include: Comparing memory snapshots before and after a login operation is performed to determine difference data between the memory snapshot after the login and the memory snapshot before the login, wherein the login operation refers to logging into the target application using preset credentials; Processing the preset credentials respectively according to multiple processing modes formed by combining known encryption storage mechanisms to obtain multiple credential processing results corresponding to the multiple processing modes; The data segments corresponding to the credential processing results are matched one by one with the data segments corresponding to the difference data, and the storage vulnerability detection results of the target application are output according to the matching results, wherein each data segment corresponds to a storage location.

2. The method according to claim 1, characterized in that The known encryption storage mechanism included in each of the processing modes includes at least one of a compression method, an encoding method and an encryption algorithm.

3. The method according to claim 1, characterized in that Before matching the data segments corresponding to the credential processing results with the data segments corresponding to the difference data one by one, the method further includes: If the differential data corresponds to multiple differential data segments, the information entropy of each differential data segment is calculated separately, and the differential data segments greater than the preset entropy value are screened as the differential data segments at the estimated storage location of the preset voucher, and the screened differential data segments are used as the data segments corresponding to the differential data and matched with the data segments corresponding to each voucher processing result.

4. The method according to claim 3, characterized in that The step of matching the data segments corresponding to the credential processing results with the data segments corresponding to the difference data one by one includes: For each voucher processing result, the following steps are performed: determining the voucher data segment corresponding to the voucher processing result, and determining the difference data segment corresponding to the difference data; matching the voucher data segment with each difference data segment one by one, and determining whether the voucher processing result is matched in the difference data based on the matching result.

5. The method according to claim 1, wherein Before outputting the storage vulnerability detection result of the target application according to the matching result, the method further includes: Restarting the target application and performing the memory snapshot comparison and data segment matching steps again; Compare the result obtained after the re-execution with the result obtained before the restart, combine the comparison result with the matching result, and output the storage vulnerability detection result of the target application.

6. The method according to claim 5, characterized in that The comparison of the result obtained after the re-execution with the result obtained before the restart includes: Comparing the difference data obtained again with the difference data obtained before the restart to see if they are the same, to obtain a first comparison result; and / or, If the matching result obtained by the data segment matching step executed again and the matching result obtained by the data segment matching step executed before restart both match the credential processing result, then compare whether the matched credential processing results in the two matching results correspond to the same storage address to obtain a second comparison result.

7. The method according to claim 6, characterized in that Whether the difference data obtained again is the same as the difference data obtained before the restart includes: whether the data content is the same and / or whether the storage address is the same.

8. An application credential storage vulnerability detection device, characterized in that: include: a comparison and determination unit, configured to compare memory snapshots before and after a login operation is performed to determine difference data between the memory snapshot after login and the memory snapshot before login, wherein the login operation refers to logging into a target application using preset credentials; a processing unit, configured to process the preset credentials respectively according to a plurality of processing modes formed by combining known encryption storage mechanisms, and obtain a plurality of credential processing results corresponding to the plurality of processing modes; A matching detection unit is used to match the data segments corresponding to each credential processing result with the data segments corresponding to the difference data one by one, and output the storage vulnerability detection result of the target application according to the matching result, wherein each data segment corresponds to a storage location.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 7.

Images