Vulnerability link testing method, device, computer equipment and storage medium

Abstract

The present application relates to a vulnerability link testing method, apparatus, computer equipment, and storage medium. The method comprises: obtaining a test link library of a tested application; selecting a first character from an extended character set, the extended character set including characters included in at least one potential vulnerability link; constructing a candidate vulnerability link headed by the first character based on the characters in the extended character set, and updating the test link library based on the candidate vulnerability link; repeating the above process of selecting the first character, constructing a candidate vulnerability link headed by the first character, and updating the test link library based on the candidate vulnerability link until no new candidate vulnerability link is generated and the cumulative duration of repeated links in the test link library reaches a preset duration; comparing the access result of the tested application based on each link with the access result of the tested application based on the login information of the tested application and based on the same link, and determining the vulnerability link according to the comparison result.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a vulnerability link testing method, apparatus, computer equipment, and storage medium. Background Art

[0002] In normal business implementation of applications, access links to sensitive functions require the identity of the visitor to be verified, and only after the verification is passed can the link be called to perform operations.

[0003] In related technologies, access links to sensitive application functions are typically tested manually. Specifically, in actual manual testing scenarios, security testers can access the application's post-login link without logging in, checking whether the returned data is consistent with the logged-in state to determine whether there are any vulnerable links. However, an application typically requires numerous test points, and since manual testing relies on manual experience, it is easy to miss test points, resulting in incomplete testing. Summary of the Invention

[0004] Based on this, it is necessary to provide a vulnerability link testing method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems, which can make the test more comprehensive, and relate to the field of information security technology.

[0005] In a first aspect, the present application provides a vulnerability link testing method. The method comprises:

[0006] Obtaining a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0007] Selecting the first character in an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0008] Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link;

[0009] Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time;

[0010] The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

[0011] In one embodiment, based on characters in an extended character set, a candidate vulnerability link starting with the first character is constructed, including:

[0012] Build a growing string based on the first character;

[0013] Determine a character to be added based on at least one potential vulnerability link, and add the character to the end of the growing string;

[0014] If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but duplicates an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and does not duplicate an existing link in the test link library. The final growing string is used as the candidate vulnerability link.

[0015] In one embodiment, determining the characters to be added based on at least one potential vulnerability link includes:

[0016] Determine the last character in the growing character string, and obtain a growing character set consisting of characters directly following the last character in at least one potential vulnerability link;

[0017] Select the characters to be added from the growing character set.

[0018] In one embodiment, selecting a character to be added from a growing character set includes:

[0019] Based on the adjacent distance between the last character and each character in the growing character set and pheromone, the probability of each character in the growing character set being the character to be added is obtained, and the character corresponding to the maximum probability is used as the character to be added.

[0020] In one embodiment, after determining whether the growing character string is a valid link, the method further includes:

[0021] If it is a valid link, the historical pheromone between each two adjacent characters in the growing string is updated according to the historical pheromone between each two adjacent characters in the growing string and the distance between each two adjacent characters in the growing string. The historical pheromone is obtained in the last pheromone update process.

[0022] In one embodiment, the process of obtaining the adjacent distance between the last character and each character in the growing character set includes:

[0023] For any character in the growing character set, if any character has not been the next character of the last character in at least one potential vulnerability link, the preset adjacent distance is used as the adjacent distance between the last character and any character;

[0024] If any character has been the next character after the last character in at least one potential vulnerability link, the first occurrence of any character after the last character is counted;

[0025] Count the number of times the last character appears as the second character in at least one potential vulnerability link.

[0026] Determine the adjacent distance between the last character and any character according to the first number of occurrences and the second number of occurrences.

[0027] In one embodiment, comparing the access result of the application under test based on each link in the test link library with the access result of the application under test based on the same link through the login information of the application under test, and determining the vulnerability link based on the comparison result, including:

[0028] For any link in the test link library, obtain the cookie value representing the identity information based on the login information; the login information includes the system domain name, login link and login account;

[0029] Assemble any link and the system domain name respectively to obtain a first complete test link without identity information of any link; assemble any link, the system domain name and the cookie value respectively to obtain a second complete test link with identity information of any link;

[0030] Accessing the first complete test link to obtain a first response of the first complete test link in a non-logged-in state, and accessing the second complete test link to obtain a second response of the second complete test link in a logged-in state;

[0031] If the status code in the first response and the status code in the second response do not start with a preset number, and the response content in the first response is the same as the response content in the second response, then any link is determined to be a vulnerable link.

[0032] In a second aspect, the present application also provides a vulnerability link testing device. The device includes:

[0033] An acquisition module, configured to acquire a test link library of the application under test, the test link library including at least one potential vulnerability link associated with the application under test;

[0034] a selection module, configured to select a first character from an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0035] The first building module is used to build a candidate vulnerability link starting with the first character based on the characters in the extended character set, and update the test link library based on the candidate vulnerability link;

[0036] The second construction module is configured to repeatedly execute the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link, until the cumulative time during which no new candidate vulnerability link is generated and no duplicate links are generated in the test link library reaches a preset time;

[0037] The access result analysis module is used to compare the access result of the tested application based on each link in the test link library with the access result of the tested application based on the login information of the tested application and the same link, and determine the vulnerability link according to the comparison result.

[0038] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are performed:

[0039] Obtaining a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0040] Selecting the first character in an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0041] Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link;

[0042] Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time;

[0043] The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

[0044] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0045] Obtaining a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0046] Selecting the first character in an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0047] Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link;

[0048] Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time;

[0049] The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

[0050] The vulnerability link testing method, apparatus, computer equipment, and storage medium described above, on the one hand, construct more candidate vulnerability links associated with the application under test based on characters in an extended character set, thereby covering more test points of the application under test, thereby achieving a more comprehensive test of the application under test and avoiding the problem of incomplete testing that exists in manual testing. On the other hand, because the server automatically generates a test link library for the application under test, the test link library includes at least one potential vulnerability link associated with the application under test and several candidate vulnerability links, and then automatically tests the links in the test link library, it is possible to complete the testing of access links to sensitive functions of the application under test without the need for testers to have vulnerability link testing experience, thereby improving the testing efficiency and accuracy of vulnerability links. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 Schematic diagram of a flow chart of a vulnerability link testing method in one embodiment;

[0052] Figure 2 Schematic diagram of a flow chart of a vulnerability link testing method in one embodiment;

[0053] Figure 3 1 is a flow chart of a vulnerability link testing method in another embodiment;

[0054] Figure 4 Schematic diagram of a flow chart of a vulnerability link testing method according to another embodiment;

[0055] Figure 5 is a structural block diagram of a vulnerability link testing device in one embodiment;

[0056] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0058] It is understood that the terms "first," "second," and the like used herein may be used to describe various technical terms, but unless otherwise specified, these technical terms are not limited by these terms. These terms are used solely to distinguish one technical term from another. For example, the first response and the second response may be the same or different without departing from the scope of this application.

[0059] In normal business implementation of applications, access links to sensitive functions require the identity of the visitor to be verified, and only after the verification is passed can the link be called to perform operations.

[0060] In related technologies, access links to sensitive application functions are typically tested manually. Specifically, in actual manual testing scenarios, security testers can access the application's post-login link without logging in, checking whether the returned data is consistent with the logged-in state to determine whether there are any vulnerable links. However, an application typically requires numerous test points, and since manual testing relies on manual experience, it is easy to miss test points, resulting in incomplete testing.

[0061] In response to the problems existing in the above-mentioned related technologies, an embodiment of the present invention provides a vulnerability link testing method, which can be applied to a server, a terminal, or a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the server can be implemented as an independent server or a server cluster composed of multiple servers. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. It should be noted that the quantities of "multiple" and the like mentioned in the embodiments of this application all refer to the quantity of "at least two", for example, "multiple" refers to "at least two".

[0062] In one embodiment, Figure 1 As shown, a vulnerability link testing method is provided. This embodiment uses the method applied to a server as an example for illustration. The method includes the following steps:

[0063] 102. Obtain a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test.

[0064] The test link library may include links to common functions and common potential vulnerabilities of the application under test. It should be noted that common function links may include links to the homepage, performance monitoring components, and memory monitoring components. Common potential vulnerability links refer to links that can bypass login authentication and provide unauthorized access to the application under test during security testing.

[0065] It is understandable that common function links and common potential vulnerability links are all potential vulnerability links associated with the application under test. In actual applications, the test link library may also contain more potential vulnerability links associated with the application under test. The embodiments of this application do not limit the number of potential vulnerability links associated with the application under test contained in the test link library.

[0066] It is also understandable that, because the homepage, performance monitoring component, and memory monitoring component are usually not core application functions of the tested application, security testers tend to ignore the homepage access link, the performance monitoring component access link, and the memory monitoring component access link in manual testing scenarios, and do not test the above links. Therefore, this application can add the homepage access link, the performance monitoring component access link, and the memory monitoring component access link to the test link library, thereby testing the links that security testers tend to ignore, making the test more comprehensive.

[0067] 104. Select a first character from an extended character set, where the extended character set includes characters included in at least one potential vulnerability link.

[0068] For example, at least one potential vulnerability link includes three potential vulnerability links: / abc, / fgh.ab, and acfg. Accordingly, the extended character set includes the characters / , a, b, c, f, g, h, and .

[0069] 106. Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link.

[0070] Specifically, step 106 includes but is not limited to: constructing a growing string based on the first character; determining the characters to be added based on the extended character set and adding them to the end of the growing string; if the number of characters in the growing string does not reach the preset number, then determining whether the growing string is a valid link; if it is not a valid link or it is a valid link but is repeated with an existing link in the test link library, then repeating the above process of determining the characters to be added and adding them to the end of the growing string until the growing string obtained is a valid link and is not repeated with an existing link in the test link library, and using the final growing string as a candidate vulnerability link, and updating the test link library based on the candidate vulnerability link. Randomly select a character from the extended character set as the character to be added,

[0071] Determining the character to be added based on the extended character set may include: randomly selecting a character from the extended character set as the character to be added.

[0072] Determining the characters to be added based on the extended character set may also include: determining the last character in the growing character string, obtaining the probability of each character in the extended character set being the character to be added based on the adjacent distance between the last character and each character in the extended character set and pheromones, taking the character corresponding to the maximum probability as the character to be added, and adding it to the end of the growing character string.

[0073] It should be noted that, compared with the random selection method, the probability-based selection method has a greater probability that the constructed growing string is a valid link, thereby improving the efficiency of constructing the candidate vulnerability links and constructing more candidate vulnerability links.

[0074] 108. Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until no new candidate vulnerability link is generated and the cumulative time for duplicate links in the test link library reaches a preset time.

[0075] In practical applications, the preset duration can be set based on experience.

[0076] 110. Compare the access result of the tested application based on each link in the test link library with the access result of the tested application based on the same link through the login information of the tested application, and determine the vulnerability link according to the comparison result.

[0077] In the above-mentioned vulnerability link testing method, a test link library of the application under test is obtained, and the test link library includes at least one potential vulnerability link associated with the application under test; the first character is selected from the extended character set, and the extended character set includes characters contained in at least one potential vulnerability link; based on the characters in the extended character set, a candidate vulnerability link headed by the first character is constructed, and the test link library is updated based on the candidate vulnerability link; the above-mentioned process of selecting the first character, constructing the candidate vulnerability link headed by the first character, and updating the test link library based on the candidate vulnerability link is repeated until no new candidate vulnerability link is continuously generated and the cumulative time of repeated links in the test link library reaches a preset time; the access result of the application under test based on each link in the test link library is compared with the access result of the application under test through the login information of the application under test and based on the same link, and the vulnerability link is determined according to the comparison result.

[0078] On the one hand, since more candidate vulnerability links associated with the application under test are constructed based on the characters in the extended character set, more test points of the application under test are covered, thereby achieving a more comprehensive test of the application under test and avoiding the problem of incomplete testing in manual testing.

[0079] On the other hand, since the server automatically generates a test link library for the application under test, the test link library includes at least one potential vulnerability link associated with the application under test and several candidate vulnerability links, and then automatically tests the links in the test link library, the test of access links to sensitive functions of the application under test can be completed without the tester having experience in vulnerability link testing, thereby improving the testing efficiency and accuracy of vulnerability links.

[0080] In one embodiment, Figure 2 As shown, based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, which may include:

[0081] 202. Build a growing string based on the first character.

[0082] 204. Determine a character to be added based on at least one potential vulnerability link, and add the character to the end of the growing string.

[0083] Specifically, step 204 includes but is not limited to: determining the last character in the growing character string, obtaining a growing character set consisting of characters directly following the last character in at least one potential vulnerability link; and selecting a character to be added from the growing character set.

[0084] 206. If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but is a duplicate of an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and is not a duplicate of an existing link in the test link library. The final growing string is used as a candidate vulnerability link.

[0085] Among them, if the number of characters in the growing string reaches a preset number or the obtained growing string is a valid link and does not overlap with an existing link in the test link library, the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link is repeated.

[0086] In this embodiment, since at least one potential vulnerability link is a valid link, and the characters to be added are determined based on the at least one potential vulnerability link, compared with a method of randomly selecting characters to be added from an extended character set, the resulting grown character string is more likely to be a valid link, thereby improving the efficiency of constructing the selected vulnerability links.

[0087] In one embodiment, Figure 3 As shown, the characters to be added are determined based on at least one potential vulnerability link, including:

[0088] 302. Determine the last character in the growing character string, and obtain a growing character set consisting of characters directly following the last character in at least one potential vulnerability link.

[0089] For example, if the last character is a, at least one potential vulnerability link includes / abc, / fgh.ab, acfg / abfg, and ahc. In this case, the growing character set includes the three characters b, c, and h.

[0090] 304. Select a character to be added from the growing character set.

[0091] Step 304 may include randomly selecting a character from the growing character set as the character to be added. Since the growing character set is composed of characters that directly follow the last character in at least one potential vulnerability link, and the at least one potential vulnerability link is a valid link, compared to randomly selecting characters from the extended character set to construct a growing character string, using a character from the growing character set as the character to be added increases the likelihood that the constructed growing character string will be a valid link, thereby improving the efficiency of constructing the candidate vulnerability link.

[0092] It is understandable that the reason why this possibility is greater is that such a construction has a basis for construction, which is that the last character in at least one potential vulnerability link is directly connected to a character in the growth character set, and the link formed by such a combination can be a valid link.

[0093] In this embodiment, since the growing character set is composed of characters that directly follow the last character in at least one potential vulnerability link, and at least one potential vulnerability link is a valid link, compared with the method of randomly selecting characters from the extended character set as the characters to be added to construct a growing character string, the possibility that the growing character string constructed by selecting a character from the growing character set as the character to be added is a valid link is greater, thereby improving the efficiency of constructing the candidate vulnerability link.

[0094] In one embodiment, selecting a character to be added from the growing character set includes:

[0095] Based on the adjacent distance between the last character and each character in the growing character set and pheromone, the probability of each character in the growing character set being the character to be added is obtained, and the character corresponding to the maximum probability is used as the character to be added.

[0096] Specifically, based on the adjacent distance between the last character and each character in the growing character set and the pheromone, obtaining the probability of each character in the growing character set as the character to be added may include: for the probability of any character as the character to be added, multiplying the adjacent distance and the pheromone between the last character and each character in the growing character set, obtaining the product corresponding to each character, and obtaining the sum of all products; obtaining the ratio between the product corresponding to any character and the sum, and using the ratio as the probability of any character as the character to be added.

[0097] It should be noted that the probability of each character in the growing character set being a character to be added can be obtained by referring to the following formula (1):

[0098]

[0099] It should be noted that in formula (1), P(i, j) represents the probability of any character being the character to be added, i represents the last character, j represents any character, k(i, j) represents the pheromone between the last character and any character, d(i, j) represents the adjacent distance between the last character and any character, and N k represents the growing character set, u represents a character in the growing character set, k(i,u) represents the pheromone between the last character and a certain character, and d(i,u) represents the adjacent distance between the last character and the certain character.

[0100] In this embodiment, by determining the last character in the growing character string, a growing character set consisting of characters directly following the last character in at least one potential vulnerability link is obtained; based on the adjacent distance between the last character and each character in the growing character set and pheromones, the probability of each character in the growing character set being a character to be added is obtained, and the character corresponding to the maximum probability is used as the character to be added.

[0101] On the one hand, since the growing character set is composed of the characters directly connected to the last character in at least one potential vulnerability link, and at least one potential vulnerability link is a valid link, the characters to be added determined from the growing character set are more likely to be a valid link in the growing character string, thereby improving the efficiency of constructing the candidate vulnerability links.

[0102] On the other hand, since the character corresponding to the maximum probability is used as the character to be added, and the character corresponding to the maximum probability is the character that appears the most times as the next character of the last character in at least one potential vulnerability link, the character corresponding to the maximum probability is used as the character to be added, and the constructed growing character string is more likely to be a valid link, thereby improving the construction efficiency of the vulnerability link to be selected.

[0103] In one embodiment, after determining whether the growing character string is a valid link, the method further includes: if it is a valid link, updating the historical pheromone between each two adjacent characters in the growing character string based on the historical pheromone between each two adjacent characters in the growing character string and the distance between each two adjacent characters in the growing character string, where the historical pheromone is obtained during the last pheromone update process.

[0104] Specifically, for any group of adjacent characters in a growing string, the character at the front of the group of adjacent characters in the growing string is taken as the previous character, and the character at the back of the group of adjacent characters is taken as the next character. All characters after the next character in the growing string are removed to obtain a target growing string. The historical pheromones of any group of adjacent characters are updated based on the attenuation factor, the historical pheromones between any group of adjacent characters, and the distance between every two adjacent characters in the target growing string.

[0105] For example, let's assume the growing string is abcde. The process for updating the historical pheromone between the group of adjacent characters cd can be as follows: Consider c as the previous character and d as the next character. All characters after d in the growing string are removed to obtain the target growing string abcd. Based on the attenuation factor, the historical pheromone between the group of adjacent characters cd, and the distance between each adjacent character in the target growing string abcd, the historical pheromone between the group of adjacent characters cd is updated.

[0106] The process of updating the historical pheromone between every two adjacent characters in the growing string can be referred to the following formula (2):

[0107]

[0108] In the above formula (2), k(c, d) represents the update result of the historical pheromone between any group of adjacent characters in the growing string, t represents the attenuation factor, k1(c, d) represents the historical pheromone between any group of adjacent characters, and L represents the sum of the reciprocals of the distances between every two adjacent characters in the target growing string.

[0109] For ease of understanding, we will take the growth string abcde and update the historical pheromone between the adjacent characters cd as an example to explain L.

[0110] In the first pheromone update process, the historical pheromone between every two adjacent characters in the growing string is the reciprocal of the total number of characters contained in at least one potential vulnerability link.

[0111] For example, if the growing string is abcd, at least one potential vulnerable link includes the three potential vulnerable links: / abc, / fgh.ab, and acfg. In this case, the total number of characters in the at least one potential vulnerable link is 15, and the historical pheromone between a and b, the historical pheromone between b and c, and the historical pheromone between c and d are all 1 / 15.

[0112] Since the character corresponding to the maximum probability is used as the character to be added each time, and the probability corresponding to each character is determined based on the adjacent distance between the last character and each character in the growing character set and the pheromone, among which the adjacent distance between each character is fixed and will not change, the determining factor of the probability size is the pheromone. The greater the pheromone between each two adjacent characters, the greater the probability obtained.

[0113] It is understandable that after updating the historical pheromone between every two adjacent characters in the growing string, the historical pheromone between every two adjacent characters will decrease. By updating the historical pheromone between every two adjacent characters in each valid link, the historical pheromone between every two adjacent characters in the valid link is reduced, thereby reducing the probability of every two adjacent characters in the valid link appearing in the growing string, increasing the probability of other characters being selected as characters to be added, and thus constructing more different growing strings, covering more test points of the tested application.

[0114] In this embodiment, since each time a valid link is generated, the historical pheromone between each two adjacent characters in the valid link is updated, the historical pheromone between each two adjacent characters in the valid link is reduced, and the probability of each two adjacent characters in the valid link appearing in the growing character string is reduced, and the probability of other characters being selected as characters to be added is increased, thereby constructing more different growing character strings, and thus covering more test points of the tested application.

[0115] In one embodiment, the process of obtaining the adjacent distance between the last character and each character in the growing character set includes:

[0116] For any character in the growing character set, if any character has never been the next character of the last character in at least one potential vulnerability link, the preset adjacent distance is used as the adjacent distance between the last character and any character.

[0117] For example, at least one potentially vulnerable link includes abc, abd, acfg, and fgac, with the last character being a. Since d, f, and g have never been the next character of a, the adjacent distances between a and d, the adjacent distances between a and f, and the adjacent distances between a and g are all preset distances. The preset adjacent distances can be set to 1.

[0118] It should be noted that the adjacent distance between the last character and any character that has not been the next character of the last character in at least one potential vulnerability link is greater than the adjacent distance between the last character and any character that has been the next character of the last character in at least one potential vulnerability link.

[0119] If any character has been the next character of the last character in at least one potential vulnerability link, then the first occurrence number of any character as the next character of the last character is counted; the second occurrence number of the last character not being the last character in at least one potential vulnerability link is counted; and the adjacent distance between the last character and any character is determined based on the first occurrence number and the second occurrence number.

[0120] Determining the adjacent distance between the last character and any character based on the first number of occurrences and the second number of occurrences may include: obtaining a ratio between the first number of occurrences and the second number of occurrences, and using the ratio as the adjacent distance between the last character and any character.

[0121] Let's take the example of at least one potentially vulnerable link including abc, abd, acfg, and fgac, with the last character being a. For the distance between a and b, the first occurrence of b as the next character of a is 2, and the second occurrence of a not being the last character in at least one potentially vulnerable link is 4. Based on this, the distance between a and b can be determined to be 1 / 2.

[0122] In one embodiment, step 110 includes:

[0123] For any link in the test link library, based on the login information, obtain the cookie value representing the identity information; the login information includes the system domain name, login link and login account.

[0124] Specifically, before the test begins, the tester can enter the login information of the application under test in the application configuration unit. The server then obtains the login information and automatically calls the login page of the application under test to capture the cookie value after login. This allows subsequent comparison of the page response before and after login for each link in the test link library.

[0125] Assemble any link and system domain name respectively to obtain a first complete test link without identity information of any link; assemble any link, system domain name and cookie value respectively to obtain a second complete test link with identity information of any link.

[0126] Access the first complete test link to obtain a first response of the first complete test link in a non-logged-in state, access the second complete test link to obtain a second response of the second complete test link in a logged-in state.

[0127] After the above steps, the method may further include: if the status code in the first response begins with a preset number, determining that any link is an invalid link. It should be noted that the preset number may include 4 and 5.

[0128] If the status code in the first response and the status code in the second response do not start with a preset number, and the response content in the first response is the same as the response content in the second response, then any link is determined to be a vulnerable link.

[0129] like Figure 4 As shown, an embodiment of a vulnerability link testing method is provided. This embodiment includes:

[0130] 402. Obtain a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0131] 404. Select the first character in an extended character set, where the extended character set includes characters contained in at least one potentially vulnerable link;

[0132] 406. Construct a growing string based on the first character;

[0133] 408. Determine the last character in the growing character string, and obtain a growing character set consisting of characters directly following the last character in at least one potential vulnerability link;

[0134] 410. Based on the adjacent distance between the last character and each character in the growing character set and the pheromone, obtain the probability of each character in the growing character set being the character to be added, select the character corresponding to the maximum probability as the character to be added, and add it to the end of the growing character string;

[0135] 412. If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but duplicates an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and does not duplicate an existing link in the test link library. The resulting growing string is used as the candidate vulnerability link.

[0136] 414. If it is a valid link, then update the historical pheromone between each two adjacent characters in the growing string based on the historical pheromone between each two adjacent characters in the growing string and the distance between each two adjacent characters in the growing string. The historical pheromone is obtained during the last pheromone update process.

[0137] 416. If the number of characters in the growing character string reaches a preset number or the resulting growing character string is a valid link and does not duplicate an existing link in the test link library, the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link is repeated until the cumulative time period during which no new candidate vulnerability link is generated and duplicate links in the test link library reach a preset time period.

[0138] 418. Compare the access result of the tested application based on each link in the test link library with the access result of the tested application based on the same link through the login information of the tested application, and determine the vulnerability link based on the comparison result.

[0139] It should be noted that, for the explanation of the terms and steps involved in step 402 to step 418, reference may be made to the explanation of the relevant terms and steps in the above embodiment, which will not be repeated here.

[0140] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0141] Based on the same inventive concept, the present application also provides a vulnerability link testing device for implementing the vulnerability link testing method described above. The solution provided by this device is similar to the solution described in the method described above. Therefore, the specific limitations of one or more vulnerability link testing device embodiments provided below can be found in the above-mentioned limitations of the vulnerability link testing method and will not be repeated here.

[0142] In one embodiment, Figure 5 As shown, a vulnerability link testing device is provided, including: an acquisition module 502, a selection module 504, a first construction module 506, a second construction module 508 and an access result analysis module 510, wherein:

[0143] An acquisition module 502 is configured to acquire a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0144] A selection module 504 is configured to select a first character from an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0145] A first constructing module 506 is configured to construct a candidate vulnerability link starting with the first character based on the characters in the extended character set, and update the test link library based on the candidate vulnerability link;

[0146] The second constructing module 508 is configured to repeatedly execute the above-mentioned process of selecting the first character, constructing the candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are generated in the test link library reaches a preset time;

[0147] The access result analysis module 510 is used to compare the access result of the tested application based on each link in the test link library with the access result of the tested application based on the login information of the tested application and the same link, and determine the vulnerability link according to the comparison result.

[0148] In one embodiment, the first building block 506 includes:

[0149] Build submodule for building growing strings based on the first character;

[0150] A first determining submodule is configured to determine a character to be added based on at least one potential vulnerability link, and add the character to the end of the growing string;

[0151] The judgment submodule is used to determine whether the growing string is a valid link if the number of characters in the growing string does not reach a preset number. If it is not a valid link or is a valid link but duplicates an existing link in the test link library, the above process of determining the characters to be added and adding them to the end of the growing string is repeated until the resulting growing string is a valid link and does not duplicate an existing link in the test link library. The final growing string is used as a candidate vulnerability link.

[0152] In one embodiment, the first determining submodule includes:

[0153] an acquisition unit, configured to determine the last character in a growing character string, and acquire a growing character set consisting of characters directly following the last character in at least one potential vulnerability link;

[0154] The selection unit is used to select characters to be added from the growing character set.

[0155] In one embodiment, the selection unit includes:

[0156] The acquisition subunit is used to obtain the probability of each character in the growing character set as the character to be added based on the adjacent distance between the last character and each character in the growing character set and the pheromone, and to use the character corresponding to the maximum probability as the character to be added.

[0157] In one embodiment, the first building block 506 further includes:

[0158] The update submodule is used to update the historical pheromone between each two adjacent characters in the growing string according to the historical pheromone between each two adjacent characters in the growing string and the distance between each two adjacent characters in the growing string if it is a valid link. The historical pheromone is obtained in the last pheromone update process.

[0159] In one embodiment, an acquisition subunit is configured to, for any character in the growing character set, use a preset adjacent distance as the adjacent distance between the last character and any character if any character has never been the next character of the last character in at least one potential vulnerability link; count the first occurrence number of any character as the next character of the last character if any character has been the next character of the last character in at least one potential vulnerability link; count the second occurrence number of the last character not being the last character in at least one potential vulnerability link; and determine the adjacent distance between the last character and any character based on the first occurrence number and the second occurrence number.

[0160] In one embodiment, the access result analysis module 510 includes:

[0161] The acquisition submodule is used to obtain the cookie value representing the identity information for any link in the test link library based on the login information; the login information includes the system domain name, login link and login account;

[0162] An assembly submodule is used to assemble any link and the system domain name respectively to obtain a first complete test link without identity information of any link, and to assemble any link, the system domain name and the cookie value respectively to obtain a second complete test link with identity information of any link;

[0163] An access submodule, configured to access a first complete test link, obtain a first response of the first complete test link in a non-logged-in state, and access a second complete test link, obtain a second response of the second complete test link in a logged-in state;

[0164] The second determination submodule is configured to determine that any link is a vulnerable link if neither the status code in the first response nor the status code in the second response begins with a preset number and the response content in the first response is the same as the response content in the second response.

[0165] Each module in the vulnerability link testing device described above can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0166] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store a test link library, an extended character set, and vulnerability link data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a vulnerability link testing method is implemented.

[0167] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0168] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0169] Obtaining a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0170] Selecting the first character in an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0171] Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link;

[0172] Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time;

[0173] The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

[0174] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0175] Build a growing string based on the first character;

[0176] Determine a character to be added based on at least one potential vulnerability link, and add the character to the end of the growing string;

[0177] If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but duplicates an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and does not duplicate an existing link in the test link library. The final growing string is used as the candidate vulnerability link.

[0178] In one embodiment, when the processor executes the computer program, it further implements the following steps: determining the last character in the growing character string, obtaining a growing character set consisting of characters directly following the last character in at least one potential vulnerability link; and selecting a character to be added from the growing character set.

[0179] In one embodiment, when the processor executes the computer program, it also implements the following steps: based on the adjacent distance between the last character and each character in the growing character set and the pheromone, obtain the probability of each character in the growing character set as the character to be added, and use the character corresponding to the maximum probability as the character to be added.

[0180] In one embodiment, when the processor executes the computer program, the following steps are further implemented: if it is a valid link, the historical pheromone between each two adjacent characters in the growing string is updated based on the historical pheromone between each two adjacent characters in the growing string and the distance between each two adjacent characters in the growing string, where the historical pheromone is obtained during the last pheromone update process.

[0181] In one embodiment, when the processor executes the computer program, the following steps are further implemented: for any character in the growing character set, if any character has not been the next character of the last character in at least one potential vulnerability link, then a preset adjacent distance is used as the adjacent distance between the last character and any character;

[0182] If any character has been the next character after the last character in at least one potential vulnerability link, the first occurrence of any character after the last character is counted;

[0183] Count the number of times the last character appears as the second character in at least one potential vulnerability link.

[0184] Determine the adjacent distance between the last character and any character according to the first number of occurrences and the second number of occurrences.

[0185] In one embodiment, when the processor executes the computer program, the following steps are further implemented: for any link in the test link library, based on login information, obtaining a cookie value representing identity information; the login information includes a system domain name, a login link, and a login account;

[0186] Assemble any link and the system domain name respectively to obtain a first complete test link without identity information of any link; assemble any link, the system domain name and the cookie value respectively to obtain a second complete test link with identity information of any link;

[0187] Accessing the first complete test link to obtain a first response of the first complete test link in a non-logged-in state, and accessing the second complete test link to obtain a second response of the second complete test link in a logged-in state;

[0188] If the status code in the first response and the status code in the second response do not start with a preset number, and the response content in the first response is the same as the response content in the second response, then any link is determined to be a vulnerable link.

[0189] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0190] Obtaining a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0191] Selecting the first character in an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0192] Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link;

[0193] Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time;

[0194] The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

[0195] In one embodiment, when the computer program is executed by a processor, the computer program further implements the following steps: constructing a growing character string based on the first character;

[0196] Determine a character to be added based on at least one potential vulnerability link, and add the character to the end of the growing string;

[0197] If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but duplicates an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and does not duplicate an existing link in the test link library. The final growing string is used as the candidate vulnerability link.

[0198] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining the last character in the growing character string, obtaining a growing character set consisting of characters directly following the last character in at least one potential vulnerability link; and selecting a character to be added from the growing character set.

[0199] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the adjacent distance between the last character and each character in the growing character set and the pheromone, the probability of each character in the growing character set being the character to be added is obtained, and the character corresponding to the maximum probability is used as the character to be added.

[0200] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if it is a valid link, the historical pheromone between each two adjacent characters in the growing string is updated based on the historical pheromone between each two adjacent characters in the growing string and the distance between each two adjacent characters in the growing string, where the historical pheromone is obtained during the last pheromone update process.

[0201] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented: for any character in the growing character set, if any character has not been the next character of the last character in at least one potential vulnerability link, then a preset adjacent distance is used as the adjacent distance between the last character and any character;

[0202] If any character has been the next character after the last character in at least one potential vulnerability link, the first occurrence of any character after the last character is counted;

[0203] Count the number of times the last character appears as the second character in at least one potential vulnerability link.

[0204] Determine the adjacent distance between the last character and any character according to the first number of occurrences and the second number of occurrences.

[0205] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: for any link in the test link library, based on login information, obtaining a cookie value representing identity information; the login information includes a system domain name, a login link, and a login account;

[0206] Assemble any link and the system domain name respectively to obtain a first complete test link without identity information of any link; assemble any link, the system domain name and the cookie value respectively to obtain a second complete test link with identity information of any link;

[0207] Accessing the first complete test link to obtain a first response of the first complete test link in a non-logged-in state, and accessing the second complete test link to obtain a second response of the second complete test link in a logged-in state;

[0208] If the status code in the first response and the status code in the second response do not start with a preset number, and the response content in the first response is the same as the response content in the second response, then any link is determined to be a vulnerable link.

[0209] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0210] Obtaining a test link library of the application under test, where the test link library includes at least one potential vulnerability link associated with the application under test;

[0211] Selecting the first character in an extended character set, where the extended character set includes characters included in at least one potential vulnerability link;

[0212] Based on the characters in the extended character set, a candidate vulnerability link starting with the first character is constructed, and the test link library is updated based on the candidate vulnerability link;

[0213] Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until the cumulative time when no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time;

[0214] The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

[0215] In one embodiment, when the computer program is executed by a processor, the computer program further implements the following steps: constructing a growing character string based on the first character;

[0216] Determine a character to be added based on at least one potential vulnerability link, and add the character to the end of the growing string;

[0217] If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but duplicates an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and does not duplicate an existing link in the test link library. The final growing string is used as the candidate vulnerability link.

[0218] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: determining the last character in the growing character string, obtaining a growing character set consisting of characters directly following the last character in at least one potential vulnerability link; and selecting a character to be added from the growing character set.

[0219] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the adjacent distance between the last character and each character in the growing character set and the pheromone, the probability of each character in the growing character set being the character to be added is obtained, and the character corresponding to the maximum probability is used as the character to be added.

[0220] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if it is a valid link, the historical pheromone between each two adjacent characters in the growing string is updated based on the historical pheromone between each two adjacent characters in the growing string and the distance between each two adjacent characters in the growing string, where the historical pheromone is obtained during the last pheromone update process.

[0221] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented: for any character in the growing character set, if any character has not been the next character of the last character in at least one potential vulnerability link, then a preset adjacent distance is used as the adjacent distance between the last character and any character;

[0222] If any character has been the next character after the last character in at least one potential vulnerability link, the first occurrence of any character after the last character is counted;

[0223] Count the number of times the last character appears as the second character in at least one potential vulnerability link.

[0224] Determine the adjacent distance between the last character and any character according to the first number of occurrences and the second number of occurrences.

[0225] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: for any link in the test link library, based on login information, obtaining a cookie value representing identity information; the login information includes a system domain name, a login link, and a login account;

[0226] Assemble any link and the system domain name respectively to obtain a first complete test link without identity information of any link; assemble any link, the system domain name and the cookie value respectively to obtain a second complete test link with identity information of any link;

[0227] Accessing the first complete test link to obtain a first response of the first complete test link in a non-logged-in state, and accessing the second complete test link to obtain a second response of the second complete test link in a logged-in state;

[0228] If the status code in the first response and the status code in the second response do not start with a preset number, and the response content in the first response is the same as the response content in the second response, then any link is determined to be a vulnerable link.

[0229] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0230] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0231] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A vulnerability link testing method, characterized in that: The method comprises: Obtaining a test link library of the application under test, wherein the test link library includes at least one potential vulnerability link associated with the application under test; Selecting a first character from an extended character set, where the extended character set includes characters included in the at least one potential vulnerability link; Based on the characters in the extended character set, construct a candidate vulnerability link starting with the first character, and update the test link library based on the candidate vulnerability link; Repeat the above process of selecting the first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until a cumulative time period during which no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time period; The access result of the tested application based on each link in the test link library is compared with the access result of the tested application based on the login information of the tested application and the same link, and the vulnerability link is determined according to the comparison result.

2. The method according to claim 1, characterized in that The step of constructing a candidate vulnerability link starting with the first character based on the characters in the extended character set includes: constructing a growing string based on the first character; Determining a character to be added based on the at least one potential vulnerability link, and adding the character to the end of the growing character string; If the number of characters in the growing string does not reach the preset number, determine whether the growing string is a valid link. If it is not a valid link or is a valid link but is a duplicate of an existing link in the test link library, repeat the above process of determining the characters to be added and adding them to the end of the growing string until the resulting growing string is a valid link and is not a duplicate of an existing link in the test link library. The final growing string is used as a candidate vulnerability link.

3. The method according to claim 2, characterized in that The determining of characters to be added based on the at least one potential vulnerability link includes: Determining the last character in the growing character string, and obtaining a growing character set consisting of characters directly following the last character in the at least one potential vulnerability link; Select a character to be added from the growing character set.

4. The method according to claim 3, characterized in that The step of selecting a character to be added from the growing character set includes: Based on the adjacent distance between the last character and each character in the growing character set and pheromone, the probability of each character in the growing character set being a character to be added is obtained, and the character corresponding to the maximum probability is used as the character to be added.

5. The method according to claim 4, characterized in that After determining whether the growing character string is a valid link, the method further includes: If it is a valid link, the historical pheromone between each two adjacent characters in the growing character string is updated according to the historical pheromone between each two adjacent characters in the growing character string and the distance between each two adjacent characters in the growing character string, wherein the historical pheromone is obtained in the last pheromone update process.

6. The method according to claim 4, characterized in that The process of obtaining the adjacent distance between the last character and each character in the growing character set includes: For any character in the growing character set, if the character has never been the next character of the last character in the at least one potential vulnerability link, a preset adjacent distance is used as the adjacent distance between the last character and the character; If any of the characters has been the next character of the last character in the at least one potential vulnerability link, then counting the first occurrence number of the character being the next character of the last character; Counting the number of times the last character appears as a second character in the at least one potential vulnerability link; The adjacent distance between the last character and any one of the characters is determined according to the first number of occurrences and the second number of occurrences.

7. The method according to any one of claims 1 to 6, characterized in that The step of comparing the access result of the application under test based on each link in the test link library with the access result of the application under test based on the same link through the login information of the application under test, and determining the vulnerability link according to the comparison result includes: For any link in the test link library, based on the login information, obtain a cookie value representing identity information; the login information includes the system domain name, login link and login account; Assembling the arbitrary link and the system domain name respectively to obtain a first complete test link without identity information of the arbitrary link, and assembling the arbitrary link, the system domain name and the cookie value respectively to obtain a second complete test link with identity information of the arbitrary link; Accessing the first complete test link to obtain a first response to the first complete test link in a non-logged-in state, and accessing the second complete test link to obtain a second response to the second complete test link in a logged-in state; If neither the status code in the first response nor the status code in the second response begins with a preset number, and the response content in the first response is the same as the response content in the second response, then it is determined that any one of the links is a vulnerable link.

8. A vulnerability link testing device, characterized in that: The device comprises: an acquisition module, configured to acquire a test link library of the application under test, wherein the test link library includes at least one potential vulnerability link associated with the application under test; a selection module, configured to select a first character from an extended character set, wherein the extended character set includes characters included in the at least one potential vulnerability link; A first building module is configured to build, based on characters in the extended character set, a candidate vulnerability link starting with the first character, and update the test link library based on the candidate vulnerability link; A second construction module is configured to repeatedly execute the above process of selecting a first character, constructing a candidate vulnerability link starting with the first character, and updating the test link library based on the candidate vulnerability link until a cumulative time period during which no new candidate vulnerability link is generated and no duplicate links are in the test link library reaches a preset time period; The access result analysis module is used to compare the access result of the tested application based on each link in the test link library with the access result of the tested application based on the login information of the tested application and the same link, and determine the vulnerability link according to the comparison result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images