Method and device for detecting GUID vulnerability in application system

Abstract

The application provides a GUID vulnerability detection method and device for an application system, and the method comprises the following steps: determining a standard version corresponding to a known GUID of the application system to be detected based on the known GUID; if the standard version corresponding to the known GUID is a time-based GUID version, extracting timestamp information, clock information and device identification information from a corresponding position of the known GUID; determining a timestamp range according to the timestamp information and determining a device identification range according to the device identification information; generating a plurality of test GUIDs through an enumeration method according to the timestamp range, the device identification range and the clock information; verifying the validity of each test GUID by using the application system to be detected; and determining a GUID vulnerability detection result in the application system to be detected according to the verification result. According to the scheme, whether the GUID in the application system is vulnerable can be detected.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for detecting GUID vulnerabilities in an application system. Background Technology

[0002] A globally unique identifier (GUID) is a 128-bit binary number generated by an algorithm. GUIDs are widely used, especially in web security, for user tokens, password resets, and temporary passwords. If attackers can predict GUIDs, it will seriously impact system security. Therefore, there is an urgent need to provide a vulnerability detection method for GUIDs in application systems. Summary of the Invention

[0003] This invention provides a method and apparatus for detecting GUID vulnerability in an application system, which can detect whether a GUID in the application system is vulnerable.

[0004] In a first aspect, embodiments of the present invention provide a method for detecting GUID vulnerability in an application system, comprising:

[0005] Based on the known GUID of the application system to be tested, determine the standard version corresponding to the known GUID;

[0006] If the standard version corresponding to the known GUID is a time-based GUID version, then according to the GUID data structure required by the time-based GUID version, the timestamp information, clock information and device identification information are extracted from the corresponding position of the known GUID.

[0007] The timestamp range is determined based on the timestamp information, and the device identifier range is determined based on the device identifier information;

[0008] Based on the timestamp range, the device identifier range, and the clock information, multiple test GUIDs are generated through enumeration.

[0009] The validity of each test GUID is verified using the application system under test, and the vulnerability detection result of the GUID in the application system under test is determined based on the verification result.

[0010] In one possible implementation, determining the timestamp range based on the timestamp information includes:

[0011] Determine whether the timestamp information is obtained after the generated timestamp has been processed by a timestamp processing algorithm;

[0012] If not, the timestamp information is determined as the generated timestamp, and the timestamp range is determined based on the generated timestamp and the preset time length;

[0013] If so, determine whether the generated timestamp can be parsed; if it is determined that the generated timestamp can be parsed, determine the timestamp range based on the generated timestamp and the preset time length.

[0014] In one possible implementation, determining whether the timestamp information is obtained by processing the generated timestamp using a timestamp processing algorithm includes:

[0015] Determine whether the timestamp information is within a preset time range. If not, determine that the timestamp information is obtained after the generated timestamp has been processed by a timestamp processing algorithm.

[0016] In one possible implementation, determining whether the generated timestamp can be parsed includes:

[0017] Based on the timestamp information of multiple known GUIDs, determine whether they have the same timestamp. The processing algorithm processes multiple generated timestamps within the preset time range to obtain the timestamp information of multiple known GUIDs one by one. If so, it is determined that the generated timestamp can be parsed.

[0018] In one possible implementation, determining the device identifier range based on the device identifier information includes:

[0019] Based on the known device identifiers obtained for the application system to be tested, it is determined whether the device identifier information exists in the known device identifiers. If it exists, the known device identifier is determined as a selectable device identifier within the range of device identifiers.

[0020] In one possible implementation, determining the standard version corresponding to the known GUID includes:

[0021] The standard version corresponding to a known GUID is determined based on the version identifier bit in the GUID.

[0022] One possible implementation also includes:

[0023] If the standard version corresponding to the known GUID is determined to be a random number-based GUID version based on the version identifier bit in the GUID, then the vulnerability detection result of the GUID in the application system to be tested is determined to be safe.

[0024] Secondly, embodiments of the present invention also provide a GUID vulnerability detection device for an application system, comprising:

[0025] The version determination unit is used to determine the standard version corresponding to the known GUID of the application system to be detected.

[0026] The extraction unit is used to extract timestamp information, clock information, and device identification information from the corresponding position of the known GUID when it is determined that the standard version corresponding to the known GUID is a time-based GUID version, according to the GUID data structure required by the time-based GUID version.

[0027] A range determination unit is used to determine a timestamp range based on the timestamp information and a device identifier range based on the device identifier information.

[0028] The generation unit is used to generate multiple test GUIDs by enumeration based on the timestamp range, the device identifier range, and the clock information;

[0029] The verification unit is used to verify the validity of each test GUID using the application system under test, and to determine the vulnerability detection result of the GUID in the application system under test based on the verification result.

[0030] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the method described in any embodiment of this specification.

[0031] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods described in any embodiment of this specification.

[0032] This invention provides a method and apparatus for detecting GUID vulnerabilities in an application system. From an attacker's perspective, a known GUID in the application system to be tested is obtained. Then, the standard version corresponding to the known GUID is determined. Since different standard versions require different data structures, when the standard version corresponding to the known GUID is determined to be a time-based GUID version, timestamp information, clock information, and device identification information can be extracted from the corresponding position of the known GUID. Next, by determining the timestamp range and device identification range, multiple test GUIDs can be generated using an enumeration method. The validity of the test GUIDs is verified to determine the vulnerability detection result of the GUID in the application system to be tested. Therefore, in this solution, an attack on the application system to be tested can be simulated through enumeration, thereby detecting the vulnerability of the GUID in the application system. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of a GUID vulnerability detection method in an application system provided by an embodiment of the present invention;

[0035] Figure 2 This is a hardware architecture diagram of an electronic device provided in an embodiment of the present invention;

[0036] Figure 3 This is a structural diagram of a GUID vulnerability detection device in an application system provided by an embodiment of the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0038] Different GUID versions have varying vulnerabilities, especially time-based GUID versions. Considering the GUIDs in an application system, if they are strictly generated according to time-based GUID versions, the GUIDs in the application system may have vulnerabilities. Therefore, we can enumerate test GUIDs based on known GUIDs to simulate attacks on the application system, thereby detecting whether GUID vulnerabilities exist.

[0039] The following describes the specific implementation of the above concept.

[0040] Please refer to Figure 1 This invention provides a method for detecting GUID vulnerability in an application system, the method comprising:

[0041] Step 100: Based on the known GUID of the application system to be tested, determine the standard version corresponding to the known GUID;

[0042] Step 102: If the standard version corresponding to the known GUID is a time-based GUID version, then according to the GUID data structure required by the time-based GUID version, extract the timestamp information, clock information and device identification information from the corresponding position of the known GUID.

[0043] Step 104: Determine the timestamp range based on the timestamp information, and determine the device identifier range based on the device identifier information;

[0044] Step 106: Generate multiple test GUIDs by enumeration based on the timestamp range, the device identifier range, and the clock information;

[0045] Step 108: Verify the validity of each test GUID using the application system under test, and determine the vulnerability detection result of the GUID in the application system under test based on the verification result.

[0046] In this embodiment of the invention, a known GUID in the application system to be tested is obtained from the attacker's perspective. Then, the standard version corresponding to the known GUID is determined. Since different standard versions require different data structures, when the standard version corresponding to the known GUID is determined to be a time-based GUID version, timestamp information, clock information, and device identification information can be extracted from the corresponding position of the known GUID. Next, by determining the timestamp range and device identification range, multiple test GUIDs can be generated using an enumeration method. The validity of the test GUIDs is verified to determine the vulnerability detection result of the GUIDs in the application system to be tested. Therefore, in this solution, an attack on the application system to be tested can be simulated using an enumeration method, thereby detecting the vulnerability of the GUIDs in the application system.

[0047] The following description Figure 1 The execution method for each step is shown.

[0048] First, for step 100, based on the known GUID of the application system to be tested, determine the standard version corresponding to the known GUID.

[0049] The application system to be tested can be a browser, access control card management system, or other application system that uses GUIDs. To detect vulnerabilities in the GUIDs of the application system, the attacker can obtain the GUIDs currently used by the application system under test. This can be done through browser cookies or network packet sniffing tools. The obtained GUID is then used as the known GUID of the application system under test. This known GUID can be one or multiple.

[0050] The standard form of a GUID is a string of 32 hexadecimal digits, divided into five parts, such as: 467e8542-2275-4163-95d6-7adc205580a9, where each part contains 8-4-4-4-12 characters. To meet different needs, the standard provides multiple GUID versions, each with a different generation algorithm.

[0051] In this embodiment of the invention, when determining the standard version corresponding to the known GUID, the standard version corresponding to the known GUID can be determined based on the version identifier bit in the GUID.

[0052] Specifically, the version identifier bit in the GUID has a one-to-one correspondence with the standard version number, and the standard version number is determined based on this correspondence and the version identifier bit in the GUID.

[0053] In this embodiment of the invention, the standard version may include at least: a time-based GUID version and a random number-based GUID. Each standard version requires a different GUID data structure. Specifically, the time-based GUID version is generated based on the current timestamp, clock information, and device identifier; the random number-based GUID version is generated based on random numbers or pseudo-random numbers.

[0054] For GUID versions based on random numbers, since the GUID is generated based on random or pseudo-random numbers, the generated GUID has randomness. In this embodiment of the invention, if the standard version corresponding to the known GUID is determined to be a GUID version based on the version identifier bit in the GUID, then the vulnerability detection result of the GUID in the application system to be tested is determined to be secure.

[0055] It should be noted that, in determining the standard version corresponding to a known GUID, in addition to using the version identifier bit mentioned above, the GUID data structure can also be used.

[0056] Then, for step 102, if the standard version corresponding to the known GUID is a time-based GUID version, then according to the GUID data structure required by the time-based GUID version, the timestamp information, clock information and device identification information are extracted from the corresponding position of the known GUID.

[0057] As can be seen from step 100 above, the time-based GUID version is generated based on the current timestamp, clock information, and device identifier. In other words, the GUID data structure of the time-based GUID version includes three parts: timestamp information, clock information, and device identifier information. Therefore, the timestamp information, clock information, and device identifier information can be directly extracted from the corresponding positions of the known GUID.

[0058] Next, we will explain steps 104, "determine the timestamp range based on the timestamp information and the device identifier range based on the device identifier information," and 106, "generate multiple test GUIDs by enumeration based on the timestamp range, the device identifier range, and the clock information."

[0059] From an attacker's perspective, if it is determined that the known GUID is a time-based GUID version, then it can be assumed that all GUIDs used in the application system under investigation are time-based GUID versions. Thus, the known GUID can be used to predict other GUIDs used in the application system under investigation.

[0060] When generating a GUID from a time-based GUID version, at least the following two processing methods can be used:

[0061] Method 1: Directly stack the generated timestamp, clock information, and device identifier into the corresponding positions;

[0062] Method 2: After processing the generated timestamp using a timestamp processing algorithm, and / or after processing the device identifier using an identifier processing algorithm, place the resulting timestamp information, clock information, and device identifier information in the corresponding locations.

[0063] Since attackers cannot know which method the time-based GUID version is used to generate the GUID in the application system under test, they can use enumeration to generate test GUIDs for verification. However, enumeration requires knowledge of the timestamp range and device identifier range to predict the GUIDs that might be used in the system under test.

[0064] In this embodiment of the invention, determining the timestamp range based on timestamp information may specifically include the following steps S1 to S3:

[0065] S1: Determine whether the timestamp information is obtained by processing the generated timestamp using a timestamp processing algorithm; if not, proceed to S2; if yes, proceed to S3.

[0066] S2: Determine the timestamp information as the generated timestamp, and determine the timestamp range based on the generated timestamp and the preset time length;

[0067] S3: Determine whether the generated timestamp can be parsed; if it is determined that the generated timestamp can be parsed, then determine the timestamp range based on the generated timestamp and the preset time length.

[0068] In this embodiment of the invention, the timestamp information can be directly determined as the generation timestamp of the known GUID, and then the generation timestamp can be used to determine the timestamp range. However, if the timestamp information of the known GUID is generated based on the timestamp generated in Method 2 above and processed by the timestamp processing algorithm, then the determined timestamp range will have errors, causing errors in the enumerated test GUIDs, and thus affecting the vulnerability detection results.

[0069] Therefore, step S1 is used to make a preliminary determination of the timestamp information. If the timestamp information is obtained by processing the generated timestamp using a timestamp processing algorithm, then the generated timestamp needs to be further parsed.

[0070] In step S1, it can be determined whether the timestamp information is obtained after the generated timestamp has been processed by the timestamp processing algorithm in the following way: determine whether the timestamp information is within a preset time range; if not, then determine that the timestamp information is obtained after the generated timestamp has been processed by the timestamp processing algorithm.

[0071] The preset time range can be set according to the actual situation.

[0072] For example, if the current time is December 1, 2022, then the preset time range can be from January 1, 2015 to December 1, 2022. If the timestamp information is used to represent a timestamp and the timestamp information is within the preset range, then it can be determined that the timestamp information is a generated timestamp. Otherwise, it is determined that the timestamp information is obtained by processing the generated timestamp using a timestamp processing algorithm.

[0073] In step S3, if the timestamp information is obtained by processing the generated timestamp using a timestamp processing algorithm, then a single known GUID cannot be used to parse the generated timestamp; multiple known GUIDs are required. Specifically, this may include: based on the timestamp information of multiple known GUIDs, determining whether they have the same timestamp processing algorithm to process multiple generated timestamps within the preset time range and obtain the timestamp information of multiple known GUIDs one-to-one; if so, then it is determined that the generated timestamp can be parsed.

[0074] If the same timestamp processing algorithm processes multiple generated timestamps within a preset time range to obtain timestamp information for multiple known GUIDs, it indicates that the same timestamp processing algorithm is the one used by the application system under test when generating GUIDs using method two. Therefore, the corresponding generated timestamps can be parsed using this timestamp processing algorithm. Accordingly, this timestamp processing algorithm needs to be used to generate the test GUID.

[0075] Furthermore, when determining the range of device identifiers based on device identifier information, it can also be determined based on the method for determining the timestamp range.

[0076] In another implementation, the device identifier range can be determined as follows: based on the known device identifiers obtained for the application system to be tested, determine whether the device identifier information exists in the known device identifiers; if it exists, then the known device identifiers are determined as the device identifier range.

[0077] The known device identifier can be obtained from intelligence databases or network packet-scraping tools. If the known device identifier contains device identifier information extracted from a known GUID, it indicates that the device identifier has been placed directly in the corresponding position of the GUID according to the data structure required by the time-based GUID version without processing. In this way, the known device identifier can be directly identified as a selectable device identifier within the range of device identifiers.

[0078] In this embodiment of the invention, when generating multiple test GUIDs through enumeration in step 106, a timestamp can be selected from a timestamp range as the generation timestamp, and a device identifier can be selected from a device identifier range. The selected generation timestamp, device identifier, and clock information are then combined to obtain a test GUID. It can be understood that if the timestamp processing algorithm and device identifier processing algorithm are parsed when generating the timestamp range or device identifier range, the selected generation timestamp and device identifier need to be processed using the same timestamp processing algorithm and device identifier processing algorithm. Then, the processed timestamp information, device identifier information, and clock information are combined to obtain the test GUID.

[0079] Finally, for step 108, the validity of each test GUID is verified using the application system under test, and the vulnerability detection result of the GUID in the application system under test is determined based on the verification result.

[0080] When performing validity verification, the GUID can be verified one by one according to the application scenario of the application system to be tested. Concurrent processing can be used during verification to improve the verification speed.

[0081] For example, if the application system to be tested is an access control card system, it can be determined whether the test GUID can open the access control. If it can, the test GUID is determined to be valid; otherwise, the test GUID is determined to be invalid.

[0082] In this embodiment of the invention, the vulnerability detection result can be determined by setting a threshold. For example, if the validity verification result shows that there are at least a set threshold of valid test GUIDs, then the vulnerability detection result of the GUIDs in the application system to be tested is determined to be insecure.

[0083] like Figure 2 , Figure 3 As shown, this embodiment of the invention provides a GUID vulnerability detection device for an application system. The device embodiment can be implemented through software, hardware, or a combination of both. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware architecture diagram of an electronic device containing a GUID vulnerability detection device in an application system provided by an embodiment of the present invention. Except for... Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 3 As shown, a device in a logical sense is formed by the CPU of the electronic device in which it resides reading the corresponding computer program from non-volatile memory into memory for execution. This embodiment provides a GUID vulnerability detection device for an application system, comprising:

[0084] Version determination unit 301 is used to determine the standard version corresponding to the known GUID of the application system to be detected;

[0085] Extraction unit 302 is used to extract timestamp information, clock information and device identification information from the corresponding position of the known GUID when it is determined that the standard version corresponding to the known GUID is a time-based GUID version, according to the GUID data structure required by the time-based GUID version.

[0086] The range determination unit 303 is used to determine the timestamp range based on the timestamp information and to determine the device identification range based on the device identification information.

[0087] The generation unit 304 is used to generate multiple test GUIDs by enumeration based on the timestamp range, the device identifier range, and the clock information;

[0088] The verification unit 305 is used to verify the validity of each test GUID using the application system under test, and to determine the vulnerability detection result of the GUID in the application system under test based on the verification result.

[0089] In one embodiment of the present invention, when the range determination unit determines the timestamp range based on the timestamp information, it specifically includes: determining whether the timestamp information is obtained by processing a generated timestamp using a timestamp processing algorithm; if not, determining the timestamp information as a generated timestamp, and determining the timestamp range based on the generated timestamp and a preset time length; if yes, determining whether the generated timestamp can be parsed; if it is determined that the generated timestamp can be parsed, determining the timestamp range based on the generated timestamp and the preset time length.

[0090] In one embodiment of the present invention, when the range determination unit determines whether the timestamp information is obtained after the generated timestamp has been processed by the timestamp processing algorithm, it specifically includes: determining whether the timestamp information is within a preset time range; if not, determining that the timestamp information is obtained after the generated timestamp has been processed by the timestamp processing algorithm.

[0091] In one embodiment of the present invention, when the range determination unit determines whether the generated timestamp can be parsed, it specifically includes: based on the timestamp information of multiple known GUIDs, determining whether there is a common timestamp processing algorithm that processes multiple generated timestamps within the preset time range to obtain the timestamp information of multiple known GUIDs one by one; if so, it is determined that the generated timestamp can be parsed.

[0092] In one embodiment of the present invention, when the range determination unit determines the range of device identifiers based on the device identifier information, it specifically includes: determining whether the device identifier information exists in the known device identifiers based on the known device identifiers obtained for the application system to be detected; if it exists, then determining the known device identifiers as selectable device identifiers within the range of device identifiers.

[0093] In one embodiment of the present invention, the version determination unit is specifically used to determine the standard version corresponding to the known GUID based on the version identifier bit in the GUID.

[0094] In one embodiment of the present invention, the version determination unit is further configured to determine that the vulnerability detection result of the GUID in the application system to be tested is safe when the standard version corresponding to the known GUID is determined to be a GUID version based on random numbers based on the version identifier bit in the GUID.

[0095] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on a GUID vulnerability detection device in an application system. In other embodiments of the present invention, a GUID vulnerability detection device in an application system may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0096] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description of the method embodiment of the present invention, and will not be repeated here.

[0097] This invention also provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements a GUID vulnerability detection method in an application system according to any embodiment of this invention.

[0098] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform a GUID vulnerability detection method in an application system according to any embodiment of this invention.

[0099] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0100] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0101] Examples of storage media used to provide program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0102] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0103] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion module connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion module execute some and all of the actual operations, thereby realizing the function of any of the above embodiments.

[0104] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0105] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting GUID vulnerability in an application system, characterized in that, include: Based on the known GUID of the application system to be tested, determine the standard version corresponding to the known GUID; If the standard version corresponding to the known GUID is a time-based GUID version, then according to the GUID data structure required by the time-based GUID version, the timestamp information, clock information and device identification information are extracted from the corresponding position of the known GUID. The timestamp range is determined based on the timestamp information, and the device identifier range is determined based on the device identifier information; Based on the timestamp range, the device identifier range, and the clock information, multiple test GUIDs are generated through enumeration. The validity of each test GUID is verified using the application system under test, and the vulnerability detection result of the GUID in the application system under test is determined based on the verification result.

2. The method according to claim 1, characterized in that, Determining the timestamp range based on the timestamp information includes: Determine whether the timestamp information is obtained after the generated timestamp has been processed by a timestamp processing algorithm; If not, the timestamp information is determined as the generated timestamp, and the timestamp range is determined based on the generated timestamp and the preset time length; If so, determine whether the generated timestamp can be parsed; if it is determined that the generated timestamp can be parsed, determine the timestamp range based on the generated timestamp and the preset time length.

3. The method according to claim 2, characterized in that, Determining whether the timestamp information is obtained after the generated timestamp has been processed by a timestamp processing algorithm includes: Determine whether the timestamp information is within a preset time range. If not, determine that the timestamp information is obtained after the generated timestamp has been processed by a timestamp processing algorithm.

4. The method according to claim 3, characterized in that, The determination of whether the generated timestamp can be parsed includes: Based on the timestamp information of multiple known GUIDs, determine whether they have the same timestamp. The processing algorithm processes multiple generated timestamps within the preset time range to obtain the timestamp information of multiple known GUIDs one by one. If so, it is determined that the generated timestamp can be parsed.

5. The method according to claim 1, characterized in that, The step of determining the device identifier range based on the device identifier information includes: Based on the known device identifiers obtained for the application system to be tested, it is determined whether the device identifier information exists in the known device identifiers. If it exists, the known device identifier is determined as a selectable device identifier within the range of device identifiers.

6. The method according to any one of claims 1-5, characterized in that, Determining the standard version corresponding to the known GUID includes: The standard version corresponding to a known GUID is determined based on the version identifier bit in the GUID.

7. The method according to claim 6, characterized in that, Also includes: If the standard version corresponding to the known GUID is determined to be a random number-based GUID version based on the version identifier bit in the GUID, then the vulnerability detection result of the GUID in the application system to be tested is determined to be safe.

8. A GUID vulnerability detection device in an application system, characterized in that, include: The version determination unit is used to determine the standard version corresponding to the known GUID of the application system to be detected. The extraction unit is used to extract timestamp information, clock information, and device identification information from the corresponding position of the known GUID when it is determined that the standard version corresponding to the known GUID is a time-based GUID version, according to the GUID data structure required by the time-based GUID version. A range determination unit is used to determine a timestamp range based on the timestamp information and a device identifier range based on the device identifier information. The generation unit is used to generate multiple test GUIDs by enumeration based on the timestamp range, the device identifier range, and the clock information; The verification unit is used to verify the validity of each test GUID using the application system under test, and to determine the vulnerability detection result of the GUID in the application system under test based on the verification result.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-7.

Images