Method, device and equipment for detecting hijacked vulnerability information and storage medium
By automatically creating test cases using a keyword information database, the problem of time-consuming and labor-intensive manual detection of website hijacking vulnerabilities is solved, achieving efficient vulnerability detection and accurate location.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- AGRICULTURAL BANK OF CHINA
- Filing Date
- 2022-11-28
- Publication Date
- 2026-05-15
AI Technical Summary
In existing technologies, manually detecting website hijacking vulnerabilities is time-consuming, labor-intensive, and has low detection efficiency.
By using a keyword database and website message information, multiple test cases corresponding to callback keywords are automatically created, and these test cases are used to detect website hijacking vulnerabilities.
It improves the efficiency of detecting website hijacking vulnerabilities, and can automatically discover and accurately locate vulnerability keywords, which is more efficient than manual detection.
Smart Images
Figure CN116094751B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, device and storage medium for detecting hijacking vulnerability information. Background Technology
[0002] In recent years, cross-domain communication requests in business applications have become increasingly common. Cross-domain communication can leverage JSONP technology to bypass the same-origin policy, enabling communication between different servers. However, some websites may contain hijacking vulnerabilities, allowing other websites to obtain users' personal information from the compromised website through cross-domain communication. Therefore, to improve website security, it is necessary to detect and address website hijacking vulnerabilities.
[0003] In existing technologies, website hijacking vulnerabilities are typically detected manually. First, test cases are created manually and sent to the website; then, the website's response is used to determine its hijacking vulnerabilities.
[0004] However, the inventors discovered that the existing technology has at least the following technical problems: manually detecting website hijacking vulnerabilities is time-consuming, labor-intensive, and has low detection efficiency. Summary of the Invention
[0005] This application provides a method, apparatus, device, and storage medium for detecting hijacking vulnerability information, which can improve the detection efficiency of hijacking vulnerability information.
[0006] Firstly, this application provides a method for detecting hijacking vulnerability information, including:
[0007] Obtain message information from the website to be detected, including request messages and response messages;
[0008] Based on the keyword information database, at least one callback keyword corresponding to the message information is determined;
[0009] Create a set of test cases corresponding to the at least one callback keyword, wherein the set of test cases includes at least one test case;
[0010] Based on at least one test case, detect hijacking vulnerability information of the website to be tested.
[0011] In one possible design, the keyword information database includes multiple test keywords;
[0012] The step of determining at least one callback keyword corresponding to the message information based on the keyword information database includes: filtering at least one target keyword that is the same as the plurality of test keywords from the message information; and using the at least one target keyword as at least one callback keyword corresponding to the message information.
[0013] In one possible design, the method further includes: if there is no target keyword in the message information that is the same as the plurality of test keywords, then the plurality of test keywords are used as at least one callback keyword corresponding to the message information.
[0014] In one possible design, creating a test case set corresponding to the at least one callback keyword includes: determining at least one callback function corresponding to the at least one callback keyword; and creating a test case set corresponding to the at least one callback keyword based on the at least one callback keyword and the at least one callback function.
[0015] In one possible design, creating a set of test cases corresponding to the at least one callback keyword based on the at least one callback keyword and the at least one callback function includes: for each callback keyword, constructing the function following the callback keyword as the callback function corresponding to the callback keyword; adding the callback keyword and the callback function to the request message to obtain at least one test case.
[0016] In one possible design, detecting hijacking vulnerability information of the website to be tested based on at least one test case includes: for each test case, parsing the Uniform Resource Locator (URL) in the test case, the URL including a callback keyword and a callback function; if the parameters of the callback function returned by the website to be tested contain user information, then the callback keyword corresponding to the test case is determined to be the callback keyword that generates the vulnerability, and the website to be tested is determined to have a hijacking vulnerability.
[0017] In one possible design, it also includes: displaying hijacking vulnerability information of the website to be detected.
[0018] In one possible design, the keyword information database includes multiple test keywords such as: callback, cb, jsonp, jsonpcallback, jcb, CALLBACK, CB, JSONP, JSONPCALLBACK, and JCB.
[0019] Secondly, this application provides a device for detecting hijacking vulnerability information, comprising:
[0020] The acquisition module is used to acquire message information of the website to be detected, including request messages and return messages;
[0021] The determination module is used to determine at least one callback keyword corresponding to the message information based on the keyword information database;
[0022] A creation module is used to create a set of test cases corresponding to the at least one callback keyword, wherein the set of test cases includes at least one test case.
[0023] The detection module is used to detect hijacking vulnerability information of the website to be detected based on at least one test case.
[0024] Thirdly, the present invention provides an electronic device, comprising: at least one processor and a memory;
[0025] The memory stores computer-executed instructions;
[0026] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the hijacking vulnerability information detection method as described in the first aspect above.
[0027] Fourthly, the present invention provides a computer storage medium storing computer execution instructions, wherein when a processor executes the computer execution instructions, the method for detecting hijacking vulnerability information as described in the first aspect above is implemented.
[0028] Fifthly, this application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it implements the hijacking vulnerability information detection method described in the first aspect above.
[0029] The method, apparatus, device, and storage medium for detecting hijacking vulnerability information provided in this application first determine multiple callback keywords using a keyword database and website message information; then, multiple test cases corresponding to these callback keywords are created, and the hijacking vulnerability information of the website is detected through these multiple test cases. Therefore, this application can automatically create multiple test cases corresponding to multiple callback keywords and detect website hijacking vulnerability information through these multiple test cases, thus improving detection efficiency compared to manual detection. Attached Figure Description
[0030] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0031] Figure 1 The flowchart of the hijacking vulnerability information detection method provided in the embodiments of this application Figure 1 ;
[0032] Figure 2 This is a schematic diagram of a method for detecting hijacking vulnerability information provided in an embodiment of this application;
[0033] Figure 3 The flowchart of the hijacking vulnerability information detection method provided in the embodiments of this application Figure 2 ;
[0034] Figure 4 The flowchart of the hijacking vulnerability information detection method provided in the embodiments of this application Figure 3 ;
[0035] Figure 5 A schematic diagram of the structure of the hijacking vulnerability information detection device provided in the embodiments of this application;
[0036] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.
[0037] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0038] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0039] The collection, storage, use, processing, transmission, provision, and disclosure of image data or user data and other information involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0040] In recent years, cross-domain communication requests in business applications have become increasingly common. Cross-domain communication can leverage JSONP technology to bypass the same-origin policy, enabling communication between different servers. However, some websites may have hijacking vulnerabilities, allowing other websites to obtain users' personal information from vulnerable sites through cross-domain communication. For example, JSONP technology utilizes the fact that the `src` attribute of the `<script>` tag is unaffected by the same-origin policy, enabling cross-domain data access. The process by which attackers exploit JSONP's cross-domain access capabilities to obtain the victim's user information is known as JSONP cross-domain hijacking. For instance, when a terminal accesses website X, it also sends a request URL to another website Y through its browser. Website Y's response to the terminal includes a callback function (JS code) and a JS tag requesting website X. If website X directly returns data to the other website's JSONP request without performing security checks, a JSONP cross-domain hijacking vulnerability exists. After receiving the request, website X generates the necessary data in JSON format and returns the JSON data containing the terminal user's information as a parameter to the callback function. Ultimately, website Y can exploit this JSONP cross-domain hijacking vulnerability to obtain the terminal user's information on website X.
[0041] Therefore, to improve website security, it is necessary to detect website hijacking vulnerabilities. Currently, this is generally done manually. First, test cases are created manually and sent to the website; then, the website's response is used to determine the website's hijacking vulnerabilities. However, manual detection of website hijacking vulnerabilities is time-consuming, labor-intensive, and inefficient.
[0042] To address the aforementioned technical issues, this application proposes the following technical concept: First, obtain the website's message information; then, determine multiple callback keywords using a keyword database and the website's message information; next, create multiple test cases corresponding to these callback keywords, and then use these multiple test cases to detect website hijacking vulnerabilities. In other words, automatically creating multiple test cases corresponding to multiple callback keywords and using these multiple test cases to detect website hijacking vulnerabilities improves detection efficiency.
[0043] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0044] This application provides a method for detecting hijacking vulnerability information. The method in this application can be executed by a server. Figure 1The flowchart of the hijacking vulnerability information detection method provided in the embodiments of this application Figure 1 .like Figure 1 As shown, the method includes:
[0045] Step S101: Obtain the message information of the website to be detected. The message information includes request messages and return messages.
[0046] In embodiments of the present invention, such as Figure 2 As shown, the request and response messages of the website application interface can be obtained through the message parsing module. The request message can be a transaction request sent to the website. The response message can be the website's response to the transaction request.
[0047] Step S102: Based on the keyword information database, determine at least one callback keyword corresponding to the message information.
[0048] Optional, such as Figure 2 As shown, by using the keyword information database, the callback keywords in the request and response messages are filtered to obtain at least one callback keyword corresponding to the message information.
[0049] For example, the keyword information database includes several test keywords such as: callback, cb, jsonp, jsonpcallback, jcb, CALLBACK, CB, JSONP, JSONPCALLBACK, and JCB.
[0050] It should be noted that the keyword database includes multiple test keywords, and there is no specific limit to the number of test keywords. For example, the keyword database can be an expandable data dictionary. The test keywords in this expandable data dictionary are not limited by data type or data volume and can be arbitrarily expanded.
[0051] Step S103: Create a test case set corresponding to at least one callback keyword. The test case set includes at least one test case.
[0052] In the embodiments of the present invention, see continue to see Figure 2 The automated test case construction module can be used to build test cases corresponding to each callback keyword, thus obtaining a set of test cases.
[0053] Step S104: Based on at least one test case, detect the hijacking vulnerability information of the website to be tested.
[0054] Optionally, the hijacking vulnerability information is used to indicate whether the website to be tested has a hijacking vulnerability and the callback keyword that generates the hijacking vulnerability. Accordingly, this step is as follows: For each test case, parse the Uniform Resource Locator (URL) in the test case. The URL includes the callback keyword and the callback function. If the parameters of the callback function returned by the website to be tested contain user information, then the callback keyword corresponding to the test case is determined to be the callback keyword that generates the vulnerability, and the website to be tested is determined to have a hijacking vulnerability.
[0055] Optionally, if for each test case, the callback function returned by the website to be tested does not contain user information in its parameters, then it is determined that the website to be tested does not have a hijacking vulnerability.
[0056] For example, see [link to example]. Figure 2 The process involves the following steps: The test execution and analysis module automatically invokes test cases from the interface test case set sequentially to perform JSONP cross-domain hijacking vulnerability enumeration and detection on the website application interface. For interfaces with JSONP cross-domain hijacking vulnerabilities, the URL is parsed, and JSONP data containing user information is encapsulated and returned as a parameter to the callback function. After the data is returned, the callback function processes the hijacked JSONP data containing user information to obtain the user information. Finally, the hijacking vulnerability information of the website under test is obtained, enabling the discovery of JSONP cross-domain hijacking vulnerabilities and precise identification of the keywords that cause the vulnerability.
[0057] The hijacking vulnerability detection method provided in this application first identifies multiple callback keywords using a keyword database and website message information; then, it creates multiple test cases corresponding to these callback keywords, and finally detects website hijacking vulnerabilities using these test cases. Therefore, this application can automatically create multiple test cases corresponding to multiple callback keywords and detect website hijacking vulnerabilities using these test cases, thus improving detection efficiency compared to manual detection.
[0058] Figure 3 The flowchart of the hijacking vulnerability information detection method provided in the embodiments of the present invention Figure 2 In this embodiment of the invention, in Figure 1 Based on the provided embodiments, the specific implementation method for determining at least one callback keyword corresponding to the message information in S102 based on the keyword information database is described in detail. For example... Figure 3 As shown, the method includes:
[0059] Step S301: Filter out at least one target keyword from the message information that is the same as multiple test keywords.
[0060] In this embodiment of the invention, the test keywords in the message information are filtered according to multiple test keywords to obtain at least one target keyword in the message information that is the same as the multiple test keywords.
[0061] For example, the keyword information database includes multiple test keywords: callback, cb, jsonp, jsonpcallback, and jcb; the message information includes the test keyword callback. Based on these multiple test keywords, the test keywords in the message information are filtered to obtain the target keyword callback that is the same as the multiple test keywords.
[0062] Step S302: Use at least one target keyword as at least one callback keyword corresponding to the message information.
[0063] In this embodiment of the invention, at least one target keyword selected from the message information is used as at least one callback keyword corresponding to the message information.
[0064] In this embodiment of the invention, when the target keyword exists in the message information, the hijacking vulnerability information of the website can be quickly determined directly through the callback keyword in the message information, thus improving the efficiency of vulnerability detection.
[0065] Step S303: If there is no target keyword in the message information that is the same as multiple test keywords, then the multiple test keywords are used as at least one callback keyword corresponding to the message information.
[0066] For example, the keyword information database includes multiple test keywords: callback, cb, jsonp, jsonpcallback, and jcb. If the message information does not contain a target keyword that is the same as multiple test keywords, then the multiple test keywords callback, cb, jsonp, jsonpcallback, and jcb are used as at least one callback keyword corresponding to the message information. For example, see [link to example]. Figure 2 This will use multiple test keywords from the scalable data dictionary as callback keys.
[0067] In this embodiment of the invention, even when the target keyword is not present in the message information, multiple test keywords can be used as callback keywords to effectively discover deeply hidden JSONP cross-domain hijacking vulnerabilities in the website and accurately determine the callback keywords that cause the vulnerability, thereby improving the efficiency and accuracy of vulnerability detection.
[0068] Figure 4 The flowchart of the hijacking vulnerability information detection method provided in the embodiments of the present invention Figure 3 In this embodiment of the invention, in Figure 1Based on the provided embodiments, the specific implementation method for creating a test case set corresponding to at least one callback keyword in S103 is described in detail. For example... Figure 4 As shown, the method includes:
[0069] Step S401: Determine at least one callback function corresponding to at least one callback keyword.
[0070] In this embodiment of the invention, one callback keyword corresponds to one callback function. Optionally, the server stores the association relationship between callback keywords and callback functions. Accordingly, this step is as follows: for each callback keyword, retrieve the callback function corresponding to that callback keyword from the stored association relationship between callback keywords and callback functions.
[0071] Step S402: Based on at least one callback keyword and at least one callback function, create a set of test cases corresponding to at least one callback keyword.
[0072] Optionally, this step is as follows: for each callback keyword, construct the function following the callback keyword as the callback function corresponding to the callback keyword; add the callback keyword and callback function to the request message to obtain at least one test case.
[0073] For example, when there is only one callback keyword, the function following the callback keyword is directly constructed as the callback function corresponding to the callback keyword; the callback keyword and callback function are then added to the request message. <script>标签的src属性中，得到测试用例。
[0074] 示例性的，继续参见图2，当回调关键词为多个时，可以通过自动化用例构造模块，使用逐一遍历的方法将这些回调关键词和回调函数添加到请求报文<script>标签的src属性中，得到多个测试用例，形成测试用例集合。
[0075] 需要说明的是，本申请在确定网站的劫持漏洞信息之后，还可以显示该网站的劫持漏洞信息。
[0076] 相应的，该方法还包括：展示待检测的网站的劫持漏洞信息。示例性的，展示待检测的网站的劫持漏洞信息为：网站A存在劫持漏洞，产生劫持漏洞的回调关键词是callback。
[0077] 需要说明的是，现有的自动检测JSONP跨域劫持漏洞的方案中一般输入数量有限，发现漏洞存在一定的几率，准确性较低。而本申请的优点在于创新了JSONP跨域劫持漏洞自动化接口测试用例构造方案：一方面，使用可扩展的数据字典，构造出大量不同类型的Payload(Payload，有效载荷)，也即有效接口测试自动化输入数据(在本申请中具体指多个测试关键词)。另一方面，依次针对回调关键词使用逐一遍历的方法自动化构造出接口测试用例集合，对Web应用接口进行枚举检测，可以根据回调函数的输出，有效地发现程序中隐藏较深的JSONP跨域劫持漏洞，并精准确定产生漏洞的回调关键词，极大地提高该类漏洞的检测效率和成功率。
[0078] 图5为本申请实施例提供的劫持漏洞信息的检测装置的结构示意图。如图5所示，该劫持漏洞信息的检测装置，包括：获取模块501、确定模块502、创建模块503和检测模块504。
[0079] 其中，获取模块501，用于获取待检测的网站的报文信息，报文信息包括请求报文和返回报文；
[0080] 确定模块502，用于基于关键词信息库，确定报文信息对应的至少一个回调关键词；
[0081] 创建模块503，用于创建至少一个回调关键词对应的测试用例集合，测试用例集合包括至少一个测试用例；
[0082] 检测模块504，用于基于至少一个测试用例，检测待检测的网站的劫持漏洞信息。
[0083] 在一种可能的设计中，关键词信息库包括多个测试关键词；确定模块502基于关键词信息库，确定报文信息对应的至少一个回调关键词，具体包括：从报文信息中筛选出与多个测试关键词相同的至少一个目标关键词；将至少一个目标关键词作为报文信息对应的至少一个回调关键词。
[0084] 在一种可能的设计中，确定模块502，用于若报文信息中不存在与多个测试关键词相同的目标关键词，则将多个测试关键词作为报文信息对应的至少一个回调关键词。
[0085] 在一种可能的设计中，创建模块503创建至少一个回调关键词对应的测试用例集合，具体包括：确定至少一个回调关键词对应的至少一个回调函数；基于至少一个回调关键词和至少一个回调函数，创建至少一个回调关键词对应的测试用例集合。
[0086] 在一种可能的设计中，创建模块503基于至少一个回调关键词和至少一个回调函数，创建至少一个回调关键词对应的测试用例集合，具体包括：对于每个回调关键词，将回调关键词后面的函数构造为回调关键词对应的回调函数；将回调关键词和回调函数添加到请求报文中，得到至少一个测试用例。
[0087] 在一种可能的设计中，检测模块504基于至少一个测试用例，检测待检测的网站的劫持漏洞信息，具体包括：对于每个测试用例，解析测试用例中的统一资源定位系统URL，URL包括回调关键词和回调函数；若待检测的网站返回的回调函数的参数中包含用户信息，则确定测试用例对应的回调关键词为产生漏洞的回调关键词，并确定待检测的网站存在劫持漏洞。
[0088] 在一种可能的设计中，该装置还包括展示模块。展示模块，用于展示待检测的网站的劫持漏洞信息。
[0089] 本申请实施例提供的劫持漏洞信息的检测装置，可用于执行上述实施例中劫持漏洞信息的检测方法的技术方案，其实现原理和技术效果类似，在此不再赘述。
[0090] 需要说明的是，应理解以上装置的各个模块的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且这些模块可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分模块通过处理元件调用软件的形式实现，部分模块通过硬件的形式实现。例如，获取模块501可以为单独设立的处理元件，也可以集成在上述装置的某一个芯片中实现，此外，也可以以程序代码的形式存储于上述装置的存储器中，由上述装置的某一个处理元件调用并执行以上获取模块501的功能。其它模块的实现与之类似。此外这些模块全部或部分可以集成在一起，也可以独立实现。这里的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
[0091] 图6为本申请实施例提供的电子设备的结构示意图。如图6所示，该电子设备可以包括：收发器601、处理器602、存储器603。
[0092] 处理器602执行存储器存储的计算机执行指令，使得处理器602执行上述实施例中的方案。处理器602可以是通用处理器，包括中央处理器CPU、网络处理器(networkprocessor，NP)等；还可以是数字信号处理器DSP、专用集成电路ASIC、现场可编程门阵列FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
[0093] 存储器603通过系统总线与处理器602连接并完成相互间的通信，存储器603用于存储计算机程序指令。
[0094] 收发器601可以用于获取待运行任务和待运行任务的配置信息。
[0095] 系统总线可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。系统总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。收发器用于实现数据库访问装置与其他计算机(例如客户端、读写库和只读库)之间的通信。存储器可能包含随机存取存储器(randomaccess memory，RAM)，也可能还包括非易失性存储器(non-volatile memory)。
[0096] 本申请实施例提供的电子设备，可以是上述实施例的服务器。
[0097] 本申请实施例还提供一种运行指令的芯片，该芯片用于执行上述实施例中劫持漏洞信息的检测方法的技术方案。
[0098] 本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当该计算机指令在计算机上运行时，使得计算机执行上述实施例劫持漏洞信息的检测方法的技术方案。
[0099] 本申请实施例还提供一种计算机程序产品，该计算机程序产品包括计算机程序，其存储在计算机可读存储介质中，至少一个处理器可以从计算机可读存储介质读取计算机程序，至少一个处理器执行计算机程序时可实现上述实施例中劫持漏洞信息的检测方法的技术方案。
[0100] 本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本申请的其它实施方案。本申请旨在涵盖本申请的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本申请的一般性原理并包括本申请未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本申请的真正范围和精神由下面的权利要求书指出。
[0101] 应当理解的是，本申请并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本申请的范围仅由所附的权利要求书来限制。< / script>
Claims
1. A method for detecting hijacking vulnerability information, characterized in that, include: Obtain message information from the website to be detected, including request messages and response messages; Based on an extensible keyword information database, at least one callback keyword corresponding to the message information is determined. The extensible keyword information database includes multiple test keywords for JSONP cross-domain hijacking vulnerabilities. The step of determining at least one callback keyword corresponding to the message information specifically includes: if there is at least one target keyword in the message information that is the same as the multiple test keywords, then the at least one target keyword is used as at least one callback keyword corresponding to the message information; if there is no target keyword in the message information that is the same as the multiple test keywords, then the multiple test keywords are used as at least one callback keyword corresponding to the message information. Create a test case set corresponding to the at least one callback keyword, the test case set including at least one test case, the creation of the test case set corresponding to the at least one callback keyword includes: determining at least one callback function corresponding to the at least one callback keyword; based on the at least one callback keyword and the at least one callback function, create a test case set corresponding to the at least one callback keyword, the test cases being used for cross-domain hijacking vulnerabilities; The step of creating a set of test cases corresponding to the at least one callback keyword based on the at least one callback keyword and the at least one callback function includes: For each callback keyword, construct the function following the callback keyword as the callback function corresponding to the callback keyword; Add the callback keyword and the callback function to the request message to obtain at least one test case; Based on at least one test case, detect hijacking vulnerability information of the website to be tested, including: for each test case, parse the Uniform Resource Locator (URL) in the test case, the URL including callback keywords and callback functions; if the parameters of the callback function returned by the website to be tested contain user information, then determine that the callback keyword corresponding to the test case is the callback keyword that generates the vulnerability, and determine that the website to be tested has a hijacking vulnerability, and display the hijacking vulnerability information of the website to be tested.
2. A device for detecting hijacking vulnerability information, characterized in that, include: The acquisition module is used to acquire message information of the website to be detected, including request messages and return messages; The determination module is used to determine at least one callback keyword corresponding to the message information based on an expandable keyword information database, wherein the expandable keyword information database includes multiple test keywords; The determining module is specifically configured to: if the message information contains at least one target keyword that is the same as the plurality of test keywords, then use the at least one target keyword as at least one callback keyword corresponding to the message information; if the message information does not contain a target keyword that is the same as the plurality of test keywords, then use the plurality of test keywords as at least one callback keyword corresponding to the message information. A creation module is used to create a set of test cases corresponding to the at least one callback keyword, wherein the set of test cases includes at least one test case. The creation module is specifically used to determine at least one callback function corresponding to the at least one callback keyword; and to create a set of test cases corresponding to the at least one callback keyword based on the at least one callback keyword and the at least one callback function, wherein the test cases are used for cross-domain hijacking vulnerabilities. The creation module is specifically used to construct the function following the callback keyword as the callback function corresponding to the callback keyword for each callback keyword; and to add the callback keyword and the callback function to the request message to obtain at least one test case; The detection module is used to detect hijacking vulnerability information of the website to be detected based on at least one test case; The detection module is specifically used to parse the Uniform Resource Locator (URL) in each test case, the URL including callback keywords and callback functions; if the parameters of the callback function returned by the website to be detected contain user information, then the callback keyword corresponding to the test case is determined to be the callback keyword that causes the vulnerability, and the website to be detected is determined to have a hijacking vulnerability. The display module is used to display hijacking vulnerability information of the website to be tested.
3. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in claim 1.
4. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in claim 1.