Resource id based horizontal privilege-escalation detection method and apparatus

Abstract

The application discloses a horizontal privilege-escalation detection method and device based on a resource ID, and the method comprises the following steps: receiving a network request data initiated by a user, and obtaining a response result based on the network request data; if there is an original resource ID in the network request data, a plurality of test resource IDs are generated according to the original resource ID and a generation strategy; wherein the resource ID comprises a target field associated with user identity information; one of the plurality of test resource IDs is extracted to replace the original resource ID, so as to obtain network request data with a test resource ID; if the network request data carries an anti-tampering string, a new anti-tampering string is generated based on a predetermined encryption rule, and a tampered first response result is obtained according to the new anti-tampering string; if the network request data does not carry an anti-tampering string, a tampered first response result is obtained based on the network request data with the test resource ID; whether the original response result and the first response result are the same is compared, and whether the network request initiated by the user has a horizontal privilege-escalation vulnerability is determined according to the comparison result; wherein the original response result is a response result obtained based on the original resource ID; the first type of parameter comprises a status code and a content type (Content-Type).

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers and the Internet, in particular to a horizontal privilege escalation detection method and device based on resource ID. BACKGROUND

[0002] With the rapid development of the Internet of Things / industrial Internet, the explosive growth of websites is promoted, and the security problems caused by security vulnerabilities are also growing. The challenges faced by system security are becoming increasingly severe, and the system may be threatened by various attacks at any time. Any simple vulnerability or negligence may cause the entire system to be attacked, resulting in huge losses. For example, if an attacker attempts to access the information or resources of other users with the same privileges as himself, such as accessing or operating data that does not belong to himself, if such access is successful, it is considered to have occurred "horizontal privilege escalation". Therefore, it is necessary to detect horizontal privilege escalation for user access requests or operation behaviors.

[0003] Currently, horizontal privilege escalation detection usually uses the method of replacing the authentication field to detect, which can avoid horizontal privilege escalation to a certain extent, but there are still some false positives. Especially when processing the user requests of "common pages", the detection method of replacing the authentication field has become more and more unable to meet the practical needs, the accuracy of horizontal privilege escalation detection is low, and a large number of false positives and vulnerabilities may occur, which needs to be optimized. SUMMARY

[0004] The purpose of the present application is to provide a horizontal privilege escalation detection method and device based on resource ID.

[0005] The present application provides a horizontal privilege escalation detection method based on resource ID, comprising: receiving a network request data initiated by a user, and obtaining a response result based on the network request data; if there is an original resource ID in the network request data, generating a plurality of test resource IDs according to the original resource ID and a generation strategy; wherein the resource ID includes a target field associated with user identity information; extracting one of the plurality of test resource IDs to replace the existing original resource ID to obtain network request data with a test resource ID; if the network request data carries an anti-tampering string, generating a new anti-tampering string based on a predetermined encryption rule, and obtaining a tampered first response result according to the new anti-tampering string; if the network request data does not carry an anti-tampering string, obtaining a tampered first response result based on the network request data with the test resource ID; comparing whether the corresponding first type parameter in the original response result and the first type parameter in the first response result are the same, and determining whether the network request initiated by the user exists horizontal privilege escalation vulnerability according to the comparison result; wherein the original response result is the response result obtained based on the original resource ID; the first type parameter includes a status code and a content type Content-Type.

[0006] Further, the comparing whether the corresponding first type parameter in the original response result and the first type parameter in the first response result are same, and determining whether the user initiated network request exists horizontal privilege-escalation vulnerability according to the comparison result, comprises: if the comparison result is that the corresponding first type parameter in the original response result and the first type parameter in the first response result are different, determining that the user initiated network request does not exist horizontal privilege-escalation vulnerability; if the comparison result is that the corresponding first type parameter in the original response result and the first type parameter in the first response result are same, judging whether the content type Content-Type in the first response result is json type data.

[0007] Further, the comparing whether the corresponding first type parameter in the original response result and the first response result are same, and determining whether the user initiated network request exists horizontal privilege-escalation vulnerability according to the comparison result, further comprises: if the content type Content-Type in the first response result is json type data, comparing whether the field name of the json type data in the original response result and the field name of the json type data in the first response result are same; wherein, when not same, determining that the user initiated network request does not exist horizontal privilege-escalation vulnerability.

[0008] Further, the comparing whether the corresponding first type parameter in the original response result and the first response result are same, and determining whether the user initiated network request exists horizontal privilege-escalation vulnerability according to the comparison result, further comprises: if the content type Content-Type in the first response result is json type data, comparing whether the field name of the json type data in the original response result and the field name of the json type data in the first response result are same; wherein, when same, composing a first type string by the field value of the json type data in the original response result, and composing a second type string by the field value of the json type data in the first response result; calculating the similarity of the first type string and the second type string to obtain a first similarity value; if the first similarity value is greater than or equal to a set first threshold value, determining that the user initiated network request does not exist horizontal privilege-escalation vulnerability; if the first similarity value is less than the set first threshold value, determining that the user initiated network request exists horizontal privilege-escalation vulnerability.

[0009] Further, the method further comprises: after determining that the user-initiated network request does not exist the horizontal privilege-escalation vulnerability based on one of the test resource IDs, traversing other test resource IDs.

[0010] Further, the method further comprises: after determining that the user-initiated network request does not exist the horizontal privilege-escalation vulnerability based on one of the test resource IDs, traversing other test resource IDs.

[0011] Further, the method further comprises: after determining that the user-initiated network request does not exist the horizontal privilege-escalation vulnerability based on one of the test resource IDs, traversing other test resource IDs.

[0012] Further, the method further comprises: after determining that the user-initiated network request does not exist the horizontal privilege-escalation vulnerability based on one of the test resource IDs, traversing other test resource IDs.

[0013] The embodiment of the present application provides a horizontal privilege escalation detection device, comprising: a receiving module, which is used for receiving network request data initiated by a user and obtaining a response result based on the network request data; a generating module, which is used for generating a plurality of test resource IDs according to an original resource ID and a generation strategy if the original resource ID exists in the network request data; wherein the resource ID comprises a target field associated with user identity information; a replacing module, which is used for extracting one of the plurality of test resource IDs to replace the existing original resource ID, so as to obtain network request data with a test resource ID; a first tampering module, which is used for generating a new anti-tampering string based on a predetermined encryption rule if the network request data carries an anti-tampering string, and obtaining a tampered first response result according to the new anti-tampering string; a second tampering module, which is used for obtaining a tampered first response result based on the network request data with the test resource ID if the network request data does not carry the anti-tampering string; a determining module, which is used for comparing whether corresponding first-class parameters in an original response result and first-class parameters in the first response result are the same, and determining whether the network request initiated by the user has a horizontal privilege escalation vulnerability according to a comparison result; wherein the original response result is a response result obtained based on the original resource ID; and the first-class parameters comprise a status code and a content type Content-Type.

[0014] The embodiment of the present application provides an electronic device, which comprises a processor and a memory storing computer program instructions; the processor implements the steps of the method as described above when executing the computer program instructions.

[0015] The embodiment of the present application provides a computer readable storage medium, which stores computer program instructions; the computer program instructions are executed by a processor to implement the steps of the method as described above.

[0016] The embodiment of the present application provides a computer program product, which comprises computer program instructions; the computer program instructions are executed by a processor to implement the steps of the method as described above.

[0017] The above technical solutions of the present application have the following beneficial technical effects:

[0018] The embodiment of the present application can eliminate the influence of false positives caused by the common page by first judging whether the resource ID exists in the network request data and increasing the anti-tampering function on this basis, that is, by generating a new anti-tampering string to obtain the tampered response result, or setting the parameter format of the test resource ID to be similar to the original resource ID and replaying the network request data with the test resource ID to obtain the tampered response result. Further, by comparing whether the state code and content-type in the original response result and the corresponding parameters in the tampered response result are the same, and determining whether the network request initiated by the user exists horizontal privilege escalation vulnerability according to the comparison result, the embodiment can avoid a large number of false positives and vulnerabilities when processing the common page with the same permission user request, and further improve the accuracy of horizontal privilege escalation detection, so as to meet the practical needs of the Internet of Things / industrial Internet. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings in the embodiments of the present application.

[0020] Figure 1 is a schematic diagram of the system architecture of the embodiment of the present application.

[0021] Figure 2 is a flow chart of a resource ID-based horizontal privilege escalation detection method of the embodiment of the present application.

[0022] Figure 3 is a processing process schematic diagram of a resource ID-based horizontal privilege escalation detection method of the embodiment of the present application.

[0023] Figure 4 is a structural block diagram of a resource ID-based horizontal privilege escalation detection device of the embodiment of the present application.

[0024] Figure 5 is a schematic diagram of an electronic device for implementing a resource ID-based horizontal privilege escalation detection method of the embodiment of the present application. DETAILED DESCRIPTION

[0025] The principles and spirits of the present application will be described below with reference to a number of exemplary embodiments. It should be understood that the purpose of providing these embodiments is to make the principles and spirits of the present application clearer and more thorough, so that those skilled in the art can better understand and implement the principles and spirits of the present application. The exemplary embodiments provided herein are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments herein, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0026] Embodiments of this application relate to terminal devices and / or servers. Those skilled in the art will understand that embodiments of this application can be implemented as a system, apparatus, device, method, computer-readable storage medium, or computer program product. Therefore, this disclosure can be specifically implemented in at least one of the following forms: entirely hardware, entirely software, or a combination of hardware and software. According to embodiments of this application, this application claims protection for a method, apparatus, electronic device, computer-readable storage medium, and computer program product based on resource ID for horizontal privilege escalation detection. Figure 1 A schematic diagram of a system architecture according to an embodiment of this application is shown. For example... Figure 1 As shown, the system includes a terminal device 102 and a server 104. The terminal device 102 can include at least one of the following: a smartphone, tablet, laptop, desktop computer, smart TV, various wearable devices, augmented reality (AR) devices, virtual reality (VR) devices, etc. A client can be installed on the terminal device 102. For example, the client can be a client specifically designed to perform a particular function (such as an application app), or a client with multiple embedded application applets (with different functions), or a client logged in via a browser. Users can operate on the terminal device 102. For example, a user can open the client installed on the terminal device 102 and input commands through the client, or a user can open the browser installed on the terminal device 102 and input commands through the browser. After receiving the user's input command, the terminal device 102 sends a request message containing the command to the server 104. After receiving the request message, the server 104 performs the corresponding processing and then returns the processing result information to the terminal device 102. The user command is completed through a series of data processing and information interaction.

[0027] In this document, terms such as first, second, and third are used only to distinguish one entity (or operation) from another, and are not intended to require or imply any order or relationship between these entities (or operations).

[0028] The following is a brief description of the concepts and technical terms that may be involved in the embodiments of this application.

[0029] A network request refers to the process in a computer network where one device (also called a client) sends a request to another device (also called a server) and waits for a response. This request can be to obtain resources, submit data, execute commands, etc., while the response is the result of the server's processing of the request.

[0030] Horizontal privilege escalation refers to an attacker attempting to access resources held by a user with the same privileges as them. This could involve accessing or manipulating data that doesn't belong to the attacker. If horizontal privilege escalation occurs, the user's privilege type remains the same, but their privilege ID (Identification) changes. For example, user A, a regular user, can view information about another user (such as user B). This is because user A has successfully achieved horizontal privilege escalation and can view user B's information. A common process involves modifying a specific ID parameter to access user B's information. For instance, when user A is viewing their own information, they might find a `userID` parameter in the URL (Uniform Resource Locator) or HTTP (Hypertext Transfer Protocol) request header. By modifying this parameter (from user A's own `userID` to user B's `userID`), user A can then view user B's information, thus achieving horizontal privilege escalation.

[0031] Shared pages refer to situations where multiple users share the same page on a website or application. Since shared pages are accessed by multiple users, the design and development process must consider how to differentiate the information displayed to different users. This ensures that users can only see content they have permission to view, and not content they do not have permission to view, thus avoiding security risks such as horizontal privilege escalation vulnerabilities caused by improper permission design.

[0032] Figure 2 The diagram illustrates a flowchart of a horizontal privilege escalation detection method based on resource ID according to an embodiment of this application. The method includes the following specific steps:

[0033] S110: Receive network request data initiated by the user and obtain the response result based on the network request data;

[0034] Furthermore, a resource library is pre-set to store network request data for accessing the web application. When a user has a data access need, they can initiate a user access request to the server 104 through the terminal device 102. The network request data can be, for example, API data, which is initiated by the user through a network request (such as an HTTP request). The specific network request data is, for example, an HTTP request message containing POST. The server 104 can generate a corresponding response result based on the received network request data.

[0035] S120: If the network request data contains an original resource ID, generate multiple test resource IDs based on the original resource ID and the generation strategy; wherein, the resource ID includes a target field associated with the user's identity information;

[0036] Specifically, the server 104 scans the user access request, and can obtain a resource ID (resource identifier), which can include a user ID, a resume ID, a task ID, and the like, i.e., through the resource ID, the identity information belonging to the user can be obtained. For example, the field names representing the resources in the resource ID are user, resume, and the like, and the field values following the field names are set as a combination of numbers, such as "accountID":"123456", so that the resource ID field can be accurately identified, and the identification capability of the resource ID can be further improved. When generating a plurality of test resource IDs, the plurality of test resource IDs similar to the parameter format of the current original resource ID are generated based on the current original resource ID, and the interval with the current original resource ID is appropriately expanded, so as to avoid that the generated test resource ID and the current original resource ID belong to the same user.

[0037] S130: extracting one of the plurality of test resource IDs to replace the existing original resource ID, to obtain network request data with the test resource ID;

[0038] Specifically, for example, the plurality of generated test resource IDs form a decreasing or increasing queue, and the first test resource ID in the queue can be taken out to replace the current original resource ID, to obtain network request data with the test resource ID.

[0039] S140: if the network request data carries an anti-tampering string, generating a new anti-tampering string based on a predetermined encryption rule, and obtaining a tampered first response result according to the new anti-tampering string;

[0040] Specifically, when the server 104 scans the user access request, the server 104 can determine whether the anti-tampering string exists according to the host header of the request message and the pre-set encryption rule. It can be understood that different encryption rules can be set according to different domain names. When the server 104 determines that the network request data carries the anti-tampering string, the server 104 can generate a new anti-tampering string based on the predetermined encryption rule, and the server 104 can return the tampered first response result according to the new anti-tampering string.

[0041] S150: if the network request data does not carry the anti-tampering string, obtaining a tampered first response result based on the network request data with the test resource ID;

[0042] Specifically, when the server 104 determines that the network request data does not carry the anti-tampering string, the server 104 replays the network request data with the test resource ID, and the server 104 can return the tampered first response result.

[0043] S160: compare whether the corresponding first type parameters in the original response result and the first type parameters in the first response result are same, and determine whether the horizontal privilege-escape vulnerability exists in the network request initiated by the user according to the comparison result; wherein, the original response result is a response result obtained based on the original resource ID; the first type parameters include a status code and a content type Content-Type.

[0044] Specifically, the response result includes a status code and a content-type, and a response content, etc.; the status code in the response result is a state returned by the terminal device 102 to the server 104 after sending the network request to the server 104; when the resource ID does not exist in the network request data, i.e., the terminal device 102 of the user can access through any account, if the token authentication field is replaced, a false positive of "common page" will occur, but the embodiment of the present application can eliminate the influence caused by the false positive of "common page" by first judging whether the resource ID exists in the network request data and increasing the anti-tampering function on this basis; i.e., a new anti-tampering string is generated to obtain a tampered response result, or the parameter format of the test resource ID is set to be similar to the original resource ID, and the network request data with the test resource ID is replayed to obtain a tampered response result; further, whether the status code and the content-type in the original response result and the corresponding parameters in the tampered response result are same is compared, and whether the horizontal privilege-escape vulnerability exists in the network request initiated by the user is determined according to the comparison result; in this way, when processing the "common page" with the same permission of the user request, a large number of false positives and vulnerabilities can be avoided, and the accuracy of the horizontal privilege-escape detection can be improved, so as to meet the practical needs.

[0045] In some embodiments, the step S160 of comparing whether the corresponding first type parameters in the original response result and the first type parameters in the first response result are same, and determining whether the horizontal privilege-escape vulnerability exists in the network request initiated by the user according to the comparison result can include the following specific steps:

[0046] S161: if the comparison result is that the corresponding first type parameters in the original response result and the first type parameters in the first response result are different, it is determined that the horizontal privilege-escape vulnerability does not exist in the network request initiated by the user.

[0047] S162: if the comparison result is that the corresponding first type parameters in the original response result and the first type parameters in the first response result are same, it is judged whether the content type Content-Type in the first response result is a json type data.

[0048] Specifically, when the state code and the content-type in the original response result and the corresponding parameters in the tampered response result are different, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability; when the state code and the content-type in the original response result and the corresponding parameters in the tampered response result are the same, it is processed according to whether the content type Content-Type in the returned first response result is json type data to determine whether the network request initiated by the user exists horizontal privilege-escalation vulnerability, so that the horizontal privilege-escalation detection result is more accurate.

[0049] In some embodiments, the step S160 of comparing whether the corresponding first type parameters in the original response result and the first response result are the same, and determining whether the network request initiated by the user exists horizontal privilege-escalation vulnerability according to the comparison result, can further include the following specific steps:

[0050] S1621: If the content type Content-Type in the first response result is json type data, compare whether the field name of the json type data in the original response result and the field name of the json type data in the first response result are the same; wherein when they are different, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability.

[0051] Specifically, the field name of the json type data can be set according to the business needs of the user, which is not limited here; for example, the field name of the json type data can include at least one of the following: resume username, gender, work experience, work experience, region, degree, major, college, active type and internship unit, etc.; the above field names are important fields in the recruitment industry, and when the above field names appear in the API interface data, this interface needs to be paid attention to.

[0052] In some embodiments, the step S160 of comparing whether the corresponding first type parameters in the original response result and the first response result are the same, and determining whether the network request initiated by the user exists horizontal privilege-escalation vulnerability according to the comparison result, can further include the following specific steps:

[0053] S1622: If the content type Content-Type in the first response result is json type data, compare the field name of the json type data in the original response result with the field name of the json type data in the first response result; when they are the same, the field value of the json type data in the original response result forms a first string, and the field value of the json type data in the first response result forms a second string; the similarity of the first string and the second string is calculated to obtain a first similarity value; if the first similarity value is greater than or equal to a set first threshold value, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability; if the first similarity value is less than the set first threshold value, it is determined that the network request initiated by the user exists horizontal privilege-escalation vulnerability.

[0054] Specifically, when the content type Content-Type in the tampered response result is json type data, compare the field name of the json type data in the original response result with the field name of the json type data in the tampered response result; when the field names of the json type data in the two are different, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability; when the field names of the json type data in the two are the same, compare whether the field values of the json type data in the two are completely the same or nearly completely the same; for example, the set range of the first threshold value can be 95-100%, when the first threshold value is 100%, that is, the field values of the json type data in the two are completely the same, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability.

[0055] In some embodiments, the step S160 of comparing whether the corresponding first type parameters in the original response result and the first type parameters in the first response result are the same, and determining whether the network request initiated by the user exists horizontal privilege-escalation vulnerability according to the comparison result, can further include the following specific steps:

[0056] S163: If the content type Content-Type in the first response result is not json type data, calculate the similarity of the original response result and the first response result to obtain a second similarity value; when the second similarity value is greater than or equal to a set second threshold value, it is determined that the network request initiated by the user exists horizontal privilege-escalation vulnerability; when the second similarity value is less than the set second threshold value, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability.

[0057] Specifically, when the content type Content-Type in the tampered response result is not data of the json type, the similarity of the page content in the original response result and the page content in the tampered response result is compared, and the cosine similarity algorithm or the like can be used to calculate the similarity of the page content of the two to obtain a second similarity value; for example, the second threshold can be set to be greater than or equal to 90%, and when the second similarity value is less than 90%, it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability; and when the second similarity value is greater than or equal to 90%, it is determined that the network request initiated by the user exists horizontal privilege-escalation vulnerability.

[0058] In some embodiments, the method can further include the following specific steps:

[0059] Step S170: After determining that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability based on one of the test resource IDs, other test resource IDs are traversed.

[0060] Specifically, a certain number of test resource IDs are generated according to the resource level of the user, the generated multiple test resource IDs are grouped into a queue, and the original resource ID is replaced in sequence, and when it is determined that the network request initiated by the user exists horizontal privilege-escalation vulnerability based on one of the test resource IDs, the horizontal privilege-escalation detection process can be ended; and when it is determined that the network request initiated by the user does not exist horizontal privilege-escalation vulnerability based on one of the test resource IDs, other test resource IDs can be traversed until the other test resource IDs are exhausted, so that the influence of a single test resource ID on the horizontal privilege-escalation detection result can be reduced.

[0061] In some embodiments, step S140, if the network request data carries an anti-tampering string, a new anti-tampering string is generated based on a predetermined encryption rule, and a tampered first response result is obtained according to the new anti-tampering string, can include the following specific steps:

[0062] S141: The parameter values in the network request data are sorted in descending order to obtain a third string;

[0063] S142: The token authentication field of the user is obtained;

[0064] S143: A random hash value is generated according to the third string and the token authentication field of the user, and the third string, the token authentication field of the user, and the generated random hash value are used as the new anti-tampering string.

[0065] In some embodiments, step S120, if the network request data contains an original resource ID, multiple test resource IDs are generated according to the original resource ID and a generation strategy, which can include the following specific steps:

[0066] S121: Set the target field value of the test resource ID to be approximate to the target field value of the original resource ID.

[0067] S122: Generate a plurality of test resource IDs according to the total number of resource IDs of the user and the set interval; wherein, the plurality of test resource IDs are generated in turn by increasing or decreasing according to the set interval, with the target field value of the original resource ID as the benchmark; and the set interval is an integer greater than 2.

[0068] Specifically, two adjacent resource IDs can belong to the same user, which is equivalent to the same user continuously creating two tasks. For example, when the resource magnitude of the user is tens of thousands or even hundreds of thousands, the set interval can be appropriately expanded to generate test resource IDs with the target field value of the original resource ID as the benchmark, which can reduce and avoid the same user situation.

[0069] In some embodiments, when it is determined that there is a horizontal privilege-escalation vulnerability, the network request initiated by the user needs to be rectified, and after rectification, the network request initiated by the user needs to be retested. When it is determined again that the network request initiated by the user does not have a horizontal privilege-escalation vulnerability, the server 104 releases the access request of the user and sends a data packet link that can be normally accessed to the user.

[0070] The resource ID-based horizontal privilege-escalation detection method of the embodiments of the present application can be applied to the Internet of Things or industrial Internet in the recruitment industry. Through a digital recruitment platform and using cloud computing and big data technology, it supports the storage and processing of massive data, and can provide precise recruitment suggestions and talent mining services for users. By detecting the horizontal privilege-escalation of the access request or operation behavior of the user, the safety and privacy of recruitment information and production data can be protected, and information leakage and malicious attacks can be avoided.

[0071] The above describes the implementation mode of the embodiments of the present application and the advantages brought by the implementation mode through a plurality of embodiments. The following describes the specific processing process of the embodiments of the present application in detail in combination with specific examples, such as Figure 3

[0072] Step 1: Obtain API data (network request data) from an API database, for example, an HTTP request message containing POST.

[0073] ​Step 2: Determine whether the API data has a resource ID. If the API data has a resource ID, go to Step 3. If the API data does not have a resource ID, end the horizontal privilege escalation detection. Specifically, determine whether the API data has a resource ID by forming a resource ID library with frequently used resource IDs in the project. For example, in a recruitment system, the field names representing resources are user, resume, etc., and the field values are combinations of numbers, such as "userid":"439050587". This indicates that there is a resource ID.

[0074] Step 3: If the API data has a resource ID, generate n test resource IDs according to the set generation strategy. Specifically, two adjacent resource IDs may belong to the same user, which is equivalent to the same user creating two consecutive tasks. By expanding the interval of the "userid" field value to generate test resource IDs, the occurrence of the same user can be reduced and avoided. Test resource ID generation method: According to the resource ID in the current API data and the user's resource magnitude, the default interval of the "userid" field value number is 5, and the number of generated test resource IDs is 5. The number of test resource IDs can be generated by setting a decreasing or increasing method; for example, based on the current original resource ID, according to userid=439050587, five test resource IDs can be generated: 439050582, 439050577, 439050572, 439050567, 439050562.

[0075] Step 4: Replace the original resource ID in the API data with one of the generated test resource IDs. Specifically, for example, form a queue with the five generated test resource IDs, and first replace the original resource ID with the first test resource ID "439050582" in the queue.

[0076] Step 5: Determine whether the API data has an anti-tampering string. If the API data has an anti-tampering string, go to Step 6. If the API data does not have an anti-tampering string, go to Step 8. Specifically, the host header of the API data is example.com, which matches the pre-set encryption rule and has a "sign" anti-tampering field in the parameter, indicating that the API data has an anti-tampering function. If no corresponding encryption rule is found, it is assumed that there is no anti-tampering field.

[0077] Step 6: If there is an anti-tampering string, go to Step 7. If there is no anti-tampering string, go to Step 8.

[0078] Step 7: Regenerate the anti-tampering string. Specifically, a new anti-tampering string can be generated based on an encryption rule, for example, all parameter values in the API data packet can be sorted in descending order to obtain a string, and a user token authentication field can be added to the string to obtain a combined string, and then a MD5 hash value can be randomly generated based on the combined string, and the regenerated anti-tampering string is composed of the MD5 hash value and the combined string. For example, the regenerated anti-tampering string is shown in the following table:

[0079] Host Tamper-resistant field Encryption rule example.com sign md5(Sort(param))

[0080] Step 8: When there is no anti-tampering string, the data packet needs to be replayed to obtain the tampered response result. Specifically, for example, the test resource ID is replaced with the original resource ID in the API data, and the network request is sent to the backend server again, and the server returns a response result to the network request. The tampered response result includes status code and content-type, and response content.

[0081] Step 9: Compare the status code and Content-Type in the original response result and the tampered response result, and if they are the same, go to step 10, otherwise jump to step 14. Specifically, for example, the status code in the original response result and the tampered response result is the state of sending the network request to the server, and the server returns the state of sending success or failure; when the status code of the two is the state of sending success, and the Content-Type is also completely the same, go to the next step.

[0082] Step 10: Determine whether the Content-Type in the original response result and the tampered response result is json type data; if it is json type data, proceed to the next step; if it is not json type data, jump to step 15.

[0083] Step 11: Determine whether the field name of the json type data in the original response result and the tampered response result is completely the same, and if it is completely the same, proceed to the next step, otherwise jump to step 14. For example, the field name can include one or more of the following: resume username, gender, work experience, work experience, region, degree, major, graduate school, active type, and internship unit.

[0084] Step 12: the field value of the json type data in the original response result is composed into a string A, the field value of the json type data in the tampered response result is composed into a string B, and the similarity value N of the string A and the string B is calculated by using a text similarity algorithm, for example, if the similarity value N is equal to 100%, the next step is performed; if the similarity value N is not equal to 100%, step 14 is jumped to.

[0085] Step 13: it is determined that the API data exists horizontal privilege-escape vulnerability, and the horizontal privilege-escape detection process is ended.

[0086] Step 14: it is judged whether all test resource IDs have been traversed, if all test resource IDs have been traversed, it is determined that the API data does not exist horizontal privilege-escape vulnerability, and the detection process is ended; if all test resource IDs have not been traversed, step 4 is jumped to.

[0087] Step 15: when the Content-Type in the returned original response result and the tampered response result is not the json type data, the similarity algorithm is performed on the tampered response content and the original response content to obtain the similarity value x, and it is judged whether the similarity value x is greater than a set y; if the similarity value x is greater than the set y, step 13 is jumped to; if the similarity value x is less than the set y, step 14 is jumped to. For example, the set y is 90%.

[0088] Corresponding to the method embodiment of the application, the application also provides a horizontal privilege-escape detection device based on resource ID, as shown in Figure 4 , which can specifically include:

[0089] The receiving module 510 is used for receiving the network request data initiated by the user, and obtaining the response result based on the network request data;

[0090] The generating module 520 is used for generating a plurality of test resource IDs according to the original resource ID and the generation strategy if the original resource ID exists in the network request data; wherein the resource ID includes a target field associated with the user identity information;

[0091] The replacing module 530 is used for extracting one test resource ID in the plurality of test resource IDs to replace the existing original resource ID, to obtain the network request data with the test resource ID;

[0092] The first tampering module 540 is used for generating a new anti-tampering string based on a predetermined encryption rule if the network request data carries an anti-tampering string, and obtaining a first tampered response result according to the new anti-tampering string;

[0093] a second tampering module 550, configured to obtain a tampered first response result based on the network request data with the test resource ID if the anti-tampering string is not carried in the network request data;

[0094] a determination module 560, configured to compare whether the corresponding first type parameter in the original response result and the first type parameter in the first response result are same, and determine whether the horizontal privilege-escalation vulnerability exists in the network request initiated by the user according to a comparison result; wherein,

[0095] The original response result is a response result obtained based on an original resource ID; and the first type parameter includes a status code and a content type Content-Type.

[0096] The electronic device in the embodiments of the present application can be a user terminal device, can be a server, can also be other computing devices, and can also be a cloud server. Figure 5 A hardware structure schematic diagram of an electronic device of the embodiments of the present application is shown, which can include a processor 601 and a memory 602 storing computer program instructions, and the processor 601 implements the flow or function of the method of any of the above embodiments when executing the computer program instructions.

[0097] Specifically, the processor 601 can include a central processing unit (CPU), or a specific integrated circuit (Application Specific Integrated Circuit, ASIC), or can be configured to implement one or more integrated circuits of the embodiments of the present application. The memory 602 can include a mass storage for data or instructions. For example, the memory 602 can be at least one of a hard disk drive (HDD), a read-only memory (ROM), a random access memory (RAM), a floppy disk drive, a flash memory, an optical disc, a magneto-optical disc, a magnetic tape, a universal serial bus (Universal Serial Bus, USB) drive, or other physical / tangible memory storage devices. For another example, the memory 602 can include removable or non-removable (or fixed) media. For another example, the memory 602 can be inside or outside the integrated gateway disaster recovery device. The memory 602 can be a non-volatile solid-state memory. In other words, the memory 602 generally includes a tangible (non-transitory) computer readable storage medium (such as a memory device) encoded with computer executable instructions, and when the software is executed (such as by one or more processors), the operations described in the method of the embodiments of the present application can be performed. The processor 601 realizes the flow or function of any of the above embodiments by reading and executing the computer program instructions stored in the memory 602.

[0098] In one example, Figure 5The electronic device shown can also include a communication interface 603 and a bus 610. Among them, the processor 601, the memory 602, the communication interface 603 are connected through the bus 610 and complete the communication between each other. The communication interface 603 is mainly used to realize the communication between the modules, devices, units and / or equipment in the embodiments of the application. The bus 610 includes hardware, software or both, which can couple the components of the online data traffic billing device to each other. For example, the bus can include at least one of the following: an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front side bus (FSB), a hyper transport (HT) interconnect, an industry standard architecture (ISA) bus, an infiniband interconnect, a low pin count (LPC) bus, a memory bus, a micro channel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a serial advanced technology attachment (SATA) bus, a video electronics standards association local (VLB) bus or other suitable bus. The bus 610 can include one or more buses. Although the embodiments of the application describe or show a specific bus, any suitable bus or interconnection method can be considered by the embodiments of the application.

[0099] In combination with the method in the above embodiments, the embodiments of the application further provide a computer readable storage medium, which has stored thereon computer program instructions, and the computer program instructions are executed by a processor to implement the flow or function of any of the methods in the above embodiments.

[0100] In addition, the embodiments of the application further provide a computer program product, which has stored thereon computer program instructions, and the computer program instructions are executed by a processor to implement the flow or function of any of the methods in the above embodiments.

[0101] The flowcharts and / or block diagrams of the methods, devices, systems and computer program products of the embodiments of the application are described above as examples, and the related aspects are described. It should be understood that each block in the flowchart and / or block diagram can be implemented by computer program instructions, or by special hardware that performs specified functions or actions, or by a combination of special hardware and computer instructions. For example, these computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, or other programmable data processing apparatus, to form a machine, so that the instructions executed by the processor enable the implementation of the functions / actions specified in each block or combination of blocks in the flowchart and / or block diagram. Such a processor can be a general purpose processor, a special purpose processor, a special application processor, or a field programmable logic circuit.

[0102] The functional blocks shown in the structural block diagram of the embodiments of the present application can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc.; when implemented in software, it is a program or code segment used to perform the required tasks. The program or code segment can be stored in a memory or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0103] It should be noted that the present application is not limited to the specific configurations and processes described above or shown in the drawings. The above description is merely a specific implementation of the present application, and those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the described systems, devices, modules or units can refer to the corresponding processes in the method embodiments, which need not be described again. It should be understood that the protection scope of the present application is not limited thereto, and any person skilled in the art can think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A method for detecting horizontal privilege escalation based on resource ID, characterized in that, include: Receive network request data initiated by the user and obtain the response result based on the network request data; If the network request data contains an original resource ID, multiple test resource IDs are generated based on the original resource ID and the generation strategy; the resource ID includes a target field associated with the user's identity information. Extract one of the multiple test resource IDs and replace the existing original resource ID to obtain network request data with the test resource ID; If the network request data carries an anti-tampering string, a new anti-tampering string is generated based on the predetermined encryption rules, and the first response result after tampering is obtained based on the new anti-tampering string; If the network request data does not carry an anti-tampering string, the first response result after tampering is obtained based on the network request data with the test resource ID. Compare the first type of parameters in the original response result with the first type of parameters in the first response result to see if they are the same, and determine whether the network request initiated by the user has a horizontal privilege escalation vulnerability based on the comparison result; if the comparison result shows that the first type of parameters in the original response result and the first type of parameters in the first response result are different, then it is determined that the network request initiated by the user does not have a horizontal privilege escalation vulnerability; if the comparison result shows that the first type of parameters in the original response result and the first type of parameters in the first response result are the same, then determine whether the Content-Type of the first response result is JSON data; the field names of JSON data include one or more of the following: resume username, gender, years of work experience, work experience, region, degree, major, university, activity type, and internship unit; The original response result is the response result obtained based on the original resource ID; the first type of parameter includes the status code and content type (Content-Type).

2. The method according to claim 1, characterized in that, The step of comparing whether the corresponding first-type parameters in the original response result and the first-type parameters in the first response result are the same, and determining whether the network request initiated by the user has a horizontal privilege escalation vulnerability based on the comparison result, further includes: If the Content-Type of the data in the first response is JSON, then compare the field names of the JSON data in the original response with the field names of the JSON data in the first response; where, If they are different, it is determined that the network request initiated by the user does not have a horizontal privilege escalation vulnerability.

3. The method according to claim 1, characterized in that, The step of comparing whether the corresponding first-type parameters in the original response result and the first-type parameters in the first response result are the same, and determining whether the network request initiated by the user has a horizontal privilege escalation vulnerability based on the comparison result, further includes: If the Content-Type data in the first response result is of type JSON, then compare whether the field names of the JSON data in the original response result are the same as the field names of the JSON data in the first response result. If they are the same, then the field values ​​of the JSON data in the original response result are used to form a first type of string, and the field values ​​of the JSON data in the first response result are used to form a second type of string. Calculate the similarity between the first type of string and the second type of string to obtain a first similarity value. If the first similarity value is greater than or equal to the set first threshold, it is determined that the network request initiated by the user does not have a horizontal privilege escalation vulnerability. If the first similarity value is less than the set first threshold, it is determined that the network request initiated by the user has a horizontal privilege escalation vulnerability.

4. The method according to claim 3, characterized in that, The step of comparing whether the corresponding first-type parameters in the original response result and the first-type parameters in the first response result are the same, and determining whether the network request initiated by the user has a horizontal privilege escalation vulnerability based on the comparison result, further includes: If the Content-Type of the first response is not JSON data, then the similarity between the original response and the first response is calculated to obtain a second similarity value; where, If the second similarity value is greater than or equal to the set second threshold, it is determined that the network request initiated by the user has a horizontal privilege escalation vulnerability. If the second similarity value is less than the set second threshold, it is determined that the network request initiated by the user does not have a horizontal privilege escalation vulnerability.

5. The method according to any one of claims 1-4, characterized in that, Also includes: After determining that the network request initiated by the user does not have a horizontal privilege escalation vulnerability based on one of the test resource IDs, the other test resource IDs are iterated through.

6. The method according to claim 1, characterized in that, If the network request data carries an anti-tampering string, a new anti-tampering string is generated based on a predetermined encryption rule, and the tampered first response result is obtained based on the new anti-tampering string, including: Sort the parameter values ​​in the network request data in descending order to obtain the third string; Retrieve the user's token authentication field; A random hash value is generated based on the third string and the user's token authentication field, and the third string, the user's token authentication field, and the generated random hash value are used as the new tamper-proof string.

7. The method according to claim 1, characterized in that, If the network request data contains an original resource ID, multiple test resource IDs are generated based on the original resource ID and the generation strategy, including: Set the target field value of the test resource ID to be approximately the same as the target field value of the original resource ID; Multiple test resource IDs are generated based on the total number of user resource IDs and the set interval; among them, Based on the target field value of the original resource ID, generate multiple test resource IDs by sequentially increasing or decreasing them according to the set interval; the set interval is an integer greater than 2.

8. A horizontal privilege escalation detection device based on resource ID, characterized in that, include: The receiving module is used to receive network request data initiated by the user and obtain the response result based on the network request data; The generation module is used to generate multiple test resource IDs based on the original resource ID and the generation strategy if the network request data contains an original resource ID; wherein the resource ID includes a target field associated with user identity information; The replacement module is used to extract one of multiple test resource IDs to replace the existing original resource ID, thereby obtaining network request data with the test resource ID. The first tampering module is used to generate a new anti-tampering string based on a predetermined encryption rule if the network request data carries an anti-tampering string, and obtain the tampered first response result based on the new anti-tampering string; The second tampering module is used to obtain the first tampered response result based on the network request data with the test resource ID if the network request data does not carry an anti-tampering string. The determination module compares the corresponding first-type parameters in the original response result with the first-type parameters in the first response result to determine whether the user-initiated network request has a horizontal privilege escalation vulnerability. If the comparison result shows that the corresponding first-type parameters in the original response result and the first-type parameters in the first response result are different, then it is determined that the user-initiated network request does not have a horizontal privilege escalation vulnerability. If the comparison result shows that the corresponding first-type parameters in the original response result and the first-type parameters in the first response result are the same, then it is determined whether the Content-Type of the first response result is JSON data. The field names of the JSON data include one or more of the following: resume username, gender, years of work experience, work experience, region, degree, major, university, activity type, and internship unit. The original response result is the response result obtained based on the original resource ID; the first type of parameter includes the status code and content type (Content-Type).

9. An electronic device, characterized in that, The electronic device includes a processor and a memory storing computer program instructions; when the electronic device executes the computer program instructions, it implements the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the method as described in any one of claims 1-7.

Images