Vulnerability detection method and device, equipment, medium and product

Abstract

The invention discloses a vulnerability detection method and device, equipment, a medium and a product, and relates to the technical field of vulnerability detection.The method comprises the steps that request interception is conducted on application programs in an application program list through an interception plug-in Hook, and a network request message is obtained; and performing vulnerability detection on the network request message based on a preset crawler vulnerability rule to obtain a detection result. Therefore, request interception is carried out on the application programs in the application program list through the interception plug-in Hook, the corresponding network request message is obtained, then vulnerability detection is carried out on the network request message based on the preset crawler vulnerability rule, and the detection result is obtained. The problems that in the prior art, a traditional manual sorting mode is adopted for vulnerability detection of the application program, all functions are difficult to sort out, and risk omission is likely to be caused are solved, and the vulnerability detection accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of vulnerability detection technology, and in particular to a vulnerability detection method, device, equipment, medium and product. Background Art

[0002] The current technologies for full detection of crawler vulnerabilities in APP content mainly rely on automated tools, network packet capture analysis, reverse engineering and other means. Although these technologies can help identify and prevent crawler vulnerabilities to a certain extent, they also have certain defects, such as:

[0003] Due to business development, the number of APPs is increasing day by day, but the scenarios and functions corresponding to each APP are different, which will cause incomplete scenario coverage when crawler vulnerability detection. That is, the existing detection method may not be able to cover all scenarios and logical branches, especially for APPs with highly customized or complex business logic, which are prone to omissions and affect the accuracy of the detection results and the security of the system.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a vulnerability detection method, device, equipment, medium and product, aiming to solve the technical problem that the traditional manual combing method of vulnerability detection of application programs in the prior art is difficult to sort out all functions and is prone to risk omissions.

[0006] To achieve the above object, the present application proposes a vulnerability detection method, which is applied to a detection device, the detection device includes an application list, and the method includes:

[0007] Intercept the requests of the applications in the application list through the interception plug-in Hook to obtain the network request message;

[0008] Based on the preset crawler vulnerability rules, vulnerability detection is performed on the network request message to obtain a detection result.

[0009] In one embodiment, before the step of intercepting the request of the application list of the detection device by the interception plug-in Hook to obtain the network request message, the method includes:

[0010] Analyze the detection device to obtain device information of the detection device, where the device information includes one or more of an operating system, a detection requirement, and a detection environment;

[0011] Selecting a corresponding sandbox tool based on the device information to perform environment configuration to obtain a sandbox environment, and performing an operation test on the sandbox environment to obtain an operation test result;

[0012] When the running test result is passed, the plug-in is built through the plug-in building framework Xposed to obtain the Hook.

[0013] In one embodiment, when the running test result is passed, after the step of performing plug-in construction through the plug-in construction framework Xposed to obtain the Hook, the method further includes:

[0014] The Hook is configured by the device information so that the Hook intercepts the request of the detection device based on the detection requirement;

[0015] Writing a script based on the detection requirements and the detection environment to obtain a test script, wherein the test script is used to traverse the application list and trigger a network request;

[0016] According to the test script, script testing is performed in the sandbox environment by using the test tool Appium;

[0017] When the Appium completes traversal of the application list, the script test result is output as test passed.

[0018] In one embodiment, the step of intercepting a request of an application in the application list by using an interception plug-in Hook to obtain a network request message includes:

[0019] The network request of the application is intercepted by the Hook to obtain a list of network requests;

[0020] Preprocessing the network request list to obtain a preprocessed network request list, wherein the preprocessing includes one or more of data filtering and data cleaning;

[0021] Outputting a network request message based on the preprocessed network request list.

[0022] In one embodiment, the step of performing vulnerability detection on the network request message based on a preset crawler vulnerability rule to obtain a detection result includes:

[0023] Parsing the network request message to obtain key information, where the key information includes one or more of a request parameter and a response parameter;

[0024] Performing correlation analysis on interfaces of several application programs in the application program list to obtain correlation analysis results;

[0025] According to the key information and the correlation analysis result, vulnerability matching is performed through the crawler vulnerability rule to obtain a matching result, and a detection result is output based on the matching result.

[0026] In one embodiment, after the step of performing vulnerability detection on the network request message based on a preset crawler vulnerability rule to obtain a detection result, the method further includes:

[0027] Analyze the detection results to obtain a crawler parameter field and a value change rule of the crawler parameter field;

[0028] Assemble based on the crawler parameter fields and value change rules to obtain a crawler request message;

[0029] The crawler request message is retransmitted for verification, and when a response result of the crawler request message is received, a verification result is output as passed.

[0030] In addition, to achieve the above purpose, the present application also proposes a vulnerability detection device, which is applied to a detection device, the detection device includes an application list, and the device includes:

[0031] An interception module, used to intercept requests of applications in the application list through an interception plug-in Hook to obtain a network request message;

[0032] The detection module is used to perform vulnerability detection on the network request message based on preset crawler vulnerability rules to obtain a detection result.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a vulnerability detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the vulnerability detection method described above.

[0034] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the vulnerability detection method described above are implemented.

[0035] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the vulnerability detection method described above are implemented.

[0036] One or more technical solutions proposed in this application have at least the following technical effects:

[0037] The embodiment of the present application proposes a vulnerability detection method, device, equipment, storage medium and computer program product, which intercepts the application in the application list through the interception plug-in Hook to obtain the network request message; and performs vulnerability detection on the network request message based on the preset crawler vulnerability rules to obtain the detection result. Thus, the application in the application list is intercepted through the interception plug-in Hook to obtain the corresponding network request message, and then the network request message is tested for vulnerability based on the preset crawler vulnerability rules to obtain the detection result, which solves the problem that the vulnerability detection of the application in the prior art is difficult to sort out all functions by adopting the traditional manual combing method, which is easy to cause risk omission, and improves the accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 A flowchart of the first embodiment of the vulnerability detection method of the present application is provided;

[0041] Figure 2 A flowchart of the second embodiment of the vulnerability detection method of the present application is provided;

[0042] Figure 3 A brief flowchart of the vulnerability detection method provided in Example 2 of the present application;

[0043] Figure 4 This is a schematic diagram of the module structure of the vulnerability detection device according to an embodiment of the present application;

[0044] Figure 5 Schematic diagram of the device structure of the hardware operating environment involved in the vulnerability detection method in the embodiment of the present application.

[0045] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0046] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0047] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0048] The main solution of the embodiment of the present application is: analyze the detection device to obtain the device information of the detection device, and the device information includes one or more of the operating system, detection requirements and detection environment; select the corresponding sandbox tool based on the device information to configure the environment, obtain the sandbox environment, and perform a run test on the sandbox environment to obtain the run test result; when the run test result is passed, the plug-in is constructed through the plug-in construction framework Xposed to obtain the Hook. The Hook is configured through the device information so that the Hook intercepts the request of the detection device based on the detection requirements; the script is written based on the detection requirements and the detection environment to obtain a test script, and the test script is used to traverse the application list and trigger a network request; according to the test script, the script is tested in the sandbox environment through the test tool Appium; when the Appium completes the traversal of the application list, the script test result is output as the test passed. The network request of the application is intercepted by the Hook to obtain a network request list; the network request list is preprocessed to obtain a preprocessed network request list, and the preprocessing includes one or more of data filtering and data cleaning; the network request message is output based on the preprocessed network request list. Parse the network request message to obtain key information, which includes one or more of the request parameters and the response parameters; perform correlation analysis on the interfaces of several applications in the application list to obtain correlation analysis results; perform vulnerability matching through the crawler vulnerability rules according to the key information and the correlation analysis results to obtain matching results, and output the detection results based on the matching results. Analyze the detection results to obtain the crawler parameter field and the value change law of the crawler parameter field; assemble based on the crawler parameter field and the value change law to obtain the crawler request message; resend the crawler request message for verification, and when the response result of the crawler request message is received, output the verification result as passed. This solves the problem in the prior art that it is difficult to sort out all functions by adopting the traditional manual combing method for vulnerability detection of application programs, which is easy to cause risk omissions, realizes the detection of vulnerabilities, and improves the accuracy of vulnerability detection. Based on the solution of the present invention, a vulnerability detection method is designed based on the problems that the existing technology has incomplete coverage of vulnerability detection scenarios and great difficulty in reverse engineering. The effectiveness of the vulnerability detection method of the present invention is verified when the vulnerability is detected. Finally, the accuracy of vulnerability detection performed by the method of the present invention is significantly improved.

[0049] In this embodiment, for ease of description, the following description is made with the vulnerability detection device as the execution subject.

[0050] Since the existing technologies mainly rely on automated tools, network packet analysis, reverse engineering and other means to conduct full detection of crawler vulnerabilities in APP content, although these technologies can help identify and prevent crawler vulnerabilities to a certain extent, they also have certain defects: incomplete scenario coverage, existing detection methods may not cover all scenarios and logical branches, especially for highly customized or complex business logic APPs, which are easy to miss and difficult to reverse engineer. For highly encrypted or complex protection mechanisms, reverse engineering analysis is difficult, which may lead to the inability to accurately identify its internal data processing logic and potential security vulnerabilities, as well as frequent updates and unclear adversarial strategies: that is, APPs are frequently updated, new functions or fixes may introduce new security issues. At the same time, the escalation of the confrontation between malicious crawlers and anti-crawlers requires continuous evolution of detection technology, but in reality it is often difficult to keep up with this rapid pace of change, resulting in a decrease in security.

[0051] The present application provides a solution, in a detection device with an application list, a request for the application list in the detection device is intercepted by a pre-obtained interception plug-in Hook to obtain a network request message, and then a vulnerability detection is performed on the network request message based on the crawler vulnerability rules to obtain the detection result, thereby continuously improving the accuracy of system detection and providing users with better quality services.

[0052] From the above embodiments, it can be seen that the present application intercepts the requests of the applications in the application list through the interception plug-in Hook to obtain the network request message; the network request message is tested for vulnerabilities based on the preset crawler vulnerability rules to obtain the test results. Thus, the application in the application list is intercepted by the interception plug-in Hook to obtain the corresponding network request message, and then the network request message is tested for vulnerabilities based on the preset crawler vulnerability rules to obtain the test results, which solves the problem that the vulnerability detection of the application in the prior art adopts the traditional manual combing method to make it difficult to sort out all functions and easily cause risk omissions, and improves the accuracy of vulnerability detection.

[0053] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, an intention device device, etc. that can realize the above functions. The following takes the vulnerability detection device as an example to illustrate this embodiment and the following embodiments.

[0054] Based on this, the present application embodiment provides a vulnerability detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the vulnerability detection method of the present application.

[0055] In this embodiment, the vulnerability detection method is applied to a detection device, and the detection device includes an application list, including steps S08 to S09:

[0056] Step S08, intercepting requests of applications in the application list by using the interception plug-in Hook to obtain a network request message;

[0057] It should be clear that this embodiment is aimed at the current technology for full detection of crawler vulnerabilities in APP content, which mainly relies on automated tools, network packet capture analysis, reverse engineering and other means. Although these technologies can help identify and prevent crawler vulnerabilities to a certain extent, they also have certain defects, such as:

[0058] (1) Incomplete scenario coverage: Existing detection methods may not cover all scenarios and logic branches, especially for apps with highly customized or complex business logic, which are prone to omissions;

[0059] (2) Difficulty in reverse engineering: For apps that are highly encrypted or use complex protection mechanisms, reverse engineering analysis is difficult, which may make it impossible to accurately identify their internal data processing logic and potential security vulnerabilities;

[0060] (3) Frequent updates and adversarial strategies: Apps are frequently updated, and new features or fixes may introduce new security issues. At the same time, the escalation of the confrontation between malicious crawlers and anti-crawlers requires continuous evolution of detection technology, but in reality it is often difficult to keep up with this rapid pace of change.

[0061] Therefore, in this embodiment, the pre-built interception plug-in Hook is used to intercept the requests of the applications in the application list to obtain the corresponding network request message.

[0062] Step S09: performing vulnerability detection on the network request message based on preset crawler vulnerability rules to obtain a detection result.

[0063] After obtaining the network request message, the obtained network request message can be subjected to vulnerability detection based on the preset crawler vulnerability rules to obtain the corresponding vulnerability detection results. Web Scraping is an automated technology used to extract data from websites. It accesses web pages, parses content and extracts required information programmatically. It is often used for data collection, market analysis or monitoring website updates.

[0064] There are many potential vulnerabilities and security issues that need to be paid attention to when using crawler technology. Therefore, the crawler vulnerability rules mentioned in this embodiment include: preventing SQL injection, avoiding XSS (cross-site scripting) attacks, handling CSRF (cross-site request forgery), avoiding excessive burden on services, handling sensitive data, complying with laws and website terms of use, handling verification codes, protecting the security of the crawler itself, avoiding data redundancy and obsolescence, as well as recording and monitoring, etc. Specific rules should be set according to actual business needs.

[0065] The interception plug-in Hook in this embodiment is pre-built in step S08, before the step of intercepting the request of the application list of the detection device by the interception plug-in Hook and obtaining the network request message. The specific steps include:

[0066] Step S01, analyzing the detection device to obtain device information of the detection device, wherein the device information includes one or more of an operating system, a detection requirement, and a detection environment;

[0067] Step S02, selecting a corresponding sandbox tool based on the device information to perform environment configuration to obtain a sandbox environment, and performing an operation test on the sandbox environment to obtain an operation test result;

[0068] Step S03, when the running test result is passed, the plug-in is constructed through the plug-in construction framework Xposed to obtain the Hook.

[0069] Before interception, this embodiment also provides a method for constructing an interception plug-in Hook. Before construction, the detection device needs to be analyzed to obtain device information corresponding to the detection device. The device information in this embodiment includes the operating system, detection requirements, and detection environment, etc.;

[0070] It should be clear that the detection device can be a mobile phone, tablet, computer and other devices with communication functions, so the systems they use are also different. Different sandbox tools may be available in different operating systems (such as Windows, Mac, Linux). Therefore, before building a plug-in, you need to consider the operating system running on the device.

[0071] After considering the corresponding operating system, you also need to be clear about the detection requirements for device vulnerability detection, including testing the security of software, isolating suspicious files or programs, and developing and testing software in a controlled environment.

[0072] The detection environment in this embodiment is a sandbox environment, which is an isolated test or execution environment designed to safely run and test programs or codes without affecting the main system or other applications. It can protect the main system from potential security risks and unstable factors, and is mainly used in software development and testing, network security, and system protection.

[0073] After determining the device information (i.e., operating system, detection requirements, and detection environment), select the corresponding sandbox tool based on the device information for configuration to obtain the corresponding sandbox environment. In addition, it is necessary to perform a running test on the sandbox environment to check whether the sandbox environment is suitable for vulnerability detection. The sandbox tool in this embodiment changes based on the actual operating system, for example:

[0074] (1) Sandbox tools on Windows systems: Windows Sandbox, VMware Workstation Player, VirtualBox, etc.

[0075] (2) Sandbox tools on Mac: Docker, VirtualBox, Parallels Desktop, etc.

[0076] (3)Sandbox tools on Linux: Docker, QEMU / KVM, LXC / LXD, etc.

[0077] Finally, when the running test result is passed, the plug-in is built through the plug-in building framework Xposed to obtain Hook, wherein the Hook plug-in is a tool for intercepting and modifying the runtime behavior of the program, which allows developers to insert custom code to observe or change function calls, data flows and other operations without changing the original code. This technology is widely used in debugging, testing, reverse engineering and security analysis. In this embodiment, the Hook plug-in is used to monitor and modify the communication between the crawler and the target application. These plug-ins can help discover potential security vulnerabilities, such as unauthorized data access or information leakage, and the Xposed framework is a powerful tool for the Android system. It allows users to make various customizations and modifications to installed Android applications without modifying the APK file, and the main function of Hook is to help users create links between different files, folders and applications and quickly access related content, so as to intercept requests.

[0078] It should be clear that the Hook plug-in development in this embodiment refers to developing a Hook plug-in that can intercept APP network requests. The Xposed framework can be used for Hook operations. Subsequently, injecting the Hook plug-in refers to injecting the developed Hook plug-in into the APP process running in the sandbox environment. Finally, configuring the plug-in refers to configuring the Hook plug-in so that it can monitor specific network requests (such as HTTP / HTTPS requests) and record relevant information of these requests (such as URL, Header, Body, etc.).

[0079] In addition to the construction of the interception plug-in, a script test is also required. Therefore, in step S03, when the running test result is passed, after the step of constructing the plug-in through the plug-in construction framework Xposed to obtain the Hook, the method further includes:

[0080] Step S04, configuring the Hook through the device information so that the Hook intercepts the request of the detection device based on the detection requirement;

[0081] Step S05, writing a script based on the detection requirement and the detection environment to obtain a test script, wherein the test script is used to traverse the application list and trigger a network request;

[0082] Step S06, performing script testing in the sandbox environment through the testing tool Appium according to the test script;

[0083] Step S07, when the Appium completes traversal of the application list, outputs the script test result as test passed.

[0084] After completing the construction of the plug-in, you need to configure the requests intercepted by the plug-in. Specifically, configure the Hook based on the device information so that the Hook can intercept requests for the detection device based on the detection requirements;

[0085] Then, scripts are written based on the detection requirements and the detection environment. After obtaining the corresponding test scripts, automated testing tools are installed, and automated testing tools such as Appium or UiAutomator are used to perform traversal operations. Appium is an open source automated testing framework for UI testing of mobile applications. It supports iOS and Android platforms and can test native, hybrid and mobile web applications. Appium allows the use of multiple programming languages ​​(such as Java, Python, JavaScript, etc.) to write test scripts without making any modifications to the application. It is based on JSONWire Protocol and WebDriver protocol and supports cross-platform testing, so that the same set of test scripts can run on different operating systems. UiAutomator is an Android testing framework provided by Google for automated testing of the user interface (UI) of Android applications. It allows developers to write test scripts to simulate user interaction with applications to ensure that the application's functions and interfaces work as expected.

[0086] In addition, this embodiment mainly responds to network requests of applications, so when writing automated scripts, the scripts are written to simulate user operations, traverse various interfaces and functions of the APP, and trigger all possible network requests (i.e., traverse the application list);

[0087] Finally, in actual use, execute the script and run the automated test script in the sandbox environment to ensure that all APP scenarios are covered.

[0088] This embodiment uses the above scheme to intercept the application in the application list through the interception plug-in Hook to obtain the network request message; the network request message is tested for vulnerabilities based on the preset crawler vulnerability rules to obtain the test results. Thus, the application in the application list is intercepted through the interception plug-in Hook to obtain the corresponding network request message, and then the network request message is tested for vulnerabilities based on the preset crawler vulnerability rules to obtain the test results, which solves the problem that the vulnerability detection of the application in the prior art using the traditional manual combing method is difficult to sort out all functions and is prone to risk omissions, and improves the accuracy of vulnerability detection.

[0089] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2In step S08, the request of the application in the application list is intercepted by the interception plug-in Hook to obtain the network request message. The vulnerability detection method also includes steps S081 to S083:

[0090] Step S081, intercepting the network request of the application through the Hook to obtain a list of network requests;

[0091] Step S082, preprocessing the network request list to obtain a preprocessed network request list, wherein the preprocessing includes one or more of data filtering and data cleaning;

[0092] Step S083: outputting a network request message based on the preprocessed network request list.

[0093] In this embodiment, the Hook plug-in is used to intercept the network request of the application and transmit it back in real time, that is, the network request message captured by the Hook plug-in is transmitted to the background server in real time;

[0094] The network request list contains a variety of data, including some fields that can be used for detection and some that cannot be used for detection. Therefore, it is necessary to filter the received messages, remove irrelevant information, and retain only useful fields. Data cleaning is also required, that is, cleaning the message data, removing duplicate or invalid data, and standardizing the message format for subsequent analysis.

[0095] In addition, in order to prevent the network request message from being accidentally intercepted, the present embodiment also performs data encryption, that is, to ensure the security of data transmission, the message can be encrypted to obtain the network request message.

[0096] After receiving the network request message, vulnerability detection can be performed. Figure 1 In the illustrated embodiment, the step S09, performing vulnerability detection on the network request message based on a preset crawler vulnerability rule, and obtaining the detection result comprises:

[0097] Step S091, parsing the network request message to obtain key information, where the key information includes one or more of a request parameter and a response parameter;

[0098] Step S092, performing correlation analysis on the interfaces of several application programs in the application program list to obtain correlation analysis results;

[0099] Step S093, based on the key information and the correlation analysis result, vulnerability matching is performed through the crawler vulnerability rule to obtain a matching result, and a detection result is output based on the matching result.

[0100] After obtaining the network request message, the network request message is parsed to obtain key information including request parameters and response parameters. In this embodiment, the API message fields are parsed and correlated, and then matched with customized vulnerability rules to discover vulnerabilities.

[0101] The specific parsing and vulnerability matching steps are as follows:

[0102] (1) Message field parsing: Parse each field of the message, extract key information of request parameters and response parameters, and perform parameter parsing on the four main parts of the network request, namely, URL, header, body, and response. Due to different parameter formats, it is necessary to be compatible with various formats such as key-value, json, and xml. At the same time, the location and routing information of the parameters will be fully recorded through deep traversal.

[0103] (2) API interaction correlation analysis: Analyze the interaction relationship between different APIs, identify potential correlations, clarify the call sequence relationship, and automatically sort out the APIs of each minimum unit;

[0104] (3) Vulnerability rule matching: According to the predefined crawler vulnerability rules, the parsed message is matched to determine whether there is a crawler vulnerability. The rules include: 1. Among the request parameters of the same group of APIs, only one parameter has the same value, and the rest of the structures and values ​​are the same; 2. Among the response parameters of the same group of APIs, the structure is exactly the same; and 3. There are page turning fields such as pageSize and pageNum.

[0105] More specifically, the present embodiment also includes verification of the detection result. In step S09, after the step of performing vulnerability detection on the network request message based on the preset crawler vulnerability rule and obtaining the detection result, the method further includes:

[0106] Step S10, analyzing the detection result to obtain a crawler parameter field and a value change rule of the crawler parameter field;

[0107] Step S11, assembling to obtain a crawler request message based on the crawler parameter fields and value change rules;

[0108] Step S12, resending and verifying the crawler request message, and when receiving a response result of the crawler request message, outputting a verification result of passing.

[0109] After the vulnerability is detected, the detection result can be further verified in this embodiment. First, the fields and field routing information parsed from the message are extracted, and the key parameter fields for implementing the crawler and the changing rules of the field values ​​are found.

[0110] After obtaining the key parameter field and the changing rules of the field value, the crawler request message can be assembled, and then resent using the verification device, and finally the success of the crawler can be determined by the response result.

[0111] This embodiment uses the above scheme to intercept the network request of the application program through the Hook to obtain a list of network requests; preprocess the list of network requests to obtain a preprocessed list of network requests, wherein the preprocessing includes one or more of data filtering and data cleaning; and output a network request message based on the preprocessed list of network requests. Thus, the application program in the application list is intercepted by the interception plug-in Hook to obtain the corresponding network request message, and then the network request message is tested for vulnerabilities based on the pre-set crawler vulnerability rules to obtain the test results, which solves the problem in the prior art that the traditional manual combing method for vulnerability detection of the application program is difficult to sort out all functions and is prone to risk omissions, thereby improving the accuracy of vulnerability detection.

[0112] For example, to help understand the implementation process of the vulnerability detection method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 3 , Figure 3 A brief flow chart of a vulnerability detection method is provided, specifically:

[0113] First, install the sandbox environment in the test device and install the corresponding plug-in device (i.e., interception plug-in Hook);

[0114] Then, the application list in the test device is traversed through the Hook to obtain the network request message;

[0115] Then, the network request message return device returns the message to the server and performs certain preprocessing on the message;

[0116] Then, the vulnerability discovery device performs vulnerability detection on the network request message according to the vulnerability discovery rules to obtain the detection result;

[0117] Finally, the detection results are further verified through the vulnerability verification device to verify the accuracy of the detection.

[0118] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the vulnerability detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0119] This application also provides a vulnerability detection device, please refer to Figure 4 , the vulnerability detection device comprises:

[0120] An interception module 10 is used to intercept requests of applications in the application list through an interception plug-in Hook to obtain a network request message;

[0121] The detection module 20 is used to perform vulnerability detection on the network request message based on preset crawler vulnerability rules to obtain a detection result.

[0122] The vulnerability detection device provided by the present application adopts the vulnerability detection method in the above embodiment, which can solve the technical problem that it is difficult to sort out all functions in the conventional manual combing method for vulnerability detection of application programs in the prior art, which easily leads to risk omissions. Compared with the prior art, the beneficial effects of the vulnerability detection device provided by the present application are the same as those of the vulnerability detection method provided by the above embodiment, and the other technical features of the vulnerability detection device are the same as those disclosed in the above embodiment method, which will not be described in detail here.

[0123] The present application provides a vulnerability detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the vulnerability detection method in the above-mentioned embodiment one.

[0124] Reference below Figure 5 , which shows a schematic diagram of the structure of a vulnerability detection device suitable for implementing the embodiment of the present application. The vulnerability detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The vulnerability detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] like Figure 5As shown, the vulnerability detection device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the vulnerability detection device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the vulnerability detection device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a vulnerability detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0126] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0127] The vulnerability detection device provided by the present application adopts the vulnerability detection method in the above embodiment, which can solve the technical problem that it is difficult to sort out all functions in the vulnerability detection of the application program in the traditional manual combing method in the prior art, which easily leads to risk omission. Compared with the prior art, the beneficial effects of the vulnerability detection device provided by the present application are the same as the beneficial effects of the vulnerability detection method provided by the above embodiment, and the other technical features in the vulnerability detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0128] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0129] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0130] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the vulnerability detection method in the above-mentioned embodiment.

[0131] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0132] The computer-readable storage medium may be included in the vulnerability detection device; or may exist independently without being assembled into the vulnerability detection device.

[0133] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the vulnerability detection device, the vulnerability detection device: intercepts the request of the application in the application list through the interception plug-in Hook to obtain the network request message; performs vulnerability detection on the network request message based on the preset crawler vulnerability rules to obtain the detection result.

[0134] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0135] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0136] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0137] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned vulnerability detection method, and can solve the technical problem that it is difficult to sort out all functions in the conventional manual combing method for vulnerability detection of application programs in the prior art, which easily leads to risk omissions. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the vulnerability detection method provided by the above-mentioned embodiment, and will not be elaborated here.

[0138] The present application also provides a computer program product, including a computer program, which implements the steps of the vulnerability detection method as described above when executed by a processor.

[0139] The computer program product provided by the present application can solve the technical problem that it is difficult to sort out all functions in the conventional manual combing method for vulnerability detection of application programs in the prior art, which easily leads to risk omissions. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as those of the vulnerability detection method provided by the above embodiment, and will not be elaborated here.

[0140] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A vulnerability detection method, characterized in that: The method is applied to a detection device, the detection device includes an application list, and the method includes: Intercept the requests of the applications in the application list through the interception plug-in Hook to obtain the network request message; Based on the preset crawler vulnerability rules, vulnerability detection is performed on the network request message to obtain a detection result.

2. The method according to claim 1, characterized in that Before the step of intercepting the request of the application list of the detection device by the interception plug-in Hook to obtain the network request message, the method includes: Analyze the detection device to obtain device information of the detection device, where the device information includes one or more of an operating system, a detection requirement, and a detection environment; Selecting a corresponding sandbox tool based on the device information to perform environment configuration to obtain a sandbox environment, and performing an operation test on the sandbox environment to obtain an operation test result; When the running test result is passed, the plug-in is built through the plug-in building framework Xposed to obtain the Hook.

3. The method according to claim 2, characterized in that In the case where the running test result is passed, after the step of obtaining the Hook by performing plug-in construction through the plug-in construction framework Xposed, the method further includes: The Hook is configured by the device information so that the Hook intercepts the request of the detection device based on the detection requirement; Writing a script based on the detection requirements and the detection environment to obtain a test script, wherein the test script is used to traverse the application list and trigger a network request; According to the test script, script testing is performed in the sandbox environment by using the test tool Appium; When the Appium completes traversal of the application list, the script test result is output as test passed.

4. The method according to claim 1, characterized in that The step of intercepting the request of the application in the application list by the interception plug-in Hook to obtain the network request message includes: The network request of the application is intercepted by the Hook to obtain a list of network requests; Preprocessing the network request list to obtain a preprocessed network request list, wherein the preprocessing includes one or more of data filtering and data cleaning; Outputting a network request message based on the preprocessed network request list.

5. The method according to claim 1, characterized in that The step of performing vulnerability detection on the network request message based on the preset crawler vulnerability rule to obtain the detection result includes: Parsing the network request message to obtain key information, where the key information includes one or more of a request parameter and a response parameter; Performing correlation analysis on interfaces of several application programs in the application program list to obtain correlation analysis results; According to the key information and the correlation analysis result, vulnerability matching is performed through the crawler vulnerability rule to obtain a matching result, and a detection result is output based on the matching result.

6. The method according to claim 1, characterized in that After the step of performing vulnerability detection on the network request message based on the preset crawler vulnerability rule to obtain the detection result, the method further includes: Analyze the detection results to obtain a crawler parameter field and a value change rule of the crawler parameter field; Assemble based on the crawler parameter fields and value change rules to obtain a crawler request message; The crawler request message is retransmitted for verification, and when a response result of the crawler request message is received, a verification result is output as passed.

7. A vulnerability detection device, characterized in that: The apparatus is applied to a detection device, the detection device includes an application list, and the apparatus includes: An interception module is used to intercept requests of applications in the application list through an interception plug-in Hook to obtain a network request message; The detection module is used to perform vulnerability detection on the network request message based on preset crawler vulnerability rules to obtain a detection result.

8. A vulnerability detection device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the vulnerability detection method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the vulnerability detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the vulnerability detection method according to any one of claims 1 to 6 are implemented.

Images