Enumeration vulnerability detection method and device, storage medium and terminal

Abstract

The embodiment of the invention discloses an enumeration vulnerability detection method and device, a storage medium and a terminal, and the method comprises the steps: obtaining data containing an account information page, recognizing a page type corresponding to the data, determining a target account parameter corresponding to the data according to the corresponding relation between different page types and different account parameters, and determining the enumeration vulnerability according to the target account parameter. And performing account operation on an account page corresponding to the data based on the target account parameter to obtain returned operation information, and determining a detection result of the user name enumeration vulnerability based on the operation information. According to the embodiment of the invention, the data containing the account information page can be automatically scanned, the detection result of the user name enumeration vulnerability on the website corresponding to the data is confirmed, whether the user name enumeration vulnerability exists on the website or not does not need to be manually detected, the effect of automatically detecting the user name enumeration vulnerability is achieved, and the user name enumeration vulnerability detection efficiency is improved. The efficiency of detecting the user name enumeration vulnerability is also improved, and the intelligence of detecting the user name enumeration vulnerability is improved.

Description

Technical Field

[0001] The present application relates to the field of computer and network security technology, and in particular to a detection method, device, storage medium and terminal for enumerating vulnerabilities. Background Art

[0002] Nowadays, enumeration vulnerabilities are a relatively common vulnerability. Destroyers can use enumeration vulnerabilities to attack websites and obtain relevant information from the website. Enumeration vulnerabilities can be understood as taking advantage of incorrect configuration or design defects to input valid information and invalid information on the website. The server's response content to valid information and invalid information is different. The difference in the response content returned by the server is used to determine whether there is an enumeration vulnerability. Common enumeration vulnerabilities include username vulnerabilities, that is, when valid account information and invalid account information are provided on the website, the server returns different response content to the above two account information. For the repair of username vulnerabilities, a common means is to unify the returned response content. Summary of the invention

[0003] The embodiments of the present application provide a method, device, computer storage medium and terminal for detecting an enumeration vulnerability, which can automatically scan data containing an account information page and confirm the detection result of a username enumeration vulnerability on a website corresponding to the data, without manually detecting whether there is a username enumeration vulnerability on the website, thereby achieving the effect of automatically detecting a username enumeration vulnerability. The technical solution is as follows:

[0004] In a first aspect, an embodiment of the present application provides a method for detecting an enumeration vulnerability, the method comprising:

[0005] Obtain data containing an account information page, and identify a page type corresponding to the data;

[0006] Determine the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters;

[0007] An account operation is performed on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and a detection result of the user name enumeration vulnerability is determined based on the operation information.

[0008] In a feasible implementation manner, the identifying the page type corresponding to the data includes:

[0009] Obtaining parameter information in the data;

[0010] A page type corresponding to the data is determined based on the parameter information.

[0011] In a feasible implementation manner, obtaining data including the account information page includes:

[0012] Obtain data containing account information pages based on crawler algorithms; or,

[0013] The element locator selected by the user is obtained, and data of the account information page is obtained based on the element locator.

[0014] In a feasible implementation manner, before performing an account operation on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, the method further includes:

[0015] If there is a verification code on the account information page corresponding to the data, identifying the verification code to obtain an identification result;

[0016] The identification result is input on the account information page.

[0017] In a feasible implementation, the target account parameter is each login combination consisting of a user name and a password, and the account operation is performed on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and the detection result of the user name enumeration vulnerability is determined based on the operation information, including:

[0018] Performing login operations on the account page corresponding to the data based on the login combination to obtain returned login information;

[0019] A detection result of a username enumeration vulnerability is determined based on the login information.

[0020] In a feasible implementation, the target account parameter is a registration combination of a user name and a password, and the account operation is performed on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and the detection result of the user name enumeration vulnerability is determined based on the operation information, including:

[0021] Performing registration operations on the account page corresponding to the data based on the registration combination to obtain returned registration information;

[0022] A detection result of a username enumeration vulnerability is determined based on the registration information.

[0023] In a feasible implementation, the target account parameters include known user names and unknown user names, performing account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determining the detection result of the user name enumeration vulnerability based on the operation information include:

[0024] Performing a password retrieval operation on the account page corresponding to the data based on the known user name and the unknown user name to obtain returned reference information;

[0025] A detection result of the username enumeration vulnerability is determined based on the reference information.

[0026] In a feasible implementation, the target account parameters include a known second user name, an unknown third user name, and an unknown fourth user name, performing an account operation on an account page corresponding to the data based on the target account parameters to obtain returned operation information, and determining a detection result of a user name enumeration vulnerability based on the operation information, includes:

[0027] Replacing the first user name contained in the network path of the account page corresponding to the data with the second user name, the third user name, and the fourth user name respectively, to obtain returned status information;

[0028] A detection result of the username enumeration vulnerability is determined based on the state information.

[0029] In a feasible implementation manner, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, after determining the detection result of the username enumeration vulnerability based on the operation information, the method further includes:

[0030] Based on the preset user names in the user name dictionary, account operations are performed on the account information page to obtain returned target information;

[0031] Based on the target information, a target user name that actually exists on the website corresponding to the data is determined from the preset user names, and the target user name is output.

[0032] In a second aspect, an embodiment of the present application provides a detection device for enumeration vulnerabilities, the device comprising:

[0033] A data acquisition module, used to acquire data containing account information pages and identify the page type corresponding to the data;

[0034] A parameter determination module, used to determine the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters;

[0035] The vulnerability detection module is used to perform account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determine the detection result of the user name enumeration vulnerability based on the operation information.

[0036] In a feasible implementation manner, the identifying the page type corresponding to the data includes:

[0037] Obtaining parameter information in the data;

[0038] A page type corresponding to the data is determined based on the parameter information.

[0039] In a feasible implementation manner, obtaining data including the account information page includes:

[0040] Obtain data containing account information pages based on crawler algorithms; or,

[0041] The element locator selected by the user is obtained, and data of the account information page is obtained based on the element locator.

[0042] In a feasible implementation manner, before performing an account operation on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, the method further includes:

[0043] If there is a verification code on the account information page corresponding to the data, identifying the verification code to obtain an identification result;

[0044] The identification result is input on the account information page.

[0045] In a feasible implementation, the target account parameter is each login combination consisting of a user name and a password, and the account operation is performed on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and the detection result of the user name enumeration vulnerability is determined based on the operation information, including:

[0046] Performing login operations on the account page corresponding to the data based on the login combination to obtain returned login information;

[0047] A detection result of a username enumeration vulnerability is determined based on the login information.

[0048] In a feasible implementation, the target account parameter is a registration combination of a user name and a password, and the account operation is performed on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and the detection result of the user name enumeration vulnerability is determined based on the operation information, including:

[0049] Performing registration operations on the account page corresponding to the data based on the registration combination to obtain returned registration information;

[0050] A detection result of a username enumeration vulnerability is determined based on the registration information.

[0051] In a feasible implementation, the target account parameters include known user names and unknown user names, performing account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determining the detection result of the user name enumeration vulnerability based on the operation information include:

[0052] Performing a password retrieval operation on the account page corresponding to the data based on the known user name and the unknown user name to obtain returned reference information;

[0053] A detection result of the username enumeration vulnerability is determined based on the reference information.

[0054] In a feasible implementation, the target account parameters include a known second user name, an unknown third user name, and an unknown fourth user name, performing an account operation on an account page corresponding to the data based on the target account parameters to obtain returned operation information, and determining a detection result of a user name enumeration vulnerability based on the operation information, includes:

[0055] Replacing the first user name contained in the network path of the account page corresponding to the data with the second user name, the third user name, and the fourth user name respectively, to obtain returned status information;

[0056] A detection result of the username enumeration vulnerability is determined based on the state information.

[0057] In a feasible implementation manner, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, after determining the detection result of the username enumeration vulnerability based on the operation information, the method further includes:

[0058] Based on the preset user names in the user name dictionary, account operations are performed on the account information page to obtain returned target information;

[0059] Based on the target information, a target user name that actually exists on the website corresponding to the data is determined from the preset user names, and the target user name is output.

[0060] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium has a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0061] In a fourth aspect, an embodiment of the present application provides a terminal, which may include: a memory and a processor; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the memory and executing the above-mentioned method steps.

[0062] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0063] In an embodiment of the present application, the terminal obtains data including an account information page, identifies the page type corresponding to the data, determines the target account parameters corresponding to the data based on the correspondence between different page types and different account parameters, performs account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determines the detection result of the username enumeration vulnerability based on the operation information. The embodiment of the present application can automatically scan the data including the account information page, and confirm the detection result of the username enumeration vulnerability on the website corresponding to the data, without manually detecting whether there is a username enumeration vulnerability on the website, thereby achieving the effect of automatically detecting the username enumeration vulnerability, improving the efficiency of detecting the username enumeration vulnerability, and increasing the intelligence of detecting the username enumeration vulnerability. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 It is a flowchart of a method for detecting enumerated vulnerabilities provided in an embodiment of the present application;

[0066] Figure 2 It is a flowchart of another method for detecting enumeration vulnerabilities provided in an embodiment of the present application;

[0067] Figure 3 It is a flowchart of another method for detecting enumeration vulnerabilities provided in an embodiment of the present application;

[0068] Figure 4 It is a flowchart of another method for detecting enumeration vulnerabilities provided in an embodiment of the present application;

[0069] Figure 5 It is a flowchart of another method for detecting enumeration vulnerabilities provided in an embodiment of the present application;

[0070] Figure 6 It is a flow chart of a detection device for enumerating vulnerabilities provided in an embodiment of the present application;

[0071] Figure 7 It is a structural diagram of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In order to make the purpose, features, and advantages of the embodiments of the present application more obvious and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0073] In the description of the present application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood in specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0074] In the related art, the detection of username enumeration vulnerabilities is usually carried out manually, which takes up a lot of manpower, is time-consuming and inefficient. Therefore, how to improve the intelligence of detecting username vulnerabilities is an urgent problem to be solved.

[0075] In the following method embodiments, for the sake of convenience, only the execution subject of each step is introduced and described as the terminal.

[0076] See also Figure 1 , is a flow chart of a method for detecting enumerated vulnerabilities provided in an embodiment of the present application. Figure 1 As shown, the method of the embodiment of the present application may include the following steps:

[0077] S101, obtaining data including account information pages, and identifying the page type corresponding to the data.

[0078] It is easy to understand that data can refer to data of code extracted from web page code. Web page code can refer to the code of a web page containing account information. Account information page can refer to a web page containing account information.

[0079] The page type may refer to the type of web page containing account information. For example, in the embodiment of the present application, the page type may refer to the type of page on which account operations can be performed on an account, and account operations may refer to operations such as logging in to an account, registering an account, and retrieving an account password, and the page type may refer to types such as an account login page, a password retrieval page, and an account registration page.

[0080] In some embodiments, the data including the account information page can be obtained by using a data extraction program. Specifically, the data extraction program can send a request to the server of the web page, and the server of the web page can return the code of the web page, so that the data including the account information page can be obtained.

[0081] Furthermore, the page type corresponding to the data can be identified. Specifically, the parameters in the data can be analyzed, such as identifying the name of the parameter contained in the data, the type of the parameter, the number of parameters, etc., so that the page type of the webpage corresponding to the data can be identified based on the name of the parameter, the type of the parameter, the number of parameters, etc. For example, when the page type is an account login page, the parameters contained in the data may include a username parameter (username), a password parameter (password), a request method parameter (post), a login button parameter, etc. For another example, when the page type is an account registration page, the parameters contained in the data may include a username parameter, a first password parameter, a second password parameter, a request method parameter (post), a registration case parameter, etc.

[0082] S102, determining the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters.

[0083] It is easy to understand that account parameters can refer to parameters related to account information, and the account parameters in the embodiments of the present application mainly refer to username parameters and password parameters. Username parameters can be subdivided into valid usernames and invalid usernames; wherein, a valid username can be understood as the username of an account that actually exists on the website, and an invalid username can be understood as a username that has not registered an account on the website. Password parameters can be subdivided into valid passwords, invalid passwords, and repeated passwords; wherein, a valid password can be understood as the password of an account that actually exists on the website, an invalid password can be understood as a randomly constructed password that is not a real password on the website, and a repeated password can be equal to an invalid password.

[0084] In some embodiments, for web pages corresponding to different page types, when different account operations are performed on an account on the web page, the account parameters (i.e., target account parameters) input on the web page are different. Therefore, before executing the steps of this solution, the correspondence between different page types and different account parameters can be preset and stored. When executing this step, the target account parameters corresponding to the current page type can be directly queried from the stored correspondence.

[0085] For example, when the page type is an account login page, the webpage corresponding to the page type can be a webpage for logging into an account, and the parameters entered on the webpage (i.e., target account parameters) can include a username parameter and a password parameter. Specifically, the target account parameters can be a valid username + invalid password, an invalid username + a valid password, or an invalid username + an invalid password. When the page type is an account registration page, the webpage corresponding to the page type is a webpage for registering an account, and the parameters entered on the webpage (i.e., target account parameters) can include a username parameter and a password parameter. Specifically, the target account parameters can be a valid username + password + repeated password, an invalid username + password + repeated password, and the password can be any symbol, and the repeated password is equal to the password. When the page type is a password retrieval page, the webpage corresponding to the page type can be a page for retrieving a password, and the parameters entered on the webpage (i.e., target account parameters) can be a username parameter. Specifically, the target account parameters can be a valid username and an invalid username. There are more page types, and the account parameters to be entered on the corresponding webpages are not exactly the same, which are not listed here one by one.

[0086] S103, performing an account operation on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determining a detection result of the user name enumeration vulnerability based on the operation information.

[0087] It is easy to understand that account operations can refer to operations on an account, such as logging into an account, registering an account, retrieving an account password, and other account operations.

[0088] Operation information may refer to prompt information returned by the web server to the terminal in response to the request sent by the terminal. Specifically, the prompt information may be text content, or the prompt information may be a character code, and different character codes may represent different meanings. The request sent by the terminal is the request sent by the terminal to the server when performing account operations.

[0089] Username enumeration vulnerabilities refer to the vulnerabilities that can enumerate the real accounts in the system based on the different responses fed back by the system's server. The principle of username enumeration vulnerabilities is that due to misconfiguration or design flaws, when valid accounts and invalid accounts are submitted to the system, the server will have different responses. Then, using different responses, attackers can obtain existing accounts in the system, which can be used for brute force cracking to further obtain the account's login password.

[0090] In some embodiments, after determining the target account parameters corresponding to the current data, you can open the web page corresponding to the data, enter the target account parameters at the corresponding position on the web page, and further, click the function icon or function button of the account operation, and the returned operation information can be displayed on the web page. This is because the terminal clicks the function icon or function button of the account operation, which is the process of the terminal sending an operation request to the server of the web page. On the server side, after receiving the request, the server can process the request, determine the operation information corresponding to the request, and return the operation information to the terminal. Furthermore, the terminal can identify the operation information and determine whether the web page has a username enumeration vulnerability based on the operation information, that is, the detection result of the username enumeration vulnerability.

[0091] It should be noted that when the target account parameters are inputted in batches and the account operations are performed in batches, and the target account parameters inputted each time are different, the operation information returned after each account operation may have different corresponding information content. The terminal can determine whether there is a user name enumeration vulnerability on the web page based on the information content of multiple operation information returned after multiple account operations.

[0092] For example: when the page type is a password retrieval page, the web page corresponding to the page type may be a password retrieval page, and the parameters displayed thereon may include a username parameter and a password retrieval parameter. Two values ​​may be set for the user parameter, namely username 1 and username 2. Username 1 may be a username that actually exists on the current web page, and username 2 may be a username that has not registered an account on the current web page, that is, username 2 may be a username that does not exist on the web page. When performing the first password retrieval operation, you may enter username 1 in the location where the username parameter is located, and then click the password retrieval button corresponding to the password retrieval parameter to obtain the returned operation information. If username 1 is an email address, the returned operation information may be a prompt message, and the content of the prompt message may be "The email address you submitted has been received, and you will receive a password reset email." When performing the second password retrieval operation, you can enter username 2 in the location where the username parameter is located, and then click the password retrieval button corresponding to the password retrieval parameter to obtain the returned operation information. If username 2 is an email address that has not registered an account on the current web page, the returned operation information can also be a prompt message, and the content of the prompt message can be "The current email address does not exist." Obviously, the content of the returned operation information is completely different when using username 1 and username 2 to perform password retrieval operations, which can indicate that there is a username enumeration vulnerability on the current web page. Alternatively, when performing the second password retrieval operation, that is, using username 2 to perform the password retrieval operation, the prompt information returned is also "The email address you submitted has been received, and you will receive a password reset email." Since username 2 is a non-existent username, the content of the message returned at this time is the same as the message content returned by username 1, which can indicate that there is no username enumeration vulnerability on the current web page.

[0093] In an embodiment of the present application, the terminal obtains data including an account information page, identifies the page type corresponding to the data, determines the target account parameters corresponding to the data based on the correspondence between different page types and different account parameters, performs account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determines the detection result of the username enumeration vulnerability based on the operation information. The embodiment of the present application can automatically scan the data including the account information page, and confirm the detection result of the username enumeration vulnerability on the website corresponding to the data, without manually detecting whether there is a username enumeration vulnerability on the website, thereby achieving the effect of automatically detecting the username enumeration vulnerability, improving the efficiency of detecting the username enumeration vulnerability, and increasing the intelligence of detecting the username enumeration vulnerability.

[0094] See also Figure 2 , is a flow chart of a method for detecting enumerated vulnerabilities provided in an embodiment of the present application. Figure 2As shown, the method of the embodiment of the present application may include the following steps:

[0095] S201, obtaining data including an account information page.

[0096] It is easy to understand that data can refer to data of code extracted from web page code. Web page code can refer to the code of a web page containing account information. Account information page can refer to a web page containing account information.

[0097] In some embodiments, data can be obtained in an intelligent recognition manner. Specifically, data containing account information pages can be obtained based on a crawler algorithm. Among them, a crawler algorithm refers to an algorithm that automatically obtains web pages and extracts and saves information. Specifically, the embodiment of the present application can use a crawler algorithm to crawl the code of a web page, that is, to obtain the source code of the web page, and the source code contains some useful information of the web page. Further, the source code of the web page can be analyzed to extract data of interest from the source code of the web page. For example, since there may be certain rules in the structure of the web page, some libraries can be used to efficiently and quickly extract data of interest from the web page, such as Beautiful Soup, pyquery, lxml, etc.

[0098] In some other embodiments, data can be obtained by manual positioning and intelligent identification. Specifically, the element locator selected by the user can be obtained, and the data of the account information page can be obtained based on the element locator. First, the user can select an element on the web page by moving the cursor. Since each element on the web page has its own element locator css selector, when the user selects an element of account information on the web page, the terminal can obtain the element locator of the element, and the data of the account information page can be obtained through the code information corresponding to the element locator.

[0099] S202, obtaining parameter information in the data, and determining a page type corresponding to the data based on the parameter information.

[0100] It is easy to understand that the page type can refer to the type of web page containing account information. For example, in the embodiment of the present application, the page type can refer to the type of page that can perform account operations on the account, and the account operation can refer to operations such as logging in to an account, registering an account, and retrieving an account password. The page type can refer to types such as an account login page, a password retrieval page, and an account registration page.

[0101] Parameter information may refer to information such as parameter type, parameter quantity, and parameter name.

[0102] In some embodiments, since the known data refers to the data of the code, the code contains a variety of parameters, each parameter has a unique name, and the number of each parameter may also be different. For web pages of different page types, the parameter information contained in the code is also different. Therefore, the page type of the web page corresponding to the data can be identified based on the parameter information in the data. For example, when the page type is an account login page, the parameters it contains must include a user name parameter, a password parameter, and a login parameter (parameters corresponding to the login button). In an embodiment of the present application, when the user name parameter, the password parameter, and the login parameter are identified, it can be determined that the current page is a login page.

[0103] S203, determining the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters.

[0104] Specifically, by Figure 1 As can be seen from the description of S102 in the illustrated embodiment, different page types correspond to different account parameters. Then in the embodiment of the present application, when determining that the current page is a login page, the target account parameters can be determined to be the user name parameter and the password parameter.

[0105] S204, performing login operations on the account page corresponding to the data based on the login combination to obtain returned login information.

[0106] It is easy to understand that the login combination can be a combination of a user name and a password. In the embodiment of the present application, the target account parameter can be each login combination.

[0107] Login information may refer to prompt information returned by the webpage server to the terminal in response to the login request sent by the terminal. Specifically, the prompt information may be text content, or the prompt information may be a character code, and different character codes may represent different meanings. The login request sent by the terminal is the login request sent by the terminal to the server when performing a login operation.

[0108] In some embodiments, for the currently acquired data, the corresponding page type is an account login page, and the webpage corresponding to the page type can be a webpage for logging in to an account, on which a login operation can be performed according to a user name and a password. The target account parameter found according to the webpage type is a login combination, and further, each login combination can be used to perform a login operation respectively to obtain the returned login information. Specifically, the login combination can include a valid user name + invalid password, an invalid user name + invalid password, and an invalid user name + valid password. For the first time, a login operation is performed using a valid user name + invalid password, and the login information returned by this login operation is recorded; for the second time, a login operation is performed using an invalid user name + invalid password, and the login information returned by this login operation is recorded; for the third time, an invalid user name + valid password is used to perform a login operation, and the login information returned by this login operation is recorded; for the fourth time, an invalid user name + invalid password is used to perform a login operation, and the login information returned by this login operation is recorded.

[0109] Among them, a valid username may refer to a username that actually exists on the current web page; an invalid username may refer to a username that does not exist on the current web page; a valid password may refer to the password of an account that actually exists on the current web page; an invalid password may refer to the password of an account that does not exist on the current web page.

[0110] Optionally, before performing a login operation on an account page corresponding to the data based on the login combination, it is also possible to determine whether there is a verification code on the account page, that is, before each login operation, it is possible to determine whether there is a verification code on the account page. If there is a verification code on the account page, the verification code is identified to obtain a recognition result, and the above recognition result is entered on the account page. Among them, the verification code may refer to a verification code in the form of a picture, and the verification code may specifically be a Chinese character verification code, or a letter verification code, or a digital verification code. For example, if there is a verification code in the form of a picture on the account page, and the picture contains several numbers, the numbers in the picture can be identified, and the recognition result obtained is the above numbers. Therefore, the embodiment of the present application can automatically identify the verification code on the account page, and input the identified verification code result into the corresponding position, which can save the operation of manual verification.

[0111] S205: Determine a detection result of a user name enumeration vulnerability based on the login information.

[0112] In some embodiments, the detection result of the user name enumeration vulnerability can be determined based on the login information returned by the above four login operations. Specifically, the login information returned by the first login operation can be compared with the login information returned by the second login operation, and the login information returned by the second login operation can be compared with the login information returned by the fourth login operation. If the login information returned by the first login operation is different from the login information returned by the second login operation, and the login information returned by the second login operation is the same as the login information returned by the fourth login operation, it can be determined that there is a user name enumeration vulnerability on the current web page. Otherwise, it can be determined that there is no user name enumeration vulnerability on the current web page.

[0113] S206, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, account operations are performed on the account information page based on the preset usernames in the username dictionary to obtain returned target information.

[0114] It is easy to understand that the user name dictionary can be a file with multiple user names. These user names can be obtained by combining common surnames and given names. For example, these user names can be Chinese user names, English user names, user names obtained by combining Chinese and English, user names obtained by combining Chinese and numbers, user names obtained by combining English and numbers, and other types of user names. In actual application, the user name dictionary can be selected according to actual needs. There may be a public user name dictionary and a user-defined user name dictionary. In this case, the public user name dictionary or the user-defined user name dictionary can be selected according to actual needs.

[0115] The preset user name can refer to any user name in the user name dictionary.

[0116] In some embodiments, when it is determined that a username enumeration vulnerability exists, an invalid password can be used and the invalid password can be combined with any username in the username dictionary to obtain multiple test login combinations. Furthermore, each test login combination can be used in turn to perform login operations on the web page to obtain returned target information, which is the response content returned by the server corresponding to the web page in response to the login request sent by the terminal.

[0117] S207, based on the target information, determine a target user name that actually exists on the website corresponding to the data in the preset user name, and output the target user name.

[0118] In some embodiments, each target information can be analyzed to determine whether the user name in the test login combination corresponding to the target information is a real user name on the website. If it is a real user name on the website, the user name can be determined as the target user name, and the terminal can choose to output the target user name in a manner that displays the target user name. For example: Assuming that the preset user name is "Wang Fang", "Wang Fang" + invalid password is used to log in on the web page, and the returned target information is a prompt content, the prompt content can be "Wrong password", then it can be confirmed that the user name "Wang Fang" is a real user name on the web page. After traversing all the preset user names in the user name dictionary and determining all the target user names, all the target user names can be displayed on the screen of the terminal for users to view and record.

[0119] In the embodiment of the present application, when the login page is identified, the login operation can be performed on the login page based on the login combination to obtain the returned login information, so that it can be determined whether the current page has a username enumeration vulnerability according to the login information. After determining that the current page has a username enumeration vulnerability, the login operation can be performed on the current page based on the preset username in the username dictionary, and the returned target information can be obtained, so that the target username that actually exists on the current website can be determined in the preset username according to the target information, and the target username is provided to the user. Therefore, the embodiment of the present application can automatically confirm the detection result of the username enumeration vulnerability on the website corresponding to the login page, without manually detecting whether there is a username enumeration vulnerability on the website, and the effect of automatically detecting the username enumeration vulnerability is achieved, and the efficiency of detecting the username enumeration vulnerability is also improved, and the intelligence of detecting the username enumeration vulnerability is increased. In addition, the embodiment of the present application can also output the target username that is located in the username dictionary and is actually present on the website at the same time, so that the user can view and record the above-mentioned target username.

[0120] See also Figure 3 , is a flow chart of a method for detecting enumerated vulnerabilities provided in an embodiment of the present application. Figure 3 As shown, the method of the embodiment of the present application may include the following steps:

[0121] S301, obtaining data including account information page.

[0122] Specifically, see Figure 2 The description of S201 will not be repeated here.

[0123] S302, obtaining parameter information in the data, and determining the page type corresponding to the data based on the parameter information.

[0124] In some embodiments, since the known data refers to the data of the code, the code contains a variety of parameters, each parameter has a unique name, and the number of each parameter may also be different. For web pages of different page types, the parameter information contained in the code is also different. Therefore, the page type of the web page corresponding to the data can be identified based on the parameter information in the data. For example, when the page type is an account registration page, the parameters it contains must include a user name parameter, a password parameter, a confirmation password parameter, and a registration parameter (parameters corresponding to the registration button). In an embodiment of the present application, when the user name parameter, password parameter, confirmation password parameter, and registration parameter are identified, it can be determined that the current page type is an account registration page.

[0125] S303, determining the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters.

[0126] Specifically, by Figure 1 As can be seen from the description of S102 in the illustrated embodiment, different page types correspond to different account parameters. Then in the embodiment of the present application, when determining that the current page is an account registration page, the target account parameters can be determined to be a user name parameter, a password parameter, and a confirmation password parameter.

[0127] S304, performing registration operations on the account page corresponding to the data based on the registration combination to obtain returned registration information.

[0128] It is easy to understand that the registration combination can be a combination of a user name, a password, and a confirmation password. In the embodiment of the present application, the target account parameter is a registration combination of a user name, a password, and a confirmation password.

[0129] Registration information may refer to prompt information returned by the webpage server to the terminal in response to the registration request sent by the terminal. Specifically, the prompt information may be text content, or the prompt information may be a character code, and different character codes may represent different meanings. The registration request sent by the terminal is the registration request sent by the terminal to the server when performing a registration operation.

[0130] In some embodiments, for the currently acquired data, the corresponding page type is an account registration page, and the webpage corresponding to the page type can be a webpage for registering an account, on which registration operations can be performed according to the user name, password, and confirmation password. The target account parameters found according to the webpage type are the registration combination, and further, the registration combination can be used to perform a registration operation to obtain the returned registration information. Specifically, the registration combination can include a valid user name + password 1 + confirmation password 1, an invalid user name + password 2 + confirmation password 2. For the first time, a valid user name + password + confirmation password is used to perform a registration operation, and the registration information returned by this registration operation is recorded; for the second time, an invalid user name + password 2 + confirmation password 2 is used to perform a registration operation, and the registration information returned by this registration operation is recorded.

[0131] Among them, the valid username can refer to the username that actually exists on the current web page; the invalid username can refer to the username that does not exist on the current web page; Password 1 and Confirm Password 1 are exactly the same, and Password 1 can be set at will; Password 2 and Confirm Password 2 are exactly the same, and Password 2 can also be set at will.

[0132] Optionally, before performing a registration operation on an account page corresponding to the data based on a registration combination, it is also possible to determine whether there is a verification code on the account page, that is, before each registration operation, it is possible to determine whether there is a verification code on the account page. If there is a verification code on the account page, the verification code is identified to obtain a recognition result, and the recognition result is entered on the account page. Among them, the verification code may refer to a verification code in the form of a picture, and the verification code may specifically be a Chinese character verification code, or a letter verification code, or a digital verification code. For example, if there is a verification code in the form of a picture on the account page, and the picture contains several numbers, the numbers in the picture can be identified, and the recognition result obtained is the above-mentioned number. Therefore, the embodiment of the present application can automatically identify the verification code on the account page, and input the identified verification code result into the corresponding position, which can save the operation of manual verification.

[0133] S305: Determine a detection result of a user name enumeration vulnerability based on the registration information.

[0134] In some embodiments, the detection result of the username enumeration vulnerability can be determined based on the registration information returned by the above two registration operations. Specifically, the registration information returned by the first registration operation can be compared with the registration information returned by the second registration operation. If the registration information returned by the first registration operation is different from the registration information returned by the second registration operation, it can be determined that there is a username enumeration vulnerability on the current web page. Otherwise, it can be determined that there is no username enumeration vulnerability on the current web page. For example: if the registration information returned by the first registration operation is a prompt content, the prompt content can be "the user name already exists"; if the registration information returned by the second registration operation is also a prompt content, the prompt content can be "registration successful", because the username used in the first registration operation is a username that already exists on the current web page, and the username used in the second registration operation is not a username that already exists on the current web page, the registration information returned by the two registration operations has given a prompt, and according to the prompt, it can be distinguished whether the username used in each registration operation is a real username on the current web page, then it can be determined that there is a username enumeration vulnerability on the current web page.

[0135] S306, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, account operations are performed on the account information page based on the preset usernames in the username dictionary to obtain returned target information.

[0136] In some embodiments, when it is determined that there is a username enumeration vulnerability on the current web page, an invalid password and an invalid confirmation password can be used, and the invalid password and the invalid confirmation password are the same. The invalid password and the invalid confirmation password are combined with any username in the username dictionary to obtain multiple test registration combinations. Furthermore, each test registration combination can be used in turn to perform registration operations on the current web page to obtain returned target information, which is the response content returned by the server corresponding to the web page in response to the registration request sent by the terminal.

[0137] S307, based on the target information, determine a target user name that actually exists on the website corresponding to the data in the preset user name, and output the target user name.

[0138] In some embodiments, each target information can be analyzed to determine whether the user name in the test registration combination corresponding to the target information is a real user name on the website. If it is a real user name on the website, the user name can be determined as the target user name, and the terminal can choose to output the target user name in a manner that displays the target user name. For example: assuming that the preset user name is "Wang Fang", a registration operation is performed on the web page using "Wang Fang" + invalid password + invalid confirmation password, and the returned target information is a prompt content, which can be "Registration failed, username already exists", then it can be confirmed that the username "Wang Fang" is a real user name on the web page. After traversing all the preset user names in the username dictionary and determining all the target user names, all the target user names can be displayed on the screen of the terminal for the user to view and record.

[0139] In an embodiment of the present application, when an account registration page is identified, a registration operation can be performed on the account registration page based on the registration combination to obtain the returned registration information, so that it can be determined whether there is a username enumeration vulnerability on the current page according to the registration information. After determining that there is a username enumeration vulnerability on the current page, the registration operation can be performed on the current page based on the preset username in the username dictionary, and the returned target information can be obtained, so that the target username that actually exists on the current website can be determined in the preset username according to the target information, and the target username is provided to the user. Therefore, the embodiment of the present application can automatically confirm the detection result of the username enumeration vulnerability on the website corresponding to the account registration page, without manually detecting whether there is a username enumeration vulnerability on the website, and the effect of automatically detecting the username enumeration vulnerability is achieved, and the efficiency of detecting the username enumeration vulnerability is also improved, and the intelligence of detecting the username enumeration vulnerability is increased. In addition, the embodiment of the present application can also output the target username that is located in the username dictionary and is actually present on the website at the same time, so that the user can view and record the above-mentioned target username.

[0140] See also Figure 4 , is a flow chart of a method for detecting enumerated vulnerabilities provided in an embodiment of the present application. Figure 4 As shown, the method of the embodiment of the present application may include the following steps:

[0141] S401, obtaining data including account information page.

[0142] Specifically, see Figure 2 The description of S201 will not be repeated here.

[0143] S402, obtaining parameter information in the data, and determining the page type corresponding to the data based on the parameter information.

[0144] In some embodiments, since the known data refers to the data of the code, the code contains a variety of parameters, each parameter has a unique name, and the number of each parameter may also be different. For web pages of different page types, the parameter information contained in the code is also different. Therefore, the page type of the web page corresponding to the data can be identified based on the parameter information in the data. For example, when the page type is a password retrieval page, the parameters it contains must include a username parameter and a password retrieval parameter (parameters corresponding to the password retrieval button), and there is no password parameter. In an embodiment of the present application, when the username parameter and the password retrieval parameter are identified, it can be determined that the current page type is a password retrieval page.

[0145] S403, determining the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters.

[0146] Specifically, by Figure 1 As can be seen from the description of S102 in the illustrated embodiment, different page types correspond to different account parameters. Then in the embodiment of the present application, when determining that the current page is a password retrieval page, the target account parameters can be determined to be the user name parameter and the password retrieval parameter.

[0147] S404, performing a password retrieval operation on the account page corresponding to the data based on the known user name and the unknown user name to obtain returned reference information.

[0148] It is easy to understand that a known user name is a real user name on the website corresponding to the current page. An unknown user name may refer to a user name that has not registered an account on the website corresponding to the current page. In an embodiment of the present application, the target account parameter includes a known user name and an unknown user name.

[0149] In some embodiments, for the currently acquired data, the corresponding page type is a password retrieval page, and the webpage corresponding to this page type can be a webpage for retrieving an account password, on which a password retrieval operation can be performed based on a known user name and an unknown user name. The target account parameters found according to this webpage type include a known user name and an unknown user name, and further, a password retrieval operation can be performed using the known user name and the unknown user name, respectively, to obtain returned reference information. Specifically, for the first time, a password retrieval operation can be performed using a known user name, and the reference information returned by this password retrieval operation can be recorded; for the second time, a password retrieval operation can be performed using an unknown user name, and the reference information returned by this password retrieval operation can be recorded.

[0150] S405: Determine a detection result of the username enumeration vulnerability based on the reference information.

[0151] In some embodiments, the detection result of the username enumeration vulnerability can be determined based on the reference information returned by the above two password retrieval operations. Specifically, the reference information returned by the first password retrieval operation can be compared with the reference information returned by the second password retrieval operation. If the reference information returned by the first password retrieval operation is different from the reference information returned by the second password retrieval operation, it can be determined that there is a username enumeration vulnerability on the current web page. Otherwise, it can be determined that there is no username enumeration vulnerability on the current web page. For example: if the known username is an email address that has been registered with an account on the website, and the unknown username is an email address that has not been registered with an account on the website. The reference information returned by the first password retrieval operation using a known username is a prompt content, and the prompt content can be "A password reset link has been sent to the email"; the reference information returned by the second password retrieval operation using an unknown username is also a prompt content, and the prompt content can be "The account corresponding to the email does not exist." Since the username used in the first password retrieval operation is a username that already exists on the current web page, and the username used in the second password retrieval operation is a username that does not exist on the current web page, the reference information returned by the two password retrieval operations has given a hint. Based on the hint, it can be distinguished whether the username used in each password retrieval operation is a real username on the current web page, so it can be determined that there is a username enumeration vulnerability on the current web page.

[0152] S406, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, account operations are performed on the account information page based on the preset usernames in the username dictionary to obtain returned target information.

[0153] In some embodiments, when it is determined that there is a username enumeration vulnerability on the current web page, any username in the username dictionary can be used in turn to perform a password retrieval operation to obtain returned target information. The target information is the response content returned by the server corresponding to the web page in response to the password retrieval request sent by the terminal.

[0154] S407, based on the target information, determine a target user name that actually exists on the website corresponding to the data in the preset user name, and output the target user name.

[0155] In some embodiments, each target information can be analyzed to determine whether the preset user name corresponding to the target information is a real user name on the website. If it is a real user name on the website, the user name can be determined as the target user name, and the terminal can choose to output the target user name in a manner of displaying the target user name. After all preset user names in the user name dictionary are traversed and all target user names are determined, all target user names can be displayed on the screen of the terminal for the user to view and record.

[0156] In an embodiment of the present application, when the password retrieval page of the account is identified, a password retrieval operation can be performed on the account registration page based on the known user name and the unknown user name to obtain the returned reference information, so that it can be determined whether there is a username enumeration vulnerability on the current page according to the reference information. After determining that there is a username enumeration vulnerability on the current page, the password retrieval operation can be performed on the current page based on the preset user name in the user name dictionary, and the returned target information can be obtained, so that the target user name that actually exists on the current website can be determined in the preset user name according to the target information, and the target user name is provided to the user. Therefore, the embodiment of the present application can automatically confirm the detection result of the username enumeration vulnerability on the website corresponding to the password retrieval page of the account, without manually detecting whether there is a username enumeration vulnerability on the website, and the effect of automatically detecting the username enumeration vulnerability is achieved, and the efficiency of detecting the username enumeration vulnerability is also improved, and the intelligence of detecting the username enumeration vulnerability is increased. In addition, the embodiment of the present application can also output the target user name that is located in the username dictionary and is actually present on the website at the same time, so that the user can view and record the above target user name.

[0157] See also Figure 5 , is a flow chart of a method for detecting enumerated vulnerabilities provided in an embodiment of the present application. Figure 5 As shown, the method of the embodiment of the present application may include the following steps:

[0158] S501, obtaining data including account information page.

[0159] In some embodiments, for a website to be identified, a user name and password prepared in advance can be used to log in to the website, and the user name and password can be the user name and password of an account that actually exists on the website. Further, after logging in to the website, the code corresponding to the current page can be scanned to obtain data containing the account information page.

[0160] S502, obtaining parameter information in the data, and determining the page type corresponding to the data based on the parameter information.

[0161] In some embodiments, since the known data refers to the data of the code, the code contains a variety of parameters, each parameter has a unique name, and the number of each parameter may also be different. For web pages of different page types, the parameter information contained in the code is also different. Therefore, the page type of the web page corresponding to the data can be identified based on the parameter information in the data. For example, when the page type is a page corresponding to a url path containing a username, the parameters it contains must have a url path and a username, and the username is the value corresponding to the parameter value in the url path. In an embodiment of the present application, when the url path is identified, and the parameter value contained in the url path is a username, it can be determined that the current page type is a page corresponding to the url path. Among them, the url path can refer to the network path of the browser to access the server. For example, the partial path contained in the url path can be "http: / / xxxx / ?name=zhangsan", and the partial path contained in the url path can also be "http: / / xxxx / zhangsan / ".

[0162] S503, determining the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters.

[0163] Specifically, by Figure 1 As can be seen from the description of S102 in the illustrated embodiment, different page types correspond to different account parameters. Then, in the embodiment of the present application, when determining that the current page is the page corresponding to the url path, the target account parameter can be determined to be the url path, and the parameter value in the url path is the user name.

[0164] S504, replacing the first user name contained in the network path of the account page corresponding to the data with the second user name, the third user name and the fourth user name respectively, to obtain returned status information.

[0165] It is easy to understand that the network path may refer to the network path that the browser uses to access the server, and the network path may be referred to as a URL path.

[0166] The status information may refer to the response information returned by the server in response to the browser's access request after the browser accesses the server using different URL paths.

[0167] In the embodiment of the present application, the target account parameter includes a second user name, a third user name, and a fourth user name. Among them, the second user name can be a real user name on the website corresponding to the current page; the third user name can refer to a user name that has not registered an account on the website corresponding to the current page; the fourth user name can refer to a user name that has not registered an account on the website corresponding to the current page; the first user name can be a real user name on the website corresponding to the current page.

[0168] In some embodiments, for the currently acquired data, the corresponding page type is the page corresponding to the URL path. The first user name contained in the URL path can be replaced with the second user name, the third user name and the fourth user name in sequence to obtain the returned status information respectively.

[0169] S505: Determine a detection result of the username enumeration vulnerability based on the state information.

[0170] In some embodiments, the detection result of the username enumeration vulnerability can be determined based on the status information returned by the above-mentioned operation of accessing different URL paths. Specifically, the status information obtained by using the URL path containing the second username to perform an access operation, the status information obtained by using the URL path containing the third username to perform an access operation, and the status information obtained by using the URL path containing the fourth username to perform an access operation can be compared. If the status information obtained by using the URL path containing the second username to perform an access operation is different from the status information obtained by using the URL path containing the third username to perform an access operation, and the status information obtained by using the URL path containing the third username to perform an access operation is the same as the status information obtained by using the URL path containing the fourth username to perform an access operation, then it can be determined that there is a username enumeration vulnerability on the current web page. Otherwise, it can be determined that there is no username enumeration vulnerability on the current web page.

[0171] S506, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, account operations are performed on the account information page based on the preset usernames in the username dictionary to obtain returned target information.

[0172] In some embodiments, when it is determined that there is a username enumeration vulnerability on the current web page, the username corresponding to the parameter value in the URL path can be replaced with any username in the username dictionary to perform access operations, and the returned target information can be obtained respectively. The target information is the response content returned by the server in response to the access request sent by the browser on the terminal.

[0173] S507: Determine a target user name that actually exists on the website corresponding to the data in the preset user name based on the target information, and output the target user name.

[0174] In some embodiments, each target information can be analyzed. For the specific analysis process, see the analysis process of identifying the username enumeration vulnerability in S505 to determine whether the preset username corresponding to the target information is a username that actually exists on the website. If it is a username that actually exists on the website, the username can be determined as the target username, and the terminal can choose to output the target username in a manner that displays the target username. After all preset usernames in the username dictionary are traversed and all target usernames are determined, all target usernames can be displayed on the screen of the terminal for the user to view and record.

[0175] In an embodiment of the present application, when the page corresponding to the url path is identified, the access operation on the page based on the known user name and the unknown user name is performed to obtain the returned status information, so that it can be determined whether the current page has a username enumeration vulnerability according to the status information. After determining that there is a username enumeration vulnerability on the current page, the access operation of the url path can be performed on the current page based on the preset user name in the user name dictionary, and the returned target information can be obtained, so that the target user name that actually exists on the current website can be determined in the preset user name according to the target information, and the target user name is provided to the user. Therefore, the embodiment of the present application can automatically confirm the detection result of the username enumeration vulnerability on the website corresponding to the password retrieval page of the account, without manually detecting whether there is a username enumeration vulnerability on the website, and the effect of automatically detecting the username enumeration vulnerability is achieved, and the efficiency of detecting the username enumeration vulnerability is also improved, and the intelligence of detecting the username enumeration vulnerability is increased. In addition, the embodiment of the present application can also output the target user name that is located in the username dictionary and is actually present on the website at the same time, so that the user can view and record the above target user name.

[0176] See also Figure 6 , is a schematic diagram of the structure of a detection device for enumerating vulnerabilities provided in an embodiment of the present application. The detection device 600 for enumerating vulnerabilities can be implemented as all or part of a terminal through software, hardware, or a combination of both. The device 600 includes:

[0177] The data acquisition module 610 is used to acquire data including account information pages and identify the page type of the data;

[0178] A parameter determination module 620, configured to determine target account parameters corresponding to the data according to the correspondence between different page types and different account parameters;

[0179] The vulnerability detection module 630 is used to perform account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determine the detection result of the user name enumeration vulnerability based on the operation information.

[0180] Optionally, the data acquisition module includes:

[0181] A first identification unit, used to obtain parameter information in the data;

[0182] The second identification unit is used to determine the page type corresponding to the data based on the parameter information.

[0183] Optionally, the data acquisition module includes:

[0184] A first acquisition unit is used to acquire data including account information pages based on a crawler algorithm; or,

[0185] The second acquisition unit is used to acquire the element locator selected by the user, and acquire data containing the account information page based on the element locator.

[0186] Optional vulnerability detection modules include:

[0187] A first verification unit, configured to identify a verification code to obtain a recognition result if a verification code exists on the account information page corresponding to the data;

[0188] The second verification unit is used to input the recognition result on the account information page.

[0189] Optional vulnerability detection modules include:

[0190] A first detection unit, configured to perform a login operation on the account page corresponding to the data based on the login combination to obtain returned login information;

[0191] The second detection unit is used to determine a detection result of a username enumeration vulnerability based on the login information.

[0192] Optional vulnerability detection modules include:

[0193] A third detection unit, configured to perform a registration operation on the account page corresponding to the data based on the registration combination to obtain returned registration information;

[0194] The fourth detection unit is used to determine a detection result of a username enumeration vulnerability based on the registration information.

[0195] Optional vulnerability detection modules include:

[0196] A fifth detection unit, configured to perform a password retrieval operation on the account page corresponding to the data based on the known user name and the unknown user name to obtain returned reference information;

[0197] A sixth detection unit is used to determine a detection result of the username enumeration vulnerability based on the reference information.

[0198] Optional vulnerability detection modules include:

[0199] a seventh detection unit, configured to replace the first user name contained in the network path of the account page corresponding to the data with the second user name, the third user name, and the fourth user name, respectively, to obtain returned status information;

[0200] An eighth detection unit is used to determine a detection result of a username enumeration vulnerability based on the state information.

[0201] Optionally, the device 600 further includes:

[0202] A first identification module, used to perform account operations on the account information page based on preset user names in the user name dictionary, and obtain returned target information;

[0203] The second identification module is used to determine the target user name that actually exists on the website corresponding to the data in the preset user name based on the target information, and output the target user name

[0204] Please refer to Figure 7 , Figure 7 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. Figure 7 As shown, the terminal 700 may include: at least one processor 701 , at least one network interface 704 , a user interface 703 , a memory 705 , a display screen component 706 , and at least one communication bus 702 .

[0205] The communication bus 702 is used to realize the connection and communication between these components.

[0206] The user interface 703 may include a display screen (Display) and a camera (Camera), and the optional user interface 703 may also include a standard wired interface and a wireless interface.

[0207] The network interface 704 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0208] Among them, the processor 701 may include one or more processing cores. The processor 701 uses various interfaces and lines to connect various parts in the entire terminal 700, and executes various functions and processes data of the terminal 700 by running or executing instructions, programs, code sets or instruction sets stored in the memory 705, and calling data stored in the memory 705. Optionally, the processor 701 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 701 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a search engine library builder (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 701, and it can be implemented separately through a chip.

[0209] Among them, the memory 705 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 705 includes a non-transitory computer-readable storage medium. The memory 705 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 705 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 705 may optionally be at least one storage device located away from the aforementioned processor 701. As Figure 7 As shown, the memory 705 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a program for a detection method for enumerating vulnerabilities.

[0210] exist Figure 7 In the terminal shown, the processor 701 can be used to call the program of the detection method of enumerating vulnerabilities stored in the memory 705, and specifically perform the following operations:

[0211] Obtain data containing an account information page, and identify a page type corresponding to the data;

[0212] Determine the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters;

[0213] An account operation is performed on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and a detection result of the user name enumeration vulnerability is determined based on the operation information.

[0214] In one embodiment, when the processor 701 executes the step of identifying the page type corresponding to the data, the processor 701 specifically performs the following operations:

[0215] Obtaining parameter information in the data;

[0216] A page type corresponding to the data is determined based on the parameter information.

[0217] In one embodiment, when the processor 701 executes the step of obtaining data including the account information page, the processor 701 specifically performs the following operations:

[0218] Obtain data containing account information pages based on crawler algorithms; or,

[0219] The element locator selected by the user is obtained, and data of the account information page is obtained based on the element locator.

[0220] In one embodiment, before executing the step of performing an account operation based on the target account parameter on the account page corresponding to the data to obtain the returned operation information, the processor 701 further performs the following operations:

[0221] If there is a verification code on the account information page corresponding to the data, identifying the verification code to obtain an identification result;

[0222] The identification result is input on the account information page.

[0223] In one embodiment, the processor 701 executes each login combination consisting of a user name and a password, performs an account operation based on the target account parameter on the account page corresponding to the data to obtain returned operation information, and determines the detection result of the user name enumeration vulnerability based on the operation information, specifically performing the following operations:

[0224] Performing login operations on the account page corresponding to the data based on the login combination to obtain returned login information;

[0225] A detection result of a username enumeration vulnerability is determined based on the login information.

[0226] In one embodiment, when the processor 701 executes the registration combination of the target account parameter being a user name and a password, and performing an account operation based on the target account parameter on the account page corresponding to the data to obtain returned operation information, and determining the detection result of the user name enumeration vulnerability based on the operation information, the processor 701 specifically performs the following operations:

[0227] Performing registration operations on the account page corresponding to the data based on the registration combination to obtain returned registration information;

[0228] A detection result of a username enumeration vulnerability is determined based on the registration information.

[0229] In one embodiment, when the processor 701 executes the target account parameter including a known user name and an unknown user name, and performs an account operation on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and determines the detection result of the user name enumeration vulnerability based on the operation information, the processor 701 specifically performs the following operations:

[0230] Performing a password retrieval operation on the account page corresponding to the data based on the known user name and the unknown user name to obtain returned reference information;

[0231] A detection result of the username enumeration vulnerability is determined based on the reference information.

[0232] In one embodiment, when the processor 701 executes the target account parameter including a known second user name, an unknown third user name, and an unknown fourth user name, and performs an account operation on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and determines the detection result of the username enumeration vulnerability based on the operation information, the following operations are specifically performed:

[0233] Replacing the first user name contained in the network path of the account page corresponding to the data with the second user name, the third user name, and the fourth user name respectively, to obtain returned status information;

[0234] A detection result of the username enumeration vulnerability is determined based on the state information.

[0235] In one embodiment, when the detection result of the username enumeration vulnerability is that there is a username enumeration vulnerability, after determining the detection result of the username enumeration vulnerability based on the operation information, the processor 701 further performs the following operations:

[0236] Based on the preset user names in the user name dictionary, account operations are performed on the account information page to obtain returned target information;

[0237] Based on the target information, a target user name that actually exists on the website corresponding to the data is determined from the preset user names, and the target user name is output.

[0238] In addition, those skilled in the art will appreciate that the structure of the terminal 700 shown in the above figures does not limit the terminal 700, and the user terminal may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the terminal 700 also includes components such as a radio frequency circuit, an audio circuit, a WiFi component, a power supply, and a Bluetooth component, which will not be described in detail here.

[0239] An embodiment of the present application also provides a computer-readable storage medium, which stores at least one instruction, and the at least one instruction is used to be executed by a processor to implement the enumeration vulnerability detection method as described in the above embodiments.

[0240] An embodiment of the present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the enumeration vulnerability detection method described in the above embodiments.

[0241] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented with hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0242] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting enumeration vulnerabilities, characterized in that: The method comprises: Obtain data containing an account information page, and identify a page type corresponding to the data; Determine the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters; An account operation is performed on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and a detection result of the user name enumeration vulnerability is determined based on the operation information.

2. The method according to claim 1, characterized in that The identifying the page type corresponding to the data includes: Obtaining parameter information in the data; A page type corresponding to the data is determined based on the parameter information.

3. The method according to claim 1, characterized in that The obtaining of data including the account information page includes: Obtain data containing account information pages based on crawler algorithms; or, The element locator selected by the user is obtained, and data of the account information page is obtained based on the element locator.

4. The method according to claim 1, characterized in that Before performing an account operation on the account page corresponding to the data based on the target account parameter to obtain returned operation information, the method further includes: If there is a verification code on the account information page corresponding to the data, identifying the verification code to obtain an identification result; The identification result is input on the account information page.

5. The method according to any one of claims 1 to 4, characterized in that: The target account parameter is each login combination consisting of a user name and a password, the account operation is performed on the account page corresponding to the data based on the target account parameter to obtain the returned operation information, and the detection result of the user name enumeration vulnerability is determined based on the operation information, including: Performing login operations on the account page corresponding to the data based on the login combination to obtain returned login information; A detection result of a username enumeration vulnerability is determined based on the login information.

6. The method according to any one of claims 1 to 4, characterized in that: The target account parameter is a registration combination of a user name and a password, performing an account operation on the account page corresponding to the data based on the target account parameter to obtain returned operation information, and determining a detection result of a user name enumeration vulnerability based on the operation information, including: Performing registration operations on the account page corresponding to the data based on the registration combination to obtain returned registration information; A detection result of a username enumeration vulnerability is determined based on the registration information.

7. The method according to any one of claims 1 to 4, characterized in that: The target account parameters include known user names and unknown user names, the account operation is performed on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and the detection result of the user name enumeration vulnerability is determined based on the operation information, including: Performing a password retrieval operation on the account page corresponding to the data based on the known user name and the unknown user name to obtain returned reference information; A detection result of the username enumeration vulnerability is determined based on the reference information.

8. A detection device for enumerating vulnerabilities, characterized in that: The device comprises: A data acquisition module, used to acquire data including account information pages and identify page types of the data; A parameter determination module, used to determine the target account parameters corresponding to the data according to the correspondence between different page types and different account parameters; The vulnerability detection module is used to perform account operations on the account page corresponding to the data based on the target account parameters to obtain returned operation information, and determine the detection result of the user name enumeration vulnerability based on the operation information.

9. A computer storage medium, characterized in that The computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 7.

10. A terminal, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 9.

Images