Unauthorized vulnerability detection method and device, storage medium and terminal

Abstract

The invention discloses an unauthorized vulnerability detection method and device, a storage medium and a terminal. Crawling first resource data obtained by the first identity information on the to-be-detected website, and crawling second resource data obtained by the second identity information on the to-be-detected website; obtaining an authority webpage resource corresponding to the first identity information based on the first resource data and the second resource data; and according to an access result obtained by accessing the permission webpage resource by the second identity information and the first resource data, determining whether an unauthorized vulnerability exists in the to-be-detected website. As the resource data corresponding to the different identity information in the same website are different, the resource data of the same website are crawled according to the different identity information to determine the permission webpage resource, then other identity information is used for accessing the permission webpage resource, and the access result can indicate whether the current website has an unauthorized vulnerability or not; the mining process of manual unauthorized access vulnerabilities in a real scene is simulated, and more comprehensive and more efficient unauthorized access vulnerability mining is realized.

Description

Technical Field

[0001] The present application relates to the field of network information security technology, and in particular to an unauthorized vulnerability detection method, device, storage medium and terminal. Background Art

[0002] In order to protect important confidential privacy data in isolated applications and websites, the access rights to data are usually controlled to limit the access or acquisition of authorized data by unauthorized persons. However, applications and websites may have unauthorized vulnerabilities due to logical errors in identity verification, which may allow unauthorized persons to access or obtain resources of authorized persons. Therefore, it is necessary to detect unauthorized vulnerabilities in applications and websites to protect the security of such data information. Summary of the invention

[0003] The present application provides a method, device, storage medium and terminal for detecting unauthorized vulnerabilities, which can solve the technical problem of low efficiency in manually detecting unauthorized vulnerabilities in related technologies.

[0004] In a first aspect, an embodiment of the present application provides a method for detecting an unauthorized vulnerability, the method comprising:

[0005] Acquire first identity information and second identity information, crawl first resource data obtained from the website to be detected by using the first identity information, and crawl second resource data obtained from the website to be detected by using the second identity information;

[0006] Based on the first resource data and the second resource data, obtaining the permission webpage resource corresponding to the first identity information;

[0007] Determine whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained by accessing the authorized web page resource by the second identity information and the first resource data.

[0008] Optionally, obtaining the permission web page resource corresponding to the first identity information based on the first resource data and the second resource data includes: deduplicating the first resource data and the second resource data to obtain the permission web page resource corresponding to the first identity information.

[0009] Optionally, when the data authority of the first identity information is higher than that of the second identity information, the first resource data and the second resource data are deduplicated to obtain the authority web page resource corresponding to the first identity information, including: deduplicating the first request data in the first resource data and the second request data in the second resource data, and determining that the web page resource corresponding to the request data in the first request data that does not overlap with the second request data is the authority web page resource corresponding to the first identity information; and / or deduplicating the response data corresponding to the overlapping request data of the first request data and the second request data, and determining that the web page resource corresponding to the non-overlapping response data is the authority web page resource corresponding to the first identity information.

[0010] Optionally, the first identity information is high-authority identity information, and the second identity information is low-authority identity information; or the first identity information is authorized identity information, and the second identity information is unauthorized identity information, and the unauthorized identity information includes at least one of visitor identity information and blank identity information.

[0011] Optionally, when the data authority of the first identity information is equal to that of the second identity information, the first resource data and the second resource data are deduplicated to obtain the authority web page resource corresponding to the first identity information, including: deduplicating the first response data in the first resource data and the second response data in the second resource data, and determining that the web page resource corresponding to the response data in the first response data that does not overlap with the second response data is the authority web page resource corresponding to the first identity information; and / or determining that the first request data in the first resource data and the second request data in the second resource data have the same virtual path and different request parameters, and determining that the web page resource corresponding to the third request data is the authority web page resource corresponding to the first identity information.

[0012] Optionally, determining whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained by accessing the authorized web page resource according to the second identity information and the first resource data includes: comparing a first access result of accessing the authorized web page resource by the first identity information in the first resource data with a second access result obtained by accessing the authorized web page resource by the second identity information; if the response data in the first access result and the second access result are consistent, determining that there is an unauthorized vulnerability in the website to be detected.

[0013] Optionally, the response data includes but is not limited to status code data and response body data.

[0014] Optionally, when the response data includes response body data, the access result obtained by accessing the authorized web page resource according to the second identity information and the first resource data, before determining whether there is an unauthorized vulnerability in the website to be detected, also includes: removing interference data in the response body data, and the interference data includes at least one of instant time and random character string.

[0015] Optionally, obtaining the first identity information and the second identity information includes: determining the authority information of the first identity information and logging in to the first identity information based on the account information and verification information of the first identity information; determining the authority information of the second identity information and logging in to the second identity information based on the account information and verification information of the second identity information.

[0016] Optionally, the first resource data obtained by crawling the first identity information on the website to be detected, and the second resource data obtained by crawling the second identity information on the website to be detected, include: avoiding crawling operations in a preset operation blacklist, crawling the first resource data obtained by crawling the first identity information on the website to be detected, and crawling the second resource data obtained by crawling the second identity information on the website to be detected; wherein the preset operation blacklist is a list of operations that do not need to be crawled on the website to be detected.

[0017] Optionally, after crawling the second resource data obtained from the website to be detected by the second identity information, the method further includes: filtering invalid resource data in the first resource data and the second resource data, wherein the invalid resource data at least includes front-end resource data.

[0018] Optionally, after determining whether there is an unauthorized vulnerability in the website to be detected, it also includes: displaying on a display interface the access result and the unauthorized vulnerability detection result obtained by accessing the authorized web page resource by the first resource data, the second resource data, and the second identity information; and generating an unauthorized vulnerability detection report corresponding to the unauthorized vulnerability detection result based on the user's confirmation operation on the unauthorized vulnerability detection result.

[0019] In a second aspect, an embodiment of the present application provides an unauthorized vulnerability detection device, the device comprising:

[0020] A data acquisition module, used to acquire first identity information and second identity information, crawl first resource data obtained from the website to be detected by crawling the first identity information, and crawl second resource data obtained from the website to be detected by crawling the second identity information;

[0021] An authority determination module, configured to obtain the authority webpage resource corresponding to the first identity information based on the first resource data and the second resource data;

[0022] The unauthorized access detection module is used to determine whether there is an unauthorized access vulnerability in the website to be detected based on the access result obtained by accessing the authorized web page resource by the second identity information and the first resource data.

[0023] Optionally, the permission determination module is further used to deduplicate the first resource data and the second resource data to obtain the permission web page resource corresponding to the first identity information.

[0024] Optionally, when the data authority of the first identity information is higher than that of the second identity information; the authority determination module is also used to deduplicate the first request data in the first resource data and the second request data in the second resource data, and determine that the web page resource corresponding to the request data in the first request data that does not overlap with the second request data is the authority web page resource corresponding to the first identity information; and / or the authority determination module is also used to deduplicate the response data corresponding to the overlapping request data of the first request data and the second request data, and determine that the web page resource corresponding to the non-overlapping response data is the authority web page resource corresponding to the first identity information.

[0025] Optionally, the first identity information is high-authority identity information, and the second identity information is low-authority identity information; or the first identity information is authorized identity information, and the second identity information is unauthorized identity information, and the unauthorized identity information includes at least one of visitor identity information and blank identity information.

[0026] Optionally, when the data authority of the first identity information is equal to the second identity information; the authority determination module is also used to deduplicate the first response data in the first resource data and the second response data in the second resource data, and determine that the web page resource corresponding to the response data in the first response data that does not overlap with the second response data is the authority web page resource corresponding to the first identity information; and / or the authority determination module is also used to determine the third request data with the same virtual path and different request parameters in the first request data in the first resource data and the second request data in the second resource data, and determine that the web page resource corresponding to the third request data is the authority web page resource corresponding to the first identity information.

[0027] Optionally, the unauthorized access detection module is also used to compare a first access result of the first identity information accessing the authorized web page resource in the first resource data with a second access result of the second identity information accessing the authorized web page resource; if the response data in the first access result and the second access result are consistent, it is determined that an unauthorized access vulnerability exists in the website to be detected.

[0028] Optionally, the response data includes but is not limited to status code data and response body data.

[0029] Optionally, the device further includes: an interference data processing module, configured to remove interference data in the response body data, wherein the interference data includes at least one of instant time and a random character string.

[0030] Optionally, the data acquisition module is also used to determine the authority information of the first identity information and log in to the first identity information based on the account information and verification information of the first identity information; determine the authority information of the second identity information and log in to the second identity information based on the account information and verification information of the second identity information.

[0031] Optionally, the data acquisition module is also used to avoid crawling operations in a preset operation blacklist, crawling the first resource data obtained by the first identity information in the website to be detected, and crawling the second resource data obtained by the second identity information in the resources of the website to be detected; wherein the preset operation blacklist is a list of operations that do not need to be crawled in the website to be detected.

[0032] Optionally, the device further includes: an invalid data filtering module, configured to filter invalid resource data in the first resource data and the second resource data, wherein the invalid resource data at least includes front-end resource data.

[0033] Optionally, the device also includes: a display module, used to display on a display interface the access results and unauthorized vulnerability detection results obtained by accessing the authorized web page resources by the first resource data, the second resource data, and the second identity information; and based on the user's confirmation operation on the unauthorized vulnerability detection result, generate an unauthorized vulnerability detection report corresponding to the unauthorized vulnerability detection result.

[0034] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the steps of the above-mentioned method.

[0035] In a fourth aspect, an embodiment of the present application provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is suitable for being loaded by the processor and executing the steps of the above method.

[0036] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0037] The present application provides a method for detecting unauthorized vulnerabilities, which includes obtaining first identity information and second identity information, crawling first resource data obtained by the first identity information on a website to be detected, and crawling second resource data obtained by the second identity information on a website to be detected; obtaining the permission web page resources corresponding to the first identity information based on the first resource data and the second resource data; determining whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained by the second identity information access permission web page resources and the first resource data. Since the resource data corresponding to different identity information in the same website are different, after crawling the resource data of the same website based on different identity information, the permission web page resources with permission requirements can be determined based on the similarities and differences of each resource data, and then the access permission web page resources of the identity information without access permission are used, and the access result can indicate whether there is an unauthorized vulnerability in the current website. Such a detection process simulates the mining process of manual unauthorized vulnerabilities in real scenarios, and realizes more comprehensive and efficient unauthorized access vulnerability mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 An exemplary system architecture diagram of an unauthorized vulnerability detection method provided in an embodiment of the present application;

[0040] Figure 2 A flowchart of an unauthorized vulnerability detection method provided in an embodiment of the present application;

[0041] Figure 3 A flowchart of an unauthorized vulnerability detection method provided in an embodiment of the present application;

[0042] Figure 4 A logic flow chart of an unauthorized vulnerability detection method provided in an embodiment of the present application;

[0043] Figure 5 A structural block diagram of an unauthorized vulnerability detection device provided in an embodiment of the present application;

[0044] Figure 6 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0046] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0047] With the development of the Internet, many companies have developed various applications and websites to provide them to users or staff for business processing. These applications and websites are based on the browser / server architecture, which contain some static pages. They not only have information display functions, but also can perform corresponding processing operations on data by calling different business logic interfaces in the pages. However, like traditional computer applications, these applications and websites may have some logical loopholes due to various uncertainties in the development process.

[0048] Unauthorized access is a common security vulnerability in applications and websites. It means that due to a logical error in the identity verification, an unauthorized person can access or obtain the resources of an authorized person. The threat lies in that the original unauthorized account can read and control the control management data in the control station, other users' private data, etc. Then, when an attacker uses any account, he can perform illegal operations on other account data with unauthorized access vulnerabilities, such as query, insert, delete, modify and other regular database commands. This directly threatens network information security, especially for some industry service types with high security and privacy requirements, such as the financial industry, credit industry, etc., which will cause great damage to the user experience. Therefore, unauthorized access vulnerability detection is a more important part of the data security system.

[0049] Current testing of applications and websites shows that in the prior art, the detection of unauthorized access vulnerabilities is mainly carried out by manually logging into two accounts, obtaining the request response data returned by the two accounts when accessing the resources to be detected, judging the permission resources corresponding to the first account through human experience, using the second account to access the permission resources of the first account, and judging whether there is an unauthorized access vulnerability based on the obtained response data. This solution requires comparing each character in the response data one by one. When the amount of response data is relatively large, a large amount of human resources are consumed, and the efficiency of unauthorized access vulnerability detection is low.

[0050] Therefore, an embodiment of the present application provides a method for detecting an unauthorized vulnerability, which obtains first identity information and second identity information, crawls first resource data obtained by the first identity information on the website to be detected, and crawls second resource data obtained by the second identity information on the website to be detected; based on the first resource data and the second resource data, obtains the permission web page resource corresponding to the first identity information; determines whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained from the web page resource with the access permission of the second identity information and the first resource data, so as to solve the technical problem of low efficiency in manually detecting unauthorized vulnerabilities mentioned above.

[0051] See also Figure 1 , Figure 1 An exemplary system architecture diagram of an unauthorized vulnerability detection method provided in an embodiment of the present application.

[0052] like Figure 1 As shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 is used to provide a medium for a communication link between the terminal 101 and the server 103. The network 102 may include various types of wired communication links or wireless communication links, for example, the wired communication link includes an optical fiber, a twisted pair, or a coaxial cable, and the wireless communication link includes a Bluetooth communication link, a Wireless-Fidelity (Wi-Fi) communication link, or a microwave communication link.

[0053] The terminal 101 can interact with the server 103 through the network 102 to receive messages from the server 103 or send messages to the server 103, or the terminal 101 can interact with the server 103 through the network 102 to receive messages or data sent by other users to the server 103. The terminal 101 can be hardware or software. When the terminal 101 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 101 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0054] In an embodiment of the present application, the terminal 101 first obtains the first identity information and the second identity information, crawls the first resource data obtained by the first identity information on the website to be detected, and crawls the second resource data obtained by the second identity information on the website to be detected; further, the terminal 101 obtains the permission web page resource corresponding to the first identity information based on the first resource data and the second resource data; finally, the terminal 101 determines whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained from the access permission web page resource of the second identity information and the first resource data.

[0055] The server 103 may be a business server that provides various services. It should be noted that the server 103 may be hardware or software. When the server 103 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 103 is software, it may be implemented as multiple software or software modules (for example, for providing distributed services), or it may be implemented as a single software or software module, which is not specifically limited here.

[0056] Alternatively, the system architecture may not include the server 103. In other words, the server 103 may be an optional device in the embodiments of this specification. That is, the method provided in the embodiments of this specification may be applied to a system structure that only includes the terminal 101, and the embodiments of this application do not limit this.

[0057] It should be understood that Figure 1 The number of terminals, networks and servers in the figure is only for illustration and any number of terminals, networks and servers may be used according to implementation requirements.

[0058] See also Figure 2 , Figure 2 A flowchart of an unauthorized vulnerability detection method provided for an embodiment of the present application. The execution subject of the embodiment of the present application can be a terminal that executes unauthorized vulnerability detection, or a processor in the terminal that executes the unauthorized vulnerability detection method, or an unauthorized vulnerability detection service in the terminal that executes the unauthorized vulnerability detection method. For the convenience of description, the specific execution process of the unauthorized vulnerability detection method is introduced below by taking the execution subject as an example of the processor in the terminal.

[0059] like Figure 2 As shown, the method for detecting an unauthorized vulnerability may at least include:

[0060] S202, obtaining first identity information and second identity information, crawling first resource data obtained from the website to be detected by crawling the first identity information, and crawling second resource data obtained from the website to be detected by crawling the second identity information.

[0061] Optionally, usually unauthorized vulnerabilities are prone to appear in permission pages (pages that require login), additions, deletions, modifications, and inquiries. When users perform these operations on the information in the permission page, the background needs to verify the permissions of the current user to see if they have the permission to operate, and then give a response. If the verification rules are too simple or there are logical errors, unauthorized vulnerabilities are prone to appear. Generally, unauthorized vulnerabilities appear in password modification, unauthorized access, password retrieval, transaction payment, user login and other functions. Most of them are caused by the logic of permission verification. However, the permissions corresponding to users of each application system are divided according to their user functions, and the business of each enterprise is different. This makes it difficult to discover unauthorized vulnerabilities through scanning tools like defects in other scenarios, but often requires manual testing, which consumes a lot of human resources, and the workload of manually determining unauthorized vulnerabilities is large, which is prone to omissions and errors, resulting in low efficiency in unauthorized vulnerability detection.

[0062] Optionally, the process of unauthorized access vulnerability detection is generally as follows: first prepare two accounts A and B; then use account A to browse the content of the website to be detected; then determine the authorized resources accessed by account A based on experience; finally use account B to access the authorized resources of account A. If account B can access successfully or get the same return as account A at this time, it means that the website to be detected has an unauthorized access vulnerability. In order to improve the efficiency of unauthorized access vulnerability detection, an automatic scanner can be used to realize the automatic detection task of unauthorized access vulnerabilities through automated scanning to simulate the process of manually mining unauthorized access vulnerabilities in real penetration scenarios. Automated scanning can obtain more comprehensive information than manual penetration, and realize more efficient and effective unauthorized access vulnerability mining.

[0063] Optionally, during the automated scanning process, two account information provided by the user must first be obtained, namely, the first identity information and the second identity information. The identity information includes account login information and authentication information. Usually, the authentication information will be included in the Cookie or Authorization header (it may also exist in other headers, depending on the specific development logic of the business system). After the user provides this information, the scanner will record the first identity information and the second identity information, and use them for subsequent resource data acquisition and access to specified resources.

[0064] Further, in manual testing, information acquisition is performed by manually browsing website information, and the same automated action also requires obtaining website information. The quality of website information acquisition is crucial to the scanning of unauthorized vulnerabilities, and incomplete information acquisition is likely to lead to underreporting. Therefore, in the embodiment of the present application, the method of automatic web page information acquisition is used to crawl the first resource data of the first identity information in the website to be detected, and the second resource data of the second identity information in the website to be detected. There are many ways to automatically obtain website resources, such as crawlers, browser agents, etc., which can be selected according to business needs, and the embodiment of the present application does not limit this. In addition, the website to be detected can be an application in an independent software or a browser-based web page, and the form of expression of the website to be detected does not affect the implementation steps and effects of the embodiment of the present application.

[0065] S204: Based on the first resource data and the second resource data, obtain the permission web page resource corresponding to the first identity information.

[0066] Optionally, unauthorized access vulnerabilities are usually divided into three categories based on the identities of authorized and unauthorized persons: horizontal unauthorized access (two accounts of the same level, such as user A being able to abnormally access user B's personal information), vertical unauthorized access (low-authorized account unauthorized access to high-authorized account, such as ordinary users being able to access administrator's resources), and unauthorized unauthorized access (unlogged-in users being able to access logged-in users' resources, which can also be considered vertical unauthorized access). Authorized web page resources are resources that can only be viewed by authorized accounts and cannot be viewed by unauthorized accounts. After obtaining the first resource data and the second resource data, it is necessary to determine which web page resources are authorized web page resources corresponding to the first identity information. Based on the first resource data and the second resource data, if the first resource data and the second resource data contain the same resources, they can be considered ordinary web page resources. If the first resource data and the second resource data are different, specific judgments are made on different resources, and the authorized web page resources corresponding to the first identity information can be further obtained.

[0067] S206: Determine whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained from the web page resource with the second identity information access permission and the first resource data.

[0068] Optionally, after determining the authorized web page resources corresponding to the first identity information, in order to verify whether there is an unauthorized vulnerability in the website to be detected, it is necessary to use the second identity information to access the authorized web page resources corresponding to the first identity information. At this time, since the scanner has recorded the authentication information of the second identity information when the user provides the second identity information, the scanner can directly replace the authentication information of the first identity information based on the authentication information of the second identity information to remove the authorized web page resources. After obtaining the access result, based on the access result and the first resource data, the similarities and / or differences between the access result and the first resource data can be determined, and further it can be determined whether there is an unauthorized vulnerability in the website to be detected. Specifically, based on the specific content of the access result, the user can determine the logic of the generation of the unauthorized vulnerability, help the user to troubleshoot the business logic defects of the website to be detected, and then update and optimize the website to be detected to protect the data security and user experience in the website to be detected.

[0069] In an embodiment of the present application, a method for detecting unauthorized vulnerabilities is provided, wherein the first identity information and the second identity information are obtained, and the first resource data obtained by the first identity information on the website to be detected is crawled, and the second resource data obtained by the second identity information on the website to be detected is crawled; based on the first resource data and the second resource data, the permission web page resources corresponding to the first identity information are obtained; according to the access results obtained by the second identity information access permission web page resources and the first resource data, it is determined whether there is an unauthorized vulnerability in the website to be detected. Since the resource data corresponding to different identity information in the same website are different, after crawling the resource data of the same website according to different identity information, the permission web page resources with permission requirements can be determined according to the similarities and differences of each resource data, and then the access permission web page resources of the identity information without access permission are used, and the access results can indicate whether there is an unauthorized vulnerability in the current website. Such a detection process simulates the mining process of manual unauthorized vulnerabilities in real scenarios, and realizes more comprehensive and efficient unauthorized access vulnerability mining.

[0070] See also Figure 3 , Figure 3 A flowchart of an unauthorized vulnerability detection method provided in an embodiment of the present application.

[0071] like Figure 3 As shown, the method for detecting an unauthorized vulnerability may at least include:

[0072] S302. Determine the authority information of the first identity information and log in to the first identity information based on the account information and verification information of the first identity information; determine the authority information of the second identity information and log in to the second identity information based on the account information and verification information of the second identity information.

[0073] Optionally, when the user has a need for unauthorized vulnerability detection, the user will provide identity information and specify the permission level corresponding to each identity information, and different types of unauthorized vulnerabilities can be detected according to different account permissions. When automatically authenticating the login identity account, there are mainly two types of situations. The first type is that the user provides the password and login link of the first identity information and the second identity information respectively, and the automatic login scanner uses the account information provided by the user to log in. This type of method is only effective for the basic login box (basic login). If the website to be detected has enabled two-factor authentication, it is necessary to add a factor on the basis of the original "user name + static secret" to determine the user's identity to ensure that it is the user who logs in, such as scanning code, SMS verification code, token, etc., in addition to the password, or the login page also contains a verification code, then the verification code blasting is required. At this time, the automatic login scanner faces greater difficulty in automatic login; the second type is for enterprise users. If the enterprise has access to a unified identity authentication system, automatic login can be directly realized. The automatic login scanner can access the website to be detected with the identity after logging in, and the effect of this automatic login is simple and easy to achieve.

[0074] Optionally, in the embodiment of the present application, a proxy method is provided, that is, after the user provides the first identity information and the second identity information, the user specifies the authority of each identity information and manually logs in on the login interface provided by the scanner, and the scanner records and records the account information and authentication information. This is common in client mode (C / S mode). If the scanner provides a browser mode (B / S mode), it is additionally necessary to be able to access the proxy port where the scanner backend service is located to achieve this. For details, please refer to Figure 4 , Figure 4 The following is a logic flow chart of an unauthorized vulnerability detection method provided in an embodiment of the present application. Figure 4 As shown, at the beginning of the process, the identity information to be used input by the user is first determined, and the scanner determines a series of configuration information such as the website to be detected.

[0075] S304, avoiding crawling operations in a preset operation blacklist, crawling first resource data obtained by crawling the first identity information on the website to be detected, and crawling second resource data obtained by crawling the second identity information on the website resources to be detected.

[0076] Optionally, after determining the first identity information, the second identity information and the website to be detected, it is necessary to obtain the first resource data of the first identity information in the website to be detected and the second resource data of the second identity information in the website to be detected respectively. The resource data is the request data, response data, etc. when the identity information account browses the website to be detected.

[0077] Furthermore, the scanner does not actually visit the website to be detected when crawling website resources. When crawling to create, delete, modify buttons or links, etc., there may be a risk of dirty data or deleted data. Therefore, a blacklist configuration is provided in the task creation interface to support users to set a preset operation blacklist when configuring the detection task. The preset operation blacklist is a list of operations that do not need to be crawled on the website to be detected. When crawling the resource data of the website to be detected, the crawling operations in the preset operation blacklist are avoided. On this basis, the first resource data obtained by the first identity information on the website to be detected is crawled, and the second resource data obtained by the second identity information on the website resources to be detected is crawled.

[0078] Specifically, there are many ways to crawl the first resource data and the second resource data. The first resource data acquisition method: crawler, including static crawler and dynamic crawler. Static crawler is more conventional, and the advantage of dynamic crawler is that it can obtain more dynamically loaded resources; the second resource data acquisition method: browser proxy, similar to burpsuite, uses browser proxy to obtain user access traffic. The advantage is that the traffic is more accurate and can include dynamic form request response data and back-end interface access data. The disadvantage is that it is necessary to follow the user's manual click to achieve access, and it is likely that all web page information cannot be obtained, resulting in an incomplete scan; the third resource data acquisition method: bypass mode, through the "port mirroring" function of network devices such as switches to achieve monitoring, use traffic mirroring to obtain the traffic of accessing the specified target in the user network, and obtain the request and response therein. The quality of obtaining web page information in this way is the same as that of the browser proxy. After processing https decryption, the traffic of all users accessing the target in the network can be obtained, and it will not cause delays to the original transmitted data packets and will not cause any impact on the network speed. However, for the scanner, port mirroring needs to be deployed to achieve this, so this deployment method is relatively complicated.

[0079] In the embodiments of this application, please continue to refer to Figure 4 Taking the use of dynamic crawlers as an example, as the main method of crawling the resources of the website to be detected, the dynamic crawler is used to crawl the website to be detected according to the first identity information and the second identity information, respectively, to obtain the first resource data corresponding to the first identity information and the second resource data corresponding to the second identity information.

[0080] S306: Filter invalid resource data in the first resource data and the second resource data, where the invalid resource data at least includes front-end resource data.

[0081] Optionally, there are some invalid resources in the first resource data and the second resource data, namely, some front-end resources displayed on the page. Such resources are not related to the permissions of the login account and do not involve information security and privacy security. Therefore, when performing subsequent unauthorized vulnerability detection, these invalid resource data can be pre-filtered. Specifically, the scanner filters the front-end resources such as css, js, png, etc. sent by the crawler. These resources will not be included in the unauthorized vulnerability detection calculation in the future, saving computing resources and speeding up detection efficiency.

[0082] S308: De-duplicate the first resource data and the second resource data to obtain the authorized web page resource corresponding to the first identity information.

[0083] Optionally, after different identity information logs in to the same website, due to different permissions, it will be reflected in the obtained resource data. Then, the scanner identifies the account name that needs to be checked for unauthorized access according to the identity information permissions pre-configured by the user, and determines the authentication information in these identity information. , respectively parse and compare the first resource data and the second resource data, and find out the pages that only the first identity information can access through the first resource data and the second resource data, that is, the authorized web page resources corresponding to the first identity information.

[0084] Optionally, different types of privilege escalation vulnerabilities may manifest themselves differently. For example, for vertical privilege escalation, the administrator page that is open to administrators cannot be viewed by ordinary users under normal circumstances. When we use an ordinary account to try to browse the administrator page, the correct characteristics of the crawled resource data should be: (1) It is impossible to obtain ordinary users' access information to the administrator page (because ordinary users do not have a jump link to the user management page); (2) Even if ordinary users' access information to the administrator page is obtained, the returned content cannot contain information about other users. Based on this, the judgment characteristics of authorized web page resources in the vertical privilege escalation scenario can be obtained as follows: (1) A virtual path (URL) accessible to high-authority users is not accessible to low-authority users; (2) High-authority users and low-authority users access a virtual path (URL), but the returned content is different.

[0085] Based on the above analysis, when the data authority of the first identity information is higher than that of the second identity information, that is, when the user uses the first identity information and the second identity information to determine the vertical unauthorized access vulnerability, (1) in all request data sets, the first request data in the first resource data and the second request data in the second resource data are deduplicated, and the web page resource corresponding to the request data in the first request data that does not overlap with the second request data is determined to be the authorized web page resource corresponding to the first identity information; and / or (2) the response data corresponding to the overlapping request data of the first request data and the second request data are deduplicated, and the web page resource corresponding to the non-overlapping response data is determined to be the authorized web page resource corresponding to the first identity information.

[0086] At this time, the permissions of the first identity information and the second identity information are high and low, respectively. There can be two situations: (1) the first identity information is high-authority identity information, and the second identity information is low-authority identity information; or (2) the first identity information is authorized identity information, and the second identity information is unauthorized identity information. The unauthorized identity information includes at least one of the visitor identity information and blank identity information. When the second identity is an unauthorized identity, it means that this is an unauthorized violation of authority. The judgment logic is the same as that of vertical violation of authority. In this case, the user can only provide one identity information, and the crawler will obtain a copy of the website's resource data in the non-logged-in state as the second resource data of the second identity information.

[0087] Optionally, for horizontal unauthorized access, it may be that two people who are both website users, such as user A viewing their own user information and user B viewing their own user information, may have the same virtual path (assuming that the user identity is identified by a key token instead of a parameter here), but the returned content is different. This means that when the data authority of the first identity information is equal to the second identity information, the first response data in the first resource data and the second response data in the second resource data can be deduplicated, and it is determined that the web page resource corresponding to the response data in the first response data that does not overlap with the second response data is the authorized web page resource corresponding to the first identity information.

[0088] Furthermore, there is another characteristic of horizontal overreach, that is, the server may return the corresponding resources to the user through parameters. For example, if the user id of user A is 1, then the request "https: / / xxxx / ?id=1" returns the user information of user A, and the request "https: / / xxxx / ?id=2" returns the user information of user B. Therefore, a characteristic of horizontal overreach can be obtained: the virtual path of the request is the same, the parameter name is the same but the parameter value is different, and the response data is different. Then, when the data authority of the first identity information is equal to the second identity information, it is also possible to determine that the first request data in the first resource data and the second request data in the second resource data have the same virtual path and different request parameters, and determine that the web page resource corresponding to the third request data is the authorized web page resource corresponding to the first identity information.

[0089] See also Figure 4 After deduplication of the first resource data and the second resource data obtained by the crawler, the permission web page resources are judged. After the same request is judged and the random characters (time, token) in the response content are removed, the responses obtained are different, indicating that the same page displays different information for accounts with different permissions; it is judged that the account that is checked for overauthorization has request information, and other users do not have request information on the page, indicating that the user's private page; it is judged that the virtual path is the same, but the parameters are different, indicating that this is information returned to the user through parameter control, so that the permission web page resource corresponding to the first identity information can be determined.

[0090] S3010: Compare a first access result obtained by obtaining a web page resource with the first identity information access permission in the first resource data and a second access result obtained by obtaining a web page resource with the second identity information access permission.

[0091] Optionally, you can then start scanning for unauthorized access to web data, see Figure 4 , replace the authentication information of the first identity information with the authentication information of the pre-recorded second identity information in the permission web page resource, re-request the permission access web page resource, and obtain the second access result after the second identity information permission access web page resource. By comparing the first access result and the second access result of the first identity information permission access web page resource in the first resource data, it can be determined whether the second identity information can normally access the permission web page resource, and then determine whether there is an unauthorized vulnerability.

[0092] S3012: If the response data in the first access result and the second access result are consistent, it is determined that an unauthorized vulnerability exists in the website to be detected.

[0093] Optionally, see Figure 4, when comparing the first access result and the second access result, specifically, the response data of the first access result and the response data in the second access result are compared to see if the two are the same. The response data includes but is not limited to status code data and response body data, so these two types of data can be focused on during the comparison, wherein when the response data includes response body data, the interference data in the response body data needs to be removed, and the interference data includes at least one of the instant time and random character string, that is, the possible noise of time, token, etc. is removed. If after comparing the results of the two data, as long as one of the data results is the same, it means that the second identity information can unauthorizedly access the authority resources of the first copy of the information, which means that the website to be tested has an unauthorized vulnerability. Such a detection process simulates the process of mining manual unauthorized vulnerabilities in real scenarios, and realizes more comprehensive and efficient unauthorized access vulnerability mining.

[0094] S3014. Display the first resource data, the second resource data, the access result of the second identity information access permission web page resource, and the unauthorized vulnerability detection result on the display interface.

[0095] Alternatively, if Figure 4 As shown, in order to facilitate users to know the current unauthorized vulnerability detection results, after the detection is completed, the access results obtained by the first resource data, the second resource data, the second identity information access permission web page resource and the unauthorized vulnerability detection results are displayed on the display interface.

[0096] S3016. Based on the user's confirmation operation on the unauthorized vulnerability detection result, generate an unauthorized vulnerability detection report corresponding to the unauthorized vulnerability detection result.

[0097] Alternatively, if Figure 4 As shown, after the user sees the unauthorized vulnerability detection result on the display interface, the user can also view the first resource data, the second resource data, etc., and view the specific data deduplication situation. The user can confirm the unauthorized vulnerability detection result, and an unauthorized vulnerability detection report corresponding to the unauthorized vulnerability detection result is generated based on the user's confirmation operation. Specifically, the user can confirm whether it is correct or a false alarm. The result confirmed as a false alarm will not be included in the report.

[0098] In an embodiment of the present application, a method for detecting unauthorized access vulnerabilities is provided, which supports multiple methods of automatically authenticating login identity information and multiple methods of acquiring website resource data; the permission web page information belonging to the first identity information is screened out through three strict logical methods; and then the access permission web page resources of the identity information without access permission are used, and the access results can indicate whether the current website has an unauthorized access vulnerability, and more comprehensive and efficient unauthorized access vulnerability mining can solve the problem of low efficiency in manual detection of unauthorized access vulnerabilities.

[0099] See also Figure 5 , Figure 5 This is a structural block diagram of an unauthorized vulnerability detection device provided in an embodiment of the present application. Figure 5 As shown, the unauthorized vulnerability detection device 500 includes:

[0100] The data acquisition module 510 is used to acquire the first identity information and the second identity information, crawl the first resource data obtained from the website to be detected by the first identity information, and crawl the second resource data obtained from the website to be detected by the second identity information;

[0101] The authority determination module 520 is used to obtain the authority webpage resource corresponding to the first identity information based on the first resource data and the second resource data;

[0102] The unauthorized access detection module 530 is used to determine whether there is an unauthorized access vulnerability in the website to be detected according to the access result obtained from the web page resource with the second identity information access permission and the first resource data.

[0103] Optionally, the authority determination module 520 is further configured to deduplicate the first resource data and the second resource data to obtain the authority web page resource corresponding to the first identity information.

[0104] Optionally, when the data authority of the first identity information is higher than that of the second identity information; the authority determination module 520 is also used to deduplicate the first request data in the first resource data and the second request data in the second resource data, and determine that the web page resource corresponding to the request data in the first request data that does not overlap with the second request data is the authority web page resource corresponding to the first identity information; and / or the authority determination module is also used to deduplicate the response data corresponding to the overlapping request data of the first request data and the second request data, and determine that the web page resource corresponding to the non-overlapping response data is the authority web page resource corresponding to the first identity information.

[0105] Optionally, the first identity information is high-authority identity information, and the second identity information is low-authority identity information; or the first identity information is authorized identity information, and the second identity information is unauthorized identity information, and the unauthorized identity information includes at least one of visitor identity information and blank identity information.

[0106] Optionally, when the data authority of the first identity information is equal to the second identity information; the authority determination module 520 is also used to deduplicate the first response data in the first resource data and the second response data in the second resource data, and determine that the web page resource corresponding to the response data in the first response data that does not overlap with the second response data is the authority web page resource corresponding to the first identity information; and / or the authority determination module is also used to determine the third request data in the first resource data and the second request data in the second resource data that has the same virtual path and different request parameters, and determine that the web page resource corresponding to the third request data is the authority web page resource corresponding to the first identity information.

[0107] Optionally, the unauthorized access detection module 530 is also used to compare the first access result of the web page resource with the first identity information access permission in the first resource data and the second access result obtained from the web page resource with the second identity information access permission; if the response data in the first access result and the second access result are consistent, it is determined that there is an unauthorized access vulnerability in the website to be detected.

[0108] Optionally, the response data includes but is not limited to status code data and response body data.

[0109] Optionally, the unauthorized vulnerability detection device 500 further includes: an interference data processing module, which is used to remove interference data in the response body data, and the interference data includes at least one of real-time and random character string.

[0110] Optionally, the data acquisition module 510 is further used to determine the authority information of the first identity information and log in to the first identity information based on the account information and verification information of the first identity information; determine the authority information of the second identity information and log in to the second identity information based on the account information and verification information of the second identity information.

[0111] Optionally, the data acquisition module 510 is also used to avoid crawling operations in a preset operation blacklist, crawling the first resource data obtained by crawling the first identity information in the website to be detected, and crawling the second resource data obtained by crawling the second identity information in the website resources to be detected; wherein the preset operation blacklist is a list of operations that do not need to be crawled in the website to be detected.

[0112] Optionally, the unauthorized vulnerability detection device 500 further includes: an invalid data filtering module, configured to filter invalid resource data in the first resource data and the second resource data, wherein the invalid resource data at least includes front-end resource data.

[0113] Optionally, the unauthorized vulnerability detection device 500 also includes: a display module, used to display the access results obtained by the first resource data, the second resource data, the second identity information access permission web page resource and the unauthorized vulnerability detection results on the display interface; based on the user's confirmation operation on the unauthorized vulnerability detection result, generate an unauthorized vulnerability detection report corresponding to the unauthorized vulnerability detection result.

[0114] In an embodiment of the present application, an unauthorized vulnerability detection device is provided, wherein a data acquisition module is used to obtain a first identity information and a second identity information, crawl the first resource data obtained by the first identity information on the website to be detected, and crawl the second resource data obtained by the second identity information on the website to be detected; a permission determination module is used to obtain the permission web page resource corresponding to the first identity information based on the first resource data and the second resource data; and an unauthorized vulnerability detection module is used to determine whether there is an unauthorized vulnerability in the website to be detected according to the access result obtained by the second identity information access permission web page resource and the first resource data. Since the resource data corresponding to different identity information in the same website are different, after crawling the resource data of the same website according to different identity information, the permission web page resource with permission requirements can be determined according to the similarities and differences of each resource data, and then the access permission web page resource of the identity information without access permission is used, and its access result can indicate whether there is an unauthorized vulnerability in the current website. Such a detection process simulates the mining process of manual unauthorized vulnerability in real scenarios, and realizes more comprehensive and efficient unauthorized access vulnerability mining.

[0115] An embodiment of the present application further provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing the steps of any method in the above embodiments.

[0116] See also Figure 6 , Figure 6 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. Figure 6 As shown, the terminal 600 may include: at least one terminal processor 601 , at least one network interface 604 , a user interface 603 , a memory 605 , and at least one communication bus 602 .

[0117] The communication bus 602 is used to realize the connection and communication between these components.

[0118] The user interface 603 may include a display screen (Display) and a camera (Camera), and the optional user interface 603 may also include a standard wired interface and a wireless interface.

[0119] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0120] Among them, the terminal processor 601 may include one or more processing cores. The terminal processor 601 uses various interfaces and lines to connect various parts in the entire terminal 600, and executes various functions and processes data of the terminal 600 by running or executing instructions, programs, code sets or instruction sets stored in the memory 605, and calling data stored in the memory 605. Optionally, the terminal processor 601 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The terminal processor 601 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the terminal processor 601, and it can be implemented separately through a chip.

[0121] Among them, the memory 605 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory, ROM). Optionally, the memory 605 includes a non-transitory computer-readable storage medium. The memory 605 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 605 may also be optionally at least one storage device located away from the aforementioned terminal processor 601. As Figure 6 As shown, the memory 605 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an unauthorized vulnerability detection program.

[0122] exist Figure 6In the terminal 600 shown, the user interface 603 is mainly used to provide an input interface for the user and obtain the data input by the user; and the terminal processor 601 can be used to call the unauthorized vulnerability detection program stored in the memory 605, and specifically perform the following operations:

[0123] Acquire the first identity information and the second identity information, crawl the first resource data obtained from the website to be detected by the first identity information, and crawl the second resource data obtained from the website to be detected by the second identity information;

[0124] Based on the first resource data and the second resource data, obtaining the permission webpage resource corresponding to the first identity information;

[0125] According to the access result obtained from the webpage resource of the second identity information access right and the first resource data, it is determined whether there is an unauthorized vulnerability in the website to be detected.

[0126] In some embodiments, when the terminal processor 601 obtains the permission web page resources corresponding to the first identity information based on the first resource data and the second resource data, it specifically performs the following steps: deduplicates the first resource data and the second resource data to obtain the permission web page resources corresponding to the first identity information.

[0127] In some embodiments, when the data authority of the first identity information is higher than that of the second identity information, the terminal processor 601 performs the following steps when deduplicating the first resource data and the second resource data to obtain the authority web page resource corresponding to the first identity information: deduplicating the first request data in the first resource data and the second request data in the second resource data, and determining that the web page resource corresponding to the request data in the first request data that does not overlap with the second request data is the authority web page resource corresponding to the first identity information; and / or deduplicating the response data corresponding to the overlapping request data of the first request data and the second request data, and determining that the web page resource corresponding to the non-overlapping response data is the authority web page resource corresponding to the first identity information.

[0128] In some embodiments, the first identity information is high-authority identity information, and the second identity information is low-authority identity information; or the first identity information is authorized identity information, and the second identity information is unauthorized identity information, and the unauthorized identity information includes at least one of visitor identity information and blank identity information.

[0129] In some embodiments, when the data authority of the first identity information is equal to the second identity information, the terminal processor 601 performs the following steps when deduplicating the first resource data and the second resource data to obtain the permission web page resource corresponding to the first identity information: deduplicate the first response data in the first resource data and the second response data in the second resource data, and determine that the web page resource corresponding to the response data in the first response data that does not overlap with the second response data is the permission web page resource corresponding to the first identity information; and / or determine that the first request data in the first resource data and the second request data in the second resource data have the same virtual path and different request parameters, and determine that the web page resource corresponding to the third request data is the permission web page resource corresponding to the first identity information.

[0130] In some embodiments, when the terminal processor 601 executes the access result obtained from the web resource with the second identity information access permission and the first resource data to determine whether there is an unauthorized access vulnerability in the website to be detected, it specifically performs the following steps: compares the first access result obtained from the web resource with the first identity information access permission in the first resource data and the second access result obtained from the web resource with the second identity information access permission; if the response data in the first access result and the second access result are consistent, it is determined that there is an unauthorized access vulnerability in the website to be detected.

[0131] In some embodiments, the response data includes, but is not limited to, status code data and response body data.

[0132] In some embodiments, when the response data includes response body data, the terminal processor 601 further specifically performs the following steps before executing the access result obtained based on the second identity information access permission web page resource and the first resource data to determine whether there is an unauthorized vulnerability in the website to be detected: removing interference data in the response body data, the interference data including at least one of the instant time and the random string.

[0133] In some embodiments, when the terminal processor 601 obtains the first identity information and the second identity information, it specifically performs the following steps: determine the authority information of the first identity information and log in to the first identity information based on the account information and verification information of the first identity information; determine the authority information of the second identity information and log in to the second identity information based on the account information and verification information of the second identity information.

[0134] In some embodiments, when the terminal processor 601 executes crawling the first resource data obtained by crawling the first identity information on the website to be detected, and crawling the second resource data obtained by crawling the second identity information on the website to be detected, it specifically performs the following steps: avoiding crawling operations in a preset operation blacklist, crawling the first resource data obtained by crawling the first identity information on the website to be detected, and crawling the second resource data obtained by crawling the second identity information on the website resources to be detected; wherein the preset operation blacklist is a list of operations that do not need to be crawled on the website to be detected.

[0135] In some embodiments, after crawling the second resource data obtained by the second identity information on the website to be detected, the terminal processor 601 further specifically performs the following steps: filtering invalid resource data in the first resource data and the second resource data, and the invalid resource data at least includes front-end resource data.

[0136] In some embodiments, after determining whether there is an unauthorized vulnerability in the website to be detected, the terminal processor 601 further specifically performs the following steps: displaying the access results obtained by the first resource data, the second resource data, and the second identity information access permission web page resource and the unauthorized vulnerability detection result on the display interface; based on the user's confirmation operation on the unauthorized vulnerability detection result, generating an unauthorized vulnerability detection report corresponding to the unauthorized vulnerability detection result.

[0137] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0138] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0139] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of this specification is generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted by the above computer-readable storage medium. The above computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile discs (DVD)), or semiconductor media (for example, solid state drives (SSD)), etc.

[0140] It should be noted that, for the convenience of description, the aforementioned method embodiments are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described action sequence, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0141] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0142] The above is a description of an unauthorized vulnerability detection method, device, storage medium and terminal provided in the present application. For technicians in this field, according to the ideas of the embodiments of the present application, there may be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting unauthorized vulnerabilities, characterized in that: The method comprises: Acquire first identity information and second identity information, crawl first resource data obtained from the website to be detected by using the first identity information, and crawl second resource data obtained from the website to be detected by using the second identity information; Based on the first resource data and the second resource data, obtaining the permission webpage resource corresponding to the first identity information; Determine whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained by accessing the authorized web page resource by the second identity information and the first resource data.

2. The method according to claim 1, characterized in that The obtaining, based on the first resource data and the second resource data, the permission webpage resource corresponding to the first identity information includes: The first resource data and the second resource data are deduplicated to obtain the authorized web page resource corresponding to the first identity information.

3. The method according to claim 2, characterized in that When the data authority of the first identity information is higher than that of the second identity information, the step of deduplicating the first resource data and the second resource data to obtain the authority webpage resource corresponding to the first identity information includes: De-duplicating the first request data in the first resource data and the second request data in the second resource data, and determining that the web page resource corresponding to the request data in the first request data that does not overlap with the second request data is the permission web page resource corresponding to the first identity information; and / or Response data corresponding to overlapping request data of the first request data and the second request data are deduplicated, and a web page resource corresponding to non-overlapping response data is determined to be an authorized web page resource corresponding to the first identity information.

4. The method according to claim 3, wherein the first identity information is high-authority identity information, and the second identity information is low-authority identity information; Or the first identity information is authorized identity information, and the second identity information is unauthorized identity information, and the unauthorized identity information includes at least one of visitor identity information and blank identity information.

5. The method according to claim 2, characterized in that: When the data authority of the first identity information is equal to the data authority of the second identity information, the step of deduplicating the first resource data and the second resource data to obtain the authority webpage resource corresponding to the first identity information includes: De-duplication of the first response data in the first resource data and the second response data in the second resource data, and determining that the web page resource corresponding to the response data in the first response data that does not overlap with the second response data is the permission web page resource corresponding to the first identity information; and / or Determine that the first request data in the first resource data and the third request data in the second resource data have the same virtual path and different request parameters, and determine that the web page resource corresponding to the third request data is the authorized web page resource corresponding to the first identity information.

6. The method according to claim 1, characterized in that Determining whether there is an unauthorized vulnerability in the website to be detected based on the access result obtained by accessing the authorized webpage resource according to the second identity information and the first resource data includes: Compare a first access result obtained by the first identity information accessing the authorized webpage resource in the first resource data with a second access result obtained by the second identity information accessing the authorized webpage resource; If the response data in the first access result and the response data in the second access result are consistent, it is determined that an unauthorized vulnerability exists in the website to be detected.

7. The method according to claim 6, characterized in that The response data includes but is not limited to status code data and response body data.

8. An unauthorized vulnerability detection device, characterized in that: The device comprises: A data acquisition module, used to acquire first identity information and second identity information, crawl first resource data obtained from the website to be detected by crawling the first identity information, and crawl second resource data obtained from the website to be detected by crawling the second identity information; An authority determination module, configured to obtain the authority webpage resource corresponding to the first identity information based on the first resource data and the second resource data; The unauthorized access detection module is used to determine whether there is an unauthorized access vulnerability in the website to be detected based on the access result obtained by accessing the authorized web page resource by the second identity information and the first resource data.

9. A computer storage medium, characterized in that The computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the steps of the method according to any one of claims 1 to 7.

10. A terminal, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the program.

Images