Login blasting test method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a login blasting test method and device, electronic equipment and a storage medium. The method comprises the steps that form elements corresponding to a form of a to-be-logged blasting page are determined; performing login blasting based on the element information of the constructed form elements; testing result information returned in the login blasting process is compared with preset multi-class error information, and the preset multi-class error information is error information returned after login failure; and if the test result information is different from the error information and the test result information is the same as correct information returned by successful login, determining that login blasting succeeds. According to the technical scheme provided by the embodiment of the invention, the login operation on the browser can be simulated to perform login blasting on the to-be-tested target website, and whether the target website has a login blasting vulnerability or a weak password vulnerability or not is tested.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically to a login blasting test method, device, electronic device and storage medium in the field of network security technology. Background Art

[0002] With the rapid development of information technology, network security issues have arisen. Security testing of websites is an indispensable task, and login blasting testing is a very important part of website security testing.

[0003] In the related technical solution, weak password blasting is used to blast the website login. However, in websites using dynamic forms such as dynamic verification codes, dynamic pages can be protected from bypassing verification codes by adding timestamps, resulting in the inability to complete login blasting, and thus the login blasting test cannot be performed.

[0004] Therefore, for websites that use forms, how to effectively perform login brute force testing on the website becomes a problem to be solved.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include but not constitute information of the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The present application provides a login blasting test method, device and storage medium, which can simulate the scenario of a real user using a browser to perform a login operation, perform login blasting on a target website containing a form, and test whether the target website has a login blasting vulnerability or a weak password vulnerability.

[0007] In a first aspect, a login blasting test method is provided, the method comprising: determining a form element corresponding to a form of a page to be blasted for login; performing login blasting based on element information of the constructed form element; comparing the test result information returned during the login blasting process with multiple types of preset error information, the multiple types of preset error information being error information returned for failed logins; if the test result information is different from the error information and the test result information is the same as the correct information returned for successful logins, then it is determined that the login blasting is successful.

[0008] In the above technical scheme, the present application proposes a login blasting test method. On the one hand, the form element corresponding to the form of the page to be logged in is determined, and the login blasting is performed based on the element information of the constructed form element, which can accurately and efficiently construct the element information of the form element of the website page, and then can simulate the login operation of the website containing the form on the browser; on the other hand, the test result information returned by the login is compared with the information returned by the successful login and the failed login, which can directly determine whether the login blasting is successful, thereby testing whether the target website has a login blasting vulnerability or a weak password vulnerability.

[0009] In combination with the first aspect, in some possible implementations, before comparing the test result information returned during the login blasting process with the preset multiple types of error information, the method also includes: capturing the code information returned by the server during the login blasting process through a listener; parsing the code information to obtain the test result information.

[0010] In the above technical solution, the code information returned by the server to the browser during the blasting process is captured by the listener and the test result information is parsed. There is no need to wait for the browser interface to display the test result information before processing the test result, which can improve the efficiency of the login blasting test.

[0011] In combination with the first aspect and the above implementation, in some possible implementations, the above determining the form element corresponding to the form of the login page to be blasted includes: determining the form elements corresponding to multiple forms of the login page to be blasted in each of the multiple browsers.

[0012] In the above technical solution, multiple browsers and multiple tabs are used to perform login blasting tests simultaneously, which further improves the speed and efficiency of the login blasting tests.

[0013] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the above-mentioned login blasting based on the constructed element information of the form element includes: if there are multiple account types in the form element, determining the account dictionary corresponding to each account in the multiple account types; based on the account dictionary corresponding to each account type, constructing the element information corresponding to the form element; and performing login blasting based on the constructed element information of the form element.

[0014] In the above technical solution, in view of the situation where some websites have input boxes of multiple account types, it supports users to customize input boxes of multiple account types, determine the account dictionary corresponding to each account in the multiple account types, and perform blasting based on the multiple account dictionaries, thereby improving the accuracy of the login blasting test.

[0015] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the method also includes: after testing a predetermined number of times, if the returned test result information is different from the correct information and is different from each error message in the multiple types of error messages, then it is determined that the test result information is that the number of login failures exceeds the limit.

[0016] In the above technical solution, the error message of "the number of failed logins exceeds the limit" will only appear after a certain number of logins. Therefore, after testing a predetermined number of times, the returned test results are compared with the correct information of successful login and the error messages of multiple types of failed logins. If they are all different, the test result is determined to be that the number of failed logins exceeds the limit, so that the test result information can be correctly identified, further improving the accuracy of the test results.

[0017] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the preset multiple categories of error messages include at least two of an incorrect username, an incorrect password, an incorrect username and password, an incorrect image verification code, an incorrect SMS verification code, and an excessive number of login failures.

[0018] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the form element includes a graphic verification code and a text message verification code, and the method also includes: identifying the graphic verification code through a convolutional neural network model; and obtaining the text message verification code through a text message platform interface.

[0019] In summary, the present application proposes a login blasting test method. On the one hand, the form element corresponding to the form of the page to be logged in is determined, and the login blasting is performed based on the element information of the constructed form element, which can accurately and efficiently construct the element information of the form element of the website page, and then can simulate the login operation of the website containing the form on the browser; on the other hand, the test result information returned by the login is compared with the information returned by the successful login and the failed login, which can directly determine whether the login blasting is successful, thereby testing whether the target website has a login blasting vulnerability or a weak password vulnerability.

[0020] During the blasting process, this application proposes a method for obtaining test results. The listener captures the code information returned by the server during the login blasting process and parses the test result information. There is no need to wait for the browser interface to display the test result information before processing the test result, which can improve the efficiency of the login blasting test.

[0021] Using multiple browsers and multiple tabs to perform login blasting tests simultaneously further improves the speed and efficiency of login blasting tests.

[0022] For the situation where some websites have input boxes of multiple account types, it supports users to customize input boxes of multiple account types, determine the account dictionary corresponding to each account in multiple account types, and perform brute force based on multiple account dictionaries, which improves the accuracy of login brute force testing.

[0023] In addition, regarding how to identify the test result information as the number of failed logins exceeding the limit, the present application proposes a determination method. After testing a predetermined number of times, the returned test result is compared with the correct information of successful login and multiple types of error information of failed logins. If they are all different, the test result is determined to be the number of failed logins exceeding the limit. The test result can be correctly identified, further improving the accuracy of the test result.

[0024] In a second aspect, a login blasting test device is provided, which includes: a first determination unit, used to determine the form element corresponding to the form of the login page to be blasted; a blasting unit, used to blast based on the constructed element information of the form element; a comparison unit, used to compare the test result information returned during the blasting process with multiple types of preset error information; a second determination unit is used to determine that the login blasting is successful if the test result information is different from the error information and the test result information is the same as the correct information returned when the login is successful.

[0025] In combination with the second aspect, in some possible implementations, the device further includes: a capturing unit, configured to capture, through a listener, code information returned by the server for logging into the blasting process; and a parsing unit, configured to parse the code information to obtain the test result information.

[0026] In combination with the second aspect and the above implementations, in some possible implementations, the first determining unit is specifically configured to determine form elements corresponding to multiple forms of pages to be logged in and blasted in each of the multiple browsers.

[0027] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the blasting unit is specifically used to determine the account dictionary corresponding to each account in the multiple account types if there are multiple account types in the form element; construct element information corresponding to the form element based on the account dictionary corresponding to each account type; and perform login blasting based on the constructed element information of the form element.

[0028] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the determination unit is also used to, after a predetermined number of tests, if the returned test result information is different from the correct information and is different from each of the multiple types of error information, then determine that the test result information is that the number of login failures exceeds the limit.

[0029] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the device also includes an identification unit for identifying the graphic verification code through a convolutional neural network model; and an acquisition unit for acquiring the SMS verification code through an SMS platform interface.

[0030] In a third aspect, an electronic device is provided, comprising a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the electronic device executes the method in the first aspect or any possible implementation of the first aspect.

[0031] In a fourth aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0032] In a fifth aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A schematic diagram showing an application scenario of the login blasting test method provided in an embodiment of the present application is shown;

[0035] Figure 2 A schematic diagram of a login blasting test method provided according to some embodiments of the present application is shown;

[0036] Figure 3 A schematic diagram of a process of performing login blasting based on element information of constructed form elements provided in accordance with some embodiments of the present application is shown;

[0037] Figure 4 A schematic structural diagram of a logging blasting test device provided in an embodiment of the present application is shown;

[0038] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0040] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0041] First, the terms involved in one or more embodiments of this specification are explained.

[0042] CNN (Convolutional Neural Networks) model: It is a type of feedforward neural network with deep structure and convolutional calculation, and is one of the representative algorithms of deep learning. Convolutional neural network has the ability of representation learning, and can recognize mixed graphic verification codes with numbers 0-9, lowercase letters az, and uppercase letters AZ.

[0043] Below, the technical solution of the login blasting test method of the embodiment of the present application will be described in detail with reference to the accompanying drawings.

[0044] Figure 1 A schematic diagram showing an application scenario of the login brute force testing method provided according to an embodiment of the present application is shown.

[0045] Reference Figure 1 As shown in (a), the login page of the target website to be tested has multiple form elements, including user name, password, verification code, login button, etc. After entering the form content corresponding to the form element, click to log in. After receiving the submitted form information, the server of the target website to be tested verifies the user name and password and returns the information of login success or failure to the browser page. The return interface of successful login is as follows Figure 1 (b) shows the return interface for failed login. Figure 1 (c) as shown.

[0046] In the example embodiment, the browser installed on the client enters the login page of the target website to be tested, which is the page to be blasted. Determine the form element of the page to be logged in and blasted; perform login blasting based on the constructed form element information, such as logging in with the constructed user name information and password value; obtain the test result information returned by the page after login, and compare the test result information with multiple types of preset error information. The preset multiple types of error information are the information returned when the login fails, such as Figure 1 (c) shows an error in the verification code. The information returned when the login fails is determined based on the submitted form information. For example, if the entered username is incorrect, the error message is an incorrect username, etc. If the test result information is different from the preset multiple error messages and is the same as the correct information returned when the login is successful, then it is determined that the login attack is successful, that is, there is a login attack vulnerability in the target website to be tested.

[0047] It should be noted that the above-mentioned browser is a headless browser installed on the client, such as Headless, Awesomium, Benv, Erik, etc., and the embodiments of the present application do not make special limitations on this.

[0048] Figure 2 A flowchart of a login brute force test method provided according to some embodiments of the present application is shown. The execution subject of the login brute force test method can be a computing device with computing and processing functions, such as a terminal device or a server such as a laptop computer. The login brute force test method includes steps 201 to 204. The login brute force test method in the example embodiment is described in detail below in conjunction with the accompanying drawings.

[0049] Reference Figure 2 As shown, in step 201, the form element corresponding to the form of the page to be logged in is determined.

[0050] In the example embodiment, the login page has multiple form elements, such as user name, password, confirm password, graphic verification code, SMS verification code, etc. The form elements can be located and identified by Python crawler; in order to more accurately identify the form elements, the configuration information of the form elements can also be obtained, and the form elements of the login page can be determined by the configuration information.

[0051] For example, in the configuration of the form element, the user sets the form to be filled in, the position of the form, and the type of form element, such as user name, password, confirm password, graphic verification code, SMS verification code, submit button, etc. For the user name and password form elements, the corresponding user name dictionary and password dictionary are provided.

[0052] Furthermore, the form element configuration information set by the user is obtained, and then the content corresponding to the form element is filled in according to the configuration information, such as the user name information corresponding to the user name input box and the password value corresponding to the password box.

[0053] In step 202, login blasting is performed based on the element information of the constructed form element.

[0054] In an exemplary embodiment, the form element includes a user name and a password, and the corresponding form element information includes the user name information and the password value. Based on the user name dictionary and the password dictionary provided by the user, the user name information and the password value are constructed for login.

[0055] For example, the user name dictionary and password dictionary provided by the user are traversed, and the user name dictionary and password dictionary include many user names and passwords that people habitually set, for example, commonly used password dictionaries: a123456789, password, 123456abc, etc.; commonly used user name dictionaries: login, admin, admin123, etc. By traversing the user name and password dictionary, a large number of user names and corresponding passwords are constructed by exhaustive method for login, for example, the constructed user name: admin, password: 123456 is used for login, if the login fails, continue to use other constructed user names and passwords for login.

[0056] It should be noted that although this embodiment takes the blasting method as a dictionary cracking method as an example, those skilled in the art should understand that the blasting method may also be other methods, such as brute force cracking, rainbow table attack, etc., which are also within the scope of the embodiments of the present application.

[0057] In step 203, the test result information returned during the login blasting process is compared with the preset multiple types of error information, where the preset multiple types of error information are the error information returned when the login fails.

[0058] In an example embodiment, the test result information returned by the target website to be tested in response to the submitted form information is obtained, and the test result information is compared with multiple types of preset error information. The multiple types of error information are information returned when a login fails, including: incorrect user name, incorrect password, incorrect user name and password, incorrect graphic verification code, incorrect SMS verification code, and the number of login failures exceeds the limit.

[0059] For example, after clicking login, the server verifies the submitted username and password, and returns a login failure or login success message to the browser page. The returned information is compared with the above-mentioned multiple types of error messages to determine whether the test result information is a successful login message or a failed login message.

[0060] In step 204, if the test result information is different from the error information and the test result information is the same as the correct information returned when the login is successful, it is determined that the login brute force attack is successful.

[0061] In the example embodiment, if the test result information is different from the above-mentioned multiple types of errors, that is, it is not information of a login failure, and is the same as the correct information returned when a correct user name and password are used to successfully log in, it proves that the login blasting is successful. In other words, when the test result information is a successful login, it is determined that the login blasting is successful.

[0062] according to Figure 2 The technical solution in the example embodiment, on the one hand, determines the form element corresponding to the form of the page to be logged in, and performs login blasting based on the element information of the constructed form element, which can accurately and efficiently construct the element information of the form element of the website page, and then can simulate the login operation of the website containing the form on the browser; on the other hand, the login return information is compared with the information returned by the successful login and the failed login, so as to directly determine whether the login blasting is successful, thereby testing whether the target website has a login blasting vulnerability or a weak password vulnerability.

[0063] Figure 3 A schematic diagram of a process of performing login blasting based on element information of constructed form elements provided in accordance with some embodiments of the present application is shown.

[0064] Reference Figure 3 As shown, in step 301, if there are multiple account types in the form element, the account dictionary corresponding to each of the multiple account types is determined.

[0065] In an exemplary embodiment, if there are multiple account types in the form element, such as user name, mobile phone number, email address, etc., a user name dictionary corresponding to the user name, a mobile phone number dictionary corresponding to the mobile phone number, and an email address dictionary corresponding to the email address are determined.

[0066] For example, a user defines multiple account type input boxes in the form element configuration, such as an input box corresponding to a user name, an input box corresponding to a mobile phone number, and an input box corresponding to an email address, and provides a dictionary corresponding to each account type. By obtaining the form element configuration information, form elements of multiple account types and corresponding dictionaries are determined.

[0067] In step 302, based on the account dictionary corresponding to each account type, element information corresponding to the form element is constructed.

[0068] In an example embodiment, a user name dictionary, a mobile phone number dictionary, and an email address dictionary are traversed to construct a large number of mobile phone numbers, user names, and email addresses as accounts, and a password dictionary is traversed to construct a large number of passwords.

[0069] In step 303, login blasting is performed based on the constructed form element information.

[0070] In the example embodiment, the form elements include an account and a password. Accounts include multiple types such as user name, mobile phone number, email address, etc. Login is performed based on the constructed multiple accounts and corresponding passwords.

[0071] For example, use the constructed username: 123abc, mobile phone number: 123456, email: 123@123.com password: password to log in. If the login fails, continue to use other account and password combinations to log in.

[0072] Through the technical solution in the above embodiment, for the situation where there are multiple account type input boxes on some websites, the account dictionary corresponding to each account in the multiple account types is determined, and blasting is performed based on the multiple account dictionaries, thereby improving the accuracy of the login blasting test.

[0073] In a possible implementation, after determining that the login brute force attack is successful, a secondary login verification is performed.

[0074] For example, when the return information for the first time during the login blasting process is consistent with the return information of a successful login, the user's registered correct username and password are used to log in again, and the login return result is compared with the above-mentioned multiple types of error information and the correct information of a successful login. If it is consistent with the correct information, it means that the blasting is successful.

[0075] Through the technical solution in the above embodiment, in order to prevent mis-explosion, a secondary verification is performed after the login blasting is successful, thereby improving the accuracy of the test result.

[0076] In a possible implementation, before comparing the test result information returned during the login blasting process with the preset multiple types of error information, the code information returned by the server during the login blasting process is captured by a listener, and the code information is parsed to obtain the test result information.

[0077] For example, the listener in the browser obtains the code information returned by the server of the target website to be tested in response to the login operation, parses the code information, obtains the test result information in the code information, and determines whether the login blasting is successful based on the test result information.

[0078] After clicking login on the login page, the server responds according to the request sent by the client and returns the response Hypertext Markup Language (HTML) page code to the browser. The browser then renders the page according to the HTML page code to present a page indicating successful or failed login. It takes a certain amount of time for the server to return the HTML page code and for the browser to fully render the page. If you wait for the page to render successfully before obtaining the login return information for processing, the login blasting test will be slow. Therefore, you can use the listener in the browser to capture the code information returned by the server to obtain the test result information in advance.

[0079] Through the technical solution in the above embodiment, the code information returned by the server during the blasting process is captured by the listener and the test result information is parsed. There is no need to wait for the browser interface to display the test result information before processing the test result, which can further improve the efficiency of the login blasting test.

[0080] In one possible implementation, multiple browsers and multiple tabs are used to perform login testing simultaneously.

[0081] For example, use 100 browsers, open 100 login tabs in 100 browsers, and perform login brute force at the same time. After a login tab completes the login operation, do not close the tab, and reuse the already opened browsers and tabs to continue the login operation.

[0082] Through the technical solution in the above embodiment, multiple browsing and multiple tabs are used for login blasting, and the opened browsers and tabs are reused to continuously perform login operations, which further improves the login blasting efficiency.

[0083] In a possible implementation, during the login blasting process, if there is a graphic verification code on the page to be logged in, the graphic verification code of the login page is automatically identified through the CNN model. Image recognition based on CNN belongs to the existing technology and will not be elaborated here.

[0084] In a possible implementation, when there is a text message verification code on the login page, the correct verification code is obtained by connecting to the user's text message platform API and automatically filled in the text message verification code input box.

[0085] Through the technical solution in the above embodiment, the graphic verification code is automatically identified through the convolutional neural model, and the SMS verification code is automatically obtained and filled in through the SMS platform. There is no need to manually fill in the graphic verification code and the SMS verification code, which further improves the efficiency of the login brute force test.

[0086] In one possible implementation, after a predetermined number of tests, if the returned test result information is different from the correct information returned upon successful login, and is different from each of the multiple error messages mentioned above, then the test result information is determined to be due to an excess of login failures.

[0087] For security reasons, the website will limit logins after a certain number of logins. Therefore, when collecting error information returned by failed logins, if the set number limit is not reached, it will be impossible to collect error information about the number of failed logins exceeding the limit. When doing login brute force testing, it will be impossible to determine whether the test result is an error message about the number of logins exceeding the limit.

[0088] Therefore, after testing a predetermined number of times, for example 50 times, if the test result information returned by the 50th login is different from the information returned by the successful login and the above-mentioned multiple types of error information, it is determined that the test result information is that the number of login failures exceeds the limit.

[0089] Through the technical solution in the above embodiment, after testing a predetermined number of times, the returned test results are compared with the correct information of successful login and the error information of multiple types of login failures. If they are all different, the test result is determined to be that the number of login failures exceeds the limit. The test results can be correctly identified, further improving the accuracy of the test results.

[0090] Figure 4 A schematic structural diagram of a logging blasting test device provided in an embodiment of the present application is shown;

[0091] For example, Figure 4 As shown, the device 400 includes:

[0092] The first determining unit 401 is used to determine the form element corresponding to the form of the login page to be blasted;

[0093] Explosion unit 402: used for blasting based on element information of constructed form elements;

[0094] Comparison unit 403: used to compare the test result information returned during the blasting process with the preset multiple types of error information.

[0095] The second determining unit 404 is used to determine that the login blasting is successful if the test result information is different from the error information and the test result information is the same as the correct information returned when the login is successful.

[0096] Optionally, the device further includes: a capturing unit, used to capture the code information returned by the server during the login blasting process through a listener; and a parsing unit, used to parse the code information to obtain test result information.

[0097] In a possible implementation, the determining unit is specifically configured to determine form elements corresponding to multiple forms of pages to be logged in and blasted in each of the multiple browsers.

[0098] In one possible implementation, the blasting unit is specifically used to, if there are multiple account types in the form element, determine the account dictionary corresponding to each account in the multiple account types; construct element information corresponding to the form element based on the account dictionary corresponding to each account type; and perform login blasting based on the element information of the constructed form element.

[0099] Optionally, the device also includes: a third determination unit, which is used to determine that the test result information is that the number of login failures exceeds the limit if the returned test result information is different from the correct information and different from each error message in the multiple types of error messages after testing a predetermined number of times.

[0100] Optionally, the device also includes: an identification unit, used to identify the graphic verification code through a convolutional neural network model; and an acquisition unit, used to acquire the SMS verification code through an SMS platform interface.

[0101] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0102] For example, Figure 5 As shown, the electronic device 500 includes: a memory 501 and a processor 502, wherein the memory 501 stores an executable program code 5011, and the processor 502 is used to call and execute the executable program code 5011 to perform a login brute force test method.

[0103] In this embodiment, the electronic device can be divided into functional modules according to the above method example. For example, each functional module can be corresponded to, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0104] In the case of dividing each functional module according to each function, the electronic device may include: a determination unit, a blasting unit, a comparison unit, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0105] The electronic device provided in this embodiment is used to execute the above-mentioned login blasting test method, and thus can achieve the same effect as the above-mentioned implementation method.

[0106] In the case of an integrated unit, the electronic device may include a processing module and a storage module. The processing module may be used to control and manage the actions of the electronic device. The storage module may be used to support the electronic device in executing mutual program codes and data.

[0107] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits disclosed in the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0108] This embodiment also provides a computer-readable storage medium, in which a computer program code is stored. When the computer program code is executed on a computer, the computer executes the above-mentioned related method steps to implement a login brute force test method in the above-mentioned embodiment.

[0109] This embodiment also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement a login brute force testing method in the above-mentioned embodiment.

[0110] In addition, the electronic device provided in the embodiments of the present application may specifically be a chip, a component or a module, and the electronic device may include a connected processor and a memory; wherein the memory is used to store instructions, and when the electronic device is running, the processor may call and execute instructions so that the chip executes a login blasting test method in the above-mentioned embodiments.

[0111] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0112] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0113] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A login blasting test method, characterized in that: The method comprises: Determine the form element corresponding to the form of the page to be logged in; Perform login blasting based on the constructed element information of the form element; Compare the test result information returned during the login blasting process with the preset multiple types of error information, where the preset multiple types of error information are the error information returned when the login fails; If the test result information is different from the error information and the test result information is the same as the correct information returned when the login is successful, it is determined that the login blasting is successful.

2. The method according to claim 1, characterized in that: Before comparing the test result information returned during the login blasting process with the preset multiple types of error information, the method further includes: Capture the code information returned by the server during the login blasting process through the listener; The code information is parsed to obtain the test result information.

3. The method according to claim 1, characterized in that The step of determining the form element corresponding to the form of the page to be logged in for blasting comprises: Determine the form elements corresponding to the multiple forms of the pages to be logged in and blasted in each of the multiple browsers.

4. The method according to claim 1, characterized in that The login blasting based on the constructed element information of the form element includes: If the form element has multiple account types, determine the account dictionary corresponding to each of the multiple account types; Based on the account dictionary corresponding to each account type, construct element information corresponding to the form element; Login blasting is performed based on the element information of the constructed form element.

5. The method according to claim 1, characterized in that The method further comprises: After a predetermined number of tests, if the returned test result information is different from the correct information and is different from each of the multiple types of error information, it is determined that the test result information indicates that the number of login failures exceeds the limit.

6. The method according to any one of claims 1 to 5, characterized in that The preset multiple types of error messages include at least two of an incorrect user name, an incorrect password, an incorrect user name and password, an incorrect image verification code, an incorrect SMS verification code, and an excessive number of failed login attempts.

7. The method according to claim 1, wherein the form element comprises a graphic verification code and a text message verification code, and the method further comprises: Recognize the graphic verification code through a convolutional neural network model; The SMS verification code is obtained through the SMS platform interface.

8. A logging blasting test device, characterized in that: The device comprises: The first determining unit is used to determine the form element corresponding to the form of the login page to be blasted; A blasting unit, used for blasting based on the constructed element information of the form element; The comparison unit is used to compare the test result information returned during the blasting process with the preset multiple types of error information. The second determining unit is used to determine that the login blasting is successful if the test result information is different from the error information and the test result information is the same as the correct information returned when the login is successful.

9. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable program codes; A processor, configured to call and run the executable program code from the memory, so that the electronic device executes the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 is implemented.

Images