Login to explosive testing methods, apparatus, electronic equipment and storage media

Abstract

Embodiments of the present application provide a login burst test method and device, electronic equipment and storage medium, the method comprising: determining the form element corresponding to the form of the login burst page; based on the element information of the constructed form element, login burst is carried out; the test result information returned in the login burst process is compared with the preset multi-type error information, and the preset multi-type error information is the error information returned when login fails; if the test result information and the error information are different, and the test result information is the same as the correct information returned when login succeeds, it is determined that the login burst is successful. According to the technical scheme of the embodiments of the present application, the login operation on the browser can be simulated to login burst on the target website to be tested, and whether the target website to be tested has a login burst vulnerability or a weak password vulnerability.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically to a login brute-force testing method, apparatus, electronic device, and storage medium in the field of network security technology. Background Technology

[0002] With the rapid development of information technology, network security issues have emerged. Conducting security testing on websites is an essential task, and login brute-force testing is a very important part of website security testing.

[0003] In existing technical solutions, weak password brute-force attacks are used to crack website logins. However, on websites using dynamic forms, such as dynamic CAPTCHAs, dynamic pages can bypass CAPTCHA protection by adding timestamps, rendering brute-force login attacks impossible and thus preventing login brute-force tests from being conducted.

[0004] Therefore, how to effectively conduct login brute-force tests on websites that use forms has become an unsolved problem.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of the present invention, and therefore may include, but does not constitute, information on prior art known to those skilled in the art. Summary of the Invention

[0006] This application provides a login brute-force testing method, apparatus, and storage medium. The method can simulate the scenario of a real user using a browser to log in, and perform login brute-force attacks on target websites containing forms to test whether the target website has login brute-force vulnerabilities or weak password vulnerabilities.

[0007] Firstly, a login brute-force testing method is provided. The method includes: determining the form element corresponding to the form of the page to be brute-forced; performing login brute-force based on the element information of the constructed form element; comparing the test result information returned during the login brute-force process with preset multiple types of error information, wherein the preset multiple types of error information are error information returned when login fails; if the test result information and the error information are different and the test result information is the same as the correct information returned when login is successful, then the login brute-force is determined to be successful.

[0008] In the above technical solution, this application proposes a login brute-force testing method. On the one hand, it determines the form elements corresponding to the form on the page to be brute-forced, and performs login brute-force based on the constructed form element information. This can accurately and efficiently construct the form element information of the website page, thereby simulating the login operation of a website containing a form in a browser. On the other hand, by comparing the test result information returned by login with the information returned by login success and login failure, it can directly determine whether the login brute-force was successful, thereby testing whether the target website has login brute-force vulnerabilities or weak password vulnerabilities.

[0009] In conjunction with the first aspect, in some possible implementations, before comparing the test result information returned during the login brute-force process with preset error information, the method further includes: capturing the code information returned by the server during the login brute-force process through a listener; parsing the code information to obtain the test result information.

[0010] In the above technical solution, the code information returned by the server to the browser during the brute-force attack is captured by the listener and the test result information is parsed out. There is no need to wait for the browser interface to display the test result information before processing the test result, which can improve the efficiency of login brute-force testing.

[0011] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the above-mentioned determination of the form elements corresponding to the form of the login page to be brute-forced includes: determining the form elements corresponding to the forms of multiple login pages to be brute-forced in each browser in multiple browsers.

[0012] In the above technical solution, multiple browsers and multiple tabs are used to conduct login brute-force tests simultaneously, which further improves the speed and efficiency of login brute-force testing.

[0013] Combining the first aspect and the above implementation methods, in some possible implementation methods, the above-mentioned login brute-force attack based on the constructed element information of the form element includes: if the form element has multiple account types, then determining the account dictionary corresponding to each account among the multiple account types; constructing the element information corresponding to the form element based on the account dictionary corresponding to each account type; and performing login brute-force attack based on the constructed element information of the form element.

[0014] In the above technical solution, for situations where some websites have input boxes for multiple account types, it supports users to customize input boxes for multiple account types, determine the account dictionary corresponding to each account in multiple account types, and perform brute-force attacks based on multiple account dictionaries, thereby improving the accuracy of login brute-force testing.

[0015] In combination with the first aspect and the above implementation methods, in some possible implementation methods, the method further includes: after a predetermined number of tests, if the returned test result information is different from the correct information and different from each of the error information in the multiple types of error information, then the test result information is determined to be that the login failure count has exceeded the limit.

[0016] In the above technical solution, the error message indicating that the number of failed login attempts has exceeded the limit will only appear after a certain number of login attempts. Therefore, after testing a predetermined number of times, the returned test results are compared with the correct login success message and various types of login failure error messages. If they are all different, the test result is determined to be that the number of failed login attempts has exceeded the limit. This can correctly identify the test result information and further improve the accuracy of the test results.

[0017] Combining the first aspect and the above implementation methods, in some possible implementation methods, the preset multiple error messages include at least two of the following: incorrect username, incorrect password, incorrect username and password, incorrect image verification code, incorrect SMS verification code, and exceeding the limit for the number of failed login attempts.

[0018] Combining the first aspect and the above implementation methods, in some possible implementation methods, the form element includes a graphic verification code and an SMS verification code. The method also includes: recognizing the graphic verification code through a convolutional neural network model; and obtaining the SMS verification code through an SMS platform interface.

[0019] In summary, this application proposes a login brute-force testing method. On one hand, it identifies the form elements corresponding to the form on the page to be brute-forced, and performs login brute-force based on the constructed form element information. This allows for accurate and efficient construction of the form element information of the website page, thereby simulating the login operation of a website containing forms in a browser. On the other hand, by comparing the login test results with the login success and failure results, it is possible to directly determine whether the login brute-force attack was successful, thus testing whether the target website has login brute-force vulnerabilities or weak password vulnerabilities.

[0020] During the brute-force attack, this application proposes a method for obtaining test results. By capturing the code information returned by the server during the login brute-force attack through a listener and parsing the test result information, it is not necessary to wait for the browser interface to display the test result information before processing the test result, which can improve the efficiency of login brute-force testing.

[0021] By using multiple browsers and multiple tabs to conduct login brute-force tests simultaneously, the speed and efficiency of login brute-force testing have been further improved.

[0022] For websites with multiple account type input fields, the system supports users to customize multiple account type input fields, determine the account dictionary corresponding to each account in multiple account types, and perform brute-force attacks based on multiple account dictionaries, thereby improving the accuracy of login brute-force testing.

[0023] Furthermore, this application proposes a method to identify login failures exceeding the limit in test results. After a predetermined number of tests, the returned test results are compared with the correct login success information and various types of login failure error information. If they are all different, the test result is determined to be login failures exceeding the limit. This method can correctly identify test results and further improve the accuracy of test results.

[0024] Secondly, a login brute-force testing device is provided, comprising: a first determining unit for determining the form element corresponding to the form of the login page to be brute-forced; a brute-force unit for brute-forcing based on the element information of the constructed form element; a comparison unit for comparing the test result information returned during the brute-force process with preset multiple types of error information; and a second determining unit for determining that the login brute-force is successful if the test result information and the error information are both different and the test result information is the same as the correct information returned upon successful login.

[0025] In conjunction with the second aspect, in some possible implementations, the device further includes: a capture unit for capturing code information returned by the server during the login brute-force process via a listener; and a parsing unit for parsing the code information to obtain the test result information.

[0026] Combining the second aspect and the above implementation methods, in some possible implementation methods, the first determining unit is specifically used to determine the form elements corresponding to the multiple login brute-force page forms of each browser in multiple browsers.

[0027] Combining the second aspect and the above implementation methods, in some possible implementation methods, the brute-force unit is specifically used to determine the account dictionary corresponding to each account among the multiple account types if the form element has multiple account types; construct the element information corresponding to the form element based on the account dictionary corresponding to each account type; and perform login brute-force based on the constructed element information of the form element.

[0028] In conjunction with the second aspect and the above implementation methods, in some possible implementation methods, the determining unit is further configured to determine that the test result information is "login failure count exceeded limit" if, after a predetermined number of tests, the returned test result information is different from the correct information and different from each of the error information in the multiple types of error information.

[0029] In conjunction with the second aspect and the above implementation methods, in some possible implementation methods, the device further includes an identification unit for identifying the graphic verification code through a convolutional neural network model; and an acquisition unit for acquiring the SMS verification code through an SMS platform interface.

[0030] Thirdly, an electronic device is provided, including a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, causing the electronic device to perform the methods of the first aspect or any possible implementation thereof.

[0031] Fourthly, a computer program product is provided, comprising: computer program code, which, when run on a computer, causes the computer to perform the methods described in the first aspect or any possible implementation thereof.

[0032] Fifthly, a computer-readable storage medium is provided that stores computer program code, which, when executed on a computer, causes the computer to perform the methods described in the first aspect or any possible implementation thereof. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A schematic diagram illustrating an application scenario of the login brute-force testing method provided according to an embodiment of this application is shown;

[0035] Figure 2 A flowchart illustrating a login brute-force test method according to some embodiments of this application is shown;

[0036] Figure 3 The illustration shows a flowchart of a login brute-force attack based on element information of constructed form elements according to some embodiments of this application;

[0037] Figure 4 This paper shows a schematic diagram of the structure of a login blasting test device provided in an embodiment of this application;

[0038] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0039] The technical solutions in this application will be clearly and thoroughly described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. "And / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0040] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0041] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0042] CNN (Convolutional Neural Networks) models are a type of feedforward neural network that incorporates convolutional computations and has a deep structure. They are one of the representative algorithms of deep learning. Convolutional neural networks have representation learning capabilities and can recognize mixed graphic CAPTCHAs containing digits 0-9, lowercase letters az, and uppercase letters AZ.

[0043] The technical solution of the login blasting test method of this application embodiment will be described in detail below with reference to the accompanying drawings.

[0044] Figure 1 A schematic diagram illustrating an application scenario of the login brute-force testing method provided in an embodiment of this application is shown.

[0045] Reference Figure 1 As shown in (a), the login page of the target website under test contains multiple form elements, including username, password, verification code, and login button. After entering the form content corresponding to the form element and clicking login, the server of the target website receives the submitted form information, verifies the username and password, and returns a success or failure message to the browser page. The successful login return interface is as follows. Figure 1 As shown in (b), the return screen after a login failure is as follows: Figure 1 As shown in (c).

[0046] In the example embodiment, the login page of the target website to be tested is accessed through a browser installed on the client. This login page is the page to be brute-force tested. The form elements of the login page to be brute-forced are determined; login brute-force is performed based on the constructed form element information, such as constructed username and password; the test result information returned by the page after login is obtained, and the test result information is compared with preset error messages, which are information returned when login fails, such as... Figure 1 (c) shows an error in the verification code. The information returned for login failure depends on the submitted form information. For example, if the entered username is incorrect, the error message will be "Incorrect username". If the test result information is different from the preset error information and is the same as the correct information returned for successful login, then the login brute-force attack is successful, that is, the target website to be tested has a login brute-force vulnerability.

[0047] It should be noted that the browsers mentioned above are headless browsers installed on the client, such as Headless, Awesomium, Benv, Erik, etc., and this application embodiment does not make any special limitation on them.

[0048] Figure 2 A schematic flowchart of a login brute-force test method according to some embodiments of this application is shown. The execution entity of this login brute-force test method can be a computing device with computing processing capabilities, such as a terminal device like a laptop or a server. The login brute-force test method includes steps 201 to 204. The login brute-force test method in the example embodiments will be described in detail below with reference to the accompanying drawings.

[0049] Reference Figure 2 As shown, in step 201, the form elements corresponding to the form of the page to be logged in and brute-forced are determined.

[0050] In the example implementation, the login page contains multiple form elements, such as username, password, confirm password, CAPTCHA, and SMS verification code. Form elements can be located and identified using a Python web crawler. For more accurate identification, configuration information of the form elements can also be obtained to determine their location on the login page.

[0051] For example, users configure the forms they need to fill out, their positions, and the types of form elements, such as username, password, confirm password, CAPTCHA, SMS verification code, and submit button. For username and password form elements, corresponding username and password dictionaries are provided.

[0052] Furthermore, the system obtains the configuration information of the form elements set by the user, and then fills in the corresponding content of the form elements according to the configuration information, such as the username information for the username input box and the password value for the password box.

[0053] In step 202, a login brute-force attack is performed based on the element information of the constructed form elements.

[0054] In the example embodiment, the form elements include a username and a password, and the corresponding form element information includes username information and password value. Based on the username dictionary and password dictionary provided by the user, the username information and password value are constructed for login.

[0055] For example, the system iterates through the username and password dictionaries provided by the user. These dictionaries contain many commonly used usernames and passwords. Examples of common passwords include: a123456789, password, 123456abc, etc.; common usernames include: login, admin, admin123, etc. By iterating through these dictionaries, the system uses brute force to construct a large number of usernames and corresponding passwords for login. For instance, it might try logging in with the constructed username: admin and password: 123456. If the login fails, it continues to try other constructed usernames and passwords.

[0056] It should be noted that although this embodiment uses the brute-force method as an example of dictionary attack, those skilled in the art should understand that the brute-force method can also be other methods, such as brute-force attack, rainbow table attack, etc., which are also within the scope of this application embodiment.

[0057] In step 203, the test result information returned during the login brute-force process is compared with the preset multi-type error information, which is the error information returned when the login fails.

[0058] In the example embodiment, the test result information returned by the target website in response to the submitted form information is obtained, and this test result information is compared with a set of preset error messages. The error messages are information returned when login fails, including: incorrect username, incorrect password, incorrect username and password, incorrect CAPTCHA, incorrect SMS verification code, and exceeding the login failure limit.

[0059] For example, after clicking login, the server verifies the submitted username and password and returns a login failure or login success message to the browser page. The returned information is compared with the various error messages mentioned above to determine whether the test result is a login success message or a login failure message.

[0060] In step 204, if the test result information and the error information are different, and the test result information is the same as the correct information returned upon successful login, then the login brute-force attack is confirmed to be successful.

[0061] In the example embodiment, if the test result information is different from all of the above-mentioned error types, i.e., it does not belong to the login failure information, and is the same as the correct information returned when logging in successfully with the correct username and password, it proves that the login brute-force attack was successful. In other words, if the test result information is login successful, then the login brute-force attack is determined to be successful.

[0062] according to Figure 2 The technical solution in the example embodiment, on the one hand, determines the form element corresponding to the form of the page to be brute-forced, and performs login brute-force based on the element information of the constructed form element. This can accurately and efficiently construct the element information of the form element of the website page, thereby simulating the login operation of a website containing a form on a browser. On the other hand, by comparing the login return information with the login success and login failure return information, it is possible to directly determine whether the login brute-force was successful, thereby testing whether the target website has a login brute-force vulnerability or a weak password vulnerability.

[0063] Figure 3 This document illustrates a flowchart of a login brute-force attack based on element information of constructed form elements, according to some embodiments of this application.

[0064] Reference Figure 3 As shown, in step 301, if the form element has multiple account types, then the account dictionary corresponding to each account type among the multiple account types is determined.

[0065] In the example implementation, if a form element has multiple account types, such as username, phone number, and email, then the username dictionary, phone number dictionary, and email dictionary are determined.

[0066] For example, a user might define multiple input fields for different account types in the form element configuration, such as input fields for username, phone number, and email address, and provide a dictionary for each account type. By retrieving the form element configuration information, the form elements for multiple account types and their corresponding dictionaries can be determined.

[0067] In step 302, based on the account dictionary corresponding to each account type, the element information corresponding to the form element is constructed.

[0068] In the example implementation, the username dictionary, mobile phone number dictionary, and email address dictionary are traversed to construct a large number of mobile phone numbers, usernames, and email addresses as accounts. At the same time, the password dictionary is traversed to construct a large number of passwords.

[0069] In step 303, a login brute-force attack is performed based on the constructed form element information.

[0070] In the example implementation, the form elements include account and password. Accounts can be of multiple types, such as username, mobile phone number, and email address. Login is performed based on multiple constructed accounts and their corresponding passwords.

[0071] For example, you can log in using the constructed username: 123abc, mobile number: 123456, email: 123@123.com, and password: password. If the login fails, you can continue to try to log in using other account and password combinations.

[0072] By employing the technical solutions described in the above embodiments, and addressing the issue of input boxes for multiple account types on certain websites, the accuracy of login brute-force testing is improved by determining the account dictionary corresponding to each account among the multiple account types and performing brute-force attacks based on multiple account dictionaries.

[0073] In one possible implementation, after confirming a successful brute-force login attempt, a secondary login verification is performed.

[0074] For example, when the first login brute-force attack results in a message that matches the login success message, the user then logs in again using the correct username and password they registered with. The login result is then compared with the various error messages and the successful login message mentioned above. If the result matches the correct message, the brute-force attack is successful.

[0075] By employing the technical solutions described in the above embodiments, a secondary verification is performed after a successful login attempt to prevent accidental brute-force attacks, thereby improving the accuracy of the test results.

[0076] In one possible implementation, before comparing the test result information returned during the login brute-force attack with preset error messages, a listener captures the code information returned by the server during the login brute-force attack, parses the code information, and obtains the test result information.

[0077] For example, a listener in the browser can be used to obtain the code information returned by the server of the target website in response to the login operation, parse the code information, obtain the test result information in the code information, and determine whether the login brute-force attack was successful based on the test result information.

[0078] After clicking "Login" on the login page, the server responds to the client's request and returns the Hypertext Markup Language (HTML) page code to the browser. The browser then renders the page based on the HTML page code to display a success or failure message. There is a certain amount of time between the server returning the HTML page code and the browser fully rendering the page. If the login information is only retrieved and processed after each successful page rendering, the login brute-force test will be slow. Therefore, a browser listener can be used to capture the server's returned code information to obtain test results in advance.

[0079] By using the technical solutions in the above embodiments, the code information returned by the server during the brute-force attack is captured by the listener and the test result information is parsed out. There is no need to wait for the browser interface to display the test result information before processing the test result, which can further improve the efficiency of login brute-force testing.

[0080] One possible implementation involves using multiple browsers and multiple tabs to perform login tests simultaneously.

[0081] For example, using 100 browsers, open 100 login tabs in each of the 100 browsers and perform a brute-force login attack simultaneously. After completing the login operation on a login tab, do not close the tab; reuse the already opened browser and tab to continue the login operation.

[0082] The technical solutions described in the above embodiments employ multi-browser and multi-tab login brute-force attacks, and reuse open browsers and tabs to continuously perform login operations, further improving the efficiency of login brute-force attacks.

[0083] In one possible implementation, during the login brute-force attack, if the login page contains a graphical CAPTCHA, the CNN model is used to automatically identify the graphical CAPTCHA on the login page. Image recognition based on CNN is an existing technology and will not be elaborated on here.

[0084] In one possible implementation, when an SMS verification code is present on the login page, the correct verification code is obtained by connecting to the user's SMS platform API and automatically filled into the SMS verification code input box.

[0085] The technical solutions described in the above embodiments automatically identify graphic verification codes using a convolutional neural network model and automatically obtain and fill in SMS verification codes through an SMS platform, eliminating the need for manual input of graphic and SMS verification codes and further improving the efficiency of login brute-force testing.

[0086] In one possible implementation, after a predetermined number of tests, if the returned test result information is different from the correct information returned upon successful login, and also different from each of the aforementioned error messages, then the test result information is determined to be an error indicating that the number of failed login attempts has exceeded the limit.

[0087] For security reasons, websites restrict logins after a certain number of attempts. Therefore, when collecting error messages returned after failed login attempts, if the set limit for the number of failed login attempts has not been reached, it will be impossible to collect error messages indicating that the number of failed login attempts has exceeded the limit. When conducting login brute-force tests, it will be impossible to determine whether the test results belong to the error message indicating that the number of failed login attempts has exceeded the limit.

[0088] Therefore, after a predetermined number of tests, such as 50, if the test result information returned on the 50th login is different from the information returned on a successful login and the various error messages mentioned above, then the test result information is determined to be that the number of failed login attempts has exceeded the limit.

[0089] Through the technical solution in the above embodiments, after a predetermined number of tests, the returned test results are compared with the correct login information and various types of login failure error information. If they are all different, the test result is determined to be that the number of login failures has exceeded the limit. This can correctly identify the test results and further improve the accuracy of the test results.

[0090] Figure 4 This paper shows a schematic diagram of the structure of a login blasting test device provided in an embodiment of this application;

[0091] For example, such as Figure 4 As shown, the device 400 includes:

[0092] First determining unit 401: used to determine the form element corresponding to the form of the login page to be brute-forced;

[0093] Explosive unit 402: Used for brute-forcing based on element information of constructed form elements;

[0094] Comparison unit 403: Used to compare the test result information returned during the blasting process with preset error information of multiple types.

[0095] The second determining unit 404 is used to determine that the login brute-force attack was successful if the test result information and the error information are different and the test result information is the same as the correct information returned upon successful login.

[0096] Optionally, the device further includes: a capture unit for capturing code information returned by the server during the login brute-force attack process via a listener; and a parsing unit for parsing the code information to obtain test result information.

[0097] In one possible implementation, the determining unit is specifically used to determine the form elements corresponding to multiple brute-force login page forms in multiple browsers.

[0098] In one possible implementation, the brute-force unit is specifically used to: if a form element has multiple account types, determine the account dictionary corresponding to each account among the multiple account types; construct the element information corresponding to the form element based on the account dictionary corresponding to each account type; and perform login brute-force based on the constructed element information of the form element.

[0099] Optionally, the device further includes a third determining unit, configured to determine that the test result information is "login failure count exceeded" if, after a predetermined number of tests, the returned test result information is different from the correct information and also different from each of the error information in the multiple types of error information.

[0100] Optionally, the device further includes: an identification unit for identifying the graphic verification code through a convolutional neural network model; and an acquisition unit for acquiring the SMS verification code through an SMS platform interface.

[0101] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0102] For example, such as Figure 5 As shown, the electronic device 500 includes a memory 501 and a processor 502. The memory 501 stores executable program code 5011, and the processor 502 is used to call and execute the executable program code 5011 to perform a method for login brute-force testing.

[0103] This embodiment can divide the electronic device into functional modules according to the above method example. For example, each module can correspond to a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0104] When each functional module is divided according to its corresponding function, the electronic device may include: a determining unit, a detonation unit, a comparison unit, etc. It should be noted that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0105] The electronic device provided in this embodiment is used to execute the above-described login brute-force test method, and therefore can achieve the same effect as the above-described implementation method.

[0106] When using integrated units, the electronic device may include a processing module and a storage module. The processing module is used to control and manage the operation of the electronic device. The storage module is used to support the execution of program code and data by the electronic device.

[0107] The processing module may be a processor or a controller, which can implement or execute various exemplary logic blocks, modules, and circuits as disclosed in this application. The processor may also be a combination of computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and microprocessors, etc., and the storage module may be a memory.

[0108] This embodiment also provides a computer-readable storage medium storing computer program code. When the computer program code is run on a computer, the computer executes the above-described related method steps to implement a login brute-force test method in the above embodiment.

[0109] This embodiment also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned steps to implement a login brute-force test method as described in the above embodiment.

[0110] In addition, the electronic device provided in the embodiments of this application may specifically be a chip, component or module. The electronic device may include a connected processor and a memory. The memory is used to store instructions. When the electronic device is running, the processor may call and execute the instructions to make the chip execute a login blasting test method in the above embodiments.

[0111] In this embodiment, the electronic device, computer-readable storage medium, computer program product or chip are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects of the corresponding methods provided above, and will not be repeated here.

[0112] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0113] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0114] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of logging a blast test, characterized by, The method comprises: determining a form element corresponding to a form of a login-bombing page; performing login bombing based on element information of the constructed form element; comparing test result information returned in the login bombing process with preset multi-type error information, the preset multi-type error information being error information returned upon login failure; if the test result information and the error information are both different and the test result information is the same as correct information returned upon login success, determining that the login bombing is successful; wherein, before the comparing of the test result information returned in the login bombing process with the preset multi-type error information, the method further comprises: capturing code information returned by a server in the login bombing process through a listener; parsing the code information to obtain the test result information; wherein, the determining of the form element corresponding to the form of the login-bombing page comprises: determining form elements corresponding to forms of a plurality of login-bombing pages in each of a plurality of browsers; wherein, the performing of login bombing based on the element information of the constructed form element comprises: if the form element has a plurality of account types, determining an account dictionary corresponding to each of the plurality of account types; constructing element information corresponding to the form element based on the account dictionary corresponding to each of the plurality of account types; performing login bombing based on the constructed element information of the form element.

2. The method of claim 1, wherein, The method further comprises: after a predetermined number of tests, if the returned test result information is different from the correct information and different from each of the multi-type error information, determining that the test result information is a login failure number exceeding a limit.

3. The method of any one of claims 1-2, wherein, The preset multi-type error information comprises at least two of an incorrect username, an incorrect password, incorrect username and password, an incorrect image verification code, an incorrect short message verification code, and a login failure number exceeding a limit.

4. The method of claim 1, wherein, The form element comprises a graphic verification code and a short message verification code, and the method further comprises: identifying the graphic verification code through a convolutional neural network model; obtaining the short message verification code through a short message platform interface.

5. A log-on blast testing device characterized by, The device comprises: a first determining unit configured to determine a form element corresponding to a form of a login-bombing page; a bombing unit configured to perform bombing based on element information of the constructed form element; a comparison unit configured to compare test result information returned in the bombing process with preset multi-type error information; a second determining unit configured to determine that the login bombing is successful if the test result information and the error information are both different and the test result information is the same as correct information returned upon login success; wherein, the login bombing testing device further comprises: a capturing unit configured to capture code information returned by a server in the login bombing process through a listener; a parsing unit configured to parse the code information to obtain the test result information; wherein, the first determining unit is configured to determine form elements corresponding to forms of a plurality of login-bombing pages in each of a plurality of browsers. The explosion unit is configured to: if the form element has multiple account types, determine an account dictionary corresponding to each account type; construct element information corresponding to the form element based on the account dictionary corresponding to each account type; and perform login explosion based on the constructed element information of the form element.

6. The log-on blast testing device of claim 5, wherein, The login explosion testing device further includes: A third determination unit is configured to, after a predetermined number of tests, determine that the test result information is a login failure number exceeding a limit if the returned test result information is different from the correct information and different from each of the multiple types of error information.

7. The log-on blast testing device of any one of claims 5 to 6, wherein, The preset multiple types of error information include at least two of an incorrect username, an incorrect password, incorrect username and password, an incorrect image verification code, an incorrect short message verification code, and a login failure number exceeding a limit.

8. The log-on blast testing device of claim 5, wherein, The form element includes a graphical verification code and a short message verification code, and the login explosion testing device further includes: An identification unit is configured to identify the graphical verification code by using a convolutional neural network model. An acquisition unit is configured to acquire the short message verification code by using a short message platform interface.

9. An electronic device, comprising: The electronic device includes: A memory configured to store executable program code; A processor configured to call and run the executable program code from the memory, so that the electronic device performs the method of any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, which, when executed, implements the method of any one of claims 1 to 4.

Images