Application program vulnerability detection method and device, storage, product and storage medium
By hijacking user page requests and comparing front-end page information, the problem of slow vulnerability detection response and low accuracy in the prior art is solved, and fast and accurate vulnerability detection and patching is achieved, improving the security of the application.
Patent Information
- Application Number
- CN202411330298.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-23
- Publication Date
- 2025-01-03
AI Technical Summary
In the prior art, application vulnerability detection depends on the perspective of external attackers, and has slow response speed and low accuracy, making it difficult to quickly detect and repair brute-force vulnerabilities.
By hijacking the user's page request, obtain the front-end page information when the application responds to the page request, compare it with the cracked vulnerability detection rules, determine whether the application has vulnerabilities, and obtain context information based on the front-end instrumentation to improve detection accuracy and response. efficiency.
It realizes fast and accurate vulnerability detection, and can promptly detect and patch brute-force vulnerabilities in applications, improving detection efficiency and accuracy.
Smart Images
Figure CN119254481A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the computer field, and more specifically, to a method, device, storage, product and storage medium for detecting application program vulnerabilities in the computer field. Background Art
[0002] After the application is launched and used by users, it faces problems such as repeated login attempts and brute force cracking, unauthorized access to the system, etc. Therefore, the application needs to be tested during the application development process to determine whether the application has vulnerabilities that are easy to be cracked by brute force, so as to prompt the development engineer to find and solve the vulnerabilities in time. In the prior art, it is often used to test whether the application has vulnerabilities by simulating the attack behavior of external attackers, but it depends on the perspective of external attackers and needs to be discovered after security scanning. The perspective has limitations and the response speed is slow. It is necessary to provide a vulnerability detection method that responds quickly and has a high accuracy rate. Summary of the invention
[0003] The present application provides a method, device, storage, product and storage medium for detecting application vulnerabilities. The method can obtain the front-end page information when the application responds to the page request, and judge whether the application has a vulnerability by comparing with the cracked vulnerability detection rules. The context information for the page request and the information in the front-end page are obtained based on the front-end instrumentation to improve the detection accuracy, and the judgment is made according to each page request to improve the response efficiency.
[0004] In a first aspect, a method for detecting application vulnerabilities is provided, the method comprising: monitoring a front-end page of an application, hijacking a user's page request for the front-end page;
[0005] Obtaining front-end page information when the application responds to the page request;
[0006] If the page request and the front-end page information match the crack vulnerability detection rule, vulnerability prompt information for the application is output, and the crack vulnerability detection rule is used to determine whether the application has a crack vulnerability.
[0007] In a second aspect, an application vulnerability detection device is provided, the device comprising:
[0008] A hijacking processing unit, used to monitor the front-end page of the application program and hijack the user's page request for the front-end page;
[0009] A front-end information acquisition unit, used to acquire the front-end page information when the application responds to the page request;
[0010] A vulnerability prompt unit is used to output vulnerability prompt information for the application if the page request and the front-end page information match a cracking vulnerability detection rule, and the cracking vulnerability detection rule is used to determine whether the application has a cracking vulnerability.
[0011] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.
[0012] In a fourth aspect, an embodiment of the present application provides a computer program product, which stores a plurality of instructions suitable for being loaded by a processor and executing the above-mentioned method steps.
[0013] In a fifth aspect, an embodiment of the present application provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.
[0014] In one or more embodiments of the present application, the front-end page of the application is monitored, the user's page request for the front-end page is hijacked, and the front-end page information when the application responds to the page request is obtained. If the page request and the front-end page information do not match the cracked vulnerability detection rules, the vulnerability prompt information for the application is output. By obtaining the front-end page information when the application responds to the page request, it is judged whether the application has a vulnerability by comparing it with the cracked vulnerability detection rules, and the context information for the page request and the information in the front-end page are obtained based on the front-end plug-in to improve the detection accuracy, and the judgment is made according to each page request, thereby improving the response efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 This is a system architecture diagram of an application vulnerability detection provided by an embodiment of the present application;
[0016] Figure 2 It is a flowchart of an application vulnerability detection method provided by an embodiment of the present application;
[0017] Figure 3 It is a flowchart of an application vulnerability detection method provided by an embodiment of the present application;
[0018] Figure 4 This is an example schematic diagram of an insertion module implantation provided in an embodiment of the present application;
[0019] Figure 5 It is a structural diagram of an application vulnerability detection device provided in an embodiment of the present application;
[0020] Figure 6 It is a structural diagram of an application vulnerability detection device provided in an embodiment of the present application;
[0021] Figure 7 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0022] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.
[0023] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.
[0024] The application vulnerability detection device provided in the embodiment of the present application can be an application or an electronic device installed with the application, or it can be an insertion module in the application for executing the application vulnerability detection method. It is understandable that if the application vulnerability detection device is an application or an electronic device, the relevant staff or development engineer can use the application vulnerability detection device to implant the insertion module for executing the application vulnerability detection method into all the front-end pages of the application. Please refer to Figure 1 , a system architecture diagram of application vulnerability detection is provided for an embodiment of the present application. The application is installed in an electronic device. The application may include one or more front-end pages. The application vulnerability detection device may be an insertion module that inputs the front-end page. It can be understood that the implanted insertion module may be to only add specific code snippets or instructions to the source code so as to collect information, monitor program behavior or modify program behavior when the program is executed. Therefore, the application vulnerability detection device monitors and collects various information during the execution of the application front-end.
[0025] Among them, the front-end page can be an interface for users to interact with the application, and the front-end page can present the information and functions of the application through various elements and layouts, so that users can browse content and perform operations. The application in the embodiment of the present application can be an application in the development process and the testing process, and the user interacting with the application can be a user authorized to participate in the testing process, or an engineer who develops and tests the application. The user can interact with the application through the front-end page, for example, the user can send a page request to the application through the front-end page, and the page request can be an account login request, or an information viewing request or a link access request, etc. For example, if the front-end page is an account login interface, a "login" button can be displayed in the front-end page, and the user can send an account login request to the application by clicking the "login" button. If the front-end page is an information display page, information such as pictures or jump links can be displayed in the front-end page, and the user can click on the picture to send an information viewing request for viewing a clear large picture, or click on the jump link to send a link access request to view the corresponding page of the jump link.
[0026] It is understandable that, whether it is an account login request or an information viewing request, the user's page request often indicates that the user wants to obtain or view more information through the application, and the acquisition and viewing of information requires certain permissions, such as the correct account password is required to open the corresponding account page to view account-related information. However, when the application is officially launched for users to use, they need to face problems such as repeated attempts to log in and other brute force cracking, unauthorized access to the system to obtain private information, etc. The application should have the ability to prevent brute force cracking. If the application cannot prevent or detect brute force cracking, it can be determined that the application has a brute force cracking vulnerability, and the application needs to be repaired by the relevant development engineer. The application vulnerability detection device is to monitor the front end of the application during the development and testing process of the application, when the user authorized to participate in the testing process or the engineer who develops and tests the application uses the application, to determine whether the application has a cracking vulnerability.
[0027] Since the application vulnerability detection device can monitor the front-end page of the application, it can detect the user's page request for the front-end page and hijack the page request, thereby obtaining the relevant information of the page request and monitoring how the application responds to the page request. It can be understood that when the application responds to the page request, the front-end page information will be generated, and the front-end page information can be used to reflect how the application responds to the page request and the operations performed on the front-end when responding. For example, when the page request is a login request, the application can display a verification window on the front-end page. The verification window can be a window that instructs the user to enter a verification code, so as to determine whether the user's page request is operated by a real person. The application vulnerability detection device can obtain cracking vulnerability detection rules for the application from a remote server. The cracking vulnerability detection rules are used to determine whether the application has a cracking vulnerability. The cracking vulnerability detection rules can be set based on how the application without a brute force cracking vulnerability should respond to the page request. For example, the application without a brute force cracking vulnerability should detect whether the page request contains a user identifier, detect whether the page request contains a user identification key, display a verification window for the page request, or obtain the user's interactive information. Therefore, the crack vulnerability detection rules may include not detecting whether the page request contains a user identifier, not detecting whether the page request contains a user identification key, not displaying a verification window for the page request, or not obtaining user interaction information, etc. The remote server may be a cloud server or a server cluster, and a rule database may exist in the remote server, which stores crack vulnerability detection rules for all applications.
[0028] The application vulnerability detection device can determine whether the application has a cracking vulnerability by comparing page requests, front-end page information and cracking vulnerability detection rules. If the application has a brute force cracking vulnerability, the application vulnerability detection device can output vulnerability prompt information for the application to prompt development and testing engineers to patch the brute force cracking vulnerability of the application.
[0029] The application vulnerability detection method provided by the present application is described in detail below in conjunction with specific embodiments.
[0030] See also Figure 2 , which is a flowchart of a method for detecting application program vulnerabilities according to an embodiment of the present application. Figure 2 As shown, the method of the embodiment of the present application may include the following steps S102-S106.
[0031] S102, monitoring the front-end page of the application program, hijacking the user's page request for the front-end page.
[0032] Specifically, the application vulnerability detection device can be a plug-in module implanted in the front-end page of the application. The application vulnerability detection device can monitor the front-end page of the application. It can be understood that there can be multiple front-end pages of the application, and each front-end page can be implanted with a plug-in module, so the application vulnerability detection device can monitor all the front-end pages of the application. When the application vulnerability detection device detects a page request sent by a user for a front-end page, the page request can be hijacked to obtain relevant information of the page request and monitor how the application responds to the page request.
[0033] S104, obtaining the front-end page information when the application responds to the page request.
[0034] Specifically, when an application responds to a page request, front-end page information is generated. The front-end page information can be used to reflect how the application responds to the page request and the operations performed on the front-end when responding. For example, when the page request is a login request, the application can display a verification window on the front-end page. The verification window can be a window that instructs the user to enter a verification code, thereby determining whether the user's page request is operated by a real person. Since the application vulnerability detection device can monitor the front-end page, it can obtain the front-end page information when the application responds to the page request.
[0035] S106: If the page request and the front-end page information match the vulnerability detection rule, output vulnerability prompt information for the application.
[0036] Specifically, the application vulnerability detection device can compare the page request and the front-end page information with the crack vulnerability detection rules. The crack vulnerability detection rules are used to determine whether the application has a crack vulnerability. For example, the crack vulnerability detection rules may include not detecting whether the page request contains a user identifier, not detecting whether the page request contains a user identification key, not displaying a verification window for the page request, or not obtaining the user's interactive information, etc. If the page request and the front-end page information match the crack vulnerability detection rules, that is, the application has the behavior included in the crack vulnerability detection rules, it means that the application has not judged whether the page request is a brute force crack operation for the page request, or cannot distinguish whether the page request is a brute force crack operation. The application vulnerability detection device can output vulnerability prompt information for the application to prompt development and testing engineers to patch the brute force crack vulnerability of the application.
[0037] In the embodiment of the present application, the front-end page of the application is monitored, the user's page request for the front-end page is hijacked, and the front-end page information when the application responds to the page request is obtained. If the page request and the front-end page information match the cracked vulnerability detection rules, the vulnerability prompt information for the application is output. By obtaining the front-end page information when the application responds to the page request, it is judged whether the application has a vulnerability by comparing it with the cracked vulnerability detection rules, and the context information for the page request and the information in the front-end page are obtained based on the front-end plug-in to improve the detection accuracy, and the judgment is made according to each page request, thereby improving the response efficiency.
[0038] See also Figure 3 , provides a schematic diagram of a process for detecting application program vulnerabilities in an embodiment of the present application. Figure 3 As shown, the method of the embodiment of the present application may include the following steps S202-S214.
[0039] S202: If it is detected that the application is running for the first time, a rule acquisition request is sent to a remote server.
[0040] Specifically, the application vulnerability detection device can be a plug-in module implanted in the front-end page of the application. The application vulnerability detection device can monitor the front-end page of the application. It is understandable that the application can have multiple front-end pages, and a plug-in module can be implanted in each front-end page. When the application vulnerability detection device detects that the application is running and is running for the first time, it can send a rule acquisition request to the remote server. The rule acquisition request is used to obtain the plug-in rules for the application from the remote server. The plug-in rules are used to instruct the application vulnerability detection device how to perform plug-in processing on the front-end page of the application. For example, the plug-in rules may include crack vulnerability detection rules and request hijacking rules, wherein the request hijacking rule is used to determine which page requests are hijacked, and the crack vulnerability detection rule is used to determine whether the application has a crack vulnerability. The remote server can be a cloud server or a server cluster. There can be a rule database in the remote server, and the rule database stores the plug-in rules for all applications.
[0041] Optionally, storing the plugging rules in the remote server can facilitate the development and testing engineers to save and update the plugging rules. All applications can directly obtain the plugging rules from the remote server, without the need for development and testing engineers and other staff to enter the plugging rules into the application vulnerability detection device in all applications in turn, thereby improving the efficiency of obtaining the plugging rules. It is understandable that with the development progress of the application, the plugging rules may also need to be updated, so the development and testing engineers and other staff can also directly update the plugging rules in the remote server. In order to be able to use the latest plugging rules to detect the application, if the application vulnerability detection device detects that the application is running, it sends an update request to the cloud server. The update request can be used to obtain update information for the plugging rules from the remote server. After the remote server receives the update request, it can obtain update information for the plugging rules. The update information is used to update the plugging rules previously saved by the application vulnerability detection device to the latest plugging rules. After the application vulnerability detection device obtains the update information returned by the remote server based on the update request, it can use the update information to update the plugging rules.
[0042] Optionally, if the remote server detects that the instrumentation rules for the application have not been updated after receiving the update request, the remote server may not respond to the update request.
[0043] Optionally, developers and test engineers can use front-end templates when developing front-end pages. Front-end templates are used to provide the basic code framework of front-end pages. Developers and test engineers can add different functions and elements based on the front-end templates to generate front-end pages for different purposes. Please also refer to Figure 4 , an example schematic diagram of the implantation of a plug-in module is provided for an embodiment of the present application. The application vulnerability detection device can be a plug-in module installed on the front-end template, or the application vulnerability detection device can implant the plug-in module on the front-end template. The staff can develop the front-end page of the application based on the front-end template containing the plug-in module, thereby generating front-end pages with different functions, such as front-end page A, front-end page B, front-end page C, etc., so that the plug-in module exists on all front-end pages of the application, and the application vulnerability detection device can also monitor all front-end pages of the application.
[0044] S204, obtaining the instrumentation rules returned by the remote server based on the rule acquisition request.
[0045] Specifically, the application vulnerability detection device can obtain the plug-in rules returned by the remote server based on the rule acquisition request, wherein the plug-in rules can include cracking vulnerability detection rules and request hijacking rules.
[0046] Optionally, crack vulnerability detection rules are used to determine whether an application has a crack vulnerability, and may include how an application without a brute force crack vulnerability should respond to a page request. For example, the crack vulnerability detection rules may include not detecting whether a page request contains a user identifier, not detecting whether a page request contains a user identification key, not displaying a verification window for a page request, or not obtaining user interaction information. Among them, the user identifier may be an access key (Access Key ID, AK), the user identification key may be a secret access key (Secret AccessKey, SK), AK may be used to identify the user, and is a unique identifier associated with the user identification key, SK may be a key used to encrypt the user identifier and to verify the user identifier. It is understandable that the page request should include a user identifier and a user identification key to verify the user's identity and protect data privacy.
[0047] The verification window can be a window that instructs the user to enter a verification code, so as to determine whether the user's page request is operated by a real person. The user's interaction information is the interaction information between the user and the front-end page before and after sending the page request, which may include the frequency and location of the user's mouse clicks on the front-end page. The user's interaction information can also be used to determine whether the user's page request is operated by a real person.
[0048] S206, monitoring the front-end page of the application.
[0049] Specifically, the application vulnerability detection device can monitor the front-end page of the application, monitor the front-end page opened by the application and the content displayed on the front-end page in real time, and detect whether the user sends a page request for the front-end page.
[0050] S208, detecting a page request from a user for a front-end page, and hijacking the page request if the page request matches a request hijacking rule.
[0051] Specifically, when the application vulnerability detection device detects a page request sent by a user for a front-end page, the page request can be hijacked to obtain relevant information about the page request and monitor how the application responds to the page request. However, not all page requests from users need to be judged as brute force operations. For example, if the user's page request is only used to request the application to display a clear large image, the application vulnerability detection device may not hijack the page request. The application vulnerability detection device may only hijack page requests involving brute force operations and access to private data. When the application vulnerability detection device detects a page request from a user for a front-end page, it can determine whether the page request matches the request hijacking rule. If the page request matches the request hijacking rule, the page request is hijacked.
[0052] It can be understood that the request hijacking rules are used to determine which page requests to hijack. For example, the request hijacking rules are used to instruct the application vulnerability detection device to hijack page requests for accessing system data. For example, if the page request is a login request, since the login request is used to log in to an account to view account data, the login request matches the request hijacking rules, and the application vulnerability detection device can hijack the login request.
[0053] S210, obtaining front-end page information when the application responds to the page request.
[0054] Specifically, when an application responds to a page request, front-end page information is generated. The front-end page information can be used to reflect how the application responds to the page request and the operations performed on the front-end when responding. For example, when the page request is a login request, the application can display a verification window on the front-end page. The verification window can be a window that instructs the user to enter a verification code, thereby determining whether the user's page request is operated by a real person. Since the application vulnerability detection device can monitor the front-end page, it can obtain the front-end page information when the application responds to the page request.
[0055] Optionally, if the front-end page is a login page and the page request is a login request, the application vulnerability detection device can determine, based on the crack vulnerability detection rule, whether the page request in the front-end page information of the application contains a user identifier and a user identification key. If not, it means that the front-end page information matches the crack vulnerability detection rule. The application vulnerability detection device can also determine whether a verification window is displayed for the page request in the front-end page information. If not, it means that the front-end page information matches the crack vulnerability detection rule. The application vulnerability detection device can also determine whether the user's interactive information is obtained in the front-end page information. If not, it means that the front-end page information matches the crack vulnerability detection rule.
[0056] Optionally, the cracking vulnerability detection rules may also include whether the account number and account password are included in the undetected page request. The application vulnerability detection device may determine, based on the cracking vulnerability detection rules, whether the front-end page information of the application has detected whether the page request contains the account number and account password. If not, it means that the front-end page information matches the cracking vulnerability detection rules.
[0057] S212: If the page request and the front-end page information match the vulnerability detection rule, the traffic characteristics and operation flow of the page request are obtained.
[0058] Specifically, the application vulnerability detection device can compare the page request and the front-end page information with the crack vulnerability detection rules. The crack vulnerability detection rules are used to determine whether the application has a crack vulnerability, and can include how the application without a brute force crack vulnerability should respond to the page request. For example, the crack vulnerability detection rules can include not detecting whether the page request contains a user identifier, not detecting whether the page request contains a user identification key, not displaying a verification window for the page request, or not obtaining the user's interactive information, etc. If the page request and the front-end page information match the crack vulnerability detection rules, that is, the application has the behavior included in the crack vulnerability detection rules, it means that the application has not judged whether the page request is a brute force crack operation for the page request, or cannot distinguish whether the page request is a brute force crack operation. The application vulnerability detection device can determine that the application has a brute force crack vulnerability and can obtain the traffic characteristics and operation process of the page request.
[0059] Among them, the traffic characteristics of page requests may include the frequency, source, time interval, etc. of page requests, and the operation process may include the interaction between the user and the front-end page when entering the page request, such as the location of the mouse click, the time of entering the account and password, etc. It can be understood that the traffic characteristics and operation process of page requests can be used to determine whether the page request is a brute force cracking operation. For example, if the frequency of page requests is too high and the source is single, the time interval is short, and the mouse click position is messy, it may be that the script is repeatedly making page requests and trying to log in without permission, and the page request may be a brute force cracking operation.
[0060] S214, uploading the traffic characteristics, operation process, front-end page information and vulnerability prompt information to the remote server.
[0061] Specifically, the application vulnerability detection device can upload traffic characteristics, operation procedures, front-end page information and vulnerability prompt information to a remote server. The vulnerability prompt information is used to prompt development and testing engineers to patch the brute force cracking vulnerabilities of the application. The traffic characteristics and operation procedures can help development and testing engineers further determine whether the page request is a brute force cracking operation, and perform targeted patches on the brute force cracking vulnerabilities of the application based on the page request.
[0062] Optionally, if the front-end page information does not match the cracking vulnerability detection rules, that is, the application does not have any behavior in the cracking vulnerability detection rules, and the application determines that the page request is a non-cracking operation, and the non-cracking operation means that the application determines that the page request is a normal user manual request operation, and there is no brute force cracking operation such as unauthorized login, then the application vulnerability detection device can obtain the traffic characteristics and operation process of the page request. If the application vulnerability detection device determines that the page request is a cracking operation based on the traffic characteristics and operation process, that is, it determines that the page request may be a brute force cracking operation of repeatedly performing page requests to attempt unauthorized login, then the application vulnerability detection device may also upload the traffic characteristics, operation process, front-end page information and vulnerability prompt information to the remote server.
[0063] In an embodiment of the present application, if it is detected that the application is running for the first time, a rule acquisition request is sent to the remote server to obtain the plugging rules returned by the remote server based on the rule acquisition request, and the plugging rules are saved in the remote server to improve the acquisition efficiency of the plugging rules, and an update request can be sent when the application is started to obtain the update information of the plugging rules, thereby ensuring the timeliness of the plugging rules and further improving the accuracy of vulnerability detection. And the plugging target can be implanted in the front-end template to improve the efficiency of implanting the plugging module into the front-end page, avoiding the existence of missed front-end pages. The front-end page of the application is monitored and processed, and the user's page request for the front-end page is detected. If the page request matches the request hijacking rule, the page request is hijacked to avoid meaningless hijacking operations and thus improve the efficiency of vulnerability detection. The front-end page information when the application responds to the page request is obtained. If the page request and the front-end page information match the cracked vulnerability detection rule, the traffic characteristics and operation process of the page request are obtained, and the traffic characteristics, operation process, front-end page information and vulnerability prompt information are uploaded to the remote server. By obtaining the front-end page information when the application responds to the page request, it is judged whether the application has a vulnerability compared with cracking the vulnerability detection rules. The context information for the page request and the information in the front-end page are obtained based on the front-end instrumentation to improve the detection accuracy, and judgment is made based on each page request to improve the response efficiency. The traffic characteristics and operation processes can also assist the staff to carry out targeted repairs to the application vulnerabilities.
[0064] The following will be combined with the attached Figure 5 -Attached Figure 6 , the application vulnerability detection device provided by the embodiment of the present application is introduced in detail. It should be noted that the attached Figure 5 -Attached Figure 6 The application vulnerability detection device in the present invention is used to execute the application Figure 1-Figure 4 For the convenience of explanation, only the part related to the embodiment of the present application is shown. For the specific technical details not disclosed, please refer to the present application. Figure 1-Figure 4 The embodiment shown.
[0065] See also Figure 5 , which shows a schematic diagram of the structure of an application vulnerability detection device provided by an exemplary embodiment of the present application. The application vulnerability detection device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes a hijacking processing unit 11, a front-end information acquisition unit 12 and a vulnerability prompt unit 13.
[0066] The hijacking processing unit 11 is used to monitor the front-end page of the application program and hijack the user's page request for the front-end page;
[0067] The front-end information acquisition unit 12 is used to acquire the front-end page information when the application responds to the page request;
[0068] The vulnerability prompt unit 13 is used to output vulnerability prompt information for the application if the page request and the front-end page information match the cracking vulnerability detection rule, and the cracking vulnerability detection rule is used to determine whether the application has a cracking vulnerability.
[0069] In the embodiment of the present application, the front-end page of the application is monitored, the user's page request for the front-end page is hijacked, and the front-end page information when the application responds to the page request is obtained. If the page request and the front-end page information match the cracked vulnerability detection rules, the vulnerability prompt information for the application is output. By obtaining the front-end page information when the application responds to the page request, it is judged whether the application has a vulnerability by comparing it with the cracked vulnerability detection rules, and the context information for the page request and the information in the front-end page are obtained based on the front-end plug-in to improve the detection accuracy, and the judgment is made according to each page request, thereby improving the response efficiency.
[0070] See also Figure 6, which shows a schematic diagram of the structure of an application vulnerability detection device provided by an exemplary embodiment of the present application. The application vulnerability detection device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes an instrumentation rule acquisition unit 14, an update request unit 15, a hijacking processing unit 11, a front-end information acquisition unit 12, a vulnerability prompt unit 13 and an error detection prompt unit 16.
[0071] The instrumentation rule acquisition unit 14 is used to send a rule acquisition request to a remote server if it is detected that the application is running for the first time, wherein the rule acquisition request is used to acquire instrumentation rules for the application from the remote server;
[0072] The insertion rule returned by the remote server based on the rule acquisition request is obtained, and the insertion rule includes a vulnerability detection rule.
[0073] An update request unit 15, configured to send an update request to the remote server if it is detected that the application is running, wherein the update request is used to obtain update information for the instrumentation rule from the remote server;
[0074] The update information returned by the remote server based on the update request is obtained, and the update information is used to update the instrumentation rule.
[0075] The hijacking processing unit 11 is used to monitor the front-end page of the application program and hijack the user's page request for the front-end page;
[0076] Optionally, the instrumentation rule may also include a request hijacking rule;
[0077] The hijacking processing unit 11 is specifically used to detect a page request from a user for the front-end page;
[0078] If the page request matches the request hijacking rule, the page request is hijacked.
[0079] Optionally, the crack vulnerability detection rule includes one or more of not detecting whether the page request contains a user identifier, not detecting whether the page request contains a user identification key, not displaying a verification window for the page request, or not obtaining interaction information of the user.
[0080] The front-end information acquisition unit 12 is used to acquire the front-end page information when the application responds to the page request;
[0081] The vulnerability prompt unit 13 is used to output vulnerability prompt information for the application if the page request and the front-end page information match the cracking vulnerability detection rule, and the cracking vulnerability detection rule is used to determine whether the application has a cracking vulnerability.
[0082] Optionally, the vulnerability prompt unit 13 is specifically used to obtain the traffic characteristics and operation process of the page request if the page request and the front-end page information match the cracking vulnerability detection rule;
[0083] The traffic characteristics, the operation process, the front-end page information and the vulnerability prompt information are uploaded to the remote server.
[0084] The error detection prompt unit 16 is used to obtain the traffic characteristics and operation process of the page request if the page request and the front-end page information do not match the cracking vulnerability detection rule, and the application determines that the page request is a non-cracking operation;
[0085] If the page request is determined to be a cracking operation based on the traffic characteristics and the operation process, the traffic characteristics, the operation process, the front-end page information and the vulnerability prompt information are uploaded to the remote server.
[0086] In an embodiment of the present application, if it is detected that the application is running for the first time, a rule acquisition request is sent to the remote server to obtain the plugging rules returned by the remote server based on the rule acquisition request, and the plugging rules are saved in the remote server to improve the acquisition efficiency of the plugging rules, and an update request can be sent when the application is started to obtain the update information of the plugging rules, thereby ensuring the timeliness of the plugging rules and further improving the accuracy of vulnerability detection. And the plugging target can be implanted in the front-end template to improve the efficiency of implanting the plugging module into the front-end page, avoiding the existence of missed front-end pages. The front-end page of the application is monitored and processed, and the user's page request for the front-end page is detected. If the page request matches the request hijacking rule, the page request is hijacked to avoid meaningless hijacking operations and thus improve the efficiency of vulnerability detection. The front-end page information when the application responds to the page request is obtained. If the page request and the front-end page information match the cracked vulnerability detection rule, the traffic characteristics and operation process of the page request are obtained, and the traffic characteristics, operation process, front-end page information and vulnerability prompt information are uploaded to the remote server. By obtaining the front-end page information when the application responds to the page request, it is judged whether the application has a vulnerability compared with cracking the vulnerability detection rules. The context information for the page request and the information in the front-end page are obtained based on the front-end instrumentation to improve the detection accuracy, and judgment is made based on each page request to improve the response efficiency. The traffic characteristics and operation processes can also assist the staff to carry out targeted repairs to the application vulnerabilities.
[0087] It should be noted that the application vulnerability detection device provided in the above embodiment only uses the division of the above functional modules as an example when executing the application vulnerability detection method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the application vulnerability detection device provided in the above embodiment and the application vulnerability detection method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.
[0088] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.
[0089] The present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1-Figure 4 The application vulnerability detection method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 4 The specific description of the illustrated embodiment will not be repeated here.
[0090] The present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1-Figure 4 The application vulnerability detection method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 4 The specific description of the illustrated embodiment will not be repeated here.
[0091] Please refer to Figure 7 , which shows a block diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. The electronic device in the present application may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.
[0092] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the terminal 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user pages, and applications; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.
[0093] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable medium (Non-Transitory Computer-Readable Storage Medium). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems.
[0094] The memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, the requirements for system resources in different application scenarios in the same third-party application are also different. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and third-party applications are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.
[0095] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.
[0096] The input device 130 is used to receive input commands or data, and includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is used to output commands or data, and includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screen displays.
[0097] The touch display screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in the embodiments of the present application.
[0098] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module and other components, which will not be described in detail here.
[0099] exist Figure 7 In the electronic device shown, the processor 110 can be used to call the application vulnerability detection application stored in the memory 120, and specifically perform the following operations:
[0100] Monitor the front-end page of the application and hijack the user's page request for the front-end page;
[0101] Obtaining front-end page information when the application responds to the page request;
[0102] If the page request and the front-end page information match the crack vulnerability detection rule, vulnerability prompt information for the application is output, and the crack vulnerability detection rule is used to determine whether the application has a crack vulnerability.
[0103] In one embodiment, the processor 110 further performs the following operations before performing monitoring processing on the front-end page of the application program and hijacking the user's page request for the front-end page:
[0104] If it is detected that the application is running for the first time, a rule acquisition request is sent to a remote server, wherein the rule acquisition request is used to acquire an instrumentation rule for the application from the remote server;
[0105] The insertion rule returned by the remote server based on the rule acquisition request is obtained, and the insertion rule includes a vulnerability detection rule.
[0106] In one embodiment, the instrumentation rules may also include request hijacking rules;
[0107] When executing the hijacking of the user's page request for the front-end page, the processor 110 specifically performs the following operations:
[0108] Detecting a page request from a user for the front-end page;
[0109] If the page request matches the request hijacking rule, the page request is hijacked.
[0110] In one embodiment, when executing the application vulnerability detection method, the processor 110 further performs the following operations:
[0111] If it is detected that the application is running, an update request is sent to the remote server, wherein the update request is used to obtain update information for the instrumentation rule from the remote server;
[0112] The update information returned by the remote server based on the update request is obtained, and the update information is used to update the instrumentation rule.
[0113] In one embodiment, the vulnerability detection rule includes one or more of not detecting whether the page request contains a user identifier, not detecting whether the page request contains a user identification key, not displaying a verification window for the page request, or not obtaining the user's interaction information.
[0114] In one embodiment, when the processor 110 outputs vulnerability prompt information for the application program if the page request and the front-end page information do not match the vulnerability detection rule, the processor 110 specifically performs the following operations:
[0115] If the page request and the front-end page information match the cracking vulnerability detection rule, the traffic characteristics and operation process of the page request are obtained;
[0116] The traffic characteristics, the operation process, the front-end page information and the vulnerability prompt information are uploaded to the remote server.
[0117] In one embodiment, when executing the application vulnerability detection method, the processor 110 further performs the following operations:
[0118] If the page request and the front-end page information do not match the cracking vulnerability detection rule, and the application determines that the page request is a non-cracking operation, then obtain the traffic characteristics and operation process of the page request;
[0119] If the page request is determined to be a cracking operation based on the traffic characteristics and the operation process, the traffic characteristics, the operation process, the front-end page information and the vulnerability prompt information are uploaded to the remote server.
[0120] In an embodiment of the present application, if it is detected that the application is running for the first time, a rule acquisition request is sent to the remote server to obtain the plugging rules returned by the remote server based on the rule acquisition request, and the plugging rules are saved in the remote server to improve the acquisition efficiency of the plugging rules, and an update request can be sent when the application is started to obtain the update information of the plugging rules, thereby ensuring the timeliness of the plugging rules and further improving the accuracy of vulnerability detection. And the plugging target can be implanted in the front-end template to improve the efficiency of implanting the plugging module into the front-end page, avoiding the existence of missed front-end pages. The front-end page of the application is monitored and processed, and the user's page request for the front-end page is detected. If the page request matches the request hijacking rule, the page request is hijacked to avoid meaningless hijacking operations and thus improve the efficiency of vulnerability detection. The front-end page information when the application responds to the page request is obtained. If the page request and the front-end page information match the cracked vulnerability detection rule, the traffic characteristics and operation process of the page request are obtained, and the traffic characteristics, operation process, front-end page information and vulnerability prompt information are uploaded to the remote server. By obtaining the front-end page information when the application responds to the page request, it is judged whether the application has a vulnerability compared with cracking the vulnerability detection rules. The context information for the page request and the information in the front-end page are obtained based on the front-end instrumentation to improve the detection accuracy, and judgment is made based on each page request to improve the response efficiency. The traffic characteristics and operation processes can also assist the staff to carry out targeted repairs to the application vulnerabilities.
[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.
[0122] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.
[0123] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the page requests and traffic characteristics involved in this specification are all obtained with full authorization.
Claims
1. A method for detecting application program vulnerabilities, the method comprising: Monitor the front-end page of the application and hijack the user's page request for the front-end page; Obtaining front-end page information when the application responds to the page request; If the page request and the front-end page information match the crack vulnerability detection rule, vulnerability prompt information for the application is output, and the crack vulnerability detection rule is used to determine whether the application has a crack vulnerability.
2. According to the method of claim 1, before the monitoring process of the front-end page of the application program and hijacking the user's page request for the front-end page, the method further comprises: If it is detected that the application is running for the first time, a rule acquisition request is sent to a remote server, wherein the rule acquisition request is used to acquire an instrumentation rule for the application from the remote server; The insertion rule returned by the remote server based on the rule acquisition request is obtained, and the insertion rule includes a vulnerability detection rule.
3. According to the method of claim 2, the instrumentation rule may further include a request hijacking rule; The hijacking of the user's page request for the front-end page includes: Detecting a page request from a user for the front-end page; If the page request matches the request hijacking rule, the page request is hijacked.
4. The method according to claim 2, further comprising: If it is detected that the application is running, an update request is sent to the remote server, wherein the update request is used to obtain update information for the instrumentation rule from the remote server; The update information returned by the remote server based on the update request is obtained, and the update information is used to update the instrumentation rule.
5. According to the method described in claim 1, the vulnerability detection rules include one or more of not detecting whether the page request contains a user identifier, not detecting whether the page request contains a user identification key, not displaying a verification window for the page request, or not obtaining the user's interaction information.
6. The method according to claim 2, wherein if the page request and the front-end page information match the vulnerability detection rule, outputting vulnerability prompt information for the application program comprises: If the page request and the front-end page information match the cracking vulnerability detection rule, the traffic characteristics and operation process of the page request are obtained; The traffic characteristics, the operation process, the front-end page information and the vulnerability prompt information are uploaded to the remote server.
7. The method according to claim 6, further comprising: If the page request and the front-end page information do not match the cracking vulnerability detection rule, and the application determines that the page request is a non-cracking operation, then obtain the traffic characteristics and operation process of the page request; If the page request is determined to be a cracking operation based on the traffic characteristics and the operation process, the traffic characteristics, the operation process, the front-end page information and the vulnerability prompt information are uploaded to the remote server.
8. An application vulnerability detection device, the device comprising: A hijacking processing unit, used to monitor the front-end page of the application program and hijack the user's page request for the front-end page; A front-end information acquisition unit, used to acquire the front-end page information when the application responds to the page request; A vulnerability prompt unit is used to output vulnerability prompt information for the application if the page request and the front-end page information match a cracking vulnerability detection rule, and the cracking vulnerability detection rule is used to determine whether the application has a cracking vulnerability.
9. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 7.
10. A computer program product, wherein the computer program product stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 7.
11. An electronic device, comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 7.