Interface request playback method and device, medium and electronic equipment

Abstract

The embodiment of the invention provides an interface request playback method and device, a computer readable medium and electronic equipment, and the method comprises the steps: obtaining request record data of an interface request for a target interface, the request record data comprising a plurality of request parameters; visually displaying elements corresponding to the request record data in a first display interface; when an element configuration instruction is received, one or more labels corresponding to each request parameter in the request record data are determined, and the labels are used for representing the types of the corresponding request parameters; performing parameter variation operation according to a parameter variation rule defined for the label corresponding to each request parameter to obtain a varied parameter value of each request parameter; and when a replay instruction is received, generating a new interface request based on the varied parameter value of each request parameter, and sending the new interface request to the target interface. According to the embodiment of the invention, the safety test can be effectively carried out, the test efficiency is improved, and the cost is saved.

Description

Technical Field

[0001] The present application relates to the technical field of interface detection, and in particular to a method, device, computer-readable medium and electronic device for replaying an interface request. Background Art

[0002] Interface security testing is the process of discovering and fixing potential security vulnerabilities and risks by testing interfaces to ensure the security and stability of applications or systems. It is of great significance in protecting data security, improving application reliability, preventing attacks and vulnerability exploits, etc.

[0003] Replay of interface requests is an important part of interface security testing, which involves the modification of request parameters.

[0004] However, in existing solutions, when replaying interface requests, the modification of request parameters is heavily dependent on personnel's understanding of the business, requiring testers to invest a lot of time and energy to understand the business, which is inefficient and costly. If testers do not have sufficient business understanding, they cannot modify the parameters to be effectively used for interface security testing, and the security testing cannot play its role. Summary of the invention

[0005] The embodiments of the present application provide a method, device, computer-readable medium and electronic device for replaying an interface request, thereby improving test efficiency and saving costs while effectively performing security testing, at least to a certain extent.

[0006] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0007] According to one aspect of an embodiment of the present application, a method for replaying an interface request is provided, the method comprising: obtaining request record data of an interface request for a target interface, the request record data comprising a number of request parameters; visually displaying an element corresponding to the request record data in a first display interface, the element displaying a portion of the content in the request record data; upon receiving a configuration instruction for the element, determining one or more tags corresponding to each request parameter in the request record data, the tags being used to characterize the type of the corresponding request parameter; performing a parameter mutation operation according to a parameter mutation rule defined for the tag corresponding to each request parameter to obtain a mutated parameter value for each request parameter; upon receiving a replay instruction, generating a new interface request based on the mutated parameter value for each request parameter, and sending the new interface request to the target interface.

[0008] According to one aspect of an embodiment of the present application, a replay device for an interface request is provided, the device comprising: an acquisition unit, for acquiring request record data of an interface request for a target interface, the request record data comprising a number of request parameters; a visualization unit, for visually displaying an element corresponding to the request record data in a first display interface, the element displaying a portion of the content in the request record data; a determination unit, for determining one or more tags corresponding to each request parameter in the request record data upon receiving a configuration instruction for the element, the tags being used to characterize the type of the corresponding request parameter; a mutation unit, for performing a parameter mutation operation according to a parameter mutation rule defined for the tag corresponding to each request parameter to obtain a mutated parameter value of each request parameter; and a generation unit, for generating a new interface request based on the mutated parameter value of each request parameter upon receiving a replay instruction, and sending the new interface request to the target interface.

[0009] In some embodiments of the present application, based on the aforementioned scheme, the label includes an account label, and the determination unit is configured to: when receiving a configuration instruction for the element, determine the label corresponding to each request parameter in the request record data; display a second display interface, and visually display the label corresponding to each request parameter in the second display interface; the mutation unit is configured to: according to the parameter mutation rule defined for the account label corresponding to the target request parameter, obtain and display several original mutated account numbers corresponding to the account label; when receiving a selection instruction for a target original mutated account number among the original mutated account numbers, use the target original mutated account number as the mutated parameter value of the target request parameter.

[0010] In some embodiments of the present application, based on the aforementioned scheme, the visualization unit is configured to: determine the request type corresponding to the request record data; identify the sensitive information in the request record data according to the sensitive information rule corresponding to the request type, and determine the sensitive fields corresponding to each sensitive information; visually display the elements corresponding to the request record data in the first display interface, and display the sensitive fields in the elements.

[0011] In some embodiments of the present application, based on the aforementioned solution, the acquisition unit is configured to: receive an original network data packet uploaded locally from a user terminal, and extract request record data of an interface request for a target interface from the original network data packet.

[0012] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a content editing unit; after the step of visually displaying the element corresponding to the request record data in the first display interface, the content editing unit is used to: when a trigger instruction for the element is received, display the complete content of the request record data in the first display interface, the complete content includes a request address, original login status information, a request data packet and a return data packet, the original login status information is used to verify the identity of the requester when making a request, and the request data packet includes several request parameters; according to the editing operation of the complete content, the edited complete content is obtained; when a replay instruction is received, based on the edited complete content, a new interface request is generated, and the new interface request is sent to the target interface.

[0013] In some embodiments of the present application, based on the aforementioned scheme, the request address, login status information and request data packet are all editable parts, and the return data packet is a non-editable part. The content editing unit is configured to: display an edit box when receiving an editing instruction for a specified editable part in the complete content; obtain the edited content through the edit box, and replace the specified editable part with the edited content to obtain the edited complete content.

[0014] In some embodiments of the present application, based on the aforementioned scheme, the content editing unit is configured as follows: when receiving a replacement instruction for the original login state information in the complete content, the original login state information is replaced with the target login state information indicated by the replacement instruction to obtain the edited complete content.

[0015] In some embodiments of the present application, based on the aforementioned scheme, the mutation unit is configured as follows: performing parameter mutation operations according to parameter mutation rules defined for tags corresponding to each request parameter to obtain a number of mutated parameter values ​​corresponding to each request parameter; combining the several mutated parameter values ​​corresponding to each request parameter to obtain multiple groups of mutated parameter values, each group of mutated parameter values ​​including a mutated parameter value corresponding to each request parameter; for each group of mutated parameter values, determining the pairwise combination results of all mutated parameter values ​​in the group of mutated parameter values, and deleting the group of mutated parameter values ​​if the pairwise combination results are included in the same position of other groups of mutated parameter values; the generation unit is configured as follows: when a replay instruction is received, generating a new interface request based on the remaining set of mutated parameter values ​​each time, and sending the new interface request to the target interface.

[0016] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a comparison unit; when a replay instruction is received, a new interface request is generated each time based on the remaining set of mutated parameter values, and the new interface request is sent to the target interface, the comparison unit is used to: for each new interface request, generate a replay request record corresponding to the new interface request according to the new interface request and the response content returned by the target interface according to the new interface request; when a comparison instruction is received, compare at least a portion of the replay request records corresponding to at least two new interface requests, and visually display the comparison results.

[0017] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for replaying an interface request as described in the above embodiment is implemented.

[0018] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for replaying the interface request as described in the above embodiments.

[0019] According to one aspect of an embodiment of the present application, a computer program product is provided, which includes computer instructions, wherein the computer instructions are stored in a computer-readable storage medium, a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method for replaying the interface request as described in the above embodiments.

[0020] In the technical solutions provided in some embodiments of the present application, the request record data of the interface request for the target interface is first obtained, and then the request record data is parsed, and the elements corresponding to the request record data are visually displayed in the first display interface, and the elements will display part of the content in the request record data, so that the user can intuitively see the relevant information of the interface request for the target interface; then, when the configuration instruction for the element is received, the label corresponding to each request parameter in the request record data is determined, and each label is pre-defined with a corresponding parameter variation rule; next, for each request parameter, the parameter variation operation is performed according to the parameter variation rule pre-defined for the corresponding label, and the corresponding mutated parameter value can be obtained; finally, when a replay instruction is received, a new interface request is generated based on the mutated parameter values ​​of each request parameter, so that the interface request can be replayed. Since the label corresponds to the request parameter and is used to characterize the type of the corresponding request parameter, and the parameter mutation rule is defined for the label, the parameter mutation operation based on the parameter mutation rule can more effectively and accurately complete the modification of the request parameter, thereby realizing effective security testing; at the same time, the whole process no longer depends on the tester's understanding of the business, and the tester no longer needs to invest a lot of time and energy to understand the business, which can improve the testing efficiency and the use cost of the whole system is low.

[0021] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0023] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied;

[0024] Figure 2 A flowchart of a method for replaying an interface request according to an embodiment of the present application is shown;

[0025] Figure 3 A system framework flow chart according to an embodiment of the present application is shown;

[0026] Figure 4 An embodiment according to the present application is shown. Figure 2 A flowchart of the details of step 210 in an embodiment;

[0027] Figure 5 An embodiment according to the present application is shown. Figure 2 A flowchart of the details of step 220 in an embodiment;

[0028] Figure 6 A schematic diagram showing the principle of sensitive information detection and unauthorized detection according to the present application is shown;

[0029] Figure 7 A schematic diagram of an interface for real-time request list summary according to the present application is shown;

[0030] Figure 8 A flowchart showing steps after the step of visually displaying elements corresponding to the requested record data in a first display interface according to the present application;

[0031] Fig. 9 An embodiment according to the present application is shown. Figure 8 A flowchart of the details of step 820 in an embodiment;

[0032] Fig.10 A schematic diagram of an interface of an editing box according to an embodiment of the present application is shown;

[0033] Fig.11 Another embodiment according to the present application is shown. Figure 8 A flowchart of the details of step 820 in an embodiment;

[0034] Fig.12 A schematic diagram of the principle of parameter identification analysis according to the present application is shown;

[0035] Fig.13 An embodiment according to the present application is shown. Figure 2 A flowchart of the details of step 230 and step 240 in the embodiment;

[0036] Fig.14 A schematic diagram of a second display interface according to an embodiment of the present application is shown;

[0037] Fig.15 A schematic diagram of an interface for selecting an account based on an enterprise account tag according to an embodiment of the present application is shown;

[0038] Fig.16 A schematic diagram of an interface showing mutated parameter values ​​corresponding to fixed value labels according to an embodiment of the present application is shown;

[0039] Fig.17 A schematic diagram of an interface of a parameter rule workspace according to an embodiment of the present application is shown;

[0040] Fig.18 A schematic diagram of an interface showing a playback request according to an embodiment of the present application is shown;

[0041] Fig.19 An embodiment according to the present application is shown. Figure 2 A flowchart of the details of step 240 and step 250 in the embodiment;

[0042] Fig. 20 A schematic diagram of an interface in which a parameter combination according to an embodiment of the present application is one combination is shown;

[0043] Fig.21 A schematic diagram of an interface showing all parameter combinations according to an embodiment of the present application is shown;

[0044] Fig. 22 A schematic diagram of an interface for orthogonal dimension reduction of parameters according to an embodiment of the present application is shown;

[0045] Fig.23 A schematic diagram of an interface showing the number of combinations after orthogonal dimension reduction of parameters according to an embodiment of the present application;

[0046] Fig.24 A schematic diagram of an interface for comparing returned content according to an embodiment of the present application is shown;

[0047] Fig.25 A block diagram of a playback device for an interface request according to an embodiment of the present application is shown;

[0048] Fig.26 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0049] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0050] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the present application.

[0051] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0052] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0053] In the related art, when performing security testing on the backend interface, the current manual testing solution usually requires the use of a packet capture tool. This method collects the requests sent by the client to the packet capture software (such as Fiddler software and Charles software) by setting up a proxy. After that, you need to select the request you want to pay attention to, double-click to select the parameters for editing, and replay to observe the results.

[0054] However, this approach has the following drawbacks:

[0055] 1. Traffic aggregation is highly disruptive, making it difficult to accurately select requests that require attention and difficult to adjust parameters. This makes the operation steps complicated, lacks an integrated platform, and has high operating costs.

[0056] 2. Unable to detect sensitive information in time, request to return redundant sensitive information, need to check the returned packages one by one.

[0057] 3. For situations where timely operations are required, such as when the login status or cookie expires, the operation of replaying the request is almost ineffective in integrating the login status or cookie. At this point, all requests have expired and cannot be replayed.

[0058] 4. It depends largely on the personnel's understanding of the entire business, which leads to low efficiency and high cost of use. Since the testers do not have sufficient understanding of the business, it is difficult to modify the parameters in a targeted and purposeful manner when replacing parameters, which will result in too many invalid parameters and make it difficult to play the role of security testing. In addition, there will be a large number of combinations between parameters, and a large amount of replayed data will not only waste traffic, but also have a certain impact on the backend system.

[0059] 5. There is no unified standard after replay, and each record needs to be opened before and after for manual comparison. It is impossible to compare before and after in a centralized manner, and it is impossible to compare the differences with one click.

[0060] To this end, the present application first provides a method for replaying an interface request. The replay of an interface request refers to: resending an interface request sent to a certain interface to the interface. The parameters in the resent interface request may be different from the parameters in the original interface request. The method for replaying an interface request provided in the embodiment of the present application can overcome the above-mentioned defects and at least achieve the following technical effects:

[0061] 1. Rapidly collect traffic: Relevant operation request traffic can be quickly imported in a short time to quickly conduct interface security testing.

[0062] 2. Preprocess traffic: The traffic can be preprocessed in real time, and sensitive information can be highlighted in real time according to business configuration to provide the best test results.

[0063] 3. Visual editing and replay: It provides visual editing and replay verification solutions for different parts, including login status, headers, and request packets, making it easier to edit and replay the corresponding network traffic during the test.

[0064] 4. Rapid unauthorized access detection: Provide various accounts for different levels, scenarios and identities. Each account obtains the latest login status based on the business process to perform unauthorized access detection.

[0065] 5. Variation parameter combination: Combine business parameter information to quickly construct business-related parameters and expand various parameter combinations. Through orthogonal dimensionality reduction, the interface can be covered more specifically at the lowest cost, allowing for more comprehensive testing.

[0066] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiment of the present application can be applied is shown. Figure 1 As shown, the system architecture 100 may include an interface requester terminal 110, a cloud 120, an interface server 130, and a user terminal 140. Communication connections are established between the cloud 120 and the interface requester terminal 110, between the interface server 130 and the cloud 120, and between the cloud 120 and the user terminal 140. The user terminal 140 is installed with a browser, and the interface server 130 provides an accessible interface to the outside. The cloud 120 is the execution subject of the embodiment of the present application, and the interface replay security scanning platform provided by the embodiment of the present application is deployed thereon. When a replay method for an interface request provided by the present application is applied to Figure 1In the system architecture shown, a process may be as follows: first, the interface requester terminal 110 sends an interface request to the interface server 130, and then the interface replay security scanning platform in the cloud 120 intercepts the interface request; then, the user logs in and accesses the interface replay security scanning platform in the cloud 120 through the browser of the user terminal 140, and sees the first display interface of the interface replay security scanning platform, which displays a row of request records corresponding to the interface request and a corresponding configuration button, and the row of request records includes at least part of the request record data of the interface request; when the user clicks the configuration button, the interface replay security scanning platform displayed in the browser will be displayed. The second display interface of the scanning platform visually displays several labels corresponding to each request parameter of the interface request, and the labels are obtained by the interface replay security scanning platform through parameter analysis of the interface request; then, the interface replay security scanning platform in the cloud 120 performs parameter mutation operations for the parameter mutation rules pre-defined for each label, and uses the mutated parameter values ​​obtained for each label as the new parameter values ​​of the request parameters corresponding to the corresponding labels; finally, when the user uses a browser to click the replay button in a certain interface of the interface replay security scanning platform, the cloud 120 will re-initiate an interface request to the interface provided by the interface server 130 based on the new parameter values ​​of the request parameters.

[0067] In some embodiments of the present application, when a user double-clicks a row of request records corresponding to the interface request, the complete data in the interface request will be displayed.

[0068] In some embodiments of the present application, a row of request records corresponding to each of the multiple interface requests is displayed in the first display interface.

[0069] In some embodiments of the present application, the interface replay security scanning platform will identify sensitive information of the response content in the request record data of the interface request, and determine the label corresponding to the sensitive information. The corresponding label will be displayed in the corresponding request record displayed on the first display interface.

[0070] It should be understood that Figure 1 The number of interface requester terminals, cloud, interface servers, and user terminals in the embodiment is only illustrative. According to the implementation requirements, there may be any number of interface requester terminals, cloud, interface servers, and user terminals, that is, both the interface requester terminals and the user terminals may be multiple, and the interface server may be a server cluster composed of multiple servers.

[0071] It should be noted that Figure 1 The embodiment shown is only one embodiment of the present application. Figure 1In the solution of the embodiment, the interface service is set in a single server, and the cloud outside the server is the execution subject of the embodiment of the present application, but in other embodiments of the present application, the interface service and the execution subject are both located in the cloud; although in Figure 1 In the embodiment, the interface requester terminal 110 and the user terminal 140 are both computers, but in other embodiments of the present application, the user terminal and the interface requester terminal may also be various types of terminal devices such as laptop computers, desktop computers, tablet computers, vehicle-mounted terminals, portable wearable devices, workstations, etc., and the interface requester terminal may even be a server; Figure 1 In the solution of the embodiment, the cloud obtains the request record data by intercepting the interface request, but in other embodiments of the present application, the cloud can also obtain the request record data by receiving the network data packet uploaded by the user. The embodiment of the present application does not make any limitation to this, and the protection scope of the present application should not be limited in any way.

[0072] It is easy to understand that the interface request replay method provided in the embodiment of the present application is generally executed by the server, and accordingly, the interface request replay device is generally set in the server. However, in other embodiments of the present application, the terminal device can also have similar functions as the server, so as to execute the interface request replay scheme provided in the embodiment of the present application.

[0073] Therefore, the embodiments of the present application can be applied to a terminal or a server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application is not limited here.

[0074] The solution of the embodiment of the present application can be applied to the field of cloud computing. Cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The network that provides resources is called a "cloud". The resources in the "cloud" are infinitely expandable in the eyes of users, and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0075] As a cloud computing basic capability provider, a cloud computing resource pool (referred to as a cloud platform, generally referred to as IaaS (Infrastructure as a Service)) will be established, and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0076] According to the logical function division, the PaaS (Platform as a Service) layer can be deployed on the IaaS (Infrastructure as a Service) layer, and the SaaS (Software as a Service) layer can be deployed on the PaaS layer. SaaS can also be deployed directly on IaaS. PaaS is a platform for software operation, such as databases, web containers, etc. SaaS is a variety of business software, such as web portals, SMS mass senders, etc. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0077] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0078] Figure 2 The flowchart of the interface request replay method according to an embodiment of the present application is shown. The interface request replay method can be executed by various devices capable of computing and processing, such as user terminals or cloud servers. User terminals include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, smart watches, etc. The interface request replay method can be applied to the interface replay security scanning platform, please refer to Figure 2 As shown, the replay method of the interface request at least includes the following steps:

[0079] In step 210, request record data of an interface request to a target interface is obtained, where the request record data includes several request parameters.

[0080] The target interface is the background interface that needs to be security tested, that is, the API (Application Programming Interface), which can be provided by the background server. The interface request to the target interface is the interface request that has been sent to the target interface, which can be various types of requests such as POST request and GET request. The request parameters are the parameters passed to the target interface when sending the interface request to the target interface.

[0081] Figure 3A system framework flow chart according to an embodiment of the present application is shown. Figure 3 The system framework shown is the system framework of the interface replay security scanning platform. Figure 3 As shown, the CI (Continuous Integration) process runs through the entire system framework. That is to say, when developing the interface replay security scanning platform, through continuous integration, it is possible to quickly iterate from one functional module to another, thereby efficiently realizing the development of the entire system framework. Figure 3 The first module shown is a traffic collection module, through which step 210 can be performed.

[0082] Figure 4 An embodiment according to the present application is shown. Figure 2 Flow chart of details of step 210 in the embodiment. Figure 4 As shown, obtaining the request record data of the interface request to the target interface may specifically include the following steps:

[0083] In step 210', an original network data packet uploaded locally from a user terminal is received, and request record data of an interface request for a target interface is extracted from the original network data packet.

[0084] The original network data packet can be generated in the following way: the user terminal initiates an interface request to the target interface in advance, and then generates the original network data packet according to the content of the interface request and the response content of the target interface to the interface request, and stores the original network data packet in the form of a file locally in the user terminal. Of course, the original network data packet can also be sent to the user terminal by other terminal devices, or it can be obtained by collecting the interface requests initiated by other terminal devices to the target interface and the corresponding response content.

[0085] In an embodiment of the present application, the user can directly upload the original network data packet locally, thereby more conveniently performing security testing of the interface.

[0086] In one embodiment of the present application, request record data of an interface request to a target interface is obtained, including: separately collecting the content of the interface request sent by a designated terminal device to the target interface and the response content returned by the target interface to the designated terminal device; and packaging the content of the interface request and the response content into request record data.

[0087] In the embodiment of the present application, the execution subject is allowed to import the request traffic in a proxy manner.

[0088] In step 220, an element corresponding to the requested record data is visually displayed in the first display interface, and the element displays part of the content in the requested record data.

[0089] The first display interface may be a web page, and the element is an object in the first display interface that can display specific content. The element may be a row of request records in the request record list, or may be other forms such as a card.

[0090] Figure 5 An embodiment according to the present application is shown. Figure 2 Flow chart of the details of step 220 in the embodiment. Figure 5 As shown, visually displaying elements corresponding to the requested record data in the first display interface may specifically include the following steps:

[0091] In step 221, the request type corresponding to the request record data is determined.

[0092] The corresponding request type can be determined by analyzing the request record data. It is easy to understand that the request type here is divided from the business perspective, and different businesses correspond to different request types. Specifically, the corresponding request type can be determined by analyzing the parameters in the request record data.

[0093] In step 222, according to the sensitive information rules corresponding to the request type, the sensitive information in the request record data is identified, and the sensitive fields corresponding to each sensitive information are determined.

[0094] Please continue to see Figure 3 As shown, the system framework also includes a sensitive information detection module.

[0095] For each request type, a corresponding sensitive information rule is pre-set. Specifically, the sensitive information rule is a regular expression, and the regular expression is constructed based on the characteristics of pre-defined sensitive information. In this way, the sensitive information in the request record data can be matched using a regular expression. The pre-defined sensitive information can be public sensitive information involved in various businesses, and also includes sensitive information such as mobile phone numbers, addresses, and email addresses returned by interface requests. The corresponding sensitive fields can be defined in advance for each sensitive information rule. Different sensitive information rules have different corresponding sensitive fields. When a sensitive information is identified using a certain sensitive information rule, the sensitive field corresponding to the sensitive information rule can be used as the sensitive field corresponding to the sensitive information.

[0096] Each sensitive information can correspond to one or more sensitive fields, and the sensitive information can be the same as the sensitive field.

[0097] In step 223, elements corresponding to the requested record data are visually displayed in the first display interface, and sensitive fields are displayed in the elements.

[0098] Sensitive fields can be displayed in the form of sensitivity labels.

[0099] The sensitive fields corresponding to the sensitive information in the corresponding request record data are displayed in the element. When displaying sensitive fields, the sensitive fields can be highlighted by bolding, changing the color, etc. This allows users to quickly understand whether there is sensitive information in the request record data and what type of sensitive information exists, providing a direction for subsequent interface security testing.

[0100] Figure 6 FIG. 1 shows a schematic diagram of the principle of sensitive information detection and unauthorized detection according to the present application. Figure 6 As shown, the principle of sensitive information detection is: obtain request traffic, match and filter it using sensitive rules, and highlight sensitive words based on the matching and filtering results.

[0101] Figure 7 A schematic diagram of an interface for summarizing a real-time request list according to the present application is shown. Figure 7 As shown, the interface of the real-time request list summary is the aforementioned first display interface, which shows a request record list containing multiple rows of request records, each row of request records is an element corresponding to one request record data, Figure 7 12 rows of request records are shown, each row of request records includes multiple columns of data such as request record serial number, request time, request link, suspected sensitive, request method, return code, etc. Among them, the suspected sensitive column is used to display sensitive fields. For example, "vid" is a sensitive field, that is, a sensitive label. Figure 7 The colors of sensitive fields are similar to other information, but are easy to understand and can be used in practice. Figure 7 In the solution of the embodiment shown, sensitive fields can also be highlighted in bright colors such as red. Figure 7 The data of each request record line is part of the displayed request record data. Figure 7 The input button shown can upload the original network data packet to the platform.

[0102] Figure 8 A flowchart of the steps following the step of visually displaying the elements corresponding to the requested record data in the first display interface according to the present application is shown. Figure 8 As shown, after the step of visually displaying the elements corresponding to the requested recording data in the first display interface, the method for replaying the interface request may further include the following steps:

[0103] In step 810, when a trigger instruction for an element is received, the complete content of the request record data is displayed in the first display interface. The complete content includes the request address, original login status information, request data packet and return data packet. The original login status information is used to verify the identity of the requester when making a request. The request data packet includes several request parameters.

[0104] In interface testing, we usually need to simulate the behavior of users logging into the system to ensure the correctness and stability of the login function.

[0105] The request address is the request link, that is, the request URL (Uniform Resource Locator).

[0106] The original login information is Cookie. The original login information is returned to the interface requester by the system providing the interface after the identity authentication of the interface requester is successful. The interface requester can verify the user identity in subsequent interface requests.

[0107] The request data packet includes a request body, which includes several request parameters. The return data packet includes a response body, which includes return data.

[0108] In step 820, the edited complete content is obtained according to the editing operation on the complete content.

[0109] Users can modify and edit part of the complete content. The interface replay security scanning platform supports secondary editing of interface requests and replay.

[0110] In one embodiment of the present application, the request address, login status information and request data packet are all editable parts, and the return data packet is a non-editable part.

[0111] In order to perform interface security testing, in some cases the interface request needs to be modified and then replayed. The returned data packet is the content returned by the target interface and cannot be modified.

[0112] Fig. 9 An embodiment according to the present application is shown. Figure 8 Flow chart of details of step 820 in the embodiment. Fig. 9 As shown, according to the editing operation on the complete content, obtaining the edited complete content may include the following steps:

[0113] In step 821, when an edit instruction for a designated editable portion of the complete content is received, an edit box is displayed.

[0114] Fig.10 FIG. 1 shows a schematic diagram of an interface of an edit box according to an embodiment of the present application. Fig.10As shown in the figure, when a user clicks or double-clicks a row of request records, a trigger instruction will be generated. When the interface replay security scanning platform receives the trigger instruction, it will display the complete content of the request record data. Fig.10 The complete content of the request record data with the request link home / home is shown, where the right side of the request URL, Cookie and request parameters contains a pen button, which means that this information can be edited. The pen button on the right side of the request parameters will display an edit box on the right side of the interface in a drawer manner, and display the original parameter values ​​corresponding to the current request parameters.

[0115] In step 822, the edited content is obtained through the edit box, and the designated editable part is replaced with the edited content to obtain the edited complete content.

[0116] Users can Fig.10 Enter the new parameter value in the edit box shown, and then click the Close button or the Save button ( Fig.10 The original parameter value will be replaced by the corresponding new parameter value. The cookie can contain a user ID. When the user edits the user ID in the cookie, a new login state can be obtained, and the new login state can be used to perform unauthorized detection.

[0117] Please continue to see Figure 3 As shown, the system framework also includes an edit-replay module, through which the interface request can be edited and then replayed.

[0118] In one embodiment of the present application, when an editing instruction for a specified editable part in the complete content is received, an editing box is displayed, including: when an editing instruction for a specified editable part in the complete content is received, the specified editable part in the complete content is formatted to obtain the specified editable part in a target format; the editing box is displayed, and the specified editable part in the target format is displayed in the editing box.

[0119] Formatting the specified editable part of the complete content means converting the specified editable part into the target format. For example, the data in the cookie are arranged in sequence from beginning to end. By formatting, the data can be displayed in separate lines in the edit box according to the target format. Users can intuitively understand the data, thereby improving the efficiency of content editing for users.

[0120] Fig.11 Another embodiment according to the present application is shown. Figure 8 Flow chart of details of step 820 in the embodiment. Fig.11 As shown, according to the editing operation on the complete content, the edited complete content is obtained, and the following steps may also be included:

[0121] In step 820', when a replacement instruction for the original login state information in the complete content is received, the original login state information is replaced with the target login state information indicated by the replacement instruction to obtain the edited complete content.

[0122] When replaying, a test account needs to be logged in, and the test account can be located in a cookie. The test account can be, for example, the aforementioned user ID. The embodiment of the present application can also directly replace the entire login state information.

[0123] Please continue to see Fig.10 For example, when a user clicks on Fig.10 The Replace Identity button on the left can display a test account list, which includes several other test accounts besides the current test account. When the user selects a test account, a new login status information will be temporarily generated based on the test account selected by the user. The user can compare the original login status information in the complete content with the new login status information; when the user confirms the button, a replacement instruction for the original login status information will be generated, which instructs the original login status information to be replaced with the new login status information, namely the target login status information.

[0124] In the embodiment of the present application, the entire login state information can be directly replaced, thereby providing an efficient data generation means for unauthorized detection, thereby quickly performing unauthorized detection.

[0125] Please continue to see Figure 3 As shown, the system framework also includes identity replacement and unauthorized access detection modules. Figure 6 As shown, by editing and modifying the login information, or by directly replacing other login information to replace the identity, the unauthorized detection can be verified. Unauthorized detection is the process of detecting whether user A can access data and attributes that only user B can access.

[0126] In one embodiment of the present application, the login status information that can be replaced by the user in the interface replay security scanning platform is related to the user's identity level in the interface replay security scanning platform and the service decision corresponding to the interface request for the target interface.

[0127] Specifically, users of different identity levels can see and replace different login status information. For example, users with the identity level of administrator and ordinary users are users of different identity levels. When users test interfaces for different business scenarios, the login status information they can see and replace may also be different.

[0128] In an embodiment of the present application, by constraining the login status information that can be replaced by the user from two dimensions: identity level and the business corresponding to the interface request, the validity of the replaced login status information is guaranteed, thereby improving the reliability of replay, and also ensuring the legality and security of the replay operation.

[0129] In one embodiment of the present application, after receiving a trigger instruction for an element and displaying the complete content of the requested recorded data in the first display interface, the interface request replay method further includes: when a replay instruction is received, resending the interface request to the target interface.

[0130] When the user clicks Fig.10 The replay button shown on the left will generate a replay instruction.

[0131] In the embodiment of the present application, the interface request of the target interface is not modified, and the interface request is simply directly replayed, which is not suitable for security verification of interface requests that can only be consumed once.

[0132] Please continue to see Figure 3 As shown, the system framework also includes a direct playback module, through which the functions of the embodiments of the present application can be implemented.

[0133] Please continue to see Figure 8 As shown, in step 830, when a replay instruction is received, a new interface request is generated based on the edited complete content, and the new interface request is sent to the target interface.

[0134] When the user clicks Fig.10 The replay button displayed on the left will generate a replay instruction and generate a new interface request according to the replay instruction. When the edited complete content contains the edited or replaced login state information, unauthorized detection can be performed by sending a new interface request to the target interface.

[0135] Please continue to see Figure 2 In step 230, when a configuration instruction for an element is received, one or more tags corresponding to each request parameter in the request record data are determined, and the tags are used to characterize the type of the corresponding request parameter.

[0136] When the user selects Figure 7 A row of request records is shown, and clicking the corresponding advanced configuration button (not shown) will determine the label corresponding to the request parameter.

[0137] Please continue to see Figure 3 As shown, the system framework also includes a parameter identification module, through which the label corresponding to the request parameter can be determined.

[0138] Fig.12A schematic diagram showing the principle of a parameter identification analysis according to the present application is shown. Fig.12 As shown, for the request interface parameters, the corresponding parameter labels can be obtained through the identification abstraction of the workspace.

[0139] A workspace can also be called a rule list, which is a set of predefined rules. Each predefined rule includes the label name of the label and the mapping rules between the label and the parameter. The mapping rules between the label and the parameter include parameter variation rules and label identification rules. The parameter variation rule is a pre-implemented parameter variation method. The label identification rule is used to identify the label corresponding to the request parameter. The label identification rule is set based on fuzzy testing theory. The labels corresponding to the same request parameter in different business scenarios can be different; the parameter variation rules defined for the same label in different business scenarios can be different, that is, what kind of label and parameter variation rules to use are also related to the business scenario.

[0140] The workspace can be built by collecting and organizing data from multiple system sources. The business attribute identifiers used in business scenarios can be used as request parameters that need to be labeled, common attributes such as phone, email, time, etc. can be used as request parameters that need to be labeled, data structure types such as integers and strings can be used as request parameters that need to be labeled, and request parameters that have historically caused security issues in interfaces can be used as request parameters that need to be labeled.

[0141] Fig.13 An embodiment according to the present application is shown. Figure 2 Flow chart of details of step 230 and step 240 in the embodiment. Fig.13 As shown, when a configuration instruction for an element is received, determining one or more tags corresponding to each request parameter in the request record data may specifically include the following steps:

[0142] In step 231, when a configuration instruction for an element is received, a label corresponding to each request parameter in the request record data is determined.

[0143] Based on the workspace described above, the request record data is analyzed to obtain labels corresponding to the request parameters.

[0144] In step 232, a second display interface is displayed, and labels corresponding to each request parameter are visually displayed in the second display interface.

[0145] Fig.14 FIG. 1 shows a schematic diagram of a second display interface according to an embodiment of the present application. Fig.14 As shown, when the user clicks the corresponding advanced configuration button for a row of request records, the Fig.14The second display interface shown in the figure can be used to complete the parameter analysis and identification function in the interface replay security scanning platform provided in the embodiment of the present application. Fig.14 The left part, Fig.14 The specific contents of the parameter analysis and identification functions that can be completed in the second display interface are as follows, wherein items (9)-(11) are not shown:

[0146] (1) Pre-request: Some requests require the cooperation of a pre-request to take effect. Here, you can use the + sign on the right to import a pre-request from the displayed list.

[0147] (2) Request URL: Generally no modification is required.

[0148] (3) Request method: The corresponding HTTP method, such as POST request or GET request. When POST request replay is supported, sliding the slider on the right can indicate whether the package body needs to be serialized.

[0149] (4) Number of parameters: obtained by analyzing the request body parameters.

[0150] (5) Parameter identification: Request body. From the nested combination of request bodies, each request parameter is taken out for detection and identification, and the label corresponding to each request parameter is displayed. Fig.14 The "numbers", "strings", etc. shown are labels.

[0151] (7) Parameter configuration: Following the principle of testing two-by-two combinations, dimensionality reduction configuration can be performed.

[0152] (6) Return data: response body.

[0153] (8) Post-request: Some requests require post-requests to delete test data or clean up. You can use the + sign on the right to import from the displayed list.

[0154] (9) Sensitive words: sensitive fields analyzed from the response body.

[0155] (10) Return verification: Repeat the request for the key-value pair that needs to be verified.

[0156] (11) Replay status: summarizes the replay status of the request.

[0157] In step 240, a parameter mutation operation is performed according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain a mutated parameter value of each request parameter.

[0158] Define the corresponding parameter mutation rules for each tag in advance, and the corresponding parameter mutation rules defined for different tags can be different. If you do not need to use the mutated parameter value obtained by mutation of the parameter mutation rule, you can also customize the parameter value according to the tag.

[0159] Performing a parameter mutation operation is the process of obtaining a new parameter value as the mutated parameter value. There are various specific ways to perform a parameter mutation operation. For example, the mutation can be performed based on the original request parameters in the request record data, or based on the default parameters defined for the tag.

[0160] For example, for a string tag, the parameter mutation rules defined for it may include: range deletion, range insertion, range copying, bitwise mutation, byte mutation, random swap, arithmetic operation mutation, etc., where range deletion is to randomly delete a part of the original string; range insertion is to randomly insert a string into the original string; range copying is to randomly copy a content from other strings and insert it into the original string; bitwise mutation is to randomly select a bit from the original string and replace it in the ASCII character set; byte mutation is to mutate or operate with a random number in the range (0, 255); random swap is to randomly swap two bits in the original string; arithmetic operation mutation is to perform arithmetic +1 or -1 operation on a random bit from the original string. Each time a parameter mutation is performed, any one or more of the above parameter mutation rules may be used for mutation.

[0161] Please continue to see Figure 3 As shown, the system framework also includes a parameter generation module, through which the mutated parameter values ​​of the request parameters can be generated.

[0162] Please continue to see Fig.12 As shown, the obtained parameter tag can be an account tag, a general tag or a business tag, and each tag has a corresponding parameter variation method.

[0163] In one embodiment of the present application, the tag includes an account tag.

[0164] Please continue to see Fig.13 As shown, performing a parameter mutation operation according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain a mutated parameter value of each request parameter may specifically include the following steps:

[0165] In step 241, according to the parameter mutation rule defined for the account tag corresponding to the target request parameter, a number of original mutated accounts corresponding to the account tag are obtained and displayed.

[0166] The original mutated account may be an account that the platform has pre-collected and organized for account labels.

[0167] Fig.15 A schematic diagram of an interface for selecting an account based on an enterprise account tag according to an embodiment of the present application is shown. Fig.15 As shown, the enterprise account label is a type of account label. When the user clicks the enterprise account label, a pop-up window will be displayed, which will display a certain original mutated account, the name of the target interface fuc=1, and a selection box; when the user clicks the selection box, the original mutated account list will be displayed, which contains several original mutated accounts corresponding to the account label.

[0168] In step 242, when a selection instruction for a target original mutated account number among the original mutated account numbers is received, the target original mutated account number is used as the mutated parameter value of the target request parameter.

[0169] When the user clicks on an original mutated account in the list of original mutated accounts, it specifies which original mutated account to use to complete the corresponding logical process of fuc=1. Specifically, after the user selects an original mutated account, when the user requests to replay the interface request, the platform will obtain the latest login status information based on the original mutated account, and then construct a new interface request carrying the latest login status information based on the interface fuc=1. The return value format of the new interface request is the same as the return value format of the original interface request, but it is a return value obtained based on other identities.

[0170] Fig.16 A schematic diagram of an interface showing mutated parameter values ​​corresponding to fixed value labels according to an embodiment of the present application is shown.

[0171] See also Fig.16 As shown, when the user clicks on a fixed value label, a pop-up window will be displayed, which will show that the mutated parameter value corresponding to the fixed value label is 123, which is obtained based on the original parameter value mutation according to the parameter mutation rule.

[0172] Fig.17 FIG. 1 shows a schematic diagram of an interface of a parameter rule workspace according to an embodiment of the present application. Fig.17 As shown, it is a rule list, each line is a parameter mutation rule, which contains the rule update time, rule name, rule description information, default value, number of uses and other information, among which the default value can be the default value based on which the parameter mutation is performed, and the number of uses is the number of times the parameter is mutated using the parameter mutation rule.

[0173] Please continue to see Figure 2As shown, in step 250, when a replay instruction is received, a new interface request is generated based on the mutated parameter values ​​of each request parameter, and the new interface request is sent to the target interface.

[0174] Sending a new interface request to the target interface is the process of actually performing security testing on the interface.

[0175] Fig.18 A schematic diagram of an interface showing a playback request according to an embodiment of the present application is shown. Fig.14 After the interface shown receives the playback command, Fig.14 The right part of the page shown will automatically refresh to obtain Fig.18 The interface shown shows the replay request record obtained for each interface replay request. Fig.18 The slider shown can switch between displaying abnormal (suspicious) replay request records and full replay request records.

[0176] In one embodiment of the present application, the method further includes: based on an archiving instruction from a user, storing the playback request record indicated by the archiving instruction locally.

[0177] After the tester has verified the replay request record, he can mark the test status of the current interface and archive the replay request record, which can facilitate subsequent tracing and classification and provide support for other R&D processes.

[0178] Fig.19 An embodiment according to the present application is shown. Figure 2 Flow chart of details of step 240 and step 250 in the embodiment. Fig.19 As shown, the parameter mutation operation is performed according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain the mutated parameter value of each request parameter, and the following steps may also be included:

[0179] In step 243, a parameter mutation operation is performed according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain a number of mutated parameter values ​​corresponding to each request parameter.

[0180] Fig. 20 FIG. 1 shows an interface schematic diagram of a parameter combination according to an embodiment of the present application as one combination. Fig. 20 As shown, if the labels corresponding to the request parameters are removed and the original parameter values ​​of the request parameters are directly used, then there is only one combination of all parameter values.

[0181] As mentioned above, the solution of the embodiment of the present application can determine one or more tags for each request parameter, and a number of mutated parameter values ​​can be mutated based on the parameter mutation rules corresponding to each tag. Therefore, when replaying, each request parameter corresponds to at least one mutated parameter value, or even multiple mutated parameter values.

[0182] Assuming there are three request parameters A, B, and C, we can get several mutated parameter values ​​a1, a2, and a3 corresponding to request parameter A, several mutated parameter values ​​b1, b2, and b3 corresponding to request parameter B, and several mutated parameter values ​​c1 and c2 corresponding to request parameter C.

[0183] In step 244, a plurality of mutated parameter values ​​corresponding to each request parameter are combined to obtain a plurality of groups of mutated parameter values, each group of mutated parameter values ​​including a mutated parameter value corresponding to each request parameter.

[0184] Although when manpower and time permit, the principle of single variable is generally used for combination to control variables, and when a problem occurs, it is easy to determine which variable value caused the problem. However, the single variable combination method is inefficient and time-consuming. Moreover, this method is not suitable for a wide range of application scenarios.

[0185] Fig.21 Schematic diagram of the interface of all parameter combinations according to an embodiment of the present application is shown. Fig.21 As shown, there are 8 parameters in total, some of which have multiple labels. The number of cross-combinations of mutated parameters constructed based on these labels exceeds 670,000. Obviously, many of the interface requests based on these cross-combination parameters are invalid requests, and a large number of invalid requests will have an impact on the background service.

[0186] In the above embodiment, 18 groups of mutated parameter values ​​can be obtained through combination, which are: 1, (a1, b1, c1); 2, (a2, b1, c1); 3, (a3, b1, c1); 4, (a1, b2, c1); 5, (a1, b3, c1); 6, (a2, b2, c1); 7, (a2, b3, c1); 8, (a3, b2, c1); 9, (a3, b3, c1); 10. (a1, b1, c2); 11. (a2, b1, c2); 12. (a3, b1, c2); 13. (a1, b2, c2); 1 4. (a1, b3, c2); 15. (a2, b2, c2); 16. (a2, b3, c2); 17. (a3, b2, c2); 18. (a3, b3, c2).

[0187] In step 245, for each group of mutated parameter values, the pairwise combination results of all mutated parameter values ​​in the group are determined, and if the same positions of other groups of mutated parameter values ​​contain pairwise combination results, the group of mutated parameter values ​​is deleted.

[0188] For example, the pairwise combinations of the mutated parameter values ​​(a1, b1, c1) can be a1 and b1, a1 and c1, and b1 and c1. Since a1 and b1 appear at the same position in the 10th group, a1 and c1 appear at the same position in the 4th and 5th groups, and b1 and c1 appear at the same position in the 2nd and 3rd groups, the mutated parameter values ​​(a1, b1, c1) can be discarded.

[0189] The solution of the embodiment of the present application abandons the method of single variable combination. By introducing the above method, all possible two-by-two combinations can be considered in as few test cases as possible to find defects that only appear in specific combinations, and cross-dependencies can be found between the mutated parameter values ​​to fundamentally reduce the number of test cases while ensuring the largest possible test coverage. Therefore, this method can greatly reduce the time and cost of testing and development work.

[0190] Fig. 22 Schematic diagram of the interface of parameter orthogonal dimensionality reduction according to an embodiment of the present application is shown. Fig. 22 As shown, the value of the request parameter r can be 1, 2, 3, and the value of the request parameter sid can be A, B, C respectively. When the user clicks the conversion button in the interface, the orthogonal dimension reduction of the parameters will be performed by the method provided in the above embodiment. Fig. 22 There are only two request parameters involved, so there is no obvious dimensionality reduction effect.

[0191] In practical applications, it is considered that there may be constraints between parameters and they cannot be combined arbitrarily. For example, when the value of parameter A is 1, the value of parameter B is required to be 2 or within a specific range. Therefore, when a request parameter takes a specific value, the value range of at least one other request parameter can be constrained, thereby further enhancing the dimensionality reduction effect.

[0192] Please continue to see Figure 3 As shown, the system framework also includes a parameter dimension reduction module.

[0193] Fig.23 The interface diagram shows the number of combinations after orthogonal dimension reduction of parameters according to an embodiment of the present application. Fig.23As shown, after the dimensionality reduction operation is performed by the method provided in the embodiment of the present application, the valid combinations of request parameters are reduced from 640,000 to 290, which can greatly shorten the replay time of the interface request while ensuring the validity of the parameter combination.

[0194] Please continue to see Fig.19 As shown, when a replay instruction is received, a new interface request is generated based on the mutated parameter values ​​of each request parameter, and the new interface request is sent to the target interface, which may specifically include the following steps:

[0195] In step 250 ′, when a replay instruction is received, a new interface request is generated each time based on the remaining set of mutated parameter values, and the new interface request is sent to the target interface.

[0196] Please continue to see Fig.18 As shown in the figure, after executing the replay operation, the replay results of all new interface requests are displayed in Fig.18 In the interface shown.

[0197] In one embodiment of the present application, when a replay instruction is received, a new interface request is generated each time based on the remaining set of mutated parameter values, and the new interface request is sent to the target interface, the method further includes: for each new interface request, based on the new interface request and the response content returned by the target interface according to the new interface request, generating a replay request record corresponding to the new interface request; when a comparison instruction is received, comparing at least a portion of the replay request records corresponding to at least two new interface requests, and visually displaying the comparison results.

[0198] When the user clicks Fig.18 The comparison button displayed in the operation row shown can compare at least a portion of the replay request records corresponding to the at least two new interface requests.

[0199] Fig.24 A schematic diagram of an interface for comparing returned content according to an embodiment of the present application is shown. Fig.24 As shown, the left and right sides show the response contents returned by the interface in the two replay request records, and the interface automatically highlights the differences between the two response contents, as shown in line 17 of the figure. In this way, the user obtains the test results of the interface security test.

[0200] Please continue to see Figure 3 As shown, the system framework also includes advanced configuration and replay comparison modules.

[0201] Since the embodiment of the present application performs multiple replays based on a combination of multiple request parameters, detecting the returned results of a batch will also incur a lot of costs. Therefore, the solution of the embodiment of the present application also proposes multiple automatic verification methods for the returned results, as follows:

[0202] 1. Use the return results of some replayed interface requests as request parameters of post-requests and continue to send post-requests; determine whether the return results of the replayed interface requests are valid by judging whether the post-requests can be sent normally.

[0203] 2. Get the status code in the returned result, compare it with the specified status code, and determine the validity of the returned result based on the comparison result. For example, if the status code in the returned result is -20002, it means that the permission is illegal.

[0204] 3. If the returned result contains an HTML page, it is preprocessed into an image, and then the similarity of the two images at the pixel level is compared to determine the similarity of the returned results.

[0205] 4. Performance: For the return results under abnormal conditions such as timeout, time consumption, and infinite loop, they are directly classified as abnormal returns.

[0206] Through the above-mentioned automated inspection solution, the system can greatly reduce the burden of manual inspection of return results, and discover and identify return results of abnormal requests more quickly and accurately.

[0207] In summary, according to the interface request replay method provided in the embodiment of the present application, the following beneficial effects can be achieved:

[0208] 1. Improve security: The platform can help detect and prevent attacks, identify and correct potential security vulnerabilities and risks, reduce the possibility of system attacks, and ensure interface security.

[0209] 2. Reduce repetitive work: By automatically replaying requests and scanning, you can reduce repetitive work, saving time and labor costs.

[0210] 3. Error detection: Provides detailed response result comparison function to facilitate the detection of problems and errors in the interface.

[0211] 4. Simplify testing: Simplify the testing process and testing work by assisting analysis and automating the request processing.

[0212] In summary, the fast and efficient interface replay security scanning platform technical solution provided in the embodiments of the present application can help users perform interface security testing and scanning more efficiently, improve security, reduce risks, and save time and costs.

[0213] The following describes an apparatus embodiment of the present application, which can be used to execute the interface request replay method in the above embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the embodiment of the interface request replay method in the above embodiment of the present application.

[0214] Fig.25 A block diagram of a device for replaying an interface request according to an embodiment of the present application is shown.

[0215] Reference Fig.25 As shown, according to an embodiment of the present application, the interface request replay device 2500 includes: an acquisition unit 2510, a visualization unit 2520, a determination unit 2530, a variation unit 2540, and a generation unit 2550. The acquisition unit 2510 is used to acquire the request record data of the interface request for the target interface, and the request record data includes several request parameters; the visualization unit 2520 is used to visually display the elements corresponding to the request record data in the first display interface, and the elements display part of the content in the request record data; the determination unit 2530 is used to determine one or more tags corresponding to each request parameter in the request record data when receiving the configuration instruction for the element, and the tags are used to characterize the type of the corresponding request parameter; the variation unit 2540 is used to perform parameter variation operation according to the parameter variation rule defined for the tag corresponding to each request parameter, and obtain the mutated parameter value of each request parameter; the generation unit 2550 is used to generate a new interface request based on the mutated parameter value of each request parameter when receiving the replay instruction, and send the new interface request to the target interface.

[0216] In some embodiments of the present application, based on the aforementioned scheme, the label includes an account label, and the determination unit 2530 is configured to: when receiving a configuration instruction for the element, determine the label corresponding to each request parameter in the request record data; display a second display interface, and visually display the label corresponding to each request parameter in the second display interface; the mutation unit 2540 is configured to: according to the parameter mutation rule defined for the account label corresponding to the target request parameter, obtain and display several original mutated account numbers corresponding to the account label; when receiving a selection instruction for a target original mutated account number among the original mutated accounts, use the target original mutated account number as the mutated parameter value of the target request parameter.

[0217] In some embodiments of the present application, based on the aforementioned scheme, the visualization unit 2520 is configured to: determine the request type corresponding to the request record data; identify the sensitive information in the request record data according to the sensitive information rule corresponding to the request type, and determine the sensitive fields corresponding to each sensitive information; visually display the elements corresponding to the request record data in the first display interface, and display the sensitive fields in the elements.

[0218] In some embodiments of the present application, based on the aforementioned scheme, the acquisition unit 2510 is configured to: receive an original network data packet uploaded locally from a user terminal, and extract request record data of an interface request for a target interface from the original network data packet.

[0219] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a content editing unit; after the step of visually displaying the element corresponding to the request record data in the first display interface, the content editing unit is used to: when a trigger instruction for the element is received, display the complete content of the request record data in the first display interface, the complete content includes a request address, original login status information, a request data packet and a return data packet, the original login status information is used to verify the identity of the requester when making a request, and the request data packet includes several request parameters; according to the editing operation of the complete content, the edited complete content is obtained; when a replay instruction is received, based on the edited complete content, a new interface request is generated, and the new interface request is sent to the target interface.

[0220] In some embodiments of the present application, based on the aforementioned scheme, the request address, login status information and request data packet are all editable parts, and the return data packet is a non-editable part. The content editing unit is configured to: display an edit box when receiving an editing instruction for a specified editable part in the complete content; obtain the edited content through the edit box, and replace the specified editable part with the edited content to obtain the edited complete content.

[0221] In some embodiments of the present application, based on the aforementioned scheme, the content editing unit is configured as follows: when receiving a replacement instruction for the original login state information in the complete content, the original login state information is replaced with the target login state information indicated by the replacement instruction to obtain the edited complete content.

[0222] In some embodiments of the present application, based on the aforementioned scheme, the mutation unit 2540 is configured as follows: performing parameter mutation operations according to parameter mutation rules defined for the tags corresponding to each request parameter to obtain a number of mutated parameter values ​​corresponding to each request parameter; combining the several mutated parameter values ​​corresponding to each request parameter to obtain multiple groups of mutated parameter values, each group of mutated parameter values ​​including a mutated parameter value corresponding to each request parameter; for each group of mutated parameter values, determining the pairwise combination results of all mutated parameter values ​​in the group of mutated parameter values, and deleting the group of mutated parameter values ​​if the pairwise combination results are included in the same position of other groups of mutated parameter values; the generation unit 2550 is configured as follows: when a replay instruction is received, generating a new interface request based on the remaining set of mutated parameter values ​​each time, and sending the new interface request to the target interface.

[0223] In some embodiments of the present application, based on the aforementioned scheme, the device also includes a comparison unit; when a replay instruction is received, a new interface request is generated each time based on the remaining set of mutated parameter values, and the new interface request is sent to the target interface, the comparison unit is used to: for each new interface request, generate a replay request record corresponding to the new interface request according to the new interface request and the response content returned by the target interface according to the new interface request; when a comparison instruction is received, compare at least a portion of the replay request records corresponding to at least two new interface requests, and visually display the comparison results.

[0224] Fig.26 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0225] It should be noted that Fig.26 The computer system 2600 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0226] like Fig.26As shown, the computer system 2600 includes a central processing unit (CPU) 2601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 2602 or the program loaded from the storage part 2608 to the random access memory (RAM) 2603, such as executing the method described in the above embodiment. In RAM 2603, various programs and data required for system operation are also stored. CPU 2601, ROM 2602 and RAM 2603 are connected to each other through bus 2604. Input / output (I / O) interface 2605 is also connected to bus 2604.

[0227] The following components are connected to the I / O interface 2605: an input section 2606 including a keyboard, a mouse, etc.; an output section 2607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 2608 including a hard disk, etc.; and a communication section 2609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 2609 performs communication processing via a network such as the Internet. A drive 2610 is also connected to the I / O interface 2605 as needed. A removable medium 2611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 2610 as needed so that a computer program read therefrom is installed into the storage section 2608 as needed.

[0228] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 2609, and / or installed from the removable medium 2611. When the computer program is executed by the central processing unit (CPU) 2601, various functions defined in the system of the present application are executed.

[0229] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0230] The flowchart and block diagram in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0231] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0232] As one aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0233] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0234] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation method of the present application.

[0235] It can be understood that in the specific implementation of this application, data related to interface detection is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0236] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0237] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for replaying an interface request, characterized in that: The method comprises: Obtaining request record data of an interface request to a target interface, wherein the request record data includes a number of request parameters; Visually displaying an element corresponding to the request record data in a first display interface, wherein the element displays a portion of the content in the request record data; When receiving a configuration instruction for the element, determining one or more tags corresponding to each request parameter in the request record data, the tags being used to characterize a type of the corresponding request parameter; Perform parameter mutation operation according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain the mutated parameter value of each request parameter; When a replay instruction is received, a new interface request is generated based on the mutated parameter values ​​of each request parameter, and the new interface request is sent to the target interface.

2. The method for replaying an interface request according to claim 1, characterized in that: The tag includes an account tag, and when receiving a configuration instruction for the element, determining one or more tags corresponding to each request parameter in the request record data includes: When receiving a configuration instruction for the element, determining a label corresponding to each request parameter in the request record data; Displaying a second display interface, and visually displaying labels corresponding to each request parameter in the second display interface; The performing of parameter mutation operation according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain the mutated parameter value of each request parameter includes: According to the parameter mutation rule defined for the account tag corresponding to the target request parameter, obtain and display a number of original mutated accounts corresponding to the account tag; When a selection instruction for a target original mutated account number among the original mutated account numbers is received, the target original mutated account number is used as the mutated parameter value of the target request parameter.

3. The method for replaying an interface request according to claim 1, characterized in that: The visual display of the elements corresponding to the request record data in the first display interface includes: Determine the request type corresponding to the request record data; Identify sensitive information in the request record data according to a sensitive information rule corresponding to the request type, and determine sensitive fields corresponding to each sensitive information; Elements corresponding to the requested record data are visually displayed in the first display interface, and the sensitive fields are displayed in the elements.

4. The method for replaying an interface request according to claim 1, characterized in that: The step of obtaining the request record data of the interface request to the target interface includes: An original network data packet locally uploaded from a user terminal is received, and request record data of an interface request for a target interface is extracted from the original network data packet.

5. The method for replaying an interface request according to claim 1, characterized in that: After the step of visually displaying the elements corresponding to the requested record data in the first display interface, the method further includes: When a trigger instruction for the element is received, the complete content of the request record data is displayed in the first display interface, the complete content includes the request address, the original login state information, the request data packet and the return data packet, the original login state information is used to verify the identity of the requester when making the request, and the request data packet includes several request parameters; According to the editing operation on the complete content, obtaining the edited complete content; When a replay instruction is received, a new interface request is generated based on the edited complete content, and the new interface request is sent to the target interface.

6. The method for replaying an interface request according to claim 5, characterized in that: The request address, login status information and request data packet are all editable parts, and the return data packet is a non-editable part. The edited complete content is obtained according to the editing operation on the complete content, including: When receiving an editing instruction for a designated editable portion of the complete content, displaying an editing box; The edited content is obtained through the edit box, and the designated editable part is replaced with the edited content to obtain the edited complete content.

7. The method for replaying an interface request according to claim 5, characterized in that: The editing operation on the complete content to obtain the edited complete content includes: When a replacement instruction for the original login state information in the complete content is received, the original login state information is replaced with the target login state information indicated by the replacement instruction to obtain the edited complete content.

8. The method for replaying an interface request according to claim 1, characterized in that: The performing of parameter mutation operation according to the parameter mutation rule defined for the tag corresponding to each request parameter to obtain the mutated parameter value of each request parameter includes: Perform parameter mutation operations according to the parameter mutation rules defined for the tags corresponding to the request parameters, and obtain several mutated parameter values ​​corresponding to each request parameter; Combining several mutated parameter values ​​corresponding to each request parameter to obtain multiple groups of mutated parameter values, each group of mutated parameter values ​​including a mutated parameter value corresponding to each request parameter; For each group of mutated parameter values, determine the pairwise combination results of all mutated parameter values ​​in the group of mutated parameter values, and delete the group of mutated parameter values ​​if the same positions of other groups of mutated parameter values ​​contain the pairwise combination results; When receiving the replay instruction, generating a new interface request based on the mutated parameter values ​​of each request parameter, and sending the new interface request to the target interface, including: When a replay instruction is received, a new interface request is generated each time based on the remaining set of mutated parameter values, and the new interface request is sent to the target interface.

9. The method for replaying an interface request according to claim 8, characterized in that: After receiving the replay instruction, generating a new interface request based on the remaining set of mutated parameter values ​​each time, and sending the new interface request to the target interface, the method further includes: For each new interface request, generating a replay request record corresponding to the new interface request according to the new interface request and the response content returned by the target interface according to the new interface request; When a comparison instruction is received, at least a portion of the replay request records corresponding to at least two new interface requests are compared, and the comparison result is visually displayed.

10. A playback device for an interface request, characterized in that: The device comprises: An acquisition unit, used to acquire request record data of an interface request to a target interface, wherein the request record data includes a number of request parameters; A visualization unit, configured to visually display an element corresponding to the request record data in a first display interface, wherein the element displays a portion of the content in the request record data; a determining unit, configured to, upon receiving a configuration instruction for the element, determine one or more tags corresponding to each request parameter in the request record data, wherein the tags are used to characterize a type of the corresponding request parameter; A mutation unit, used for performing a parameter mutation operation according to a parameter mutation rule defined for a tag corresponding to each request parameter, to obtain a mutated parameter value of each request parameter; The generating unit is used to generate a new interface request based on the mutated parameter values ​​of each request parameter when receiving the replay instruction, and send the new interface request to the target interface.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for replaying an interface request according to any one of claims 1 to 9 is implemented.

12. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the method for replaying the interface request as described in any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method for replaying an interface request as described in any one of claims 1 to 9.

Images