Test method, device and equipment and readable storage medium

Abstract

The invention provides a test method, device and equipment and a readable storage medium. The method comprises the following steps: acquiring original access test scripts aiming at a plurality of interfaces by recording access operations aiming at the plurality of interfaces of a service system; generating an original test script thread group according to the original access test script; according to an access control vulnerability test requirement, performing test configuration on the original test script thread group to obtain a test script thread group; performing an access control vulnerability test on the plurality of interfaces by using the test script thread group to obtain a test result; and outputting the test result. The test efficiency of the access control vulnerability can be improved.

Description

Technical Field

[0001] The present application relates to the field of software testing technology, and in particular to a testing method, apparatus, device and readable storage medium. Background Art

[0002] Access control is a security mechanism used to manage and restrict user access to resources in a business system to protect the system and data from unauthorized access, damage, and tampering. However, a business system may have ineffective access control vulnerabilities, that is, if proper access control is not implemented for authenticated users, there may be access control vulnerabilities that attackers can exploit to access unauthorized information.

[0003] The forms of invalid access control include horizontal unauthorized access, vertical unauthorized access and unauthorized access. In the prior art, in the absence of interface test documents for business systems, testing whether a business system has invalid access control vulnerabilities is usually done manually. For example, for a business system under test, a browser or packet capture tool is used to obtain the interface information of the business system under test, and then three forms of invalid access control vulnerabilities are tested for each interface, respectively, which results in low testing efficiency. Summary of the invention

[0004] The present application provides a testing method, apparatus, device and readable storage medium to improve the testing efficiency of failed access control vulnerabilities.

[0005] In a first aspect, the present application provides a testing method, comprising:

[0006] By recording access operations to multiple interfaces of the business system, original access test scripts for the multiple interfaces are obtained;

[0007] Generate an original test script thread group according to the original access test script;

[0008] According to the access control vulnerability test requirements, the original test script thread group is tested and configured to obtain a test script thread group;

[0009] Using the test script thread group, performing access control vulnerability tests on the multiple interfaces to obtain test results;

[0010] The test result is output.

[0011] Optionally, the access control vulnerability includes: vertical unauthorized access vulnerability, unauthorized access vulnerability, horizontal unauthorized access vulnerability;

[0012] The step of recording access operations to multiple interfaces of the business system to obtain original access test scripts for the multiple interfaces includes:

[0013] Recording a first access operation of an administrator account of the business system to all interfaces of the business system, and using a script obtained by recording the first access operation as a first original access test script for testing vertical unauthorized access vulnerabilities and a second original access test script for testing unauthorized access vulnerabilities;

[0014] Record a second access operation of the first user account of the business system to at least one target interface of the business system, and use the script obtained by recording the second access operation as a third original access test script for testing horizontal unauthorized access vulnerabilities. The first user account is a common user account.

[0015] Optionally, generating an original test script thread group according to the original access test script includes:

[0016] Create a targeted test plan;

[0017] Generate a first original test script thread group of the target test plan according to the first original access test script;

[0018] Generate a second original test script thread group of the target test plan according to the second original access test script;

[0019] A third original test script thread group of the target test plan is generated according to the third original access test script.

[0020] Optionally, before generating the original test script thread group according to the original access test script, the method further includes:

[0021] The original access test script is preprocessed to delete static files in the original access test script and / or repeated operations on the same interface.

[0022] Optionally, the test configuration of the original test script thread group is performed according to the access control vulnerability test requirements to obtain the test script thread group, including:

[0023] For any original test script thread group, configure the information used by the interface access request, the access vulnerability test method, and the output method of the test result to obtain the corresponding test script thread group;

[0024] The information used by the interface access request includes at least one of the following: the communication protocol used by the interface access request, the identifier of the destination address requested to be accessed by the interface access request, the mode of the interface access request, the message format used by the interface access request, and the token used by the interface access request;

[0025] The access vulnerability testing method includes at least one of the following: a field in the interface access response used to determine the test result, and a method for determining the test result.

[0026] Optionally, the information used by the configuration interface access request includes:

[0027] The information used by the interface access request is configured for the original test script thread group in a global configuration manner.

[0028] Optionally, using the test script thread group to perform access control vulnerability tests on the multiple interfaces to obtain test results includes:

[0029] Using a token of a common user account of the business system, running a first test script thread group corresponding to the first original test script thread group, performing a vertical unauthorized access vulnerability test on the multiple interfaces, and obtaining a first test result;

[0030] Using a null value token, running a second test script thread group corresponding to the second original test script thread group, performing an unauthorized access vulnerability test on the multiple interfaces, and obtaining a second test result;

[0031] Use the token of the second user account of the business system to run the third test script thread group corresponding to the third original test script thread group, perform horizontal unauthorized access vulnerability tests on the multiple interfaces, and obtain a third test result. The second user account is another ordinary user account with the same authority as the first user account.

[0032] Optionally, the using the test script thread group to perform access control vulnerability tests on the multiple interfaces, before obtaining the test results, further includes:

[0033] Using a token of an administrator account of the business system, running a first test script thread group corresponding to the first original test script thread group to test a function of an interface of the business system;

[0034] When the interface functions of the business system are normal, each of the test script thread groups is used to perform access control vulnerability tests on the multiple interfaces to obtain test results.

[0035] In a second aspect, the present application provides a testing device, comprising:

[0036] An acquisition module, used to acquire original access test scripts for multiple interfaces by recording access operations for multiple interfaces of a business system;

[0037] A generating module, used for generating an original test script thread group according to the original access test script;

[0038] A configuration module, used to perform test configuration on the original test script thread group according to the access control vulnerability test requirements to obtain a test script thread group;

[0039] A testing module, used to use the test script thread group to perform access control vulnerability tests on the multiple interfaces to obtain test results;

[0040] An output module is used to output the test result.

[0041] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0042] The memory stores computer-executable instructions;

[0043] The processor executes the computer-executable instructions stored in the memory to implement the testing method as described in any one of the first aspects.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the test method as described in any one of the first aspects.

[0045] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the testing method as described in any one of the first aspects.

[0046] In a sixth aspect, the present application provides a chip having a computer program stored thereon, wherein when the computer program is executed by the chip, the test method as described in any one of the first aspects is implemented.

[0047] The test method, apparatus, equipment and readable storage medium provided in the present application utilize a recorded script to obtain an original access test script including interface information, and can obtain multiple interface information of a business system in batches without an interface test document. By configuring the test script thread group, batch testing of access control vulnerabilities of multiple interfaces can be implemented without testing each interface one by one, thereby improving test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0049] Figure 1 It is a structural diagram of a business system;

[0050] Figure 2A flow chart of a test method provided in this application;

[0051] Figure 3 A schematic diagram of another testing method provided for this application;

[0052] Figure 4 A flow chart of another testing method provided in this application;

[0053] Figure 5 A schematic diagram of the structure of a test device provided in this application;

[0054] Figure 6 A schematic diagram of the structure of an electronic device provided in this application.

[0055] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0056] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0057] First, the terms involved in this application are explained:

[0058] Horizontal authority violation: refers to different users with the same authority being able to access each other. For example, there are two users, A and B, both of whom can access personal information data, but the personal information of the two users is different. It can be regarded as that users A and B have horizontal authority to access personal information data. If user A can access user B's personal information, it means that the personal information access interface has a horizontal authority violation.

[0059] Vertical authority violation: refers to a user with low authority being able to access users with higher authority. For example, there are user A and administrator C, where administrator C can modify personal information, while user A only has access function. It can be regarded as user A and administrator C having vertical authority. When user A can modify personal information, it means that there is a vertical authority violation in the personal information modification interface.

[0060] Unauthorized access: refers to failure to set access permissions for business system resources. For example, personal information data should be accessible only after the user logs in. If it can be accessed without logging in, it means that there is an unauthorized access vulnerability in the personal information access interface.

[0061] Figure 1 This is a schematic diagram of the structure of a business system. Figure 1 As shown, the business system includes a server and a client.

[0062] The above-mentioned business system refers to a comprehensive system for the management and production operations of an enterprise, which can, for example, help an enterprise realize functions such as information management and business process visualization.

[0063] The above-mentioned server can be a server or a server cluster, which is used to process the business logic of the business system and store data according to the interactive request from the client. The above-mentioned server can be deployed separately on an electronic device in any environment, such as being deployed separately on a server in a local area network, or all of it can be deployed in a cloud environment, or distributedly deployed in different environments. For example, the above-mentioned server can be logically divided into multiple parts, each of which has different functions, and can be partially deployed in a cloud environment and partially deployed in other environments.

[0064] The client can be a World Wide Web (web) version client or an application (app) version client, which is used to display the front-end display interface of the business system to the user. The client can be an electronic device with communication, input and output functions, such as a computer, tablet computer, etc.

[0065] In the prior art, in the absence of interface test documents for business systems, testing whether a business system has invalid access control vulnerabilities is usually done manually. For example, for a business system under test, a browser or packet capture tool is used to first obtain the interface information of the business system under test, and then each interface is tested for invalid access control vulnerabilities in the form of horizontal unauthorized access, vertical unauthorized access, and unauthorized access, respectively, resulting in low testing efficiency.

[0066] In view of this, the present application proposes a testing method, which utilizes the script recording function to obtain multiple interface information of the business system, and uses it as a test script. It also utilizes the test script thread group to batch complete the access control vulnerability test of multiple interfaces of the business system, without the need to test each interface one by one, thereby improving the testing efficiency.

[0067] The execution subject of the present application can be any electronic device with processing capabilities, such as a computer, a server, etc. A client of a test platform is deployed in the electronic device, and the test platform is used to test access control vulnerabilities of the business system. The test platform can be deployed alone in any environment, or all in a cloud environment, or distributed in different environments. For example, the test platform can be logically divided into multiple parts, each with different functions.

[0068] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0069] Figure 2 A flow chart of a test method provided in this application. Figure 2 As shown, the method includes:

[0070] S101. Obtain original access test scripts for multiple interfaces by recording access operations for multiple interfaces of a business system.

[0071] The above recording refers to script recording.

[0072] A certain function of the above business system corresponds to the access operation of one or more interfaces. For example, the function of viewing personal information corresponds to the interface for obtaining personal information. Therefore, recording the access operations of multiple interfaces of the business system means recording the operations of the client on multiple functions of the business system.

[0073] The above-mentioned original access test script refers to the unprocessed test script after the recording is completed.

[0074] In a possible implementation, the electronic device is installed with a client of the business system and a script recording software. The script recording software on the electronic device receives a script recording request triggered by a user, records the client's access operations to multiple interfaces, and then obtains the original access test scripts for the multiple interfaces. It should be noted that in this implementation, that is, the test platform does not include a script recording function, when other script recording software is used for script recording, the original access test script needs to be converted into a format supported by the test platform.

[0075] Another possible implementation is that the client of the above-mentioned test platform includes a script recording function, and the client of the test platform is used to record the client's access operations to multiple interfaces, thereby obtaining original access test scripts for multiple interfaces.

[0076] Optionally, the above implementation method may be adopted according to the form of the access control vulnerability to obtain an original access test script corresponding to the form of the access control vulnerability.

[0077] Taking the forms of access control vulnerabilities, including vertical privilege escaping, horizontal privilege escaping, and unauthorized access, as an example, one possible implementation method is to obtain three original access test scripts based on the above three forms of access control vulnerabilities, that is, each form of access control vulnerability corresponds to an original access test script. Another possible implementation method is that since vertical privilege escaping and unauthorized access are both tests for all interfaces of the business system, these two forms of access control vulnerabilities can use the same original access test script, that is, only two original access test scripts need to be obtained, which can reduce the number of recordings and improve efficiency.

[0078] S102. Generate an original test script thread group according to the original access test script.

[0079] The original test script thread group is a thread group that has not been configured for testing. It should be understood that the original test script thread group includes multiple interface access requests of the business system.

[0080] In one possible implementation method, the client of the above-mentioned test platform pre-establishes a thread group. When performing the aforementioned recording of access operations to multiple interfaces of the business system and obtaining original access test scripts for multiple interfaces, the storage path of the original access test script is set to the pre-established thread group, and the original test script thread group is obtained after the recording is completed.

[0081] Another possible implementation method is to copy an original access test script from the original storage path of the original access test script, store it in the thread group of the client of the test platform, and generate an original test script thread group.

[0082] Optionally, if multiple original access test scripts are obtained, they are respectively stored in multiple thread groups of the client of the test platform to obtain multiple original test script thread groups.

[0083] Optionally, before generating the original test script thread group according to the original access test script, the original access test script can be preprocessed to delete static files in the original access test script and / or repeated operations on the same interface. This method can delete repeated interfaces and static files in the form of HTML in the above original access test script to improve the test speed.

[0084] Regarding how to determine whether there are repeated operations on the same interface, it should be understood that the original test script includes the path information of the interface, and based on the path of the interface, it can be determined whether the interface existed in the original access test script.

[0085] S103. According to the access control vulnerability test requirements, the original test script thread group is tested and configured to obtain a test script thread group.

[0086] The above-mentioned access control vulnerability testing requirements refer to what form of access control vulnerability needs to be tested. As mentioned above, access control vulnerabilities include vertical unauthorized access, horizontal unauthorized access, and unauthorized access. If you only need to test vertical unauthorized access vulnerabilities, you can only configure the original test script thread group corresponding to the original access test script of the vertical unauthorized access vulnerability to obtain the test script thread group corresponding to the vertical unauthorized access vulnerability.

[0087] The above test configuration refers to the information of configuring the original test script thread group. A possible implementation method is to configure at least one of the information used for interface access request, access vulnerability test method, and test result output method for any original test script thread group to obtain the corresponding test script thread group.

[0088] The information used in the above-mentioned interface access request includes at least one of the following: the communication protocol used by the interface access request, the identifier of the destination address requested to be accessed by the interface access request, the method of the interface access request, the message format used by the interface access request, and the token used by the interface access request; the above-mentioned access vulnerability testing method includes at least one of the following: the field in the interface access response used to determine the test result, and the method for determining the test result.

[0089] The communication protocol used by the above interface access request refers to the communication protocol used by the business system, for example, it can be the Hypertext Transfer Protocol (HTTP). The identifier of the destination address requested to be accessed by the above interface access request refers to the identifier of the business system, for example, it can be the IP address of the business system, or other information that can characterize the business system, such as a MAC address, etc., which is not limited in this application.

[0090] The message format used in the above-mentioned interface access request refers to the message format used in the interface access request of the business system, which may include, for example, the request method, port number, etc. The token used in the above-mentioned interface access request refers to the token assigned to the user by the server of the business system. It should be understood that after the user logs in with the account and password using the client of the business system, the server will assign a token to the account to facilitate the verification of the user's identity.

[0091] The field used to judge the test result in the above interface access response, for example, presets a return code to indicate that the interface can return data. Optionally, a mapping relationship between the return code and the interface response result can be preset, for example, return code 1 indicates that the interface can return data, and return code 2 indicates that the interface network connection fails, which is convenient for the analysis and statistics of subsequent test results.

[0092] The above-mentioned method of judging the test result refers to setting the assertion method, the representation method of the assertion result, the setting of the viewing result tree, etc. Assertions are a judgment mechanism for judging whether a request is successful. The assertion method can be, for example, response assertions, JSON assertions, etc. The representation method of the assertion result refers to the output content of the assertion success or failure. The viewing result tree is used to view the response results of each interface, which refers to setting the color setting for the response success or failure, for example, the response success is set to green.

[0093] Another possible implementation method is that for any original test script thread group, in addition to configuring the information used for the above-mentioned interface access request, the access vulnerability test method, and the output method of the test results, other information required for the test can also be configured, exemplarily, the attribute information of the original test script thread group, such as the name of the thread group, the interval time between threads, etc.

[0094] It should be noted that the above test configuration can be set according to the actual needs of the test platform, and this application does not limit it here.

[0095] Regarding the test configuration method, one possible implementation method is that the above-mentioned test configuration information is input by the user through the client of the test platform; another possible implementation method is that the configuration information corresponding to the above-mentioned original test script thread groups is pre-stored in a preset storage space of the electronic device, and the client of the test platform can obtain the configuration information of the original test script thread group from the preset storage space to automatically complete the test configuration.

[0096] Regarding how to test and configure the original test script thread group according to the access control vulnerability test requirements, one possible implementation method is to perform a separate test configuration for any original test script thread group to obtain a test script thread group. That is, test configuration is performed for each original test script thread group. Another possible implementation method is that since each original test script thread group is for the business system, the information used by the above-mentioned interface access request in each of the above-mentioned original test script thread groups is for the business system. Therefore, a global configuration method can be used to configure the information used by the interface access request for the above-mentioned original test script thread group.

[0097] S104: Use the test script thread group to perform access control vulnerability tests on multiple interfaces of the business system to obtain test results.

[0098] The above test results refer to whether there are access control vulnerabilities in multiple interfaces of the business system. For example, it can be obtained whether there are vertical unauthorized access vulnerabilities in multiple interfaces.

[0099] Optionally, the test result can be judged based on the assertion results of each test script thread group. For example, if the aforementioned preset return code exists in the response of any interface of the test script thread group, the assertion result is failure, indicating that the interface has an access control vulnerability. According to this method, the assertion results of all interfaces of the test script thread group can be obtained, and the assertion results of all interfaces are used as the test results of the test script thread group. Alternatively, the test results of the test script thread group are obtained by viewing the result tree of the aforementioned configuration. It should be noted that this application does not limit the result representation format of the viewing result tree.

[0100] In a possible implementation, if the above test script thread group is a separate test configuration, then multiple test script thread groups can be run in parallel to obtain test results of the multiple test script thread groups.

[0101] Another possible implementation method is that if the information used for the interface access request in the above-mentioned test script thread group is configured globally, then multiple test script thread groups need to be executed sequentially. According to the testing requirements of the aforementioned access control vulnerabilities, the corresponding test script thread groups can be started in sequence to obtain the test results.

[0102] Regarding the startup method of the test script thread group, one possible implementation method may be that the client of the test platform triggers the startup of the test script thread group by receiving instructions input by the user; another possible implementation method may be that the test platform automatically starts the test script thread group after receiving a response that the configuration is completed; in yet another possible implementation method, each of the above-mentioned test script thread groups may have a preset startup time during the aforementioned test configuration, and when the preset startup time is reached, the test platform automatically runs the corresponding test script thread group.

[0103] S105. Output test results.

[0104] One possible implementation method is to directly output the above test results to the client of the test platform for display; another possible implementation method is to generate a visual test report based on the above test results and output the visual test report.

[0105] The above-mentioned visual test report includes but is not limited to interface identification, assertion results, graphical test results, etc. Among them, visualization refers to the graphical representation of test results. For example, a graph can be used to show the probability of access control vulnerabilities in each interface in the test script thread group, making the representation of test results more intuitive.

[0106] The testing method provided in the present application utilizes a recorded script method to obtain an original access test script including interface information, and can obtain multiple interface information of a business system in batches without an interface test document. By configuring the test script thread group, batch testing of access control vulnerabilities of multiple interfaces can be implemented without testing each interface one by one, thereby improving testing efficiency.

[0107] The following uses access control vulnerabilities including vertical unauthorized access, horizontal unauthorized access, and unauthorized access as an example to explain how to obtain original access test scripts for multiple interfaces by recording access operations for multiple interfaces of a business system.

[0108] S201. Record the first access operation of the administrator account of the above business system to all interfaces of the business system, and use the script obtained by recording the first access operation as the first original access test script for testing vertical unauthorized access vulnerabilities and the second original access test script for testing unauthorized access vulnerabilities.

[0109] The first access operation refers to all operations that can be performed on the business system, such as adding, modifying, deleting, viewing, etc. Recording the first access operation of the administrator account of the business system on all interfaces of the business system refers to recording the interface information after the first access operation triggered by the client of the business system receiving the user's operation instruction.

[0110] It should be understood that the administrator account has the authority to perform all operations on the business system, that is, it can access all interfaces of the business system. Therefore, the administrator account can be used to record to obtain information about all interfaces of the business system. It should be noted that, as mentioned above, the unauthorized access vulnerability requires testing all interfaces, so the script recorded using the administrator account can be used as the original access test script to test the unauthorized access vulnerability.

[0111] S202, recording a second access operation of the first user account of the business system to at least one target interface of the business system, and using a script obtained by recording the second access operation as a third original access test script for testing horizontal unauthorized access vulnerabilities.

[0112] It should be noted that not all interfaces in the above business system have horizontal permissions. Only some interfaces have the possibility of horizontal unauthorized access vulnerabilities. Therefore, it is only necessary to record the access operations of the interfaces with horizontal permissions.

[0113] The target interface is an interface with horizontal permissions. The second access operation is an operation performed on the target interface, such as viewing. Recording the second access operation of the first user account of the business system on at least one target interface of the business system refers to recording the interface information after the second access operation is triggered by the client of the business system receiving the user's operation instruction.

[0114] The first user account is a common user account compared to the administrator account. It should be noted that two common user accounts with the same permissions can be preset in advance, such as the first user account and the second user account, and both can only access resources in their own accounts and cannot access resources in the other account.

[0115] It should be noted that the present application does not limit the execution order of the above steps S201 and S202. S201 may be executed first, or S202 may be executed first. The above embodiment is merely an illustration of executing S201 first.

[0116] It should be noted that the present application does not limit the execution entity of the above steps S201 and S202, which may be executed by different clients of the business system.

[0117] The testing method provided in the present application records different access operations for multiple interfaces of a business system according to different forms of access control vulnerabilities, and obtains original access test scripts corresponding to different access control vulnerabilities, that is, obtains interface information under different forms of access control vulnerabilities, and uses the script recorded by the management account as the original test access script for vertical unauthorized access vulnerabilities and unauthorized access vulnerabilities, thereby saving recording time and improving testing efficiency.

[0118] The following uses an example in which the original access test scripts include a first original access test script, a second original access test script, and a third original access test script to illustrate how to generate an original test script thread group based on the original access test scripts.

[0119] Figure 3 A schematic diagram of another test method provided in this application. Figure 3 As shown, the method includes:

[0120] S301. Create a target test plan.

[0121] The above-mentioned target test plan refers to the test plan for access control vulnerability testing of the business system.

[0122] In one possible implementation, the creation of the target test plan is manually triggered by a user through a client of the test platform; in another possible implementation, the target test plan is created periodically.

[0123] S302. Generate a first original test script thread group of a target test plan according to the first original access test script.

[0124] The above-mentioned first original test script thread group refers to the original test script thread group corresponding to the vertical unauthorized access vulnerability.

[0125] In one possible implementation, the client of the test platform adds an initial thread group to the target test plan by receiving the user's operation instruction, and configures the first original access test script to the initial thread group of the target test plan to obtain the first original test script thread group of the target test plan. In another possible implementation, after creating the target test plan, the client of the business system will automatically add an initial thread group to the target test plan, obtain the first original access test script, and automatically configure it to the initial thread group of the target test plan to obtain the first original test script thread group of the target test plan. In another possible implementation, the client of the business system will periodically add an initial thread group to the target test plan, obtain the first original access test script, and automatically configure it to the initial thread group of the target test plan to obtain the first original test script thread group of the target test plan.

[0126] It should be noted that the configuration method can refer to the description of the aforementioned step S103, which will not be repeated here.

[0127] S303. Generate a second original test script thread group of the target test plan according to the second original access test script.

[0128] The second original test script thread group mentioned above refers to the original test script thread group corresponding to the unauthorized access vulnerability.

[0129] Regarding how to generate the second original test script thread group of the target test plan, reference may be made to the description of the aforementioned step S302, which is similar and will not be repeated here.

[0130] S304. Generate a third original test script thread group of the target test plan according to the third original access test script.

[0131] The third original test script thread group mentioned above refers to the original test script thread group corresponding to the horizontal unauthorized access vulnerability.

[0132] Regarding how to generate the third original test script thread group of the target test plan, you can refer to the description of the aforementioned step S302. Similar to it, it will not be repeated here.

[0133] It should be noted that the present application does not limit the execution order of the aforementioned steps S302-S304, which can be executed sequentially, and the order of sequential execution is not limited; they can also be executed in parallel.

[0134] The testing method provided in the present application can test the access control vulnerabilities of multiple interfaces of a business system in batches by means of thread groups, and different thread groups are set for different forms of access control vulnerabilities, which can realize batch testing of multiple forms of access control vulnerabilities of multiple interfaces and improve testing efficiency.

[0135] The following takes the original test script thread group including the first original test script thread group, the second original test script thread group and the third original test script thread group as an example to explain how to test configure the original test script thread group according to the access control vulnerability testing requirements to obtain the test script thread group.

[0136] As mentioned above, for any original test script thread group, the information used for the interface access request, the access vulnerability test method, and the output method of the test result can be configured to obtain the corresponding test script thread group.

[0137] The first implementation method is to configure each original test script thread group separately.

[0138] For the first original test script thread group, the information used by the interface access request, the access vulnerability test method, and the output method of the test result are configured respectively. Among them, the token used by the interface access request in the information used by the interface access request is the token of an ordinary user account compared to the administrator account. The ordinary account can be, for example, the aforementioned first user account, the second user account, or other ordinary user accounts.

[0139] It should be understood that the first original test script thread group corresponds to the original access test script recorded using the administrator account. Therefore, when using the first original test script thread group to test the vertical unauthorized access vulnerability, the token of the ordinary user account is used, which is equivalent to using the ordinary user account to access the business system of the administrator account. If a certain interface can be accessed using an ordinary user account, it means that the interface has a vertical unauthorized access vulnerability.

[0140] For the second original test script thread group, its configuration information is different from that of the first original test script thread group in that the token used by the interface access request in the information used by the interface access request is a null value, that is, Token is a null value. It should be understood that the second original test script thread group corresponds to the original access test script recorded using the administrator account. Therefore, when using the second original test script thread group to test for unauthorized access vulnerabilities, Token is set to a null value, which is equivalent to a business system in which an account that has not logged in accesses the administrator account. If the data of a certain interface can be obtained, it means that the interface has an unauthorized access vulnerability.

[0141] For the third original test script thread group, its configuration information is different from that of the first original test script thread group in that the token used by the interface access request in the information used by the interface access request is the token of the second user account. It should be understood that the third original test script thread group corresponds to the original access test script recorded using the first user account. Therefore, when using the third original test script thread group to test the horizontal unauthorized access vulnerability, setting the token to the token of the second user account is equivalent to using the second user account to access the business system of the first user account. If the data of a certain interface can be obtained, it means that the interface has a horizontal unauthorized access vulnerability.

[0142] The second implementation method is to use global configuration.

[0143] As mentioned above, the information used by the interface access requests in the three original test script thread groups is partially the same, such as the communication protocol used by the interface access request, the identifier of the destination address requested by the interface access request, the interface access request method, and the message format used by the interface access request, all of which are for the business system. Therefore, the above information can be configured globally without configuring each thread group one by one, thereby improving configuration efficiency.

[0144] The tokens used for different interface access requests in the three original test script thread groups need to be configured one by one.

[0145] The testing method provided in the present application can configure different test script thread groups according to different forms of access control vulnerabilities, and then batch obtain the test results of interfaces with different forms of access control vulnerabilities, thereby improving the testing efficiency.

[0146] The following uses an example in which a test script thread group includes a first test script thread group, a second test script thread group, and a third test script thread group to illustrate how to use the test script thread group to perform access control vulnerability tests on multiple interfaces and obtain test results.

[0147] Figure 4 The following is a flow chart of another testing method provided in this application. Figure 4 As shown, the method includes:

[0148] S401. Use a token of an administrator account of a business system to run a first test script thread group corresponding to a first original test script thread group to test a function of an interface of the business system.

[0149] It should be noted that this step requires testing whether all interface functions of the business system are normal to ensure the accuracy of subsequent access control vulnerability testing.

[0150] Specifically, as mentioned above, if there is a preset return code in the response of the interface, the assertion result is failure, indicating that the interface has an access control vulnerability. However, if the interface function is abnormal, the interface will not return the preset return code, and the assertion result of the interface is judged to be successful, indicating that there is no access control vulnerability in the interface, and the test result of the access control vulnerability is inaccurate.

[0151] If all interfaces in the first test script thread group return the preset return code, indicating that the interface of the business system functions normally, the subsequent steps S402-S404 are executed. If there is an interface in the first test script thread group that does not return the preset return code, the interface of the business system is repaired and the step is re-executed.

[0152] S402. Use the token of the common user account of the business system to run the first test script thread group corresponding to the first original test script thread group, perform vertical unauthorized access vulnerability test on multiple interfaces, and obtain a first test result.

[0153] It should be noted that the above-mentioned common user account may be, for example, the aforementioned first user account or second user account, or other common user accounts.

[0154] S403. Use a null value token to run a second test script thread group corresponding to the second original test script thread group, perform an unauthorized access vulnerability test on multiple interfaces, and obtain a second test result.

[0155] S404. Use the token of the second user account of the business system to run the third test script thread group corresponding to the third original test script thread group, perform horizontal unauthorized access vulnerability tests on the multiple interfaces, and obtain a third test result.

[0156] It should be noted that the second user account mentioned above refers to a common user account, and may also be another common user account other than the first user account mentioned above.

[0157] The testing method provided in the present application uses an administrator account to run the first test script thread group, which can ensure the normal operation of the business system interface function, provide a guarantee for the operation of subsequent test script thread groups, and improve the accuracy of the test results.

[0158] Figure 5 This is a schematic diagram of the structure of a test device provided in this application. Figure 5 As shown, the device comprises:

[0159] An acquisition module 11 is used to acquire original access test scripts for multiple interfaces by recording access operations for multiple interfaces of a business system;

[0160] A generating module 12, configured to generate an original test script thread group according to the original access test script;

[0161] Configuration module 13, used for testing and configuring the original test script thread group according to the access control vulnerability test requirements to obtain the test script thread group;

[0162] A testing module 14 is used to use the test script thread group to perform access control vulnerability tests on the multiple interfaces to obtain test results;

[0163] The output module 15 is used to output the test result.

[0164] In a possible implementation, the access control vulnerability includes: vertical unauthorized access vulnerability, unauthorized access vulnerability, and horizontal unauthorized access vulnerability; the acquisition module 11 is specifically used to record the first access operation of the administrator account of the business system to all interfaces of the business system, and use the script obtained by recording the first access operation as the first original access test script for testing the vertical unauthorized access vulnerability and the second original access test script for testing the unauthorized access vulnerability;

[0165] Record a second access operation of the first user account of the business system to at least one target interface of the business system, and use the script obtained by recording the second access operation as a third original access test script for testing horizontal unauthorized access vulnerabilities. The first user account is a common user account.

[0166] In a possible implementation, the generation module 12 is specifically used to create a target test plan;

[0167] Generate a first original test script thread group of the target test plan according to the first original access test script;

[0168] Generate a second original test script thread group of the target test plan according to the second original access test script;

[0169] A third original test script thread group of the target test plan is generated according to the third original access test script.

[0170] In a possible implementation, the generation module 12 is used to generate the original test script thread group according to the original access test script, and the processing module 16 is used to pre-process the original access test script to delete static files in the original access test script and / or repeated operations on the same interface.

[0171] In a possible implementation, the configuration module 13 is specifically used to configure the information used by the interface access request, the access vulnerability test method, and the output method of the test result for any original test script thread group to obtain the corresponding test script thread group;

[0172] The information used by the interface access request includes at least one of the following: the communication protocol used by the interface access request, the identifier of the destination address requested to be accessed by the interface access request, the mode of the interface access request, the message format used by the interface access request, and the token used by the interface access request;

[0173] The access vulnerability testing method includes at least one of the following: a field in the interface access response used to determine the test result, and a method for determining the test result.

[0174] In a possible implementation, the configuring the information used for the interface access request includes: configuring the information used for the interface access request for the original test script thread group in a global configuration manner.

[0175] In a possible implementation, the test module 14 is specifically configured to use a token of a common user account of the business system to run a first test script thread group corresponding to the first original test script thread group, perform a vertical unauthorized access vulnerability test on the multiple interfaces, and obtain a first test result;

[0176] Using a null value token, running a second test script thread group corresponding to the second original test script thread group, performing an unauthorized access vulnerability test on the multiple interfaces, and obtaining a second test result;

[0177] Use the token of the second user account of the business system to run the third test script thread group corresponding to the third original test script thread group, perform horizontal unauthorized access vulnerability tests on the multiple interfaces, and obtain a third test result. The second user account is another ordinary user account with the same authority as the first user account.

[0178] In a possible implementation, the test module 14 is specifically configured to use a token of an administrator account of the business system to run the first test script thread group corresponding to the first original test script thread group to test the function of the interface of the business system;

[0179] When the interface functions of the business system are normal, each of the test script thread groups is used to perform access control vulnerability tests on the multiple interfaces to obtain test results.

[0180] The functional modules of the above-mentioned testing device can cooperate to execute the testing method described in the above-mentioned embodiment. The implementation principle and technical effect are similar and will not be described in detail.

[0181] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 6 As shown, the electronic device 500 may include: at least one processor 501 and a memory 502. The electronic device may be a terminal, a server, a computer device, or other device with processing capabilities.

[0182] The memory 502 is used to store programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions.

[0183] The memory 502 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0184] The processor 501 is used to execute the computer-executable instructions stored in the memory 502 to implement the test method described in the above method embodiment. The processor 501 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0185] The electronic device 500 may further include a communication interface 503, so as to communicate and interact with an external device through the communication interface 503. The external device may be, for example, a computer, a tablet, and the like.

[0186] In specific implementation, if the communication interface 503, the memory 502 and the processor 501 are implemented independently, the communication interface 503, the memory 502 and the processor 501 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc., but it does not mean that there is only one bus or one type of bus.

[0187] Optionally, in a specific implementation, if the communication interface 503, the memory 502 and the processor 501 are integrated on a chip, the communication interface 503, the memory 502 and the processor 501 can communicate through an internal interface.

[0188] The present application also provides a computer-readable storage medium, which may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes. Specifically, the computer-readable storage medium stores computer execution instructions, and the computer execution instructions are used for the test method in the above embodiment.

[0189] The present application also provides a computer program product, which includes an execution instruction, which is stored in a readable storage medium. At least one processor of the electronic device 500 can read the execution instruction from the readable storage medium, and at least one processor executes the execution instruction so that the electronic device 500 implements the methods provided in the various embodiments described above.

[0190] The present application also provides a chip having a computer program stored thereon, and when the computer program is executed by the chip, the methods provided in various implementation modes are implemented.

[0191] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0192] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A testing method, characterized in that: The method comprises: By recording access operations to multiple interfaces of the business system, original access test scripts for the multiple interfaces are obtained; Generate an original test script thread group according to the original access test script; According to the access control vulnerability test requirements, the original test script thread group is tested and configured to obtain a test script thread group; Using the test script thread group, performing access control vulnerability tests on the multiple interfaces to obtain test results; The test result is output.

2. The method according to claim 1, characterized in that: The access control vulnerabilities include: vertical unauthorized access vulnerabilities, unauthorized access vulnerabilities, and horizontal unauthorized access vulnerabilities; The step of recording access operations to multiple interfaces of the business system to obtain original access test scripts for the multiple interfaces includes: Recording a first access operation of an administrator account of the business system to all interfaces of the business system, and using a script obtained by recording the first access operation as a first original access test script for testing vertical unauthorized access vulnerabilities and a second original access test script for testing unauthorized access vulnerabilities; Record a second access operation of the first user account of the business system to at least one target interface of the business system, and use the script obtained by recording the second access operation as a third original access test script for testing horizontal unauthorized access vulnerabilities. The first user account is a common user account.

3. The method according to claim 2, characterized in that The step of generating an original test script thread group according to the original access test script comprises: Create a targeted test plan; Generate a first original test script thread group of the target test plan according to the first original access test script; Generate a second original test script thread group of the target test plan according to the second original access test script; A third original test script thread group of the target test plan is generated according to the third original access test script.

4. The method according to claim 3, characterized in that Before generating the original test script thread group according to the original access test script, the method further includes: The original access test script is preprocessed to delete static files in the original access test script and / or repeated operations on the same interface.

5. The method according to claim 3, characterized in that: The method of testing and configuring the original test script thread group according to the access control vulnerability test requirements to obtain the test script thread group includes: For any original test script thread group, configure the information used by the interface access request, the access vulnerability test method, and the output method of the test result to obtain the corresponding test script thread group; The information used by the interface access request includes at least one of the following: the communication protocol used by the interface access request, the identifier of the destination address requested to be accessed by the interface access request, the mode of the interface access request, the message format used by the interface access request, and the token used by the interface access request; The access vulnerability testing method includes at least one of the following: a field in the interface access response used to determine the test result, and a method for determining the test result.

6. The method according to claim 5, characterized in that The information used by the configuration interface access request includes: The information used by the interface access request is configured for the original test script thread group in a global configuration manner.

7. The method according to claim 5, characterized in that The using the test script thread group to perform access control vulnerability tests on the multiple interfaces to obtain test results includes: Using a token of a common user account of the business system, running a first test script thread group corresponding to the first original test script thread group, performing a vertical unauthorized access vulnerability test on the multiple interfaces, and obtaining a first test result; Using a null value token, running a second test script thread group corresponding to the second original test script thread group, performing an unauthorized access vulnerability test on the multiple interfaces, and obtaining a second test result; Use the token of the second user account of the business system to run the third test script thread group corresponding to the third original test script thread group, perform horizontal unauthorized access vulnerability tests on the multiple interfaces, and obtain a third test result. The second user account is another ordinary user account with the same authority as the first user account.

8. The method according to claim 5, characterized in that Before using the test script thread group to perform access control vulnerability tests on the multiple interfaces and obtaining test results, the method further includes: Using a token of an administrator account of the business system, running a first test script thread group corresponding to the first original test script thread group to test a function of an interface of the business system; When the interface functions of the business system are normal, each of the test script thread groups is used to perform access control vulnerability tests on the multiple interfaces to obtain test results.

9. A testing device, characterized in that: The device comprises: An acquisition module, used to acquire original access test scripts for multiple interfaces by recording access operations for multiple interfaces of a business system; A generating module, used for generating an original test script thread group according to the original access test script; A configuration module, used to perform test configuration on the original test script thread group according to the access control vulnerability test requirements to obtain a test script thread group; A testing module, used to use the test script thread group to perform access control vulnerability tests on the multiple interfaces to obtain test results; An output module is used to output the test result.

10. An electronic device, characterized in that: The electronic device comprises: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the testing method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the testing method according to any one of claims 1 to 8 when executed by a processor.

Images