Method and system for detecting forged login request vulnerabilities after third-party verification based on data flow analysis

Abstract

The present invention proposes a method and system for detecting forged login requests after third-party verification based on data flow analysis, which belongs to the technical field of network security vulnerability detection. Mini-programs are collected on a large scale to construct a data set of mini-programs to be tested. The front-end code decompilation tool of the mini-program is used to automatically decrypt and unpack the wxapkg encrypted package of the front-end of the mini-program to be tested, and the front-end source code file of the mini-program to be tested is obtained. The data flow analysis method based on AST is used to perform data flow analysis on the front-end source code of each mini-program to be tested, identify the API parameters used in the third-party verification login process as the data source, analyze the flow of the data, model the client-server interaction, obtain the mini-program client-server interaction process diagram, and finally perform third-party verification after login request forgery vulnerability. The present invention can effectively detect the vulnerability of forged login requests after third-party verification in the mini-program ecosystem.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security vulnerability detection, and in particular relates to a method and system for detecting forged login requests after third-party verification based on data flow analysis. Background Art

[0002] With the widespread adoption of mini-programs, a new type of web application, within major super-apps, the number of WeChat mini-programs has surpassed 4 million, and the total number of mini-programs online has exceeded 10 million. While providing significant convenience to users, mini-programs also store or transmit vast amounts of private, sensitive user information. Most mini-programs also offer online top-up and shopping services. Any security issues within mini-programs can pose serious risks.

[0003] However, the investigation found that there is a third-party verification login request forgery vulnerability in the mini program ecosystem. The vulnerability occurs in the super application authorization login scenario of the mini program. The normal third-party verification login process is as follows: Figure 1 As shown, after clicking a button similar to "WeChat mobile phone number one-click login" in the mini program, the mini program calls the getPhoneNumber API provided by WeChat to obtain the ciphertext of the user's mobile phone number bound to WeChat, and then sends this ciphertext to the mini program server. The mini program server applies to WeChat for a key to decrypt the ciphertext, obtains the plaintext mobile phone number, queries the user status based on the plaintext mobile phone number, and returns the token corresponding to the mobile phone number to the mini program client. However, many developers have weak security awareness and use incorrect processes, resulting in a login request forgery vulnerability after third-party verification. The login process with this vulnerability is as follows: Figure 2 As shown, after the mini program server decrypts the plaintext, it mistakenly returns the mobile phone number to the client, and mistakenly uses the mobile phone number returned to the client to send a login request. Since the attacker can tamper with the login request after forging third-party verification, forging the victim's mobile phone number to send the request, obtain the victim's user token, and finally log in to the victim's account.

[0004] One existing technique first retrieves the mini-program under test based on its name and APPID, obtains statically matched source code, extracts key string code segments, and performs a security risk assessment on these key string code segments. A simulated click operation is then performed on the mini-program to launch a vulnerability scanner for vulnerability scanning. However, this method does not support callback function processing or client-server interaction modeling. A second existing technique converts the mini-program front-end source code into a code attribute graph, then searches the code attribute graph for matching code segments containing known vulnerability signatures to detect vulnerabilities. A third existing technique injects an agent into the host program to obtain the mini-program link and then uses the android-detection-tools tool to perform security testing based on the obtained mini-program link. However, it is difficult to achieve high coverage testing of the mini-program based solely on the obtained link. A fourth existing technique requires in-depth manual reverse engineering of the host program (WeChat, Alipay) to select valid locations for hooking, addressing the difficulty in obtaining information and controlling mini-program page navigation during testing. However, the encryption and obfuscation algorithms used in applications like WeChat and Alipay are becoming increasingly complex, making manual reverse engineering extremely complex. None of the above existing techniques can detect the vulnerability of forged login requests after third-party verification. The fifth existing technology proposes a cross-page request forgery vulnerability of a mini program, which is based on the cross-page request forgery vulnerability of CodeQl. However, since CodeQl does not support the inter-process call analysis of the mini program javascript, it is unable to detect the login request forgery vulnerability after third-party verification.

[0005] It can be seen that the existing methods are unable to solve problems such as callback function processing, client-server interaction modeling, webpack packaging code analysis, and inter-process calls in the static analysis of mini-program JavaScript code, and face great challenges in detecting login request forgery vulnerabilities after third-party verification. Summary of the Invention

[0006] The present invention is aimed at the mini-program ecological authorization login scenario, and discloses a third-party post-verification login request forgery vulnerability detection solution based on data flow analysis. It aims to solve the technical problem that the existing mini-program vulnerability detection method is difficult to model JavaScript file inclusion, callback functions, webpack packaging, inter-process calls and mini-program client-server interaction processes, resulting in the inability to accurately detect the mini-program third-party post-verification login request forgery vulnerability.

[0007] A first aspect of the present invention provides a method for detecting a forged login request vulnerability after third-party authentication based on data flow analysis, the method comprising:

[0008] Step S1: calling the first module, wherein the first module is configured to execute: obtaining the source code of the mini-program client to be tested; specifically including:

[0009] Collect various mini-programs to construct a dataset of mini-programs to be tested; use a mini-program front-end code decompilation tool to automatically decrypt and unpack the wxapkg encrypted package of the mini-program to be tested, in order to obtain the front-end source code file of the mini-program to be tested;

[0010] Step S2: calling the second module, wherein the second module is configured to perform: detecting a third-party post-authentication login request forgery vulnerability based on data flow analysis according to the source code of the mini-program client to be tested; specifically, including:

[0011] An AST-based data flow analysis method is used to perform data flow analysis on the front-end source code files of each mini program to be tested; the API parameters used in the third-party verification login process are identified as the data source, and the data flow therein is analyzed; the interaction between the client and server of the mini program to be tested is modeled to obtain the interaction process diagram between the client and server of the mini program to be tested, and login request forgery vulnerability detection is performed after third-party verification.

[0012] According to the method of the first aspect of the present invention, in step S1, the first module obtains the source code of the mini-program client to be tested; wherein:

[0013] The client source code of the applet to be tested is encrypted and stored in a specific directory of the client computer. The KillWxapkg[] tool is called to decrypt, unpack and decompile the front-end wxapkg encrypted package of each applet in the applet dataset to be tested, thereby obtaining the front-end source code file of the applet to be tested as the client source code of the applet to be tested; the client source code of each applet to be tested is sent to the second module to perform subsequent vulnerability detection.

[0014] According to the method of the first aspect of the present invention, in step S2, the second module detects a vulnerability in forged login requests after third-party verification; wherein, an AST-based data flow analysis method is used to perform data flow analysis on the front-end source code files of each applet to be tested to identify the API parameters used in the third-party verification login process as a data source; specifically, the method includes:

[0015] Through collaborative analysis between the logic layer and the rendering layer, the data source is identified and located, and the JavaScript code and wxml file of the applet to be tested are converted into an abstract syntax tree (AST).

[0016] Extract the function named getPhoneNumber from the javascript code abstract syntax tree AST; if the extraction is successful, identify the API parameters of the corresponding function as the data source; if the extraction is unsuccessful, extract the event function name of the getPhoneNumber API bound to the wxml file abstract syntax tree AST, extract the function with the corresponding function name in the javascript code abstract syntax tree AST according to the event function name, and identify its API parameters as the data source.

[0017] According to the method of the first aspect of the present invention, in step S2, the second module detects a vulnerability in forging a login request after third-party verification; wherein the data flow is analyzed; specifically, the method includes:

[0018] Construct corresponding file context, object context, and function context for files, objects, and functions in JavaScript respectively;

[0019] Take each JavaScript file included in the file of the require function in the JavaScript language as a sub-file context, extract all the functions defined in it and save them in the function table;

[0020] When a function call is analyzed, determine whether there is a function declaration with the same name in the function table; if so, enter the corresponding function declaration part and perform inter-procedural call analysis. According to the parameter position of the tracking variable in the function call, determine the variable to be tracked in the function declaration part;

[0021] When analyzing variable assignments, if the right side is a tracking variable, the variable assigned on the left side is added to the tracking variable set;

[0022] When it is analyzed that a tracking variable is assigned to a corresponding attribute, the assigned object attribute will continue to be kept in the tracking variable collection.

[0023] According to the method of the first aspect of the present invention, in step S2, the second module detects a vulnerability in forged login requests after third-party verification; wherein, an interaction model is performed between the client and server of the applet to be tested to obtain an interaction process diagram between the client and server of the applet to be tested; specifically, the method includes:

[0024] According to the characteristics of the HTTP request function in the mini-program JavaScript code, the function call expression in the data flow is analyzed, the HTTP request processing function and callback function are identified, and the HTTP request parameters, request response, and operations performed on the request response are extracted, thereby constructing the interaction process diagram between the client and the server.

[0025] According to the method of the first aspect of the present invention, in step S2, the second module detects a vulnerability in forging a login request after third-party verification; wherein the detection of a vulnerability in forging a login request after third-party verification is performed; specifically, the detection includes:

[0026] Based on the interaction process diagram, determine whether the HTTP request for verifying the mobile phone number returns a plaintext mobile phone number, and whether a subsequent request uses the response of the previous request as a parameter to send a login request. If at least one of the above two situations exists, there is a login request forgery vulnerability after third-party verification. Output the interaction process diagram and data flow analysis results to the analysis report.

[0027] A second aspect of the present invention provides a system for detecting forged login requests after third-party verification based on data flow analysis, the system comprising a first module and a second module; wherein:

[0028] The first module is configured to execute: obtaining the client source code of the mini-program to be tested; specifically, collecting various mini-programs to construct a data set of the mini-program to be tested; using a mini-program front-end code decompilation tool to automatically decrypt and unpack the wxapkg encrypted package of the front-end of the mini-program to be tested to obtain the front-end source code file of the mini-program to be tested;

[0029] The second module is configured to execute: based on the source code of the mini program client to be tested, detect the vulnerability of forged login request after third-party verification based on data flow analysis; specifically including: using AST-based data flow analysis method to perform data flow analysis on the front-end source code files of each mini program to be tested; identifying the API parameters used in the third-party verification login process as the data source, and analyzing the data flow therein; modeling the interaction between the client and the server of the mini program to be tested, obtaining the interaction process diagram between the client and the server of the mini program to be tested, and performing detection of the vulnerability of forged login request after third-party verification.

[0030] According to the system of the second aspect of the present invention, the first module obtains the source code of the mini-program client to be tested; wherein:

[0031] The client source code of the applet to be tested is encrypted and stored in a specific directory of the client computer. The KillWxapkg[] tool is called to decrypt, unpack and decompile the front-end wxapkg encrypted package of each applet in the applet dataset to be tested, thereby obtaining the front-end source code file of the applet to be tested as the client source code of the applet to be tested; the client source code of each applet to be tested is sent to the second module to perform subsequent vulnerability detection.

[0032] The third aspect of the present invention discloses an electronic device comprising a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the method for detecting a forged login request vulnerability after third-party verification based on data flow analysis according to the first aspect of the present disclosure.

[0033] A fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for detecting a forged login request vulnerability after third-party authentication based on data flow analysis according to the first aspect of the present disclosure.

[0034] The technical effects brought about by the present invention include: (1) accurately analyzing the callback functions in the mini-program client JavaScript code; (2) accurately analyzing the inter-procedural call of the mini-program client JavaScript code; (3) modeling the mini-program client-server interaction process; (4) statically analyzing the mini-program client source code packaged with webpack; and (5) effectively detecting the vulnerability of forged login requests after third-party verification in the mini-program ecosystem. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 This is a diagram of the normal third-party verification login process.

[0037] Figure 2 The following is a diagram of the login process with a vulnerability.

[0038] Figure 3 This is a flowchart of the vulnerability detection of forged login requests after third-party verification of a mini-program according to an embodiment of the present invention.

[0039] Figure 4 Schematic diagram of forgery vulnerability detection for login requests after third-party verification based on data flow analysis according to an embodiment of the present invention.

[0040] Figure 5 Schematic diagram of the interaction process between the mini program client and server according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0042] The present invention proposes a solution for detecting forged login request vulnerabilities in small programs based on data flow analysis. Figure 3 As shown, it mainly includes two modules (the first module and the second module respectively) for obtaining the source code of the mini program client to be tested and detecting the forged login request vulnerability after third-party verification based on data flow analysis.

[0043] In the above scheme, first, a large-scale collection of mini-programs is carried out to construct a data set of mini-programs to be tested, and then the mini-program front-end code decompilation tool is used to automatically decrypt and unpack the wxapkg encrypted package of the front-end of the mini-program to be tested to obtain the front-end source code file of the mini-program to be tested; then, the AST-based data flow analysis method is used to perform data flow analysis on the front-end source code of each mini-program to be tested. Since the vulnerability detection is forgery of login request after third-party verification, it is necessary to first identify the API (getPhoneNumber) parameter used in the third-party verification login process as the data source, and then analyze the flow of the data, model the client-server interaction, and obtain the mini-program client-server interaction process diagram, and finally perform forgery of login request after third-party verification.

[0044] 1. Obtain the source code of the mini program client to be tested

[0045] The mini-program client source code acquisition module (first module) proposed in this invention is used to construct a dataset of mini-programs under test and collect the client source code of the mini-programs under test. The WeChat mini-program client source code is encrypted and stored in a specific directory on the client computer. By using the KillWxapkg[] tool to decrypt and decompile the encrypted wxapkg file for each mini-program in the dataset, the source code of the mini-program under test can be obtained. Each mini-program client source code is then provided to a third-party post-verification login request forgery vulnerability detection module based on data flow analysis for vulnerability detection.

[0046] 2. Detection of forged login requests after third-party verification based on data flow analysis

[0047] The third-party post-authentication login request forgery vulnerability detection module (the second module) based on data flow analysis statically detects whether the mini program under test has a third-party post-authentication login request forgery vulnerability through steps such as data source identification and positioning, data flow analysis, client-server interaction modeling, and vulnerability detection. Figure 4 shown.

[0048] First, the data source is identified and located through collaborative analysis of the logic layer and the rendering layer. The JavaScript code and wxml file of the mini program are converted into an abstract syntax tree (AST) for analysis. The function named getPhoneNumber in the JavaScript code abstract syntax tree is first extracted. If it exists, the corresponding function parameter is identified as the data source; if not, the event function name bound to the getPhoneNumber API in the wxml file abstract syntax tree is extracted. Based on the event function name, the function with the corresponding function name is extracted from the JavaScript code abstract syntax tree, and its parameter is identified as the data source.

[0049] Then, the context-based data flow analysis method is used to analyze the data flow. Corresponding file context, object context, and function context are constructed for files, objects, and functions in JavaScript. The file inclusion characteristics of functions such as require in JavaScript are processed, and each included JavaScript file is used as a sub-file context. All defined functions are extracted and saved in the function table. When a function call is analyzed, it is determined whether there is a function declaration with the same name in the function table. If so, the declaration part of the corresponding function is entered to perform inter-procedural call analysis. According to the parameter position of the tracking variable in the function call, it is decided which variables to track in the function declaration part. When variable assignment is analyzed, if the right side is a tracked variable, the variable assigned on its left side is also added to the tracking variable set. When analyzing that a tracking variable is assigned to the corresponding attribute, when the object method is called, the assigned object attribute will continue to be kept in the tracking variable set.

[0050] Then, the interaction between the mini program client and server is modeled. By analyzing and processing the HTTP request function, a client-server interaction process diagram is modeled. According to the characteristics of the HTTP request function in the mini program JavaScript code, the function call expression in the analyzed data flow is analyzed, the HTTP request processing function and its callback function are identified, and the HTTP request parameters and request response, as well as the operations performed on the request response, are extracted. The client-server interaction process diagram is constructed, as shown in the figure below. Figure 5 shown.

[0051] Finally, the login request forgery vulnerability detection module after third-party verification is performed. The generated mini-program client-server interaction process diagram is used to judge whether there is a mobile phone number verification HTTP request that returns a plaintext mobile phone number, and whether there is a subsequent request that uses the response of the previous request as a parameter to send a login request. If so, there may be a login request forgery vulnerability after third-party verification. The mini-program client-server interaction process diagram and data flow analysis results are output to the analysis report.

[0052] It can be seen that the present invention can model the callback function, file inclusion (require), webpack packaging code, inter-process calls and mini-program client-server interaction process of the mini-program JavaScript client code, and thus effectively detect the third-party post-verification login request forgery vulnerability in the third-party authorized login scenario in the mini-program ecosystem.

[0053] In some embodiments, data source positioning based on collaborative analysis of the logic layer and the rendering layer includes: converting the javascript code and wxml file of the mini program into an abstract syntax tree (AST) for analysis, first extracting the function named getPhoneNumber in the abstract syntax tree of the javascript code, and if so, identifying the parameters of the corresponding function as the data source; if not, extracting the event function name bound to the getPhoneNumber API in the abstract syntax tree of the wxml file, extracting the function with the corresponding function name in the abstract syntax tree of the javascript code according to the event function name, and identifying its parameters as the data source.

[0054] In some embodiments, context-based data flow analysis includes: building corresponding contexts for files, objects, and functions in JavaScript. For the file inclusion characteristics of functions such as require, each included JavaScript file is used as a sub-file context, and all defined functions are extracted and saved in the function table. When a function call is analyzed, if there is a function declaration with the same name in the function table, the declaration part of the function is entered to perform inter-procedural call analysis. According to the parameter position of the tracking variable in the function call, it is decided which variables to track in the function declaration part. When a variable assignment is analyzed, if the right side is a tracked variable, the variable assigned to its left side is also added to the tracking variable set. When it is analyzed that a tracking variable is assigned to a corresponding attribute, the assigned object attribute will continue to be kept in the tracking variable set when the object method is called.

[0055] In some embodiments, client-server interaction modeling includes: identifying and analyzing HTTP request functions in the data stream based on the characteristics of the HTTP request function in the mini-program, processing callback functions, extracting HTTP request parameters and responses, and the client's operations on the HTTP response, and constructing a client-server interaction process diagram based on the time. The process diagram can accurately model the interaction process between the client and the server, accurately depicting the client-server interaction process. Based on the interaction process diagram, it can effectively determine whether the mini-program under test has a vulnerability in post-third-party verification login request forgery.

[0056] In summary, the technical solution disclosed in the present invention solves the technical problem that existing mini-program static detection methods are difficult to model the JavaScript language file includes (require), callback functions, webpack packaging, inter-procedural calls, and mini-program client-server interaction process. The present invention can effectively detect third-party post-verification login request forgery vulnerabilities in the mini-program ecosystem. Specific technical effects include: (1) accurate analysis of callback functions in the mini-program client JavaScript code; (2) accurate inter-procedural call analysis of the mini-program client JavaScript code; (3) modeling the mini-program client-server interaction process; (4) static analysis of the mini-program client source code packaged using webpack; and (5) effective detection of third-party post-verification login request forgery vulnerabilities in the mini-program ecosystem.

[0057] Please note that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above embodiments only express several implementation methods of the present application. The description is relatively specific and detailed, but it cannot be understood as a limitation on the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of this application, several variations and improvements can be made, which all fall within the scope of protection of this application. Therefore, the scope of protection of the patent in this application shall be based on the attached claims.

Claims

1. A method for detecting forged login requests after third-party authentication based on data flow analysis, characterized in that: The method comprises: Step S1: calling the first module, wherein the first module is configured to execute: obtaining the source code of the mini-program client to be tested; specifically including: Collect various mini-programs to construct a dataset of mini-programs to be tested; use a mini-program front-end code decompilation tool to automatically decrypt and unpack the wxapkg encrypted package of the mini-program to be tested, in order to obtain the front-end source code file of the mini-program to be tested; Step S2: calling the second module, wherein the second module is configured to perform: detecting a third-party post-authentication login request forgery vulnerability based on data flow analysis according to the source code of the mini-program client to be tested; specifically, including: Use AST-based data flow analysis to analyze the front-end source code files of each mini-program under test. Identify the API parameters used in the third-party verification login process as the data source and analyze the data flow therein. Model the interaction between the client and server of the mini-program under test to obtain a diagram of the interaction process between the client and server of the mini-program under test, and perform post-third-party verification login request forgery vulnerability detection. Among them, in step S2, the second module detects the vulnerability of forging login request after third-party verification; performing the forging vulnerability detection of login request after third-party verification; specifically includes: Based on the interaction process diagram, determine whether the HTTP request for verifying the mobile phone number returns a plaintext mobile phone number, and whether a subsequent request uses the plaintext mobile phone number in the response to the previous request as a parameter to send a login request. If at least one of the above two situations exists, there is a login request forgery vulnerability after third-party verification. Output the interaction process diagram and data flow analysis results to the analysis report.

2. The method for detecting a forged login request vulnerability after third-party verification based on data flow analysis according to claim 1, characterized in that: In step S1, the first module obtains the source code of the mini-program client to be tested; wherein: The client source code of the applet to be tested is encrypted and stored in a specific directory of the client computer. The KillWxapkg tool is called to decrypt, unpack and decompile the front-end wxapkg encrypted package of each applet in the applet data set to be tested, thereby obtaining the front-end source code file of the applet to be tested as the client source code of the applet to be tested; the client source code of each applet to be tested is sent to the second module to perform subsequent vulnerability detection.

3. The method for detecting a forged login request vulnerability after third-party verification based on data flow analysis according to claim 2, characterized in that: In step S2, the second module detects the vulnerability of forged login requests after third-party verification. The AST-based data flow analysis method is used to perform data flow analysis on the front-end source code files of each applet to be tested to identify the API parameters used in the third-party verification login process as the data source. Specifically, the following steps are performed: Through collaborative analysis between the logic layer and the rendering layer, the data source is identified and located, and the JavaScript code and wxml file of the applet to be tested are converted into an abstract syntax tree (AST). Extract the function named getPhoneNumber from the javascript code abstract syntax tree AST; if the extraction is successful, identify the API parameters of the corresponding function as the data source; if the extraction is unsuccessful, extract the event function name of the getPhoneNumber API bound to the wxml file abstract syntax tree AST, extract the function with the corresponding function name in the javascript code abstract syntax tree AST according to the event function name, and identify its API parameters as the data source.

4. The method for detecting a forged login request vulnerability after third-party verification based on data flow analysis according to claim 3, characterized in that: In step S2, the second module detects the vulnerability of forged login request after third-party verification, wherein the data flow is analyzed, specifically including: Construct corresponding file context, object context, and function context for files, objects, and functions in JavaScript respectively; Take each JavaScript file included in the file of the require function in the JavaScript language as a sub-file context, extract all the functions defined in it and save them in the function table; When a function call is analyzed, determine whether there is a function declaration with the same name in the function table; if so, enter the corresponding function declaration part and perform inter-procedural call analysis. According to the parameter position of the tracking variable in the function call, determine the variable to be tracked in the function declaration part; When analyzing variable assignments, if the right side is a tracking variable, the variable assigned on the left side is added to the tracking variable set; When it is analyzed that a tracking variable is assigned to a corresponding attribute, the assigned object attribute will continue to be kept in the tracking variable collection.

5. The method for detecting a forged login request vulnerability after third-party verification based on data flow analysis according to claim 4, characterized in that: In step S2, the second module detects the vulnerability of forged login request after third-party verification; wherein, the client and server of the applet to be tested are interactively modeled to obtain an interaction process diagram between the client and server of the applet to be tested; specifically, the following steps are included: According to the characteristics of the HTTP request function in the mini-program JavaScript code, the function call expression in the data flow is analyzed, the HTTP request processing function and callback function are identified, and the HTTP request parameters, request response, and operations performed on the request response are extracted, thereby constructing the interaction process diagram between the client and the server.

6. A third-party post-authentication login request forgery vulnerability detection system based on data flow analysis, characterized in that: The system comprises a first module and a second module; wherein: The first module is configured to execute: obtaining the client source code of the mini-program to be tested; specifically, collecting various mini-programs to construct a data set of the mini-program to be tested; using a mini-program front-end code decompilation tool to automatically decrypt and unpack the wxapkg encrypted package of the front-end of the mini-program to be tested to obtain the front-end source code file of the mini-program to be tested; The second module is configured to perform: based on the source code of the mini program client under test, detecting the vulnerability of forged login request after third-party verification based on data flow analysis; specifically including: using AST-based data flow analysis to perform data flow analysis on the front-end source code files of each mini program under test; identifying API parameters used in the third-party verification login process as data sources and analyzing the data flow therein; modeling the interaction between the client and server of the mini program under test, obtaining an interaction process diagram between the client and server of the mini program under test, and performing forged login request vulnerability detection after third-party verification; The second module detects the vulnerability of forged login request after third-party verification; the detection of forged login request after third-party verification is performed; specifically, the detection includes: Based on the interaction process diagram, determine whether the HTTP request for verifying the mobile phone number returns a plaintext mobile phone number, and whether a subsequent request uses the plaintext mobile phone number in the response to the previous request as a parameter to send a login request. If at least one of the above two situations exists, there is a login request forgery vulnerability after third-party verification. Output the interaction process diagram and data flow analysis results to the analysis report.

7. A third-party post-verification login request forgery vulnerability detection system based on data flow analysis according to claim 6, characterized in that: The first module obtains the source code of the mini program client to be tested; wherein: The client source code of the applet to be tested is encrypted and stored in a specific directory of the client computer. The KillWxapkg tool is called to decrypt, unpack and decompile the front-end wxapkg encrypted package of each applet in the applet data set to be tested, thereby obtaining the front-end source code file of the applet to be tested as the client source code of the applet to be tested; the client source code of each applet to be tested is sent to the second module to perform subsequent vulnerability detection.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the method for detecting a forged login request vulnerability after third-party verification based on data flow analysis as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the method for detecting a forged login request vulnerability after third-party verification based on data flow analysis as described in any one of claims 1 to 5.

Images