Iterative penetration testing method for mobile application vulnerabilities based on dynamic environment adaptation

Abstract

The present invention relates to the field of mobile application security testing, and specifically to an iterative penetration testing method for mobile application vulnerabilities based on dynamic environment adaptation. First, code parsing is performed to generate an abstract syntax tree, the abstract syntax tree is traversed to extract nodes related to risk component calls, a potential risk node set is constructed, and penetration testing is performed on all nodes in the potential risk node set to verify whether vulnerabilities actually exist, and a first vulnerability node set is constructed; after the mobile application version is upgraded, code difference analysis is performed to automatically identify modified and newly added parts of the code, and penetration testing is triggered in a targeted manner to focus on newly added risk points and promptly discover newly added vulnerabilities. By iterative penetration testing of the upgraded version, the accuracy of vulnerability detection can be improved, dynamic environmental changes can be better adapted, and vulnerabilities can be accurately located.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile application security testing, and in particular to a mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation. Background Art

[0002] Mobile application vulnerabilities can lead to serious consequences such as data leaks and business interruptions. Certain components in mobile applications, particularly due to design, implementation, or configuration issues, are easy targets for attackers. Rapid mobile application upgrades, while introducing new features and user experiences, also increase the risk of vulnerability introduction. Mobile application upgrades are a key vulnerability risk point that requires careful monitoring in dynamic environments. Furthermore, the call chain of various components in mobile applications may involve multiple dependent libraries, and the interdependencies between these libraries can increase the attack surface.

[0003] Testing for mobile application vulnerabilities relies on penetration testing. Penetration testing, as a security testing method, can identify and verify potential security vulnerabilities in mobile applications by simulating the behavior of malicious attackers. Traditional penetration testing methods are manually performed by professional security experts, relying heavily on manual labor and requiring long testing cycles, making them inadequate for responding to the rapid iterations of mobile applications. While manual testing can be combined with automated tools for large-scale vulnerability testing of mobile applications, the need for repeated, redundant testing for each version of the mobile application, coupled with dynamic changes in the mobile application environment, such as version upgrades, results in inefficient testing and makes it difficult to quickly identify and locate new vulnerability risks. Summary of the Invention

[0004] In order to solve the above problems raised in the background technology, the present invention provides a mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation.

[0005] The technical solutions of the present invention are as follows:

[0006] A mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation includes the following steps:

[0007] S1. Obtain the APK file of the current version of the mobile application, decompile it to obtain the compiled code, parse the compiled code, generate an abstract syntax tree based on the logical call relationship of the function, traverse the abstract syntax tree to extract risk nodes related to the call of the risk component, and construct a potential risk node set based on all nodes;

[0008] S2. Perform penetration testing on all nodes in the potential risk node set, mark the nodes with vulnerabilities as Class 1 vulnerability nodes, and construct a first vulnerability node set based on all Class 1 vulnerability nodes;

[0009] S3. Scan the external dependency libraries used by each node in the potential risk node set for vulnerabilities, mark the nodes corresponding to the external dependency libraries with vulnerabilities as Class II vulnerability nodes, and add the Class II vulnerability nodes to the first vulnerability node set;

[0010] Associating the node positions of the first-category vulnerability nodes and the second-category vulnerability nodes in the abstract syntax tree with the first vulnerability node set respectively;

[0011] S4. Repeat S1 for the updated version of the mobile application to construct an iterative risk node set, perform node difference analysis on the iterative risk node set and the potential risk node set, and obtain difference nodes: newly added nodes, deleted nodes, and modified nodes;

[0012] S5. Perform penetration testing on the newly added nodes and modified nodes to obtain a type of difference vulnerability node; perform vulnerability scanning on the external dependency libraries used by the newly added nodes and modified nodes to obtain a type of difference vulnerability node; update the type of difference vulnerability nodes and the type of difference vulnerability nodes to the first vulnerability node set to obtain a second vulnerability node set, associate the node positions of the type of difference vulnerability nodes and the type of difference vulnerability nodes in the abstract syntax tree to the second vulnerability node set respectively, and obtain the vulnerability test results of the updated version of the mobile application.

[0013] Specifically, in S5, the first-class difference vulnerability nodes and the second-class difference vulnerability nodes are updated to the first vulnerability node set according to the set vulnerability node update rule, specifically:

[0014] Perform penetration testing on newly added nodes: If the obtained first-class difference vulnerability nodes and second-class difference vulnerability nodes are newly added vulnerability nodes, add them to the second vulnerability node set;

[0015] Perform penetration testing on the modified nodes: If the obtained Class I difference vulnerability node or Class II difference vulnerability node is a new vulnerability node, add it to the second vulnerability node set; if the Class I vulnerability node or Class II vulnerability node existing in the risk node before the update is repaired and there is no new vulnerability node, delete this risk node from the first vulnerability node set.

[0016] In S2, penetration testing is performed on all nodes in the potential risk node set to obtain vulnerable nodes with vulnerabilities. The process of penetration testing is: dynamic detection tools are used to perform dynamic verification of weak key security, SQL attack injection, and authentication bypass on all nodes in the potential risk node set, and corresponding vulnerable nodes with different types of vulnerabilities such as weak key security vulnerabilities, SQL attack injection vulnerabilities, and authentication bypass vulnerabilities are obtained.

[0017] In the S3, vulnerability scanning is performed on the external dependency libraries used by each node in the potential risk node set, and the nodes corresponding to the external dependency libraries with vulnerabilities scanned are marked as Class II vulnerability nodes, and vulnerability information of each external dependency library is obtained. The vulnerability information includes: number of vulnerabilities, vulnerability number, and vulnerability CVSS score.

[0018] Furthermore, the risk score of the external dependency library is calculated based on the number of vulnerabilities and the CVSS score of the vulnerability. External dependency libraries with a risk score greater than or equal to the risk score threshold are included in the dependency library blacklist for mobile application version updates. The risk score calculation formula is as follows:

[0019]

[0020] Among them, R is the risk score, n is the number of vulnerabilities in the external dependency library, N is the number of code blocks called by the external dependency library, and w i is the weighted coefficient corresponding to vulnerability i, CVSS i The CVSS score of vulnerability i.

[0021] Perform a penetration test on the deleted nodes obtained in S4: if there is a Class I vulnerability node or a Class II vulnerability node in the corresponding deleted risk node before the update, delete the risk node from the first vulnerability node set.

[0022] In S1, the abstract syntax tree is traversed to extract nodes related to risk component calls. The risk components include the Activity component, Service component, Content Provider component, and Broadcast Receiver component of the mobile application.

[0023] The present invention also provides a mobile application vulnerability iterative penetration testing system based on dynamic environment adaptation, comprising:

[0024] Code parsing module: This module is used to obtain the APK file of the current version of the mobile application, decompile it to obtain the compiled code, parse the compiled code, generate an abstract syntax tree based on the logical call relationship of the function, traverse the abstract syntax tree to extract risk nodes related to risky component calls, and construct a potential risk node set based on all nodes;

[0025] Class I vulnerability confirmation module: used to perform penetration testing on all nodes in the potential risk node set, mark the nodes with vulnerabilities as Class I vulnerability nodes, and build the first vulnerability node set based on all Class I vulnerability nodes;

[0026] The second-category vulnerability confirmation module is used to scan vulnerabilities in the external dependency libraries used by each node in the potential risk node set, mark the nodes corresponding to the external dependency libraries with vulnerabilities scanned as second-category vulnerability nodes, and add the second-category vulnerability nodes to the first vulnerability node set; and associate the node positions of the first-category vulnerability nodes and the second-category vulnerability nodes in the abstract syntax tree with the first vulnerability node set respectively;

[0027] Difference analysis module: used to repeatedly execute S1 on the updated version of the mobile application, build an iterative risk node set, perform node difference analysis on the iterative risk node set and the potential risk node set, and obtain difference nodes: newly added nodes, deleted nodes, and modified nodes;

[0028] Iterative penetration testing module: used to trigger penetration testing on newly added nodes and modified nodes to obtain a type of difference vulnerability node; perform vulnerability scanning on the external dependency libraries used by newly added nodes and modified nodes to obtain a type of difference vulnerability node; update the type of difference vulnerability nodes and the type of difference vulnerability nodes to the first vulnerability node set to obtain a second vulnerability node set, and associate the node positions of the type of difference vulnerability nodes and the type of difference vulnerability nodes in the abstract syntax tree to the second vulnerability node set respectively to obtain the vulnerability test results of the updated version of the mobile application.

[0029] In addition, the present invention provides an iterative penetration testing device for mobile application vulnerabilities based on dynamic environment adaptation, comprising a processor and a memory, wherein the processor implements the iterative penetration testing method for mobile application vulnerabilities based on dynamic environment adaptation as described above when executing a computer program stored in the memory.

[0030] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps of the mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation as described above.

[0031] The beneficial effects of the present invention are:

[0032] 1. The iterative penetration testing method for mobile application vulnerabilities based on dynamic environment adaptation provided by the present invention first performs code parsing to generate an abstract syntax tree, traverses the abstract syntax tree to extract nodes related to risk component calls, constructs a potential risk node set, performs penetration testing on all nodes in the potential risk node set, verifies whether there are real vulnerabilities, and constructs a first vulnerability node set; after the mobile application version is upgraded, code difference analysis is performed to automatically identify modified and newly added parts of the code, and targeted penetration testing is triggered to focus on new risk points and promptly discover new vulnerabilities, with low manpower investment and fast response speed. By iterative penetration testing of the upgraded version, the accuracy of vulnerability detection can be improved, better adapting to dynamic environmental changes, and accurate positioning of vulnerabilities can be achieved.

[0033] 2. This invention reduces the possibility of attackers exploiting these vulnerabilities by comprehensively analyzing the vulnerability risks of each component of the mobile application itself and external libraries, thereby more effectively identifying and repairing potential security risks, thereby significantly improving the overall security of the mobile application. DETAILED DESCRIPTION

[0034] Exemplary embodiments of the present disclosure will be described in more detail below.

[0035] Example

[0036] This embodiment provides a mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation, including the following steps:

[0037] S1. Obtain the APK file of the current version of the mobile application, decompile it to obtain the compiled code, parse the compiled code, generate an abstract syntax tree based on the logical call relationship of the function, traverse the abstract syntax tree to extract risk nodes related to the risk component call, and construct a potential risk node set based on all nodes.

[0038] In step S1, the APK file contains all the bytecodes of the mobile application after code compilation. However, this bytecode cannot be read directly and needs to be decompiled to convert it into readable compiled code. For example, the APK file can be decompiled using the apktool decompilation tool to obtain the compiled code. The compiled code can be parsed using a parsing library, such as the existing JavaParser, to generate an abstract syntax tree (AST) based on the logical call relationships of the functions.

[0039] Traverse the abstract syntax tree to extract nodes related to calls to risky components. Risky components include the Activity component, Service component, Content Provider component, and Broadcast Receiver component of the mobile application. The Activity component is used to manage the user interface of the mobile application and is the component responsible for interacting with the user. Improper settings may lead to unauthorized access to the mobile application. The Service component runs in the background as a service component of the mobile application. If it is called maliciously, it may lead to the leakage of mobile users' personal information and data, or cause service interruption. The Content Provider component is used to share data between mobile applications and may lead to information leakage. The Broadcast Receiver component is used to receive and respond to broadcast messages. If it is maliciously exploited, it may lead to serious consequences such as the leakage of sensitive information.

[0040] S2. Perform penetration testing on all nodes in the potential risk node set, mark the nodes with vulnerabilities as Class I vulnerability nodes, construct a first vulnerability node set based on all Class I vulnerability nodes, and associate the node positions of the Class I vulnerability nodes in the abstract syntax tree with the first vulnerability node set.

[0041] Penetration testing is performed on all nodes in the potential risk node set to obtain vulnerable nodes with vulnerabilities. The penetration testing process is as follows: dynamic detection tools are used to perform dynamic verification of weak key security, SQL attack injection, and authentication bypass on all nodes in the potential risk node set, and corresponding vulnerable nodes with different types of vulnerabilities, such as weak key security vulnerabilities, SQL attack injection vulnerabilities, and authentication bypass vulnerabilities, are obtained.

[0042] Table 1 Example script for verifying the security of weak keys

[0043]

[0044]

[0045] When conducting a penetration test, a hook script is written using the Frida dynamic verification tool. For example, Table 1 shows a script for verifying an AES weak key. First, it confirms whether the mobile application uses the ECB encryption mode (line 6) and tests whether the data can be decrypted by dynamically injecting the weak key (lines 10-12). This is a simple example. By defining a hard-coded key "123456789" and calling this.init() to force the key to be replaced, in an actual penetration test, the key is stolen by searching the memory using Frida's Memory.scan() and extracting the real key, rather than replacing it with a hard-coded key. When the original result is returned to continue execution on line 13, the key has been replaced with a custom value. If the mobile application can decrypt encrypted data due to the weak key replacement, the vulnerability is established and there is a vulnerability.

[0046] Table 2 Example script for verifying SQL injection attacks

[0047]

[0048] First, use Java.use to obtain a reference to the native SQLiteDatabase class of the node code program in the mobile application (line 1). Then, the SQL statements are recorded and all executed SQL statements are output (lines 3-4). The SQL statements are checked to see if they contain UNION SELECT, a common attack method for SQL injection. If the SQL statement contains UNION SELECT, the vulnerability confirmation information is output (lines 5-9).

[0049] Table 3 Example script for verifying authentication bypass

[0050]

[0051] Table 3 provides an authentication bypass hook script that implements an authentication bypass vulnerability, returning true regardless of the password entered. Line 2 dynamically obtains a reference to the target class com.example.auth.AuthHelper. By recording the passed password and forcing a true return (lines 3-7), password verification always succeeds, effectively bypassing authentication and establishing the vulnerability.

[0052] S3. Perform vulnerability scan on the external dependency libraries used by each node in the potential risk node set, mark the nodes corresponding to the external dependency libraries with vulnerabilities scanned as second-class vulnerability nodes, add the second-class vulnerability nodes to the first vulnerability node set, and associate the node positions of the second-class vulnerability nodes in the abstract syntax tree with the first vulnerability node set.

[0053] Perform vulnerability scans on the external dependency libraries used by each node in the potential risk node set. For example, you can use OWASP Dependency-Check to scan the external dependency libraries used by each node to obtain vulnerability information for each external dependency library. The vulnerability information includes: number of vulnerabilities, vulnerability numbers, and vulnerability CVSS scores. Mark the nodes corresponding to the external dependency libraries with vulnerabilities as Class II vulnerability nodes.

[0054] Furthermore, the risk score of the external dependency library is calculated based on the number of vulnerabilities and the CVSS score of the vulnerability. External dependency libraries with a risk score greater than or equal to the risk score threshold are included in the dependency library blacklist for mobile application version updates. The risk score calculation formula is as follows:

[0055]

[0056] Among them, R is the risk score, n is the number of vulnerabilities in the external dependency library, N is the number of code blocks called by the external dependency library, and w i is the weighted coefficient corresponding to vulnerability i, CVSS i The CVSS score of vulnerability i.

[0057] S4. Repeat S1 for the updated version of the mobile application to construct an iterative risk node set, perform node difference analysis on the iterative risk node set and the potential risk node set, and obtain difference nodes: newly added nodes, deleted nodes, and modified nodes.

[0058] In step S4, the node difference analysis algorithm is used to perform node difference analysis on the iterative risk node set and the potential risk node set, as shown in Table 4.

[0059] Table 4 Node difference analysis algorithm

[0060]

[0061]

[0062] In the algorithm of Table 4, the function diff_analysis is defined to compare the two sets of potential risk nodes (old_set) and iterative risk nodes (new_set). If a node exists in the iterative risk node set but not in the potential risk node set, it is a newly added node (row 2). If a node exists in the potential risk node set but not in the iterative risk node set, it is a deleted node (row 3). If a node is partially modified, it is a modified node (rows 4-7).

[0063] S5. Perform penetration testing on the newly added nodes and modified nodes to obtain a type of difference vulnerability node; perform vulnerability scanning on the external dependency libraries used by the newly added nodes and modified nodes to obtain a type of difference vulnerability node; update the type of difference vulnerability nodes and the type of difference vulnerability nodes to the first vulnerability node set to obtain a second vulnerability node set, associate the node positions of the type of difference vulnerability nodes and the type of difference vulnerability nodes in the abstract syntax tree to the second vulnerability node set respectively, and obtain the vulnerability test results of the updated version of the mobile application.

[0064] In step S5, the first-class difference vulnerability nodes and the second-class difference vulnerability nodes are updated to the first vulnerability node set according to the set vulnerability node update rule, specifically:

[0065] Perform penetration testing on newly added nodes: If the obtained first-class difference vulnerability nodes and second-class difference vulnerability nodes are newly added vulnerability nodes, add them to the second vulnerability node set;

[0066] Perform penetration testing on the modified nodes: If the obtained Class I difference vulnerability node or Class II difference vulnerability node is a new vulnerability node, add it to the second vulnerability node set; if the Class I vulnerability node or Class II vulnerability node existing in the risk node before the update is repaired and there is no new vulnerability node, delete this risk node from the first vulnerability node set.

[0067] Perform penetration testing on the obtained deleted nodes: if there is a Class I vulnerability node or a Class II vulnerability node in the corresponding deleted risk node before the update, delete this risk node from the first vulnerability node set.

[0068] As shown in Table 5, set V1 is defined as the first vulnerability node set, V1_updated is defined as the updated first vulnerability node set, and V2 is defined as the second vulnerability node set. Newly added vulnerability nodes are added to the second vulnerability node set (lines 4-10). If there are no new vulnerabilities and the original vulnerability has been fixed, the risk node is deleted from the first vulnerability node set (lines 11-24). This also includes deleting the vulnerability associated with the deleted node from the first vulnerability node set (lines 25-27).

[0069] Table 5 Vulnerability node update rule algorithm

[0070]

[0071]

[0072] The present invention also provides a mobile application vulnerability iterative penetration testing system based on dynamic environment adaptation, comprising:

[0073] Code parsing module: This module is used to obtain the APK file of the current version of the mobile application, decompile it to obtain the compiled code, parse the compiled code, generate an abstract syntax tree based on the logical call relationship of the function, traverse the abstract syntax tree to extract risk nodes related to risky component calls, and construct a potential risk node set based on all nodes;

[0074] Class I vulnerability confirmation module: used to perform penetration testing on all nodes in the potential risk node set, mark the nodes with vulnerabilities as Class I vulnerability nodes, and build the first vulnerability node set based on all Class I vulnerability nodes;

[0075] The second-category vulnerability confirmation module is used to scan vulnerabilities in the external dependency libraries used by each node in the potential risk node set, mark the nodes corresponding to the external dependency libraries with vulnerabilities scanned as second-category vulnerability nodes, and add the second-category vulnerability nodes to the first vulnerability node set; and associate the node positions of the first-category vulnerability nodes and the second-category vulnerability nodes in the abstract syntax tree with the first vulnerability node set respectively;

[0076] Difference analysis module: used to repeatedly execute S1 on the updated version of the mobile application, build an iterative risk node set, perform node difference analysis on the iterative risk node set and the potential risk node set, and obtain difference nodes: newly added nodes, deleted nodes, and modified nodes;

[0077] Iterative penetration testing module: used to trigger penetration testing on newly added nodes and modified nodes to obtain a type of difference vulnerability node; perform vulnerability scanning on the external dependency libraries used by newly added nodes and modified nodes to obtain a type of difference vulnerability node; update the type of difference vulnerability nodes and the type of difference vulnerability nodes to the first vulnerability node set to obtain a second vulnerability node set, and associate the node positions of the type of difference vulnerability nodes and the type of difference vulnerability nodes in the abstract syntax tree to the second vulnerability node set respectively to obtain the vulnerability test results of the updated version of the mobile application.

[0078] In addition, the present invention also provides a mobile application vulnerability iterative penetration testing device based on dynamic environment adaptation, including a processor and a memory, wherein the processor implements the mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation as described above when executing the computer program stored in the memory.

[0079] Finally, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation as described above.

[0080] The present invention provides an iterative penetration testing method for mobile application vulnerabilities based on dynamic environment adaptation. The method first performs code parsing to generate an abstract syntax tree, traverses the abstract syntax tree to extract nodes related to risk component calls, constructs a potential risk node set, performs penetration testing on all nodes in the potential risk node set, verifies whether there are actually vulnerabilities, and constructs a first vulnerability node set. After the mobile application version is upgraded, code difference analysis is performed to automatically identify the modified and newly added parts of the code, and targeted penetration testing is triggered to focus on new risk points and timely discover new vulnerabilities. By iterative penetration testing of the upgraded version, the accuracy of vulnerability detection can be improved, and the system can better adapt to dynamic environmental changes and accurately locate vulnerabilities. By comprehensively analyzing the vulnerability risks of each component of the mobile application itself and the external library, the possibility of attackers exploiting these vulnerabilities to attack is reduced, so that potential security risks can be more effectively identified and repaired, thereby significantly improving the overall security of the mobile application.

Claims

1. A mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation, characterized in that: The following steps are involved: S1. Obtain the APK file of the current version of the mobile application, decompile it to obtain the compiled code, parse the compiled code, generate an abstract syntax tree based on the logical call relationship of the function, traverse the abstract syntax tree to extract risk nodes related to the call of the risk component, and construct a potential risk node set based on all nodes; S2. Perform penetration testing on all nodes in the potential risk node set, mark the nodes with vulnerabilities as Class 1 vulnerability nodes, and construct a first vulnerability node set based on all Class 1 vulnerability nodes; S3. Scan the external dependency libraries used by each node in the potential risk node set for vulnerabilities, mark the nodes corresponding to the external dependency libraries with vulnerabilities as Class II vulnerability nodes, and add the Class II vulnerability nodes to the first vulnerability node set; Associating the node positions of the first-category vulnerability nodes and the second-category vulnerability nodes in the abstract syntax tree with the first vulnerability node set respectively; S4. Repeat S1 for the updated version of the mobile application to construct an iterative risk node set, perform node difference analysis on the iterative risk node set and the potential risk node set, and obtain difference nodes: newly added nodes, deleted nodes, and modified nodes; S5. Perform penetration testing on newly added nodes and modified node triggers to obtain a class of differential vulnerability nodes; Perform vulnerability scans on external dependency libraries used by newly added and modified nodes to obtain the second type of differential vulnerability nodes; The first-category difference vulnerability nodes and the second-category difference vulnerability nodes are updated to the first vulnerability node set to obtain the second vulnerability node set, and the node positions of the first-category difference vulnerability nodes and the second-category difference vulnerability nodes in the abstract syntax tree are respectively associated with the second vulnerability node set to obtain the vulnerability test results of the updated version of the mobile application.

2. The mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation according to claim 1 is characterized in that: In S5, the first-class difference vulnerability nodes and the second-class difference vulnerability nodes are updated to the first vulnerability node set according to the set vulnerability node update rule, specifically: Perform penetration testing on newly added nodes: If the obtained first-class difference vulnerability nodes and second-class difference vulnerability nodes are newly added vulnerability nodes, add them to the second vulnerability node set; Perform penetration testing on the modified nodes: If the obtained Class I difference vulnerability node or Class II difference vulnerability node is a new vulnerability node, add it to the second vulnerability node set; if the Class I vulnerability node or Class II vulnerability node existing in the risk node before the update is repaired and there is no new vulnerability node, delete this risk node from the first vulnerability node set.

3. The mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation according to claim 1 is characterized in that: In S2, penetration testing is performed on all nodes in the potential risk node set. The process of penetration testing is: dynamic detection tools are used to perform dynamic verification of weak key security, SQL attack injection, and authentication bypass on all nodes in the potential risk node set, and corresponding vulnerability nodes with different types of vulnerabilities such as weak key security vulnerabilities, SQL attack injection vulnerabilities, and authentication bypass vulnerabilities are obtained.

4. The mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation according to claim 1 is characterized in that: In the S3, vulnerability scanning is performed on the external dependency libraries used by each node in the potential risk node set, and the nodes corresponding to the external dependency libraries with vulnerabilities scanned are marked as Class II vulnerability nodes. The vulnerability information of the external dependency libraries includes: the number of vulnerabilities, the vulnerability number, and the vulnerability CVSS score.

5. The mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation according to claim 4 is characterized in that: The risk score of the external dependency library is calculated based on the number of vulnerabilities and the CVSS score of the vulnerability. External dependency libraries with a risk score greater than or equal to the risk score threshold are included in the dependency library blacklist for mobile application version updates. The risk score calculation formula is as follows: in, R is the risk score, n is the number of vulnerabilities in external dependent libraries, N The number of code blocks called by external dependent libraries, w i For the corresponding vulnerability i Weighted coefficient, CVSS i For vulnerabilities i CVSS score.

6. The mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation according to claim 1 is characterized in that: Perform a penetration test on the deleted nodes obtained in S4: if there is a Class I vulnerability node or a Class II vulnerability node in the corresponding deleted risk node before the update, delete the risk node from the first vulnerability node set.

7. The mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation according to claim 1 is characterized in that: In S1, the abstract syntax tree is traversed to extract nodes related to risk component calls. The risk components include the Activity component, Service component, Content Provider component, and Broadcast Receiver component of the mobile application.

8. A mobile application vulnerability iterative penetration testing system based on dynamic environment adaptation, characterized in that: include: Code parsing module: This module is used to obtain the APK file of the current version of the mobile application, decompile it to obtain the compiled code, parse the compiled code, generate an abstract syntax tree based on the logical call relationship of the function, traverse the abstract syntax tree to extract risk nodes related to risky component calls, and construct a potential risk node set based on all nodes; Class I vulnerability confirmation module: used to perform penetration testing on all nodes in the potential risk node set, mark the nodes with vulnerabilities as Class I vulnerability nodes, and build the first vulnerability node set based on all Class I vulnerability nodes; The second-class vulnerability confirmation module is used to scan vulnerabilities in the external dependency libraries used by each node in the potential risk node set, mark the nodes corresponding to the external dependency libraries with vulnerabilities scanned as second-class vulnerability nodes, and add the second-class vulnerability nodes to the first vulnerability node set; Associating the node positions of the first-category vulnerability nodes and the second-category vulnerability nodes in the abstract syntax tree with the first vulnerability node set respectively; Difference analysis module: used to repeatedly execute S1 on the updated version of the mobile application, build an iterative risk node set, perform node difference analysis on the iterative risk node set and the potential risk node set, and obtain difference nodes: newly added nodes, deleted nodes, and modified nodes; Iterative penetration testing module: used to trigger penetration testing on newly added nodes and modified nodes to obtain a class of differential vulnerability nodes; Perform vulnerability scans on external dependency libraries used by newly added and modified nodes to obtain the second type of differential vulnerability nodes; The first-category difference vulnerability nodes and the second-category difference vulnerability nodes are updated to the first vulnerability node set to obtain the second vulnerability node set, and the node positions of the first-category difference vulnerability nodes and the second-category difference vulnerability nodes in the abstract syntax tree are respectively associated with the second vulnerability node set to obtain the vulnerability test results of the updated version of the mobile application.

9. A mobile application vulnerability iterative penetration testing device based on dynamic environment adaptation, characterized in that: The method comprises a processor and a memory, wherein when the processor executes the computer program stored in the memory, the method implements the mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, it implements the mobile application vulnerability iterative penetration testing method based on dynamic environment adaptation as described in any one of claims 1 to 7.

Images