Security test method, device and system for application program

Abstract

The embodiment of the invention discloses a security test method, device and system for an application program. A Java Agent is injected into a detected application program, a method function meeting conditions is obtained through the Java Agent, a detection code is inserted into the method function, after an access request of a client to the detected application program is obtained, a parameter value in the access request is replaced with a feature character string, and when the method function containing the feature character string is called, the detected application program is called. And obtaining detection data through the detection code. Therefore, the input source can be automatically found, data circulation can be accurately tracked, and the coverage rate and accuracy of security detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and system for security testing of an application program. Background Art

[0002] With the development of information technology, the complexity of web applications has increased, and their security has become a crucial area. As a key means to ensure the security of web applications, the importance of application security testing technology is self-evident.

[0003] The current mainstream application security testing technologies include static application security testing (SAST), dynamic application security testing (DAST) and interactive application security testing (IAST).

[0004] When dealing with scenarios like framework encapsulation and reflection calls, SAST is prone to missing source points and interrupting data flow tracking, resulting in a high false negative rate. DAST cannot perceive the data flow within the application, limiting its accuracy. IAST only instrumented predefined data flow nodes, resulting in incomplete coverage. Summary of the Invention

[0005] In view of this, an object of the embodiments of the present invention is to provide a method, device, and system for security testing of an application program, which can improve the coverage and accuracy of security testing.

[0006] In a first aspect, an embodiment of the present invention provides a method for security testing of an application program, the method comprising:

[0007] Inject Java Agent into the application under test;

[0008] Obtaining a method function that meets the conditions through the Java Agent, and inserting a detection code into the method function;

[0009] Obtain access requests from the client to the application under test;

[0010] Replacing the parameter value in the access request with a characteristic character string;

[0011] When the method function containing the characteristic character string is called, detection data is obtained through the detection code.

[0012] In some embodiments, the method further comprises:

[0013] Deduplication is performed on the access request.

[0014] In some embodiments, the characteristic string includes a specified prefix and a random number.

[0015] In some embodiments, when the method function containing the characteristic string is called, obtaining the detection data through the detection code includes:

[0016] sending the modified access request to the application under test;

[0017] Processing the modified access request by the application under test, and obtaining relevant information by the detection code when a method function containing the characteristic string in the application under test is called, the relevant information including input parameters and return values;

[0018] Detection data is generated according to the relevant information, where the detection data includes at least one of a feature string, a return value, and call stack data.

[0019] In some embodiments, the method further comprises:

[0020] Sending the detection data to the control terminal;

[0021] The detection data is visually displayed through the control terminal.

[0022] In some embodiments, the method further comprises:

[0023] Input source construction and generation are performed through the control terminal.

[0024] In some embodiments, constructing and generating the input source through the control terminal includes:

[0025] analyzing the detection data to identify potential input sources;

[0026] generating simulated input data corresponding to the potential input source;

[0027] Generate a propagation path, wherein the propagation path is a flow path of data in the application program starting from an input source;

[0028] A test file is generated according to the simulated input data and propagation path.

[0029] In some embodiments, the method further comprises:

[0030] Perform security checks based on the test file.

[0031] In a second aspect, an embodiment of the present invention provides a security testing system for an application program, the system comprising:

[0032] A feature injection module is used to obtain a client's access request to the application under test and replace the parameter value in the access request with a feature string;

[0033] The application under test;

[0034] The data processing module is used to inject a Java Agent into the application under test, obtain a method function that meets the conditions through the Java Agent, and insert a detection code into the method function. When the method function containing the characteristic string is called, the detection data is obtained through the detection code.

[0035] In some embodiments, the system further comprises:

[0036] The control terminal is used to visualize the detection data.

[0037] In some embodiments, the control end is also used to construct and generate input sources.

[0038] In a third aspect, an embodiment of the present invention provides a security testing device for an application program, the device comprising:

[0039] Injection unit, used to inject Java Agent into the application under test;

[0040] An inserting unit, configured to obtain a method function that meets a condition through the Java Agent and insert a detection code into the method function;

[0041] A request acquisition unit, used to obtain the client's access request to the application under test;

[0042] a replacing unit, configured to replace a parameter value in the access request with a characteristic character string;

[0043] The data acquisition unit acquires detection data through the detection code when the method function containing the characteristic character string is called.

[0044] In a fourth aspect, an embodiment of the present invention provides an electronic device comprising a memory and a processor, wherein the memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method described in the first aspect.

[0045] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer program instructions, which implement the method described in the first aspect when executed by a processor.

[0046] The technical solution of this embodiment of the present invention injects a Java Agent into the application under test. This agent retrieves method functions that meet certain criteria and inserts detection code into these methods. After receiving a client's access request to the application under test, the parameter values ​​in the access request are replaced with a signature string. When the method function containing the signature string is called, the detection code retrieves detection data. This enables automated discovery of input sources and accurate tracking of data flows, improving the coverage and accuracy of security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0048] Figure 1 is a schematic diagram of a safety testing system according to an embodiment of the present invention;

[0049] Figure 2 is a flow chart of a security testing method for an application according to an embodiment of the present invention;

[0050] Figure 3 is a flow chart of obtaining detection data according to an embodiment of the present invention;

[0051] Figure 4 is a flow chart of input source construction and generation according to an embodiment of the present invention;

[0052] Figure 5 is a schematic diagram of a safety testing device according to an embodiment of the present invention;

[0053] Figure 6 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The present application is described below based on the following embodiments, but the present application is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without the description of these details. To avoid obscuring the essence of the present application, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0055] Furthermore, persons of ordinary skill in the art will appreciate that the figures provided herein are for illustration purposes only and are not necessarily drawn to scale.

[0056] Unless the context clearly requires otherwise, words like “include”, “comprising” and the like throughout this application should be interpreted as including rather than exclusive or exhaustive; that is, as meaning “including but not limited to”.

[0057] In the description of this application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance. In addition, in the description of this application, unless otherwise specified, "plurality" means two or more.

[0058] Where the solutions described in this specification and in the examples involve the processing of personal information, such processing will be conducted with a legitimate basis (e.g., with the consent of the personal information subject or as necessary for the performance of a contract) and only within the prescribed or agreed scope. A user's refusal to process personal information other than that required for basic functions will not affect the user's use of these basic functions.

[0059] A web application (web application) is an application program accessible through a web browser. It runs on a remote server and interacts with users over the internet or an intranet. The key feature of a web application is that it doesn't rely on a specific operating system; users only need an HTML-capable browser to access and use it.

[0060] As web applications become increasingly complex, traditional security testing technologies face numerous challenges in vulnerability discovery. As a core component of modern internet services, web application security is paramount. Current mainstream application security testing techniques include static application security testing (SAST), dynamic application security testing (DAST), and interactive application security testing (IAST).

[0061] Static application security testing (SAST) can comprehensively analyze source code, helping to identify potential security issues early in the development process. However, when dealing with scenarios like modern web framework encapsulation and reflection calls, SAST is prone to missing source points and interrupting data flow tracing, resulting in a high false negative rate.

[0062] Dynamic Application Security Testing (DAST) uses a black-box testing approach to externally assess the security of web applications by simulating attacks. This approach does not rely on source code and can be executed independently of the development environment. However, DAST assesses the security of an application based solely on external behavior and lacks insight into the internal data flow of the application, limiting its accuracy. DAST often struggles to effectively identify security vulnerabilities hidden deep within the code logic.

[0063] Interactive Application Security Testing (IAST) attempts to combine the advantages of SAST and DAST, leveraging runtime information to improve vulnerability detection accuracy. However, traditional IAST solutions typically only instrument predefined source and sink points, meaning they may not cover all potential risk points, resulting in incomplete vulnerability coverage. Furthermore, as web application architectures become increasingly complex, adopting design patterns such as microservices or multi-layer encapsulation, traditional IAST approaches are struggling to meet these complex scenarios and provide adequate security assurance.

[0064] These issues not only reduce the accuracy and efficiency of vulnerability detection, but also increase the cost of responding to security threats. Therefore, there is an urgent need for a new approach to overcome the limitations of existing technologies to adapt to the needs of modern web applications and ensure that they can maintain a high level of security protection in a rapidly changing technological environment.

[0065] Figure 1 FIG is a schematic diagram of a safety test system according to an embodiment of the present invention. Figure 1 As shown, the security testing system of the embodiment of the present invention includes a client 1, a feature injection module 2, a data processing module 3 and a control terminal 4.

[0066] In this embodiment, a user configures a browser or system on client 1 to use an HTTP (Hypertext Transfer Protocol) proxy to access the target web application interface. During this process, client 1 sends a standard HTTP request to feature injection module 2. The target web application is the application under test in this embodiment of the present invention.

[0067] Specifically, the user first configures the HTTP proxy server parameters on Client 1, including the proxy server's address and port number. Once configured, HTTP requests initiated by Client 1 are forwarded to the proxy server for processing. When a user attempts to access the application under test, Client 1 generates a request packet that complies with the HTTP protocol and sends it to Feature Injection Module 2.

[0068] Among them, the HTTP request includes information such as the request method (HTTP Method), request headers (Headers), request body (Body), URL (Uniform Resource Locator) path and query parameters. Among them, the request method is used to indicate the type of operation requested, such as obtaining resources, submitting data, updating resources, etc. The request header is used to carry meta-information related to the request, such as the user agent (User-Agent), content type (Content-Type), authentication information (Authorization), etc. For some request types, the request body contains data that needs to be submitted. The URL path and query parameters are used to specify the target resource path of the request and additional query parameters to pass additional information.

[0069] The feature injection module 2 includes a proxy server 21 and a traffic processing module 22 .

[0070] The proxy server 21 serves as an intermediate node between the client and the application under test, and is responsible for receiving the HTTP request sent by the client 1 .

[0071] The traffic processing module 22 copies the access request from the proxy server 21, captures the traffic, deduplicates it, and then replaces the parameters with characteristic character strings before requesting the application under test. Specifically, the traffic processing module 22 captures all HTTP request and response data streams passing through the proxy server 21 to ensure that the interaction information between the user and the application under test can be fully obtained. At the same time, in order to improve test efficiency and reduce redundant operations, the traffic processing module 22 will deduplicate the captured traffic, eliminate duplicate requests or meaningless traffic, and focus on key access paths and interfaces. In the captured and deduplicated traffic, the traffic processing module 22 will identify the key parameters in the request (such as URL query parameters, form data, JSON fields, etc.) and replace these parameter values ​​with predefined characteristic strings.

[0072] The characteristic string consists of a prefix and a random number. The prefix enables the system to easily identify and categorize various types of test cases, helping to quickly locate relevant test results for subsequent manual review or automated generation. The random number increases test diversity, reducing the risk of missed tests caused by reusing the same input. It also allows the system to verify whether the web application correctly handles dynamically changing data, ensuring system robustness.

[0073] After the parameter replacement, a modified access request is obtained, and the traffic processing module 22 sends the modified access request to the application under test, thereby triggering the processing logic of the application under test for the specific input.

[0074] Data processing module 3 includes a tested application 31 and a Java Agent. Tested application 31 is a Java-based web application, whose runtime behavior and internal data flow are the focus of testing and analysis. Tested application 31 is the core target of the entire security testing process, responsible for receiving and processing access requests from clients. During testing, the actual operating status and behavior of tested application 31 are important criteria for assessing its security. To achieve in-depth detection and dynamic analysis of the tested Java web application, the system extends its functionality by injecting a Java Agent.

[0075] Java Agent is a technology based on the Java Instrumentation API that can dynamically inject additional logic code into a target Java application at startup or runtime. Java Agent modifies the bytecode of the application under test, inserting custom logic (such as logging, performance testing, and security testing) without changing the original code.

[0076] Specifically, the Java Agent of the embodiment of the present invention will traverse the method functions of the application under test and filter out the target method functions that need to be detected based on predefined conditions. For method functions that meet the conditions (such as user input processing methods, database operation methods, etc.), the Java Agent will perform a Hook operation on them. Hook refers to a detection point set in the program through dynamic instrumentation technology. Dynamic instrumentation refers to inserting specific code or instructions (detection code) during the execution of the program without modifying the program source code, so as to capture and analyze various data flows when the program is running. These Hook points can be used to monitor function calls, parameter passing, return values, and changes in program status, etc. That is, specific detection code is inserted before and after the execution of the method function, and the detection code is used to capture its input parameters, return values, call stack and other information before and after the execution of the method function.

[0077] That is, after the application under test receives the modified access request, it processes the modified access request to generate a response. That is, after the application under test receives the modified request, its internal logic processes these parameters. For example, user input may be passed to a database query, file write, or other operation. When a method function containing the characteristic string in the application under test is called, if detection code is inserted into the method function, the detection code will capture relevant information and send it to the data processing module 321. The relevant information includes information such as input parameters and return values.

[0078] At the same time, the data processing module 321 is set in the Java Agent, and generates detection data based on the captured relevant information, wherein the detection data includes at least one of a feature string, a return value, and a call stack data. At the same time, the data processing module 321 sends the acquired detection data to the control terminal 4.

[0079] The control terminal 4 is a system that centrally manages and processes data collected from the tested application and instrumentation tools (such as Java Agent). It is responsible for receiving, storing, and analyzing this data, and generating reports or triggering further actions based on the analysis results. The control terminal can be deployed on various types of hardware devices, such as servers.

[0080] Furthermore, the control terminal 4 includes a visualization module 41 and a Source generation module 42 .

[0081] The visualization module 41 is used to visualize the detection data, making the detection data more intuitive and easy to understand, thereby enabling rapid identification of potential security threats and formulation of effective response strategies.

[0082] In some embodiments, the visualization module 41 can analyze the data from multiple angles (such as time series, attack type, affected application components, etc.) and display it in various forms. For example, it can be displayed in the form of a chart, for example, a line chart can be used to show the frequency change trend of different types of vulnerabilities over a period of time, or a pie chart can be used to show the proportional distribution of various types of vulnerabilities. For another example, it can be displayed through a dashboard interface, allowing users to add or remove different view components (widgets) according to their needs, such as a real-time detection panel, a history query, etc. The user can freely adjust the layout and select the data dimension of interest for viewing. For another example, the propagation path of the feature string within the entire application can be displayed through a heat map or a path tracing map.

[0083] Source generation module 42 is used to generate test files. Specifically, it analyzes the test data to identify potential input sources, generates simulated input data corresponding to these potential input sources, and generates a propagation path, which is the flow path of data from the input source within the application. Test files are then generated based on the simulated input data and propagation path. The generated test files can be provided to SAST for further security testing.

[0084] This embodiment of the present invention injects a Java Agent into the application under test. It uses the Java Agent to retrieve qualified method functions and insert detection code into these methods. After receiving a client's access request to the application under test, the Java Agent replaces the parameter values ​​in the access request with a signature string. When the method function containing the signature string is called, the detection code retrieves detection data. This allows for automated discovery of input sources and accurate tracking of data flows, improving the coverage and accuracy of security detection.

[0085] Figure 2 FIG. 1 is a flow chart of a method for security testing of an application program according to an embodiment of the present invention. Figure 2 As shown, the security testing method for an application program according to an embodiment of the present invention includes the following steps:

[0086] Step S100: Inject Java Agent into the application under test.

[0087] In this embodiment, the application under test is a Web application. When the application under test is started, the Java Agent is injected into the application under test through JVM (Java Virtual Machine) parameters.

[0088] Java Agent is a technology based on the Java Instrumentation API that can dynamically inject additional logic code into a target Java application at startup or runtime. Java Agent modifies the bytecode of the application under test, inserting custom logic (such as logging, performance testing, and security testing) without changing the original code.

[0089] Step S200: Obtain a method function that meets the conditions through the Java Agent, and insert a detection code into the method function.

[0090] In this embodiment, after loading, the Java Agent scans all classes and methods of the application under test and selects those that meet the requirements based on predefined rules, i.e., those that require security testing. These predefined rules can be set based on security testing requirements, the architectural characteristics of the application under test, and common vulnerability patterns.

[0091] Specifically, the Java Agent of the embodiment of the present invention will traverse the method functions of the application under test and filter out the target method functions that need to be detected based on predefined conditions. For method functions that meet the conditions (such as user input processing methods, database operation methods, etc.), the Java Agent will perform a Hook operation on them. Hook refers to a detection point set in the program through dynamic instrumentation technology. Dynamic instrumentation refers to inserting specific code or instructions (detection code) during the execution of the program without modifying the program source code, so as to capture and analyze various data flows when the program is running. These Hook points can be used to monitor function calls, parameter passing, return values, and changes in program status, etc. That is, specific detection code is inserted before and after the execution of the method function, and the detection code is used to capture its input parameters, return values, call stack and other information before and after the execution of the method function.

[0092] Among them, filtering out method functions that meet the conditions according to predefined rules can be implemented in various ways, for example:

[0093] Method signature matching: Filter method functions that meet the conditions based on the method signature (including class name, method name, parameter type, and return value type).

[0094] Annotation matching: Filters methods and functions that meet the conditions by detecting whether specific annotations exist on the method or class.

[0095] Class name or package name matching: Filter methods and functions that meet the conditions based on the fully qualified name of the class or the path of the package where it is located.

[0096] Call link matching: Filter method functions that meet the conditions based on whether the method appears in a specific call link.

[0097] Input parameter type matching: Filter method functions that meet the conditions based on the input parameter type of the method.

[0098] Return value type matching: Filter method functions that meet the conditions based on the return value type of the method.

[0099] Framework feature matching: Design rules based on the functional features of a specific framework to adapt to its dynamic calling mechanism.

[0100] Keyword matching: Filters method functions that meet the conditions based on whether the method name or parameters contain certain high-risk keywords.

[0101] Call frequency or hot method: Filter method functions that meet the conditions based on the method's call frequency or runtime heat.

[0102] Furthermore, after obtaining the method function that meets the screening conditions, the detection code is inserted into the method function. Specifically, the embodiment of the present invention inserts the detection code into the method function through Hook counting. Hook technology dynamically modifies the bytecode of the target method function and inserts probe code before and after the execution of the method function. These probe codes are used to capture information such as the input parameters, return value, and call stack of the method function. Among them, the inserted probe code is the detection code of the embodiment of the present invention.

[0103] Furthermore, dynamic instrumentation is used to hook methods with String type parameters and return values. That is, methods with at least one String type parameter or a String type return value are hooked.

[0104] Step S300: Obtain the client's access request to the application under test.

[0105] In this embodiment, the user first sets the relevant parameters of the HTTP proxy server on the client, including the address and port number of the proxy server. After the configuration is completed, the HTTP request initiated by the client will be forwarded to the proxy server for processing. When the user attempts to access the application under test, the client will generate a request data packet that complies with the HTTP protocol specification, that is, an access request. The HTTP proxy tool is used to intercept the communication traffic between the client and the application under test and record the content of all requests (including URL, request header, request body, etc.).

[0106] Among them, the HTTP request includes information such as the request method (HTTP Method), request headers (Headers), request body (Body), URL (Uniform Resource Locator) path and query parameters. Among them, the request method is used to indicate the type of operation requested, such as obtaining resources, submitting data, updating resources, etc. The request header is used to carry meta-information related to the request, such as the user agent (User-Agent), content type (Content-Type), authentication information (Authorization), etc. For some request types, the request body contains data that needs to be submitted. The URL path and query parameters are used to specify the target resource path of the request and additional query parameters to pass additional information.

[0107] Step S400: Replace the parameter value in the access request with a characteristic character string.

[0108] In this embodiment, after obtaining the access request, the key parameters in the access request (such as URL query parameters, form data, JSON fields, etc.) are identified, and these parameter values ​​are replaced with predefined feature strings. The feature string includes a prefix and a random number. The prefix enables the system to easily identify and classify various types of test cases, which can help quickly locate relevant test results and facilitate subsequent manual review or automated generation. Random numbers can increase the diversity of tests and reduce the risk of missed reports due to repeated use of the same input. At the same time, it can also enable the system to verify whether the Web application correctly handles dynamically changing data to ensure the robustness of the system. After parameter replacement, the modified access request is obtained, and the modified access request is sent to the application under test to trigger the processing logic of the application under test for specific input.

[0109] In some embodiments, in order to improve testing efficiency and reduce redundant operations, deduplication processing is performed before replacing parameter values ​​in access requests to eliminate duplicate access requests, thereby focusing on key access paths and interfaces.

[0110] Step S500: When the method function containing the characteristic character string is called, detection data is obtained through the detection code.

[0111] Figure 3 This is a flow chart of obtaining detection data according to an embodiment of the present invention. Figure 3 As shown, when the method function containing the characteristic string is called, obtaining the detection data through the detection code includes the following steps:

[0112] Step S510: Send the modified access request to the application under test.

[0113] In this embodiment, the parameter value in the access request is replaced with a characteristic character string to generate a modified access request, and the modified access request is sent to the application under test to trigger the processing logic of the application under test for the specific input.

[0114] Step S520: The modified access request is processed by the application under test, and when a method function containing the characteristic character string in the application under test is called, relevant information is obtained through the detection code.

[0115] In this embodiment, the relevant information includes input parameters and return values. The modified access request is processed by the application under test. When the method function into which the detection code is inserted is called, if it contains the characteristic string, the relevant information is obtained through the detection code. Specifically, when the method function containing the characteristic string is called, the inserted detection code is automatically executed to capture the relevant information.

[0116] Step S530: Generate detection data according to the relevant information.

[0117] In this embodiment, detection data is generated according to the relevant information, and the detection data includes at least one of a feature string, a return value, and call stack data.

[0118] This embodiment of the present invention injects a Java Agent into the application under test. It uses the Java Agent to retrieve qualified method functions and insert detection code into these methods. After receiving a client's access request to the application under test, the Java Agent replaces the parameter values ​​in the access request with a signature string. When the method function containing the signature string is called, the detection code retrieves detection data. This allows for automated discovery of input sources and accurate tracking of data flows, improving the coverage and accuracy of security detection.

[0119] In some embodiments, the application security testing method further includes:

[0120] Step S600: Send the detection data to the control end.

[0121] Step S700: Visually display the detection data through the control terminal.

[0122] Specifically, the acquired detection data is sent to the control terminal, and the detection data is visualized by the control terminal, making the detection data more intuitive and easy to understand, thereby enabling rapid identification of potential security threats and formulation of effective response strategies.

[0123] Among them, the control end can analyze the data from multiple angles (such as time series, attack type, affected application components, etc.) and display it in various forms. For example, it can be displayed in the form of a chart, for example, a line chart can be used to show the frequency change trend of different types of vulnerabilities over a period of time, or a pie chart can be used to show the proportional distribution of various types of vulnerabilities. For another example, it can be displayed through a dashboard interface, allowing users to add or remove different view components (widgets) according to their needs, such as real-time viewing panels, historical record query devices, etc. Users can freely adjust the layout and select the data dimensions of interest for viewing. For another example, the propagation path of feature strings throughout the application can be displayed through a heat map or path tracing map.

[0124] In some embodiments, the application security testing method further includes:

[0125] Step S800: constructing and generating an input source through the control terminal.

[0126] Specifically, Figure 4This is a flow chart of input source construction and generation according to an embodiment of the present invention. Figure 4 As shown, constructing and generating the input source through the control end includes the following steps:

[0127] Step S810: Analyze the detection data to identify potential input sources.

[0128] In this embodiment, the control end analyzes the detection data to identify potential input sources. The input source is a source point, which refers to the location or data source where external input may be introduced into the program. The input source can be user input (such as HTTP request parameters, form data), file read content, database query results, environment variables, data returned by third-party APIs, etc. These input sources may be the starting point of potential security vulnerabilities, such as SQL (Structured Query Language) injection, XSS (Cross Site Scripting) attack, etc.

[0129] In some embodiments, the control end identifies potential input sources based on call stack data captured by the Hook method.

[0130] Step S820: Generate analog input data corresponding to the potential input source.

[0131] In this embodiment, simulated input data is constructed based on the identified potential input sources.

[0132] Step S830: Generate a propagation path, where the propagation path is the flow path of data in the application starting from the input source.

[0133] In this embodiment, starting from the input source, the flow path of the data in the program is traced to generate a propagation path, which describes the flow process of the data from the source point to the sink point.

[0134] The source point refers to the point where data enters the system, which is also the input source of the embodiment of the present invention. The sink point refers to the place where data is used. If these places are not properly validated or escaped, they may lead to security vulnerabilities such as SQL injection and cross-site scripting (XSS).

[0135] Step S840: Generate a test file based on the simulated input data and propagation path.

[0136] In this embodiment, the constructed input source and propagation path are exported into a standardized format (such as JSON, XML, etc.) to obtain a test file.

[0137] In some embodiments, the application security testing method further includes:

[0138] Step S900: Perform security testing based on the test file.

[0139] In this embodiment, the generated test file is provided to SAST for further security testing.

[0140] This embodiment of the present invention uses dynamic instrumentation technology to hook methods containing String type parameters and return values, and injects characteristic strings into traffic for capture, enabling visualization of data flow paths and automated construction of source points. This approach addresses the issues of missed source points and broken edges in taint analysis data flows, often caused by complex scenarios such as framework encapsulation, reflection calls, and dynamic proxies in traditional SAST. Compared to traditional IAST, this solution improves vulnerability coverage, reduces manual analysis costs, and effectively enhances vulnerability detection efficiency.

[0141] The embodiments of the present invention effectively improve some of the shortcomings of traditional IAST by combining dynamic instrumentation and feature traffic tracing technology. It realizes the automated discovery of source points and reduces the workload of predefining and maintaining source point lists. By hooking methods with String type parameters and return values, the scope of instrumentation is expanded, and data flows in scenarios such as framework encapsulation and reflective calls can be better captured. This helps to improve vulnerability detection coverage and provides data flow visualization, providing a more intuitive reference for security analysis and, to a certain extent, alleviating the problems of incomplete source points and broken data flows in static analysis.

[0142] This embodiment of the present invention injects a Java Agent into the application under test. It uses the Java Agent to retrieve qualified method functions and insert detection code into these methods. After receiving a client's access request to the application under test, the Java Agent replaces the parameter values ​​in the access request with a signature string. When the method function containing the signature string is called, the detection code retrieves detection data. This allows for automated discovery of input sources and accurate tracking of data flows, improving the coverage and accuracy of security detection.

[0143] Figure 5 FIG is a schematic diagram of a safety testing device according to an embodiment of the present invention. Figure 5As shown, the security testing device for an application according to an embodiment of the present invention includes an injection unit 51, an insertion unit 52, a request acquisition unit 53, a replacement unit 54, and a data acquisition unit 55. The injection unit 51 is used to inject a Java Agent into the application under test. The insertion unit 52 is used to obtain a method function that meets the conditions through the Java Agent and insert a detection code into the method function. The request acquisition unit 53 is used to obtain an access request from a client to the application under test. The replacement unit 54 is used to replace the parameter value in the access request with a characteristic string. The data acquisition unit 55 obtains detection data through the detection code when the method function containing the characteristic string is called.

[0144] This embodiment of the present invention injects a Java Agent into the application under test. It uses the Java Agent to retrieve qualified method functions and insert detection code into these methods. After receiving a client's access request to the application under test, the Java Agent replaces the parameter values ​​in the access request with a signature string. When the method function containing the signature string is called, the detection code retrieves detection data. This allows for automated discovery of input sources and accurate tracking of data flows, improving the coverage and accuracy of security detection.

[0145] Figure 6 Schematic diagram of an electronic device according to an embodiment of the present invention. In this embodiment, the electronic device 6 includes a server, a terminal, etc. Figure 6 As shown, the electronic device 6 includes: at least one processor 61; a memory 62 connected to the at least one processor 61; and a communication component 63 connected to the scanning device, the communication component 63 receives and sends data under the control of the processor 61; wherein the memory 62 stores instructions that can be executed by the at least one processor 61, and the instructions are executed by the at least one processor 61 to implement the above-mentioned security testing method.

[0146] Specifically, the electronic device includes: one or more processors 61 and a memory 62, Figure 6 A processor 61 is taken as an example. The processor 61 and the memory 62 may be connected via a bus or other means. Figure 6 In the example above, a bus connection is used. Memory 62, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. Processor 61 executes the non-volatile software programs, instructions, and modules stored in memory 62 to perform various functional applications and data processing of the device, thereby implementing the aforementioned security testing method.

[0147] The memory 62 may include a program storage area and a data storage area. The program storage area may store an operating system and applications required for at least one function; the data storage area may store a list of options, etc. Furthermore, the memory 62 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 62 may optionally include a memory remotely located relative to the processor 61, and such remote memory may be connected to an external device via a network. Examples of the aforementioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0148] One or more modules are stored in the memory 62 and, when executed by one or more processors 61 , perform the security testing method in any of the above method embodiments.

[0149] The above-mentioned product can execute the method provided in the embodiment of this application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of this application.

[0150] This embodiment of the present invention injects a Java Agent into the application under test. It uses the Java Agent to retrieve qualified method functions and insert detection code into these methods. After receiving a client's access request to the application under test, the Java Agent replaces the parameter values ​​in the access request with a signature string. When the method function containing the signature string is called, the detection code retrieves detection data. This allows for automated discovery of input sources and accurate tracking of data flows, improving the coverage and accuracy of security detection.

[0151] Another embodiment of the present invention relates to a non-volatile storage medium for storing a computer-readable program, wherein the computer-readable program is used to enable a computer to execute part or all of the above method embodiments.

[0152] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which may be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0153] The foregoing is merely a preferred embodiment of the present application and is not intended to limit the present application. Persons skilled in the art will readily appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application are intended to be within the scope of protection of the present application.

Claims

1. A security testing method for an application, characterized in that: The method comprises: Inject Java Agent into the application under test; Obtaining a method function that meets the conditions through the Java Agent, and inserting a detection code into the method function; Obtain access requests from the client to the application under test; Replacing the parameter value in the access request with a characteristic character string; When the method function containing the characteristic character string is called, detection data is obtained through the detection code.

2. The method according to claim 1, characterized in that The method further comprises: Deduplication is performed on the access request.

3. The method according to claim 1, characterized in that The characteristic character string includes a specified prefix and a random number.

4. The method according to claim 1, wherein When the method function containing the characteristic character string is called, obtaining detection data through the detection code includes: sending the modified access request to the application under test; Processing the modified access request by the application under test, and obtaining relevant information by the detection code when a method function containing the characteristic string in the application under test is called, the relevant information including input parameters and return values; Detection data is generated according to the relevant information, where the detection data includes at least one of a feature string, a return value, and call stack data.

5. The method according to claim 1, wherein The method further comprises: Sending the detection data to the control terminal; The detection data is visually displayed through the control terminal.

6. The method according to claim 5, characterized in that The method further comprises: Input source construction and generation are performed through the control terminal.

7. The method according to claim 6, characterized in that The constructing and generating of the input source by the control terminal includes: analyzing the detection data to identify potential input sources; generating simulated input data corresponding to the potential input source; Generate a propagation path, wherein the propagation path is a flow path of data in the application program starting from an input source; A test file is generated according to the simulated input data and propagation path.

8. The method according to claim 7, characterized in that The method further comprises: Perform security checks based on the test file.

9. A security testing system for an application, characterized in that: The system comprises: A feature injection module is used to obtain a client's access request to the application under test and replace the parameter value in the access request with a feature string; The application under test; The data processing module is used to inject a Java Agent into the application under test, obtain a method function that meets the conditions through the Java Agent, and insert a detection code into the method function. When the method function containing the characteristic string is called, the detection data is obtained through the detection code.

10. The system according to claim 9, characterized in that The system further comprises: The control terminal is used to visualize the detection data.

11. The system according to claim 10, wherein: The control end is also used to construct and generate input sources.

12. A security testing device for an application, characterized in that: The device comprises: Injection unit, used to inject Java Agent into the application under test; An inserting unit, configured to obtain a method function that meets a condition through the Java Agent and insert a detection code into the method function; A request acquisition unit, used to obtain the client's access request to the application under test; a replacing unit, configured to replace a parameter value in the access request with a characteristic character string; The data acquisition unit acquires detection data through the detection code when the method function containing the characteristic character string is called.

13. An electronic device comprising a memory and a processor, characterized in that: The memory is configured to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method according to any one of claims 1 to 8.

14. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: The computer program instructions implement the method according to any one of claims 1 to 8 when executed by a processor.

Images