Automatic mining system and method for applet API authentication vulnerability based on IAST technology

Abstract

The invention provides an automatic mining system and method for an applet API authentication vulnerability based on an IAST technology. The method comprises the steps that a data collection module collects front-end runtime data through an IAST probe and intercepts network traffic through a global agent; the data processing and association module performs fusion processing on the multi-source data and constructs an operation context; the dynamic taint analysis module executes fine-grained data flow tracking and generates an API authentication parameter portrait; the intelligent test engine module automatically generates a targeted test case according to the vulnerability model library; the test execution and replay module realizes automatic replay of the test case through the proxy middleware; and the vulnerability analysis and report module performs multi-dimensional intelligent analysis on the response result and generates a vulnerability report. According to the method, accurate and automatic mining of API authentication vulnerabilities such as applet horizontal unauthorized, vertical unauthorized and Token bypassing is realized, the detection efficiency and accuracy are improved, and the problem of adaptability of a traditional method in an applet complex authentication scene is effectively solved.

Description

Technical Field

[0001] This invention relates to the field of network security and application security testing technology, specifically to an automated system and method for discovering API authentication vulnerabilities in mini-programs based on IAST technology. Background Technology

[0002] The mini-program ecosystem, especially WeChat mini-programs, has become an important carrier of internet services. Its application logic heavily relies on data interaction between the front-end mini-program and the back-end server through API interfaces. API authentication is a core mechanism for ensuring the security of user data and business resources, aiming to verify the legitimacy of requests and prevent unauthorized access (privilege escalation) or privilege escalation. With the surge in the number of mini-programs, API authentication vulnerabilities (such as horizontal / vertical privilege escalation, login-state bypass, and unauthorized interface access) have become one of the major security threats. Therefore, efficient and accurate automated detection of such vulnerabilities is of significant practical importance.

[0003] Currently, the detection of such vulnerabilities mainly relies on three technical approaches: First, manual testing based on global proxy tools. This method is inefficient, has narrow coverage, and is highly dependent on the tester's experience and skills. Second, traditional Dynamic Application Security Testing (DAST) scanners, as black-box testing tools, struggle to understand and simulate the complex login states of mini-programs (such as the mapping relationship between the code generated by wx.login and the cloud token), and cannot effectively handle obfuscated and encrypted mini-program code, resulting in insufficient depth of detection of authentication logic and a high false negative rate. Third, Static Application Security Testing (SAST), although it can directly analyze source code, is also limited by code obfuscation and cannot obtain runtime state and data flow information, resulting in a high false positive rate and an inability to effectively verify the actual existence of vulnerabilities. Existing technologies are all insufficient for achieving in-depth and automated discovery of mini-program API authentication vulnerabilities.

[0004] To overcome the aforementioned technical limitations, this invention aims to propose an innovative automated vulnerability discovery scheme. The core of this invention lies in the deep integration of Interactive Application Security Testing (IAST) technology and traffic analysis technology to construct an effective API authentication vulnerability detection system. By embedding IAST probes into the mini-program runtime environment, sensitive front-end operations, authentication credential generation processes, and data flows are captured in real time. Simultaneously, network requests are intercepted via traffic proxy, and the two are correlated and analyzed to accurately characterize the authentication chain. Finally, through an intelligent testing engine based on dynamic taint tracking and semantic analysis, vulnerability test cases are automatically generated, replayed, and verified, achieving efficient, accurate, and automated discovery of mini-program API authentication vulnerabilities, effectively compensating for the shortcomings of existing technologies. Summary of the Invention

[0005] The present invention aims to at least solve one of the technical problems existing in the prior art, and provides an automated system and method for discovering API authentication vulnerabilities in mini programs based on IAST technology.

[0006] In a first aspect, embodiments of the present invention provide an automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology, the system comprising: The data acquisition module is configured to collect runtime data from the front end of the mini program via the IAST probe and intercept network traffic via the global proxy module. The data processing and association module is configured to receive data from the data acquisition module and perform fusion processing and context construction. The dynamic taint analysis module is configured to perform dynamic taint tracking based on the output of the data processing and correlation module, and generate API authentication parameter profiles. The intelligent testing engine module is configured to automatically generate test cases based on the API authentication parameter profile and vulnerability model library. The test execution and replay module is configured to replay test cases generated by the test engine to the target server via a proxy. The vulnerability analysis and reporting module is configured to receive server responses and output the final vulnerability scan report based on the judgment rules.

[0007] Secondly, embodiments of the present invention provide an automated method for discovering authentication vulnerabilities in mini-program APIs based on IAST technology, the method comprising: By deploying IAST probes in the mini-program runtime environment, runtime data of the mini-program front-end is monitored and collected in real time; at the same time, all network communication traffic between the mini-program client and the server is intercepted through the global proxy module. The runtime data and network traffic are integrated and processed to construct an operation context information chain with network requests at its core, and sensitive data sources are marked based on predefined taint source rules; Based on dynamic taint tracking technology, the propagation path of the sensitive data in the JavaScript runtime environment is analyzed, the key parameters used for authentication in network requests are accurately identified, and an API authentication parameter profile is generated. Based on the preset vulnerability model library, and targeting the API authentication parameter profile, a set of test cases for testing authentication vulnerabilities is automatically generated. The test cases are replayed and sent to the target API through the global proxy module, and the response results from the analysis server are received. Based on predefined vulnerability assessment rules, the response results are intelligently analyzed to ultimately determine whether the target API has an authentication vulnerability and output a vulnerability report.

[0008] In conjunction with the second aspect, the real-time monitoring and collection of runtime data from the mini-program front-end through the IAST probe deployed in the mini-program's runtime environment includes: Collect WeChat JS-SDK API call information (function name, parameters, return value, call stack); Collect user interaction events (clicks, inputs, etc.); Customize the execution information of JavaScript functions.

[0009] In conjunction with the second aspect, the interception of all network communication traffic between the mini-program client and the server through the global proxy module includes: Collect HTTP / HTTPS requests and responses; Collect WebSocket communication data; Collect cloud function call traffic.

[0010] In conjunction with the second aspect, the fusion processing of runtime data and network traffic constructs an operation context information chain centered on network requests, and marks sensitive data sources based on predefined taint source rules, including: Use a timing alignment algorithm to associate IAST events with network requests; Establish a mapping relationship between front-end operations and back-end requests based on call stack analysis; Mark sensitive data sources, including identity identifiers, session tokens, and permission parameters.

[0011] In conjunction with the second aspect, the dynamic taint tracking technology analyzes the propagation path of the sensitive data in the JavaScript runtime environment, accurately identifies the key parameters used for authentication in network requests, and generates an API authentication parameter profile, including: Achieve fine-grained data flow tracing at the V8 engine level; Monitor the propagation of tainted data during operations such as variable assignment and function parameter passing; Accurately identify the key parameters used for authentication in network requests and their locations; Generate a structured profile of API authentication parameters.

[0012] In conjunction with the second aspect, the automatic generation of a set of test cases for testing authentication vulnerabilities based on the API authentication parameter profile, according to a preset vulnerability model library, includes: Horizontal privilege escalation test cases: Replace identifier parameters such as user ID and order ID; Vertical privilege escalation test cases: Modifying role parameters and permission flags; Token security test cases: removal, tampering, and reuse of authentication tokens; Business logic test cases: Parameter combinations that violate business rules.

[0013] In conjunction with the second aspect, the step of replaying and sending the test cases to the target API through the global proxy module, and receiving the response results from the analysis server, includes: Maintain session state and context consistency; Record the complete request-response interaction process; Collect the server response status code, headers, and body content.

[0014] In conjunction with the second aspect, the response results are intelligently analyzed based on predefined vulnerability assessment rules to ultimately determine whether the target API has an authentication vulnerability and output a vulnerability report, including: Differential analysis techniques were used to detect differences in response; Semantic analysis is used to identify features of access control failure; Combine machine learning models to assess vulnerability confidence; Generate structured vulnerability reports, including proof-of-concept (POC) and remediation recommendations.

[0015] Thirdly, embodiments of the present invention provide an electronic device, comprising: One or more processors; A storage unit is used to store one or more programs, which, when executed by one or more processors, enable the one or more processors to implement any of the above-mentioned automated methods for discovering API authentication vulnerabilities in mini-programs based on IAST technology.

[0016] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, can implement any of the above-mentioned automated mining methods for mini-program API authentication vulnerabilities based on IAST technology.

[0017] Compared with existing technologies, this invention provides an automated system and method for mining API authentication vulnerabilities in mini-programs based on IAST technology. Through a multimodal data collaborative acquisition module, it achieves synchronous capture and precise correlation of runtime data and network traffic of the mini-program front-end, constructing a complete operational context chain. Through a dynamic taint tracking module, it implements fine-grained data flow analysis at the JavaScript engine level, accurately identifying key authentication parameters in API requests and generating structured profiles. Through an intelligent testing engine module, it automatically generates semantically effective and targeted test cases based on a vulnerability model library and parameter profiles. Finally, through a multi-dimensional vulnerability analysis module, it performs intelligent differential analysis, semantic recognition, and machine learning classification verification on the test responses. This achieves efficient, accurate, and automated mining of various API authentication vulnerabilities in mini-programs, including horizontal privilege escalation, vertical privilege escalation, token bypass, and unauthorized access. It significantly improves the coverage, efficiency, and accuracy of vulnerability detection, effectively solving the problems of poor adaptability and high false positive / false positive rates of traditional methods in complex authentication scenarios of mini-programs. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the overall architecture of the automated vulnerability mining system for WeChat Mini Program API authentication based on IAST technology provided in this embodiment of the invention. Figure 2 A flowchart illustrating the automated vulnerability discovery method for WeChat Mini Program API authentication based on IAST technology provided in this embodiment of the invention; Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0021] Unless otherwise specifically stated, the technical or scientific terms used in the embodiments of this invention should be understood in their ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains. The terms "comprising" or "including," as used in the embodiments of this invention, do not limit the shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof mentioned, nor do they exclude the appearance or addition of one or more other different shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof, or the inclusion of these.

[0022] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale, and techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail; however, where appropriate, the illustrated techniques, methods, and apparatus should be considered part of the specification. In all the examples shown and discussed herein, any other specific example may have different values. It should be noted that similar symbols and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0023] In the description of the embodiments of the present invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In the embodiments of the present invention, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in the embodiments of the present invention, as well as the features of different embodiments or examples.

[0024] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention; it should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0025] like Figure 1 The diagram shown is a structural schematic of an automated vulnerability detection system for WeChat Mini Program API authentication based on IAST technology, according to an embodiment of the present invention. The system includes: Data acquisition module 110 is configured to collect runtime data of the mini-program front end through the IAST probe and intercept network traffic through the global proxy module; The data processing and association module 120 is configured to receive data from the data acquisition module and perform fusion processing and context construction. The dynamic taint analysis module 130 is configured to perform dynamic taint tracking and generate API authentication parameter profiles based on the output of the data processing and correlation module. The intelligent testing engine module 140 is configured to automatically generate test cases based on the API authentication parameter profile and vulnerability model library. Test execution and replay module 150 is configured to replay test cases generated by the test engine to the target server via a proxy. The vulnerability analysis and reporting module 160 is configured to receive server responses and output the final vulnerability scan report according to the judgment rules.

[0026] The data acquisition module 110 achieves multimodal data acquisition through two parallel data acquisition channels.

[0027] The first channel employs IAST probe technology, injecting lightweight monitoring code into the mini-program runtime environment to achieve comprehensive monitoring of the WeChat JS-SDK API. Specifically, by overriding methods such as Function.prototype and Object.defineProperty, it achieves non-intrusive mounting of key APIs such as wx.request, wx.login, and wx.getUserInfo. Monitoring data includes function call parameters, return values, complete call stack information, and user interaction events.

[0028] The second channel employs global proxy technology, deploying a man-in-the-middle proxy at the operating system's network layer. It uses a custom CA certificate to decrypt HTTPS traffic, fully capturing all network communication traffic. Data collected from both channels is standardized, with high-precision timestamps and process identifiers added to provide a foundation for subsequent data correlation.

[0029] The data processing and association module 120 receives standardized data streams from the data acquisition module. First, it uses a time-series alignment algorithm to match the IAST event stream and network request stream. Specifically, it employs a variant of the dynamic time warping algorithm to address time offset issues caused by system latency. Then, based on call stack analysis technology, it establishes a mapping relationship between front-end operations and back-end requests, constructing a complete context for each network request containing information such as the trigger source, parameter source, and operation sequence. Finally, according to predefined taint source rules, it marks sensitive information in the acquired data, including key data such as identity identifiers, session tokens, and permission parameters.

[0030] The dynamic taint analysis module 130 implements fine-grained data flow tracing at the JavaScript engine level. Specifically, it modifies the V8 engine's bytecode interpreter to add taint propagation logic at the bytecode execution level. Once tainted source data is detected, the system tracks its propagation path in real time through operations such as variable assignment, function parameter passing, and expression evaluation. The taint propagation rules combine implicit and explicit streams to ensure complete tracing. When tainted data flows into network request parameters, the system records the parameter name, parameter location (URL parameters, header, body, etc.), and its value, generating a structured API authentication parameter profile. This profile accurately describes the authentication mechanism and key parameters of each API.

[0031] The intelligent testing engine module 140 intelligently generates test cases based on a vulnerability model library and API authentication parameter profiles. The vulnerability model library includes four main testing strategies: horizontal privilege escalation testing uses an identifier parameter replacement strategy, replacing the original parameter value with the identifier of another user at the same level; vertical privilege escalation testing uses a privilege escalation strategy, modifying role parameters or adding privilege flags; token security testing uses a token tampering strategy, including removing, forging, and reusing authentication tokens; and business logic testing uses a parameter combination strategy that violates business rules. During test case generation, parameter types and semantic constraints are fully considered to ensure that the generated test cases are effective and targeted.

[0032] The test execution and replay module 150 automatically replays test cases through a proxy middleware. In practice, it maintains a complete session context, including state information such as cookies and localStorage, to ensure the consistency of the test environment. During request replay, network request parameters are rewritten in real time to inject the test case payload, while maintaining the integrity of other parameters. All test requests and responses are fully recorded, including detailed information such as request sequence, response time, and response data, providing data support for subsequent analysis.

[0033] The vulnerability analysis and reporting module 160 employs a multi-dimensional analysis method to intelligently determine test results. First, it uses differential analysis to compare the status codes, header information, body length, and content structure of the original and test responses. Second, it applies semantic analysis technology, using a lightweight NLP model to identify key semantic features in the response, such as "insufficient permissions" and "access denied" messages. Simultaneously, it combines a machine learning model with a classifier trained on historical vulnerability data to intelligently classify the response and assess the confidence level of vulnerability existence. Finally, it generates a structured vulnerability report, including detailed information such as vulnerability type, risk level, POC request, and remediation suggestions.

[0034] like Figure 2The diagram shown is a flowchart illustrating an automated method for discovering API authentication vulnerabilities in mini-programs based on IAST technology, according to an embodiment of the present invention. The method includes: S201: By deploying an IAST probe in the mini-program runtime environment, it monitors and collects runtime data of the mini-program front-end in real time. At the same time, it intercepts all network communication traffic between the mini-program client and the server through a global proxy module. S202: Integrate the runtime data and network traffic, construct an operation context information chain with network requests as the core, and mark sensitive data sources based on predefined taint source rules; S203: Based on dynamic taint tracking technology, analyze the propagation path of the sensitive data in the JavaScript runtime environment, accurately identify the key parameters used for authentication in network requests, and generate an API authentication parameter profile; S204: Based on the preset vulnerability model library, automatically generate a set of test cases for testing authentication vulnerabilities by modifying the API authentication parameter profile; S205: Replay the test cases through the global proxy module and send them to the target API, and receive the response results from the analysis server; S206: Based on predefined vulnerability determination rules, intelligently analyze the response results to ultimately determine whether the target API has an authentication vulnerability and output a vulnerability report.

[0035] Furthermore, the IAST probe deployed in the mini-program runtime environment monitors and collects runtime data from the mini-program front-end in real time. Simultaneously, a global proxy module intercepts all network communication traffic between the mini-program client and the server, including: Specifically, this phase utilizes a dual-channel parallel acquisition mechanism to achieve comprehensive data capture. In the first channel, the IAST probe employs JavaScript prototype chain rewriting technology to achieve deep monitoring of the WeChat Mini Program runtime. By rewriting the `Function.prototype.call` and `Function.prototype.apply` methods, it intercepts all JS-SDK API calls and uses `Object.defineProperty` to hijack important object properties. The monitoring scope covers: ① the call parameters and return values ​​of WeChat series APIs; ② the event objects and target elements of user interaction events; ③ the execution context and parameter passing of custom business functions.

[0036] Specifically, in the second channel, the global proxy module employs TLS / SSL two-way certificate hijacking technology to decrypt and parse encrypted traffic at the transport layer. The proxy module maintains a complete session state machine, capable of correctly handling modern Web protocols such as HTTP / 2 and WebSocket. After parsing, the collected traffic data extracts structured information such as request methods, URLs, headers, and bodies, and aligns its timestamps with IAST data using a high-precision clock synchronization mechanism.

[0037] Furthermore, the fusion processing of runtime data and network traffic constructs an operation context information chain centered on network requests, and marks sensitive data sources based on predefined taint source rules, including: Specifically, this stage employs a multi-level data fusion strategy to construct a complete operational context. First, a timing alignment algorithm, based on an improved variant of Dynamic Time Warping (DTW), is used to address the timing drift problem caused by asynchronous operations. The algorithm establishes the correspondence between events and requests by finding the optimal path between the IAST event sequence and the network request sequence.

[0038] Specifically, based on call stack analysis technology, the call chain from front-end operations to back-end requests is reconstructed. The system parses the call stack information collected by IAST, extracts business-related function call paths, removes functions within the framework, and generates a simplified business operation chain. Finally, sensitive information in the collected data is marked according to a predefined taint pattern library. The marking strategy combines pattern matching based on regular expressions with a classifier based on machine learning.

[0039] Furthermore, based on dynamic taint tracking technology, the propagation path of the sensitive data in the JavaScript runtime environment is analyzed to accurately identify the key parameters used for authentication in network requests, generating an API authentication parameter profile, including: Specifically, this phase implements fine-grained data flow tracing at the JavaScript engine level. The system injects taint propagation logic at the bytecode execution level by modifying the V8 engine's bytecode scheduler. Specific implementations include: ① adding taint flags to bytecode operands; ② defining taint propagation semantics for various operations in transfer functions; and ③ implementing an implicit taint propagation mechanism related to control flow.

[0040] Specifically, the taint tracking process employs an online analysis mode to monitor the propagation path of tainted data in real time. When tainted data is detected flowing into network request parameters, the system records the precise location information of the parameters, including URL path parameters, query strings, request headers, and request bodies. The generated API authentication parameter profile is described in JSON format, containing information such as API endpoint, HTTP method, authentication parameter list, and parameter data type.

[0041] Furthermore, based on a preset vulnerability model library, and targeting the API authentication parameter profile, the automatic mutation generation of a test case set for testing authentication vulnerabilities includes: This phase intelligently generates test cases based on a vulnerability model library and parameter profiling. The vulnerability model library employs a rule engine architecture and includes four types of testing strategies. Constraint solving technology is used during test case generation to ensure that the generated test cases satisfy both mutation rules and parameter type constraints. Horizontal privilege escalation testing: This employs an identifier parameter replacement strategy, analyzing the parameter data type and format to generate alternative user identifiers that conform to semantics. For example, adjacent value testing is used for numeric IDs, and format-preserving random generation is used for UUID IDs.

[0042] Vertical privilege escalation testing: Employing a privilege escalation strategy, this test attempts to elevate privilege levels by analyzing the possible values ​​of role parameters. The system includes a built-in enumeration of common permission parameters and supports custom permission models.

[0043] Token security testing: Token tampering strategies are employed, including token removal, use of expired tokens, and signature alteration. For structured tokens such as JWT, their structure is parsed and segmented for modification.

[0044] Business logic testing: Employ a parameter combination strategy that violates business rules. By analyzing the constraint relationships between parameters, generate parameter combinations that violate business rules.

[0045] Furthermore, the step of replaying the test cases to the target API through the global proxy module and receiving the response results from the analysis server includes: This phase utilizes a proxy middleware to automate the execution of test cases. The system maintains a complete session context, including client states such as cookies, localStorage, and sessionStorage, as well as the session identifier returned by the server. During request replay, traffic rewriting technology is employed to precisely replace target parameter values ​​while preserving the original request structure.

[0046] During execution, complete interaction logs are recorded, including performance metrics such as request sequence, response time, and network latency, as well as the complete content of requests and responses. An asynchronous concurrent execution mode is employed to improve testing efficiency, while a rate limiting mechanism is used to avoid putting excessive pressure on the target system.

[0047] Furthermore, based on predefined vulnerability assessment rules, the response results are intelligently analyzed to ultimately determine whether the target API has an authentication vulnerability, and a vulnerability report is output, including: This phase employs a multi-dimensional analysis method to intelligently determine the test results. The final vulnerability report is in a structured format, including vulnerability details, reproduction steps, risk level, and remediation suggestions, and supports multiple output formats (HTML, PDF, JSON). Differential Analysis: Employing a semantic-based differential comparison algorithm, it not only compares textual differences in response content but also analyzes differences in JSON / XML structures to detect the leakage of sensitive information.

[0048] Semantic analysis: A lightweight NLP model is used to analyze the response text and identify semantic features related to access control. The model is fine-tuned based on a BERT pre-trained model and can accurately identify Chinese access control prompts.

[0049] Behavioral analysis: Analyzes the behavioral patterns of request-response sequences to detect abnormal behavior. For example, it may detect the successful execution of operations requiring high privileges or the acquisition of sensitive data from other users.

[0050] Confidence assessment: A machine learning classifier is used to comprehensively assess the confidence level of the vulnerability's existence based on multi-dimensional features. The classifier is trained on historical vulnerability data and can accurately distinguish between true positives and false positives.

[0051] This invention provides an automated method for discovering API authentication vulnerabilities in mini-programs based on IAST technology. Through a multimodal data collaborative acquisition module, it achieves synchronous capture and precise correlation of runtime data and network traffic of the mini-program front-end, constructing a complete operational context chain. A dynamic taint tracking module performs fine-grained data flow analysis at the JavaScript engine level, accurately identifying key authentication parameters in API requests and generating structured profiles. An intelligent testing engine module automatically generates semantically valid and targeted test cases based on a vulnerability model library and parameter profiles. Finally, a multi-dimensional vulnerability analysis module performs intelligent differential analysis, semantic recognition, and machine learning classification verification on the test responses. This method achieves efficient, accurate, and automated discovery of various API authentication vulnerabilities in mini-programs, including horizontal privilege escalation, vertical privilege escalation, token bypass, and unauthorized access. It significantly improves the coverage, efficiency, and accuracy of vulnerability detection, effectively solving the problems of poor adaptability and high false positive / false positive rates of traditional methods in complex authentication scenarios of mini-programs.

[0052] Electronic device 300 can be a desktop computer, laptop, handheld computer, cloud server, or other electronic device. Electronic device 300 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that... Figure 3This is merely an example of electronic device 300 and does not constitute a limitation on electronic device 300. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device may also include input / output devices, network access devices, buses, etc.

[0053] Processor 301 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0054] The memory 302 can be an internal storage unit of the electronic device 300, such as a hard disk or RAM of the electronic device 300. The memory 302 can also be an external storage device of the electronic device 300, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the electronic device 300. Furthermore, the memory 302 can include both internal and external storage units of the electronic device 300. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0055] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this invention. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0056] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0057] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments of the invention herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0058] In the embodiments provided by this invention, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0059] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0060] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0061] If integrated modules / units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program may include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. Computer-readable media may include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in a computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0062] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. An automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology, characterized in that, The system includes: The data acquisition module is configured to collect runtime data from the front end of the mini program via the IAST probe and intercept network traffic via the global proxy module. The data processing and association module is configured to receive data from the data acquisition module and perform fusion processing and context construction. The dynamic taint analysis module is configured to perform dynamic taint tracking based on the output of the data processing and correlation module, and generate API authentication parameter profiles. The intelligent testing engine module is configured to automatically generate test cases based on the API authentication parameter profile and vulnerability model library. The test execution and replay module is configured to replay test cases generated by the test engine to the target server via a proxy. The vulnerability analysis and reporting module is configured to receive server responses and output the final vulnerability scan report based on the judgment rules.

2. The automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology according to claim 1, characterized in that, In the data acquisition module: The IAST probe mounts the WeChat JS-SDK API by rewriting Function.prototype and Object.defineProperty, and is used to collect function calls, parameters, return values ​​and call stack information; The global proxy module uses a man-in-the-middle proxy architecture and a custom CA certificate to decrypt HTTPS traffic, and is used to collect HTTP / HTTPS request and response, WebSocket communication, and cloud function call traffic.

3. The automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology according to claim 1, characterized in that, The data processing and association module is specifically configured for: A variant of the dynamic time warping algorithm is used to perform time series matching between IAST event streams and network request streams; A mapping relationship between front-end operations and back-end requests is established based on the parsed call stack information; The identity identifier, session token, and permission parameters are marked according to the predefined taint source rules.

4. The automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology according to any one of claims 1 to 3, characterized in that, The dynamic stain analysis module is specifically configured for: Add taint propagation logic at the V8 engine bytecode execution level to achieve fine-grained data flow tracing; Monitor the propagation path of tainted data in variable assignment, function parameter passing, and expression calculation; When tainted data flows into a network request, the parameter name, location, and value are recorded to generate a structured API authentication parameter profile.

5. The automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology according to any one of claims 1 to 3, characterized in that, The vulnerability model library in the intelligent testing engine module includes the following testing strategies: The horizontal privilege escalation testing strategy is used to generate test cases that replace user identifier parameters; Vertical privilege escalation testing strategy is used to generate test cases that modify role or permission parameters; Token security testing strategies are used to generate test cases for removing, tampering with, or reusing authentication tokens; Business logic testing strategies are used to generate test cases that violate combinations of parameters that violate business rules.

6. The automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology according to any one of claims 1 to 3, characterized in that, The test execution and replay module uses a proxy middleware to automatically replay test cases. The specific configuration is used for: Maintain a complete session context to ensure consistency in the test environment; During the request replay process, the network request parameters are rewritten in real time and injected into test cases, while maintaining the integrity of other parameters. All test requests and responses were fully recorded, including detailed information such as request sequence, response time, and response data, providing data support for subsequent analysis.

7. The automated vulnerability discovery system for WeChat Mini Program API authentication based on IAST technology according to any one of claims 1 to 3, characterized in that, The vulnerability analysis and reporting module employs a multi-dimensional analysis method, including: Differential analysis technology is used to compare the status codes, headers, and content structure of the original response and the test response; Semantic analysis techniques are used to identify access control semantic features in responses through NLP models; Machine learning classifiers are used to comprehensively assess the confidence level of a vulnerability's existence based on historical data. The final output is a structured report containing the vulnerability type, risk level, POC request, and remediation suggestions.

8. A method for automatically discovering API authentication vulnerabilities in WeChat Mini Programs based on IAST technology, characterized in that... The method includes: By deploying IAST probes in the mini-program runtime environment, runtime data of the mini-program front-end is monitored and collected in real time; at the same time, all network communication traffic between the mini-program client and the server is intercepted through the global proxy module. The runtime data and network traffic are integrated and processed to construct an operation context information chain with network requests at its core, and sensitive data sources are marked based on predefined taint source rules; Based on dynamic taint tracking technology, the propagation path of the sensitive data in the JavaScript runtime environment is analyzed, the key parameters used for authentication in network requests are accurately identified, and an API authentication parameter profile is generated. Based on the preset vulnerability model library, and targeting the API authentication parameter profile, a set of test cases for testing authentication vulnerabilities is automatically generated. The test cases are replayed and sent to the target API through the global proxy module, and the response results from the analysis server are received. Based on predefined vulnerability assessment rules, the response results are intelligently analyzed to ultimately determine whether the target API has an authentication vulnerability and output a vulnerability report.

9. An electronic device, characterized in that, include: One or more processors; A storage unit is used to store one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the automated mining method for mini-program API authentication vulnerabilities based on IAST technology as described in claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it can realize the automated mining method for API authentication vulnerabilities of mini-programs based on IAST technology as described in claim 8.

Images