An application programming interface privilege escalation vulnerability detection method and related product
Patent Information
- Application Number
- CN202611137834.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-29
- Publication Date
- 2026-10-09
AI Technical Summary
这种方法存在一定的缺陷：一个应用系统往往包含大量应用程序编程接口，通过人工逐一比对响应差异的方式效率较低且难以覆盖所有应用程序编程接口，容易产生遗漏
本申请实施例提供的应用程序编程接口越权漏洞检测方法，获取应用程序编程接口文档，调用大语言模型提取所述应用程序编程接口文档中各应用程序编程接口的接口信息；所述接口信息包括接口路径、请求方法、功能描述、权限等级和/或示例请求参数；根据各应用程序编程接口的权限等级，确定各应用程序编程接口的测试参数；所述测试参数至少包括第一身份凭证和第二身份凭证；按照所述第一身份凭证和所述第二身份凭证，分别向各应用程序编程接口发送测试请求，得到各应用程序编程接口的响应报文集合；调用所述大语言模型对所述响应报文集合中响应报文之间的相似度进行比较，根据相似度比较结果确定各应用程序编程接口的越权漏洞检测结果。
Smart Images
Figure CN122885930A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a method for detecting application programming interface (API) privilege escalation vulnerabilities and related products. Background Technology
[0002] Application Programming Interface (API) privilege escalation vulnerabilities are among the most serious security threats facing enterprise digitalization. The determination of these vulnerabilities relies entirely on business logic; that is, whether the current user has the necessary business authority to access the target resource. Due to the highly complex business logic of enterprise information systems, traditional security detection tools struggle to build universal signature databases for effective identification.
[0003] Currently, the mainstream methods for detecting API privilege escalation vulnerabilities in the industry mainly rely on manual operation. Testers first need to capture the actual API request traffic flowing to the system, then replace the credentials of an authorized account in a request with the credentials of an unauthorized account and resend it. Finally, they determine whether a privilege escalation vulnerability exists by comparing the responses of the original request and the replayed request. This method has certain drawbacks: an application system often contains a large number of APIs, and manually comparing the response differences one by one is inefficient and difficult to cover all APIs, easily leading to omissions.
[0004] Improving the efficiency and coverage of application programming interface (API) privilege escalation vulnerability detection is a technical problem that urgently needs to be solved. Summary of the Invention
[0005] To address the aforementioned issues, this application provides a method and related products for detecting application programming interface (API) privilege escalation vulnerabilities, aiming to improve the efficiency and coverage of API privilege escalation vulnerability detection.
[0006] The embodiments of this application disclose the following technical solutions: The first aspect of this application provides a method for detecting application programming interface privilege escalation vulnerabilities, the method comprising: Obtain the application programming interface (API) documentation, and call the large language model to extract the interface information of each API in the API documentation; the interface information includes the interface path, request method, function description, permission level and / or example request parameters; Based on the permission level of each application programming interface, the test parameters for each application programming interface are determined; the test parameters include at least a first identity credential and a second identity credential. Based on the first identity credential and the second identity credential, test requests are sent to each application programming interface (API) to obtain a set of response messages from each API. The large language model is invoked to compare the similarity between response messages in the response message set, and the unauthorized access vulnerability detection result of each application programming interface is determined based on the similarity comparison result.
[0007] Optionally, the permission levels include administrator level and user level, and determining the test parameters for each application programming interface (API) based on its permission level includes: For any application programming interface: If the current application programming interface has an administrator level of permission, then the level of the first identity credential and the level of the second identity credential are different. If the current application programming interface has a permission level of user level, then the first user identity credential and the second user identity credential have the same level.
[0008] Optionally, the step of calling the large language model to compare the similarity between response messages in the response message set, and determining the unauthorized access vulnerability detection result of each application programming interface based on the similarity comparison result, includes: For any application programming interface: If the current application programming interface has an administrator privilege level, and the similarity between response messages in the corresponding response message set exceeds a first preset similarity threshold, then the current application programming interface has a vertical privilege escalation.
[0009] Optionally, the step of calling the large language model to compare the similarity between response messages in the response message set, and determining the unauthorized access vulnerability detection result of each application programming interface based on the similarity comparison result, includes: For any application programming interface: If the current application programming interface has a user-level permission level, and the similarity between response messages in the corresponding response message set exceeds a second preset similarity threshold, then the current application programming interface has a horizontal privilege escalation.
[0010] Optionally, the step of sending test requests to each application programming interface (API) according to the first identity credential and the second identity credential, and obtaining a set of response messages from each API, includes: For any application programming interface: A first Hypertext Transfer Protocol (HTTP) request is constructed based on the first identity credential, and a second Hypertext Transfer Protocol (HTTP) request is constructed based on the second identity credential. The first Hypertext Transfer Protocol (HTTP) request and the second Hypertext Transfer Protocol (HTTP) request are respectively sent to the current application programming interface. Receive the first and second response messages returned by the current application programming interface to obtain the response message set of the current application programming interface.
[0011] Optionally, the permission level may further include a public level, and the method may further include: If the permission level of the application programming interface is public, then the detection of privilege escalation vulnerabilities in the corresponding application programming interface is skipped.
[0012] A second aspect of this application provides an application programming interface privilege escalation vulnerability detection device, the device comprising: The interface information extraction module is used to obtain the application programming interface (API) document and call the large language model to extract the interface information of each API in the API document; the interface information includes interface path, request method, function description, permission level and / or example request parameters; The test parameter determination module is used to determine the test parameters of each application programming interface based on the permission level of each application programming interface; the test parameters include at least a first identity credential and a second identity credential. The response message set determination module is used to send test requests to each application programming interface according to the first identity credential and the second identity credential, and obtain the response message set of each application programming interface. The privilege escalation vulnerability detection module is used to call the large language model to compare the similarity between response messages in the response message set, and determine the privilege escalation vulnerability detection result of each application programming interface based on the similarity comparison result.
[0013] Optionally, the test parameter determination module is used for: For any application programming interface: If the current application programming interface has an administrator level of permission, then the level of the first identity credential and the level of the second identity credential are different. If the current application programming interface has a permission level of user level, then the first user identity credential and the second user identity credential have the same level.
[0014] A third aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements an application programming interface privilege escalation vulnerability detection method as provided in any implementation of the first aspect.
[0015] The fourth aspect of this application provides a processor for running a computer program that, when running, executes an application programming interface privilege escalation vulnerability detection method as provided in any implementation of the first aspect.
[0016] Compared with the prior art, this application has the following beneficial effects: The application programming interface (API) privilege escalation vulnerability detection method provided in this application embodiment obtains the API documentation, and calls a large language model to extract the interface information of each API in the API documentation. The interface information includes the interface path, request method, function description, permission level, and / or example request parameters. Based on the permission level of each API, test parameters are determined for each API. The test parameters include at least a first identity credential and a second identity credential. Test requests are sent to each API according to the first identity credential and the second identity credential, respectively, to obtain a set of response messages for each API. The large language model is called to compare the similarity between the response messages in the set of response messages, and the privilege escalation vulnerability detection result of each API is determined based on the similarity comparison result.
[0017] By directly extracting interface information from the application programming interface (API) documentation using a large language model, a complete list of all APIs and their permission mappings can be obtained at once. Compared to traditional methods that rely on capturing request traffic to obtain interface information, this approach is not limited by traffic coverage and effectively avoids interface omissions caused by incomplete test cases or APIs not being called in a specific order of operations, significantly improving the coverage and completeness of detection. By automatically determining test parameters containing first and second identity credentials based on the permission level of each API, and sending test requests to each API based on the two credentials and recording the responses, the same detection process can cover both vertical and horizontal privilege escalation scenarios, achieving automated detection. By comparing the similarity between response messages using the large language model, batch analysis of hundreds or thousands of response messages can be automatically completed, resulting in an efficiency improvement of orders of magnitude compared to traditional manual comparison methods. Furthermore, the large language model possesses powerful semantic understanding capabilities, accurately determining the substantial similarity of response messages at the content level, rather than relying solely on keyword matching or rule matching, effectively improving detection accuracy. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1 A flowchart illustrating an application programming interface privilege escalation vulnerability detection method provided in this application embodiment; Figure 2 This is a schematic diagram of the structure of an application programming interface privilege escalation vulnerability detection device provided in an embodiment of this application. Detailed Implementation
[0020] As described earlier, current mainstream methods for detecting API privilege escalation vulnerabilities primarily rely on manual operation. Detectors first need to capture the actual API request traffic flowing to the system, then replace the credentials of an authorized account in a request with those of an unauthorized account and resend it. Finally, they determine whether a privilege escalation vulnerability exists by comparing the responses of the original and replayed requests. This method has certain drawbacks: an application system often contains a large number of APIs, and manually comparing the responses one by one is inefficient and difficult to cover all APIs, easily leading to omissions.
[0021] In view of the above problems, this application proposes a method and related products for detecting application programming interface (API) privilege escalation vulnerabilities. The method involves obtaining API documentation, using a large language model to extract interface information for each API from the API documentation; the interface information includes interface path, request method, function description, permission level, and / or example request parameters; determining test parameters for each API based on its permission level; the test parameters include at least a first identity credential and a second identity credential; sending test requests to each API according to the first and second identity credentials to obtain a set of response messages for each API; using the large language model to compare the similarity between the response messages in the set of response messages, and determining the privilege escalation vulnerability detection result for each API based on the similarity comparison result.
[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.
[0023] See Figure 1 This figure is a flowchart of an application programming interface privilege escalation vulnerability detection method provided in an embodiment of this application. Figure 1 As shown, the method includes the following steps: S101. Obtain the application programming interface (API) document and call the large language model to extract the interface information of each API in the API document.
[0024] The interface information includes the interface path, request method, function description, permission level, and / or example request parameters.
[0025] API documentation is a technical document written by developers during the system design phase, recording detailed information about all the system's APIs. Because API documentation typically uses natural language to describe the functionality and parameters of the interfaces, large language models can accurately understand these descriptions and extract structured information.
[0026] For example, the interface information of each application programming interface is shown in the following code: [ { "path": " / api / v1 / users", "method": "GET", "description": "Get user list", "required_permission_level": "admin", "example_parameters": { "page": 1, "size": 10 } }, { "path": " / api / v1 / users / {id}", "method": "GET", "description": "Retrieves information for a specified user", "required_permission_level": "user", "example_parameters": { "id": 1 } }, { "path": " / api / v1 / users", "method": "POST", "description": "Create User", "required_permission_level": "admin", "example_parameters": { "name": "John", "age": 30 } } ] The code above is a JSON-formatted list of Application Programming Interface (API) information, automatically generated by a large language model from API documentation. This list contains structured information for three APIs, each including the API path, request method, description, required permission level, and example parameters. Specifically, the APIs for retrieving the user list and creating a user require the administrator level (admin) for subsequent vertical privilege escalation detection; the API for retrieving specific user information requires the user level (user) for subsequent horizontal privilege escalation detection. The example request parameters list provides examples of request parameters for each API. GET requests use query parameters such as page, size, and id, while POST requests use request body parameters such as name and age, providing a data foundation for constructing subsequent test requests. By converting unstructured natural language documents into structured data using a large language model, a data foundation is laid for the subsequent automated generation of test parameters, sending of test requests, and identification of privilege escalation vulnerabilities.
[0027] S102. Determine the test parameters for each application programming interface based on its permission level.
[0028] The test parameters include at least a first identity credential and a second identity credential.
[0029] Permission levels are used to identify the level of permissions required to access an API, such as public level, user level, and administrator level.
[0030] Identity credentials are information used in API requests to identify the current user's identity and permission level. They are usually carried in the form of a token and can be included in the HTTP (Hypertext Transfer Protocol) request header.
[0031] In one feasible implementation, the permission levels include administrator level and user level. Based on the permission level of each application programming interface (API), the test parameters for each API are determined, including: For any application programming interface: If the current application programming interface has an administrator level of permission, then the level of the first identity credential and the level of the second identity credential are different. If the current application programming interface has a permission level of user level, then the first user identity credential and the second user identity credential have the same level.
[0032] Administrator level indicates that the API requires administrator privileges to access, and is used to detect vertical privilege escalation vulnerabilities; user level indicates that the API requires ordinary user privileges to access, and is used to detect horizontal privilege escalation vulnerabilities.
[0033] In one feasible implementation, the permission level further includes a public level, and the method further includes: If the permission level of the application programming interface is public, then the detection of privilege escalation vulnerabilities in the corresponding application programming interface is skipped.
[0034] By identifying API permission levels, the system automatically distinguishes between vertical privilege escalation detection scenarios (administrator-level APIs) and horizontal privilege escalation detection scenarios (user-level APIs). It then configures corresponding credential combinations for different scenarios. For example, administrator-level APIs are configured with two credentials at different permission levels, such as administrator and regular user; user-level APIs are configured with two credentials at the same permission level, such as regular user A and regular user B. This allows for automatic coverage of both vertical and horizontal privilege escalation vulnerabilities, eliminating the need for manual judgment and configuration for each API, thus avoiding human oversights or configuration errors. Furthermore, the system automatically determines test parameters and configures credentials based on the API's permission level, requiring no manual intervention and significantly reducing detection time and labor costs.
[0035] S103. Based on the first identity credential and the second identity credential, send test requests to each application programming interface respectively, and obtain the response message set of each application programming interface.
[0036] In one feasible implementation: For any application programming interface: A first Hypertext Transfer Protocol (HTTP) request is constructed based on the first identity credential, and a second Hypertext Transfer Protocol (HTTP) request is constructed based on the second identity credential. The first Hypertext Transfer Protocol (HTTP) request and the second Hypertext Transfer Protocol (HTTP) request are respectively sent to the current application programming interface. Receive the first and second response messages returned by the current application programming interface to obtain the response message set of the current application programming interface.
[0037] For each API, two HTTP requests are constructed based on two identity credentials and sent to that API. This allows for the acquisition of a complete set of response messages for the same API under different permissions, providing complete paired data for subsequent similarity analysis. Compared to traditional methods that manually replace tokens one by one and send requests multiple times, this method achieves automated parallel processing of request sending, significantly improving detection efficiency.
[0038] S104. Call the large language model to compare the similarity between response messages in the response message set, and determine the unauthorized access vulnerability detection result of each application programming interface based on the similarity comparison result.
[0039] In one feasible implementation: For any application programming interface: If the current application programming interface has an administrator privilege level, and the similarity between response messages in the corresponding response message set exceeds a first preset similarity threshold, then the current application programming interface has a vertical privilege escalation.
[0040] If the current application programming interface (API) has an administrator privilege level, then the API requires administrator privileges to access it normally. To detect whether the API has a vertical privilege escalation vulnerability, the first and second identity credentials have different levels: one is an administrator credential, and the other is a user credential, with the administrator credential having a higher level than the user credential. After sending requests to the API with both credentials, if the similarity between the user credential's response and the administrator credential's response is greater than a preset similarity threshold, then the API has not effectively blocked low-privilege requests and has a vertical privilege escalation vulnerability. Vertical privilege escalation refers to a low-privilege user, such as a regular user, being able to access APIs or data that only high-privilege users, such as administrators, have the right to access. When the response from the low-privilege credential is highly similar to the response from the high-privilege credential, it indicates that the API has not effectively blocked low-privilege requests and has a vertical privilege escalation risk.
[0041] In another feasible implementation: For any application programming interface: If the current application programming interface has a user-level permission level, and the similarity between response messages in the corresponding response message set exceeds a second preset similarity threshold, then the current application programming interface has a horizontal privilege escalation.
[0042] The first preset similarity threshold is less than the second preset similarity threshold.
[0043] If the current application programming interface (API) has a user-level access permission, then the API requires user privileges to access it normally. To detect whether the API has a horizontal privilege escalation vulnerability, the first and second identity credentials have the same level, both being user credentials, but belonging to different users. After sending requests to the API using these two identity credentials respectively, if one user can access the other user's resource data through the API, it indicates that the API has a horizontal privilege escalation vulnerability. Horizontal privilege escalation refers to an ordinary user being able to access another ordinary user's private resource data. When the responses corresponding to the identity credentials of two different users are highly similar, it indicates that the API has not effectively isolated user identities, and there is a risk of horizontal privilege escalation.
[0044] By using a large language model to perform semantic similarity comparisons on response messages, the actual meaning of the response messages at the content level can be accurately understood, and it can be determined whether response messages at different permission levels are substantially similar in business logic, thereby significantly improving detection accuracy. By combining the API permission level with the similarity comparison results of response messages, vertical privilege escalation and horizontal privilege escalation vulnerabilities are automatically distinguished. The entire process requires no manual intervention, achieving automated classification and judgment in the detection process, reducing reliance on professional security personnel, and improving detection efficiency.
[0045] The application programming interface (API) privilege escalation vulnerability detection method provided in this application embodiment obtains the API documentation, and calls a large language model to extract the interface information of each API in the API documentation. The interface information includes the interface path, request method, function description, permission level, and / or example request parameters. Based on the permission level of each API, test parameters are determined for each API. The test parameters include at least a first identity credential and a second identity credential. Test requests are sent to each API according to the first identity credential and the second identity credential, respectively, to obtain a set of response messages for each API. The large language model is called to compare the similarity between the response messages in the set of response messages, and the privilege escalation vulnerability detection result of each API is determined based on the similarity comparison result.
[0046] By directly extracting interface information from the application programming interface (API) documentation using a large language model, a complete list of all APIs and their permission mappings can be obtained at once. Compared to traditional methods that rely on capturing request traffic to obtain interface information, this approach is not limited by traffic coverage and effectively avoids interface omissions caused by incomplete test cases or APIs not being called in a specific order of operations, significantly improving the coverage and completeness of detection. By automatically determining test parameters containing first and second identity credentials based on the permission level of each API, and sending test requests to each API based on the two credentials and recording the responses, the same detection process can cover both vertical and horizontal privilege escalation scenarios, achieving automated detection. By comparing the similarity between response messages using the large language model, batch analysis of hundreds or thousands of response messages can be automatically completed, resulting in an efficiency improvement of orders of magnitude compared to traditional manual comparison methods. Furthermore, the large language model possesses powerful semantic understanding capabilities, accurately determining the substantial similarity of response messages at the content level, rather than relying solely on keyword matching or rule matching, effectively improving detection accuracy.
[0047] Based on the application programming interface (API) privilege escalation vulnerability detection method described in the preceding embodiments, this application also provides an API privilege escalation vulnerability detection device. Figure 2 This is a schematic diagram of the device. Figure 2 As shown, the application programming interface privilege escalation vulnerability detection device includes: The interface information extraction module 201 is used to obtain the application programming interface document and call the large language model to extract the interface information of each application programming interface in the application programming interface document; the interface information includes interface path, request method, function description, permission level and / or example request parameters; The test parameter determination module 202 is used to determine the test parameters of each application programming interface according to the permission level of each application programming interface; the test parameters include at least a first identity credential and a second identity credential. The response message set determination module 203 is used to send test requests to each application programming interface according to the first identity credential and the second identity credential, and obtain the response message set of each application programming interface. The privilege escalation vulnerability detection module 204 is used to call the large language model to compare the similarity between response messages in the response message set, and determine the privilege escalation vulnerability detection result of each application programming interface based on the similarity comparison result.
[0048] Optionally, the test parameter determination module is used for: For any application programming interface: If the current application programming interface has an administrator level of permission, then the level of the first identity credential and the level of the second identity credential are different. If the current application programming interface has a permission level of user level, then the first user identity credential and the second user identity credential have the same level.
[0049] Optionally, the privilege escalation vulnerability detection module is used for: For any application programming interface: If the current application programming interface has an administrator privilege level, and the similarity between response messages in the corresponding response message set exceeds a first preset similarity threshold, then the current application programming interface has a vertical privilege escalation.
[0050] Optionally, the privilege escalation vulnerability detection module is used for: For any application programming interface: If the current application programming interface has a user-level permission level, and the similarity between response messages in the corresponding response message set exceeds a second preset similarity threshold, then the current application programming interface has a horizontal privilege escalation.
[0051] Optionally, the response message set determination module is used to: For any application programming interface: A first Hypertext Transfer Protocol (HTTP) request is constructed based on the first identity credential, and a second Hypertext Transfer Protocol (HTTP) request is constructed based on the second identity credential. The first Hypertext Transfer Protocol (HTTP) request and the second Hypertext Transfer Protocol (HTTP) request are respectively sent to the current application programming interface. Receive the first and second response messages returned by the current application programming interface to obtain the response message set of the current application programming interface.
[0052] Optionally, the permission level may further include a public level, and the device may further include a public interface filtering module; The public interface filtering module is used to skip the unauthorized access vulnerability detection of the corresponding application programming interface if the permission level of the application programming interface is public.
[0053] Furthermore, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the application programming interface privilege escalation vulnerability detection method as described in any of the method embodiments.
[0054] Furthermore, this application embodiment also provides a processor for running a computer program, wherein the program executes the application programming interface privilege escalation vulnerability detection method as described in any of the aforementioned method embodiments.
[0055] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. The components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment solution according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0056] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A method for detecting privilege escalation vulnerabilities in application programming interfaces, characterized in that, include: Obtain the application programming interface (API) documentation, and call the large language model to extract the interface information of each application programming interface in the API documentation; The interface information includes the interface path, request method, function description, permission level and / or example request parameters; Based on the permission level of each application programming interface, the test parameters for each application programming interface are determined; the test parameters include at least a first identity credential and a second identity credential. Based on the first identity credential and the second identity credential, test requests are sent to each application programming interface (API) to obtain a set of response messages from each API. The large language model is invoked to compare the similarity between response messages in the response message set, and the unauthorized access vulnerability detection result of each application programming interface is determined based on the similarity comparison result.
2. The method according to claim 1, characterized in that, The permission levels include administrator level and user level. Determining the test parameters for each application programming interface (API) based on its permission level includes: For any application programming interface: If the current application programming interface has an administrator level of permission, then the level of the first identity credential and the level of the second identity credential are different. If the current application programming interface has a permission level of user level, then the first user identity credential and the second user identity credential have the same level.
3. The method according to claim 2, characterized in that, The process of calling the large language model to compare the similarity between response messages in the response message set, and determining the privilege escalation vulnerability detection result of each application programming interface based on the similarity comparison result, includes: For any application programming interface: If the current application programming interface has an administrator privilege level, and the similarity between response messages in the corresponding response message set exceeds a first preset similarity threshold, then the current application programming interface has a vertical privilege escalation.
4. The method according to claim 2, characterized in that, The process of calling the large language model to compare the similarity between response messages in the response message set, and determining the privilege escalation vulnerability detection result of each application programming interface based on the similarity comparison result, includes: For any application programming interface: If the current application programming interface has a user-level permission level, and the similarity between response messages in the corresponding response message set exceeds a second preset similarity threshold, then the current application programming interface has a horizontal privilege escalation.
5. The method according to claim 1, characterized in that, The step of sending test requests to each application programming interface (API) according to the first identity credential and the second identity credential, and obtaining a set of response messages from each API, includes: For any application programming interface: A first Hypertext Transfer Protocol (HTTP) request is constructed based on the first identity credential, and a second Hypertext Transfer Protocol (HTTP) request is constructed based on the second identity credential. The first Hypertext Transfer Protocol (HTTP) request and the second Hypertext Transfer Protocol (HTTP) request are respectively sent to the current application programming interface. Receive the first and second response messages returned by the current application programming interface to obtain the response message set of the current application programming interface.
6. The method according to claim 1, characterized in that, The permission level also includes a public level, and the method further includes: If the permission level of the application programming interface is public, then the detection of privilege escalation vulnerabilities in the corresponding application programming interface is skipped.
7. A device for detecting application programming interface (API) privilege escalation vulnerabilities, characterized in that, include: The interface information extraction module is used to obtain the application programming interface (API) document and call the large language model to extract the interface information of each API in the API document; the interface information includes interface path, request method, function description, permission level and / or example request parameters; The test parameter determination module is used to determine the test parameters of each application programming interface based on the permission level of each application programming interface; the test parameters include at least a first identity credential and a second identity credential. The response message set determination module is used to send test requests to each application programming interface according to the first identity credential and the second identity credential, and obtain the response message set of each application programming interface. The privilege escalation vulnerability detection module is used to call the large language model to compare the similarity between response messages in the response message set, and determine the privilege escalation vulnerability detection result of each application programming interface based on the similarity comparison result.
8. The apparatus according to claim 7, characterized in that, The test parameter determination module is used for: For any application programming interface: If the current application programming interface has an administrator level of permission, then the level of the first identity credential and the level of the second identity credential are different. If the current application programming interface has a permission level of user level, then the first user identity credential and the second user identity credential have the same level.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the application programming interface privilege escalation vulnerability detection method as described in any one of claims 1-6.
10. A processor, characterized in that, Used to run a computer program, wherein the program executes the application programming interface privilege escalation vulnerability detection method as described in any one of claims 1-6.