The invention provides a method and
system for detecting an unauthorized URL of a website based on automatic operation of a common user, belongs to the technical field of
network security, and can at least partially solve the problems of low detection efficiency, poor accuracy and excessive dependence on manual operation in the prior art. Automatically
logging in a website by using the registration information,
processing a
verification link, and obtaining session information; obtaining a JS file through a
web crawler in a normal user login state; analyzing the JS file, extracting static, dynamic and relative URLs in combination with
lexical analysis, grammatical analysis and sandbox
simulation execution, and unifying the static, dynamic and relative URLs as absolute URLs; de-duplicating and normalizing the URL; accessing the URL through a common user session by using a network test tool, obtaining response data, comparing the response data with a high-authority user reference response, and judging an unauthorized URL; the method has the beneficial effects that automatic and comprehensive detection of the unauthorized URL is realized, and the detection efficiency and accuracy are remarkably improved.