CN107948120A - leak detection method and device - Google Patents

Abstract

The present application provides a vulnerability detection method and device, by adding a step of converting the field in the JSON format in the first request message into the field in the URL format during the vulnerability detection process, so that it can be used in the existing vulnerability scanner based on the URL format Without changing the engine, add the test load to the field in the URL format, convert the field in the URL format after adding the test load into JSON format, generate a second request message, and send the second request message to the server, so that The server can identify the second request message, compare the second response message corresponding to the second request message returned by the server with the first response message returned by directly sending the first request message to the server, and combine the Vulnerability determination preset rules to obtain vulnerability detection results, thereby realizing automated vulnerability detection based on JSON format, saving development costs, and improving vulnerability detection efficiency.

Description

Vulnerability detection method and device

technical field

The present application relates to computer technology, in particular to a vulnerability detection method and device.

Background technique

JavaScript Object Notation (JavaScript Object Notation, referred to as: JSON) is a lightweight data exchange format that is easy for humans to read and write, and is also easy for machines to parse and generate.

Web vulnerability detection is to obtain the request message sent by the browser or client of the web application to the server, according to the type of vulnerability to be tested, add the test load corresponding to the vulnerability type in the request message, and send the request message after adding the test load To the server, according to the response message corresponding to the request message after adding the test load returned by the server, determine whether there is a vulnerability corresponding to the vulnerability type in the web application; for a certain type of vulnerability, if the request message returned by the server after adding the test load corresponds to If the response message is different from the estimated response message, it is considered that the web application has a vulnerability corresponding to the vulnerability type, wherein the estimated response message refers to the response message returned by the server after receiving the request message without adding a test load.

As we all know, the currently commonly used Uniform Resource Locator (Uniform Resoure Locator, referred to as: URL) format is different from the JSON format, as follows:

URL format: a combination of parameter name and parameter value in the form of "key1=value1&key2=value2";

JSON format: a combination of parameter names and parameter values in the format of "{"key1":"value1", "key2":"value2"}".

Existing vulnerability scanner engines generally perform automated request acquisition and test load addition based on the URL format, and thereby perform vulnerability detection. However, due to the inability to recognize the JSON format, there is currently no mature scanner engine for vulnerability detection based on the JSON format.

Currently, in the web architecture (Web), more and more communications between the browser and the server are in the JSON format, and developing a vulnerability scanner engine suitable for the JSON format requires a lot of development costs. Therefore, one of the current methods is to manually troubleshoot the data in JSON format, which is extremely labor-intensive.

Therefore, there is an urgent need for a method that can automatically scan the JSON format for vulnerabilities.

Contents of the invention

The present application provides a loophole detection method and device to solve the problem of low loophole detection efficiency in the prior art.

In one aspect, the present application provides a vulnerability detection method, including:

Obtaining a first request message sent to the server, where the first request message includes fields in JSON format;

Converting the field in the JSON format into a field in the Uniform Resource Locator URL format;

Add a test load in the field of the URL format;

Convert the field in the URL format after adding the test load into JSON format, and generate the second request message;

sending the second request message to the server;

receiving a first response message sent by the server for the first request message;

receiving a second response message sent by the server for the second request message;

Acquire a vulnerability detection result according to the first response message, the second response message, and a vulnerability determination preset rule.

As an implementable manner, both the first request message and the second request message are hypertext transfer protocol HTTP messages.

As an implementable manner, the acquisition of the first request message sent to the server includes:

Obtain the first request message sent to the server from the log of the server.

As an implementable manner, the acquisition of the first request message sent to the server includes:

Obtain the first request message sent to the server through the Web proxy;

The sending the second request message to the server includes:

sending the second request message to the server through the Web proxy.

As an implementable manner, the acquisition of the first request message sent to the server includes:

Obtain the first request message sent to the server by bypassing data monitoring.

As an implementable manner, after converting the field in the JSON format into a field in the Uniform Resource Locator URL format, it further includes:

Adding a format conversion identifier to the first request message;

The field in the URL format after adding the test load is converted into JSON format, and before the second request message is generated, it also includes:

It is determined that the first request message includes the format conversion identifier.

As an implementable manner, the acquisition of the vulnerability detection result according to the first response message of the second request message, the second response message, and the vulnerability determination preset rules includes:

The second response message is compared with the first response message, and a vulnerability detection result is obtained in combination with the preset rules for determining the vulnerability.

On the other hand, the present application provides a vulnerability detection device, including:

An acquisition module, configured to acquire a first request message sent to the server, where the first request message includes fields in JSON format;

A format conversion module, configured to convert the field in the JSON format into a field in the Uniform Resource Locator URL format;

A processing module, configured to add a test load to the field in the URL format;

The format conversion module is also used to convert the field of URL format after adding the test load into JSON format, and generate the second request message;

a sending module, configured to send the second request message to the server;

a receiving module, configured to receive a first response message sent by the server for the first request message;

A receiving module, further configured to receive a second response message sent by the server for the second request message;

The processing module is further configured to obtain a vulnerability detection result according to the first response message, the second response message, and vulnerability determination preset rules.

As an implementable manner, both the first request message and the second request message are hypertext transfer protocol HTTP messages.

As an implementable manner, the acquiring module is specifically configured to acquire the first request message sent to the server from a log of the server.

As an implementable manner, the acquiring module is specifically configured to acquire the first request message sent to the server through the Web proxy; the sending module is specifically configured to control the Web proxy to send the second request message to the server .

As an implementable manner, the obtaining module is specifically configured to obtain the first request message sent to the server by bypassing data monitoring.

As an implementable manner, the processing module is further configured to add a format conversion identifier in the first request message;

The processing module is further configured to determine that the format conversion identifier is included in the first request message.

As an implementable manner, the processing module is specifically configured to compare the second response message with the first response message, and obtain a vulnerability detection result in combination with the vulnerability determination preset rules.

In another aspect, the present application provides a vulnerability detection device, including:

A processor, configured to obtain a first request message sent to the server, where the first request message includes fields in JSON format;

The processor is further configured to convert the field in the JSON format into a field in the Uniform Resource Locator URL format;

The processor is also used to add a test load in the field of the URL format;

The processor is also used to convert the field in the URL format after adding the test load into a JSON format to generate a second request message;

a sending interface, the sending interface is coupled to the processor, and the sending interface is configured to send the second request message to the server;

A receiving interface, the receiving interface is coupled to the processor, and the receiving interface is configured to receive the first response message sent by the server for the first request message, and receive the first response message sent by the server for the a second response message to the second request message;

The processor is further configured to obtain a vulnerability detection result according to the first response message, the second response message, and a preset rule for determining a vulnerability.

As an implementable manner, the processor is specifically configured to acquire the first request message sent to the server from a log of the server.

As an implementable manner, the processor is specifically configured to obtain the first request message sent to the server through a Web proxy;

The sending interface is specifically used to control the Web proxy to send the second request message to the server.

As an implementable manner, the processor is specifically configured to obtain the first request message sent to the server by bypassing data monitoring.

As an implementable manner, the processor is further configured to add a format conversion identifier in the first request message;

The processor is further configured to determine that the first request message includes the format conversion identifier.

As an implementable manner, the processor is specifically configured to compare the second response message with the first response message, and obtain a vulnerability detection result in combination with the vulnerability determination preset rule.

In the vulnerability detection method and device provided by the present application, by adding the step of converting the field in the JSON format in the first request message into the field in the URL format during the vulnerability detection process, it can be used in the existing vulnerability scanner engine based on the URL format In the case of no change, add the test load in the URL format field, and convert the URL format field after adding the test load into JSON format, generate the second request message, and send the second request message to the server, so that the server Can identify the second request message, compare the second response message corresponding to the second request message returned by the server with the first response message returned by directly sending the first request message to the server, and combine the vulnerabilities in the vulnerability knowledge base Determine the preset rules and obtain the vulnerability detection results, thereby realizing automatic vulnerability detection based on the JSON format, saving development costs, and improving the efficiency of vulnerability detection.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is a schematic diagram of the B/S architecture of the present application;

Fig. 2 is a schematic diagram of the C/S architecture of the present application;

FIG. 3 is a schematic flow chart of Embodiment 1 of the vulnerability detection method of the present application;

FIG. 4 is a schematic flow diagram of Embodiment 2 of the vulnerability detection method of the present application;

5 is a schematic structural diagram of an embodiment of the vulnerability detection device of the present application;

FIG. 6 is a schematic structural diagram of another embodiment of the vulnerability detection device of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with aspects of the invention as recited in the appended claims.

It should be clear that the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. As used in the embodiments of the present invention and the appended claims, the singular forms "a", "said" and "the" are also intended to include the plural forms unless the context clearly indicates otherwise.

It should be understood that the term "and/or" used herein is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B, which may mean that A exists alone, and A and B exist simultaneously. B, there are three situations of B alone. In addition, the character "/" in this article generally indicates that the contextual objects are an "or" relationship.

It should be understood that although the terms first, second, third, etc. may be used to describe XXX in the embodiments of the present invention, these XXX should not be limited to these terms. These terms are only used to distinguish XXX from each other. For example, without departing from the scope of the embodiments of the present invention, the first XXX may also be called the second XXX, and similarly, the second XXX may also be called the first XXX.

Depending on the context, the words "if", "if" as used herein may be interpreted as "at" or "when" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrases "if determined" or "if detected (the stated condition or event)" could be interpreted as "when determined" or "in response to the determination" or "when detected (the stated condition or event) )" or "in response to detection of (a stated condition or event)".

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a good or system comprising a set of elements includes not only those elements but also includes items not expressly listed. other elements of the product, or elements inherent in the commodity or system. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the article or system comprising said element.

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with aspects of the invention as recited in the appended claims.

The technical solution of the present application can be applied to a browser/server (Browser/Server, referred to as: B/S) architecture or a client/server (Client/Server, referred to as: C/S) architecture, wherein the B/S architecture is as follows: As shown in FIG. 1, FIG. 1 is a schematic diagram of the B/S architecture of the present application, and the C/S architecture is shown in FIG. 2, and FIG. 2 is a schematic diagram of the C/S architecture of the present application. In Figure 1, the communication between the browser and the server is in JSON format, and in Figure 2, the communication between the client and the server is in JSON format.

In order to solve the problem that the web vulnerability detection method in the prior art cannot detect vulnerabilities based on the JSON format, this application adds a conversion step between the URL format and the JSON format during the vulnerability detection process, so that the existing URL format-based Without changing the vulnerability scanner engine, the vulnerability detection method of the present application can realize automatic vulnerability detection based on the JSON format.

This application is also aimed at web applications that need to be logged in before they can be used, and web applications that cannot obtain the request message sent by the client to the server through crawler technology (for example: a web application on the mobile phone), and obtain the request by manually triggering the sending of the request message. information.

The technical solution of the present application will be described in detail below with specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

Embodiment one

Figure 3 is a schematic flow diagram of Embodiment 1 of the vulnerability detection method of the present application. The vulnerability detection method of this embodiment is applied to a vulnerability detection system, which includes a browser/client, a web proxy, a first conversion module, and a vulnerability detection system. A scanner engine and a second conversion module; wherein, the first conversion module is used to convert JSON to URL format, and the second conversion module is used to convert URL format to JSON format, and the first conversion module and the second conversion module can be deployed in In the web agent, it can also be deployed independently, and this application does not limit it; wherein, the vulnerability scanner engine is a vulnerability scanner engine based on the URL format, that is, it can only recognize request messages in the URL format, and when adding a test load , add based on the URL format; the browser/client and the server communicate based on the JSON format, the method of the present embodiment is as follows:

S301: The browser/client sends a first request message to the web proxy.

The browser/client may be manually triggered to send the first request message to the web agent, for example, by clicking on a button displayed by the browser/client of the web application to trigger sending the first request message to the web agent.

It is also possible to automatically click a button displayed on the browser/client by simulating a manual click, so as to trigger sending the first request message to the server.

Wherein, the first request message includes fields in JSON format. Among them, the JSON format fields are as follows:

{"customerId":"","contactsMobile":"15678167514","contactsName":"tet","companyName":"123"}.

S302: The web agent acquires the first request message.

The browser/client communicates with the server through the web proxy, that is, the browser or client sends messages to the server, or the browser/client receives messages from the server through the web proxy. Therefore, the web proxy can obtain the first request message sent to the server.

Optionally, the first request message can be obtained through various implementation methods, except for the web proxy, for example, it can also be obtained through bypass data monitoring or from the log of the server, etc., which is not limited in this application.

S303: The web agent sends a first request message to the server.

S304: The web proxy receives a first response message sent by the server for the first request message.

Among them, the first response message is as follows:

S305: The web proxy sends a first request message to the first conversion module.

S306: The first conversion module converts the fields in the JSON format in the first request message into the fields in the URL format.

Parse the key:value sequence in the JSON format, and reorganize the key:value sequence into the URL format, thereby realizing the conversion of the fields in the JSON format into the fields in the URL format.

For example: parse out the key:value sequence in JSON format as: "{"key1":"value1", "key2":"value2"}", then reorganize the key:value sequence into the URL format as "key1=value1&key2= value2".

For example: converting the fields in JSON format in S301 to the fields in URL format is as follows:

"customerId=&contactsMobile=15678167514&contactsName=tet&companyName=123"

S307: The first converting module sends the format-converted first request message to the vulnerability scanner engine.

S308: The vulnerability scanner engine adds a test payload to the first request message.

When the vulnerability scanner engine adds a test payload, it adds it based on the URL format. Therefore, after converting the field in the JSON format to a field in the URL format, you can add the test payload in the field in the URL format.

Vulnerability types include: SQL injection vulnerabilities, command execution vulnerabilities, cross-site scripting (Cross-sitescripting, XSS) vulnerabilities, arbitrary file download vulnerabilities, and file inclusion vulnerabilities. Each vulnerability type corresponds to a set of test loads, and a set of test loads. A payload contains one or more test payloads.

For each type of test, add the corresponding test load to the first request message. Take the test error reporting SQL injection vulnerability as an example, add a test load. This example uses ",updatexml(1,@@version,1)" as the For the test load, the URL field in the first request message added at the parameter contactsMobile is as follows: customerId=&contactsMobile=15678167514, updatexml(1,@@version,1)&co ntactsName=tet&companyName=123

S309: The vulnerability scanner engine sends the first request message after adding the test load to the second conversion module.

S310: The second conversion module converts the URL format in the first request message after adding the test payload into a JSON format, and generates a second request message.

Since the browser/client of this application communicates with the server based on the JSON format, the server can only recognize messages in the JSON format. Therefore, it is also necessary to convert the field in the URL format after adding the payload into the JSON format, and generate the second request message.

The fields in JSON format in the second request message are as follows:

{"customerId":"","contactsMobile":"15678167514,updatexml(1,@@version,1)","contactsName":"tet","companyName":"123"}

S311: The second conversion module sends a second request message to the web proxy.

S312: The web proxy sends a second request message to the server.

S313: The web proxy receives the second response message sent by the server for the second request message.

Specifically, a possible situation A is: the second response message, as shown below:

Another possible situation B is: the second response message is as follows:

S314: The web proxy sends the second response message and the first response message to the vulnerability scanner engine.

S315: The vulnerability scanner engine determines whether there is a vulnerability according to the first response message, the second response message, and a vulnerability determination preset rule.

According to the vulnerability knowledge base, the difference between the response message of the second request message and the response message of the first request is compared to determine whether there is a vulnerability in the web application.

Combining the above example, it can be known that when the second response is the case A in S313, it is found that the second response message is different from the first response message, and there is SQL error information in the second response message, namely: ERRO: SELECT DISTINCT JSON.qridFROM x2 AS JSON,x2 AS x2 WHERE JSON.contactsMobile IN(1,updatexml(1,@@version,1))AND JSON.type="AND JSON.number<='10'AND JSON.status=1ANDJSON.type= 1:XPATH syntax error:'.16-log', and the error message contains the database version information, namely: '.16-log', combined with the vulnerability knowledge base, the vulnerability judgment preset rules are recorded in the vulnerability knowledge base, for example: for SQL injection vulnerability type, the default rule for vulnerability determination is: if the response message contains SQL error information, and the error information contains database version information, it is determined that there is an SQL injection vulnerability. Therefore, it can be determined that there is an SQL injection vulnerability.

When the second response is the case B in S313, and the second response message is the same as the first response message, it can be considered that there is no SQL injection vulnerability.

The above is just a test load as an example. For a specific test type, a set of test loads corresponding to the test type can be added one by one to obtain a set of second response messages, as long as there is at least one of the second response messages in the set of second response messages. The first response message is different. Combining with the preset rules for determining the vulnerability in the vulnerability knowledge base and analyzing the specific different content segments, it can be determined that there is a vulnerability of this specific test type.

In this embodiment, by adding the step of converting the field in the JSON format in the first request message into a field in the URL format during the vulnerability detection process, the existing vulnerability scanner engine based on the URL format can be changed. , add a test load to the field in the URL format, convert the field in the URL format after adding the test load into JSON format, generate a second request message, and send the second request message to the server, so that the server can recognize the second request message , compare the second response message corresponding to the second request message returned by the server with the first response message returned by directly sending the first request message to the server, and combine the vulnerability judgment preset rules in the vulnerability knowledge base to obtain Vulnerability detection results, thereby realizing automated vulnerability detection based on the JSON format, saving development costs, and improving vulnerability detection efficiency.

In the above embodiments, the format conversion involved in each step is as follows:

In S301, the fields in JSON format included in the first request message are as follows:

{"customerId":"","contactsMobile":"15678167514",

"contactsName":"tet","companyName":"123"}

In S306, the first conversion module converts the field in JSON format in S301 into the field in URL format as follows:

"customerId=&contactsMobile=15678167514&contactsName=tet&companyName=123"

In S308, take the test error report SQL injection vulnerability as an example, add a test load, this example uses ",updatexml(1,@@version,1)" as the test load, in the first request message after adding the parameter contactsMobile The URL field looks like this:

"customerId=&contactsMobile=15678167514,updatexml(1,@@version,1)&contactsName=tet&companyName=123"

In S310, the second conversion module converts the URL format in the first request message after adding the test load into JSON format to generate a second request message, and the fields in the JSON format contained in the second request message are as follows:

"customerId":"","contactsMobile":"15678167514,updatexml(1,@@ve rsion,1)","contactsName":"tet","companyName":"123"}

Embodiment two

Figure 4 is a schematic flow diagram of Embodiment 2 of the vulnerability detection method of the present application. The difference between Embodiment 2 and Embodiment 1 is that the way to obtain the first response message is that the vulnerability scanner engine obtains it without adding a load. For the same steps in Figure 3, refer to the detailed description of the same steps in Figure 3, and will not repeat them in Figure 4, as shown in Figure 4:

S401: The browser/client sends a first request message to the web proxy.

S402: The web agent acquires the first request message.

S403: The web proxy sends a first request message to the first transformation module.

S404: The first converting module converts the fields in the JSON format in the first request message into the fields in the URL format.

S405: The first converting module sends the format-converted first request message to the vulnerability scanner engine.

S406: The vulnerability scanner engine sends the format-converted first request message to the second conversion module.

The vulnerability scanner engine does not add a test payload in the first request message.

S407: The second conversion module converts the URL format in the first request message into a JSON format.

S408: The second conversion module sends the first request message for format conversion to the web proxy.

S409: The web proxy sends the first request message received from the second conversion module to the server.

S410: The web proxy receives a first response message corresponding to the first request message sent by the server.

S411: The vulnerability scanner engine adds a test payload to the first request message.

S412: The vulnerability scanner engine sends the first request message after adding the test load to the second conversion module.

S413: The second conversion module converts the URL format in the first request message after adding the test payload into JSON format, and generates a second request message.

S414: The second conversion module sends a second request message to the web proxy.

S415: The web proxy sends a second request message to the server.

S416: The web proxy receives a second response message corresponding to the second request message sent by the server.

S417: The web proxy sends the second response message and the first response message to the vulnerability scanner engine.

S418: The vulnerability scanner engine determines whether there is a vulnerability according to the first response message, the second response message, and a vulnerability determination preset rule.

Among them, S406-S410 and S411-S416 are not limited in execution sequence, they can be executed at the same time, or S406-S410 can be executed first, and then S411-S416 can be executed, or S411-S416 can be executed first, and then S406-S410 can be executed; , this application is not limited.

The implementation principles and technical effects of the technical solution in this embodiment are similar to those in Embodiment 1, and will not be repeated here.

Embodiment three

Embodiment 3 is based on Embodiment 1 or Embodiment 2. Further, after the first conversion module performs format conversion, it also includes adding a format conversion identifier in the first request message; before the second conversion module performs format conversion, it also includes: It includes determining that the first request message contains the format conversion identifier.

In this embodiment, the format conversion flag is used to identify whether the format conversion has been performed before adding the test load, so as to facilitate another format conversion after adding the test load to ensure normal communication.

Embodiment Four

On the basis of the above-mentioned embodiments, the way of obtaining the first request message sent by the client/server can also be obtained through the following possible implementation methods:

A possible implementation manner: Obtain the first request message sent to the server from the log of the server.

The log of the server will record all the first request messages sent by the browser or the client, therefore, the first request message sent to the server can be obtained from the log of the server. By acquiring the first request message from the log of the server, there is no need to manually trigger sending the first request message to the server.

Another possible implementation manner: Obtain the first request message sent to the server by bypassing data monitoring.

Different from obtaining the first request message sent to the server through the web proxy, the bypass data monitoring is usually performed at the router.

Acquiring the first request message sent to the server can be achieved through the above several possible implementation manners.

Embodiment five

In the foregoing embodiments, both the first request message and the second request message are hypertext transfer protocol (HyperText Transfer Protocol, HTTP for short) messages.

FIG. 5 is a schematic structural diagram of an embodiment of the vulnerability detection device of the present application. The device of this embodiment includes: an acquisition module 501, a format conversion module 502, a processing module 503, a sending module 504, and a receiving module 505, wherein the acquisition module 501 is used for Obtain the first request message sent to the server, the first request message includes a field in JSON format; the format conversion module 502 is used to convert the field in JSON format into a field in URL format; the processing module 503 is used in URL Add a test load in the field of the format; the format conversion module 502 is also used for converting the field of the URL format after adding the test load into a JSON format, and generates a second request message; the sending module 504 is used for sending the second request message to the server; receiving The module 505 is used to receive the first response message sent by the server for the first request message; and receive the second response message sent by the server for the second request message; the processing module 503 is also used for receiving the first response message according to the first response message, the Describe the second response message and the preset rule for vulnerability determination, obtain the vulnerability detection result, and obtain the vulnerability detection result.

Wherein, the processing module 503 is specifically configured to compare the second response message with the first response message, and obtain a vulnerability detection result in combination with the preset rule for vulnerability determination.

The device in this embodiment corresponds to a technical solution that can be used to implement the method shown in Embodiment 1 or Embodiment 2, and its implementation principle and technical effect are similar, and will not be repeated here.

Optionally, in the embodiment shown in FIG. 5 , the obtaining module 501 is specifically configured to obtain the first request message sent to the server from a log of the server.

Optionally, in the embodiment shown in FIG. 5 , the acquiring module 501 is specifically configured to acquire the first request message sent to the server through the Web proxy; the sending module 504 is specifically configured to control the Web proxy to send the first request message to the server. request message, and send a second request message to the server.

Optionally, in the embodiment shown in FIG. 5 , the obtaining module 501 is specifically configured to obtain the first request message sent to the server by bypassing data monitoring.

The device in this embodiment corresponds to a technical solution that can be used to implement the method shown in Embodiment 4, and its implementation principle and technical effect are similar, and will not be repeated here.

In the embodiment shown in FIG. 5 , the processing module 503 is further configured to add a format conversion identifier in the first request message; the processing module 503 is further configured to determine that the first request message contains the format conversion identifier.

The device in this embodiment corresponds to a technical solution that can be used to implement the method shown in Embodiment 3, and its implementation principle and technical effect are similar, and will not be repeated here.

In the embodiment shown in FIG. 5, both the first request message and the second request message are hypertext transfer protocol HTTP messages.

The device in this embodiment corresponds to the technical solution that can be used to implement the method shown in Embodiment 5, and its implementation principle and technical effect are similar, and will not be repeated here.

Fig. 6 is a schematic structural diagram of another embodiment of the vulnerability detection device of the present application. The device of this embodiment includes: a processor 601, a sending interface 602 and a receiving interface 603, wherein the sending interface 602 and the receiving interface 603 are coupled to the processor 601, The processor 601 is used to obtain the first request message sent to the server, and the first request message includes a field in JSON format; the processor 601 is also used to convert the field in JSON format into a field in URL format; the processor 601 is also used to add a test load in the field of the URL format; the processor 601 is also used to convert the field of the URL format after adding the test load into JSON format to generate a second request message; the sending interface 602 is coupled to the processor , the sending interface, configured to send the second request message to the server; the receiving interface 603 receiving interface is coupled to the processor, and the receiving interface 603 is configured to receive the first response message sent by the server for the first request message, and receive The second response message sent by the server for the second request message; the processor 601 is further configured to acquire a vulnerability detection result according to the first response message, the second response message, and a preset rule for determining a vulnerability.

Wherein, the processor 601 is specifically configured to compare the second response message with the first response message, and obtain a vulnerability detection result in combination with the vulnerability determination preset rule.

The device in this embodiment corresponds to a technical solution that can be used to execute the method shown in Embodiment 1 or Embodiment 2, and its implementation principle and technical effect are similar, and will not be repeated here.

Optionally, in the embodiment shown in FIG. 6 , the processor 601 is specifically configured to acquire the first request message sent to the server from a log of the server.

Optionally, in the embodiment shown in FIG. 6, the processor 601 is specifically configured to acquire the first request message sent to the server through the Web proxy; the sending interface 602 is specifically configured to control the Web proxy to send the second request message to the server .

Optionally, in the embodiment shown in FIG. 6 , the processor 601 is specifically configured to obtain the first request message sent to the server by bypassing data monitoring.

The device in this embodiment corresponds to a technical solution that can be used to implement the method shown in Embodiment 4, and its implementation principle and technical effect are similar, and will not be repeated here.

In the embodiment shown in FIG. 6, the processor 601 is further configured to add a format conversion identifier in the first request message; the processor 601 is further configured to determine that the first request message includes the format conversion identifier.

The device in this embodiment corresponds to a technical solution that can be used to implement the method shown in Embodiment 3, and its implementation principle and technical effect are similar, and will not be repeated here.

The present application may also provide a processor-readable storage medium, where program instructions are stored in the readable storage medium, and the program instructions are used to make the processor 601 execute all the steps in the vulnerability detection method in the first to fourth embodiments above. or partial steps. The above-mentioned readable storage medium can be realized by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit it; although the application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present application. scope.

Claims (20)

1. A kind of 1. leak detection method, it is characterised in that including：

   The first request message sent to server is obtained, the field of JSON forms is included in first request message；

   The field of the JSON forms is converted into the field of uniform resource position mark URL form；

   The addition test load in the field of the URL format；

   The field for adding the URL format after testing load is converted into JSON forms, generates the second request message；

   Second request message is sent to the server；

   Receive the first response message for first request message that the server is sent；

   Receive the second response message for second request message that the server is sent；

   Preset rules are judged according to first response message, second response message and loophole, obtain Hole Detection knot Fruit.
2. 2. according to the method described in claim 1, it is characterized in that, first request message and second request message are equal For hypertext transfer protocol HTTP message.
3. 3. according to the method described in claim 1, it is characterized in that, it is described obtain to server send the first request message, Including：

   The first request message sent to server is obtained from the daily record of the server.
4. 4. according to the method described in claim 1, it is characterized in that, it is described obtain to server send the first request message, Including：

   The first request message sent to server is obtained by web proxy；

   It is described to send second request message to the server, including：

   Second request message is sent to the server by the web proxy.
5. 5. according to the method described in claim 1, it is characterized in that, it is described obtain to server send the first request message, Including：

   The first request message sent to server is obtained by way of bypass data monitoring.
6. 6. according to claim 1-5 any one of them methods, it is characterised in that the field by the JSON forms converts After field for uniform resource position mark URL form, further include：

   Format conversion mark is added in first request message；

   It is described that the field for adding the URL format after testing load is converted into JSON forms, before generating the second request message, also Including：

   Determine to identify comprising the format conversion in first request message.
7. 7. according to the method described in claim 1, it is characterized in that, described disappear according to the first of second request message the response Breath, second response message and loophole judge preset rules obtain Hole Detection as a result, including：

   By second response message compared with first response message, and judge preset rules with reference to the loophole, Obtain Hole Detection result.
8. A kind of 8. Hole Detection device, it is characterised in that including：

   Acquisition module, for obtaining the first request message sent to server, JSON lattice are included in first request message The field of formula；

   Format conversion module, for the field of the JSON forms to be converted into the field of uniform resource position mark URL form；

   Processing module, for the addition test load in the field of the URL format；

   The format conversion module, is additionally operable to the field for adding the URL format after testing load being converted into JSON forms, generates Second request message；

   Sending module, is additionally operable to send second request message to the server；

   Receiving module, the first response message for first request message sent for receiving the server；

   The receiving module, the second response for second request message for being additionally operable to receive the server transmission disappear Breath；

   The processing module, is additionally operable to be judged according to first response message, second response message and loophole default Rule, obtains Hole Detection result.
9. 9. device according to claim 8, it is characterised in that first request message and second request message are equal For hypertext transfer protocol HTTP message.
10. 10. device according to claim 8, it is characterised in that the acquisition module is specifically used for from the server The first request message sent to server is obtained in daily record.
11. 11. device according to claim 8, it is characterised in that the acquisition module is specifically used for obtaining by web proxy The first request message sent to server；The sending module is specifically used for control web proxy and sends institute to the server State the second request message.
12. 12. device according to claim 8, it is characterised in that the acquisition module is specifically used for supervising by bypass data The mode listened obtains the first request message sent to server.
13. 13. according to claim 8-12 any one of them devices, it is characterised in that the processing module is additionally operable to described Format conversion mark is added in one request message；

    The processing module is additionally operable to determine to identify comprising the format conversion in first request message.
14. 14. device according to claim 8, it is characterised in that the processing module is specifically used for responding described second Message judges preset rules compared with first response message, and with reference to the loophole, obtains Hole Detection result.
15. A kind of 15. Hole Detection device, it is characterised in that including：

    Processor, for obtaining the first request message sent to server, JSON forms are included in first request message Field；

    The processor, is additionally operable to the field of the JSON forms being converted into the field of uniform resource position mark URL form；

    The processor, is additionally operable to the addition test load in the field of the URL format；

    The processor, is additionally operable to the field for adding the URL format after testing load being converted into JSON forms, generation second please Seek message；

    Transmission interface, the transmission interface are coupled to the processor, the transmission interface, for sending institute to the server State the second request message；

    Receiving interface, the receiving interface are coupled to the processor, and the receiving interface, sends for receiving the server The first response message for first request message, and receive that the server sends disappears for the described second request Second response message of breath；

    The processor, is additionally operable to judge default rule according to first response message, second response message and loophole Then, Hole Detection result is obtained.
16. 16. device according to claim 15, it is characterised in that the processor is specifically used for the day from the server The first request message sent to server is obtained in will.
17. 17. device according to claim 15, it is characterised in that the processor is specifically used for obtaining by web proxy The first request message sent to server；

    The transmission interface is specifically used for controlling the web proxy to send second request message to the server.
18. 18. device according to claim 15, it is characterised in that the processor is specifically used for monitoring by bypass data Mode obtain to server send the first request message.
19. 19. according to claim 15-18 any one of them devices, it is characterised in that the processor is additionally operable to described Format conversion mark is added in one request message；

    The processor is additionally operable to determine to identify comprising the format conversion in first request message.
20. 20. device according to claim 15, it is characterised in that the processor is specifically used for disappearing the described second response Breath judges preset rules compared with first response message, and with reference to the loophole, obtains Hole Detection result.