Method and system for detecting website permission vulnerabilities

Abstract

The invention relates to a method and system for detecting website permission vulnerabilities. The method comprises the following steps: obtaining a permitted access link in a website to be detected; identifying values of parameters in the access link; modifying the values of the parameters according to a preset rule to form a test access link; judging whether the test access link can be visited or not, and if so, determining that the website to be detected has permission vulnerabilities. Through the technical scheme, whether the website has the permission vulnerabilities or not can be accurately detected according to the website link, so that an accurate prompt can be made and the personal information leak of users can be avoided.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for detecting website authority loopholes and a website authority loophole detection system. Background technique [0002] Today, as the network is increasingly developed, network security issues emerge in an endless stream, and have become an important concern of website managers and users. [0003] Websites generally have some access portals, and users can access the website by entering access information, such as account numbers and passwords, or access codes. However, in order to protect the interests of users and avoid leakage of user personal data, each user has corresponding access rights. For example, in some shopping websites, a user can only view the shopping information belonging to this account under his account. To a certain extent, the security of the user's personal information is guaranteed. [0004] However, in some websites, this method of ac...

AI Technical Summary

Problems solved by technology

[0004] However, in some websites, this method of access based on permissions has potential security risks, because when accessing a website through a browser, in addition to entering access information on the login interface, you can also directly enter information related to a user page. The corresponding link to access the user's page, the difference between different user pages in the link is only reflected in the parameters of the link, and in the case that these websites do not set permissions for this way of accessing through links, the attack Users can try to view other users' information by changing the parameters in the link, resulting in the leakage of other users' information

[0005] For example, on a courier website, when inquiring about a courier tracking number, an attacker can first obtain the link corresponding to the page displaying the tracking number information for a tracking number, and then change the value of the parameters related to the tracking number in the link, thereby accessing other The user's single number information, which caused the leakage of other users' personal information

Images