Unauthorized web access vulnerability detecting method and device

Abstract

The invention discloses an unauthorized web access vulnerability detecting method. The unauthorized web access vulnerability detecting method comprises the following steps of acquiring HTTP flow information to be detected within a preset time, wherein the HTTP flow information comprises URL (Uniform Resource Locator) parameter information and a session ID, and the URL parameter information comprises URL parameters and parameter values; identifying index parameters used for indexing a server resource in the URL parameters based on the URL parameter information and the session ID and extracting private parameters used for indexing a user private resource from the index parameters; performing preset unauthorized access vulnerability testing operation for each private parameter and determining private parameters with unauthorized access vulnerability based on a testing result. The invention also discloses an unauthorized web access vulnerability detecting device. The unauthorized web access vulnerability detecting method and device can cover all the URL parameters with unauthorized access vulnerability within a detecting and testing range, and the identifying rate is high.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for detecting unauthorized loopholes in web access. Background technique [0002] One of the most serious loopholes currently existing in the Internet is unauthorized access. For example, in the Uniform Resource Locator (UniformResourceLocator, referred to as URL) unauthorized loophole, due to web programming flaws, the use of the guessability of URL incoming parameters, By changing the input parameter value, it may cause horizontal unauthorized access and obtain other people's private information. The URL unauthorized vulnerability is a very harmful business logic vulnerability. It can directly bypass the basic network security service defense, and the unauthorized vulnerability is difficult to find. In the existing technology, website designers will check the permissions of these parameters to ensure that users can only access their own resources, ...

AI Technical Summary

Problems solved by technology

When the business is complicated to a certain extent, it is difficult to ensure that the access to these data has passed strict permission verification, resulting in URL unauthorized access vulnerabilities

The URL unauthorized access vulnerability can be exploited by attackers, resulting in horizontal unauthorized access and leakage of sensitive user information

[0003] In the prior art, the detection of URL unauthorized vulnerabilities is mainly through the penetration testing of web programs by testers, and manual detection of vulnerabilities, that is, manual detection and processing of various URL parameters indiscriminately to find the existence of unauthorized vulnerabilities. URL parameters are not only inefficient and labor-intensive, but also cannot ensure that all URL parameters detected in the test range are covered

Images