Vulnerability detection method and device

Abstract

The application provides a vulnerability detection method and device. The vulnerability detection method comprises the following steps: receiving and saving login information of a website; sending an access request to a server corresponding to a unified resource locator URL in the website, wherein the access request comprises the login information of the website; receiving a return result which is sent by the server and corresponding to the URL; and detecting whether the vulnerability exits in the URL according to the return result corresponding to the URL. By use of the method provided by the application, whether the vulnerability exits in the URL is detected according to the return result corresponding to the URL, the large-batch automatic detection for the existence of the level permission vulnerability in the URL or not can be effectively realized, the realization cost is low, and the large number of labor cost can be saved.

Description

technical field [0001] The present application relates to the technical field of the Internet, in particular to a vulnerability detection method and device. Background technique [0002] Horizontal permission vulnerabilities generally occur when a user object is associated with multiple other objects (orders and / or addresses, etc.), and it is necessary to implement add, read, update, and delete operations on the associated objects (Create Retrieve Update Delete; hereinafter referred to as: CRUD) when. Developers generally habitually find out the identity of the object to be operated according to the identity of the authenticated user when generating the CRUD form, provide an entry, and then let the user submit a request, and operate the relevant object according to this identity. When processing CRUD requests, it is often defaulted that only authorized users can obtain the entry and then operate related objects, so the authorization is no longer verified. However, most of ...

AI Technical Summary

Problems solved by technology

However, most of the identifiers of the operated objects are set as self-incrementing integers, so the attacker only needs to add 1 or subtract 1 to the relevant identifier until the traversal, and then he can operate the objects associated with other users, which forms a horizontal authority loophole

[0003] Since the operations of such associated objects are all business-related and the interfaces are independent, it is difficult to implement a general prevention or solution, and there is no technology that is easy to implement and can effectively detect horizontal authority vulnerabilities in the prior art Program

Images