Method and system for automatically detecting CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) backhaul logic vulnerability

Abstract

The invention discloses a method and system for automatically detecting a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) backhaul logic vulnerability. A realization process comprises the steps of loading a URL corresponding to sensitive operation and carrying out analysis to obtain a mailbox address or a mobile phone number corresponding to the sensitive operation; and sending a CAPTCHA request and checking whether a CAPTCHA value is contained in response data or not, wherein if the CAPTCHA value is contained in the response data, it explains that the CAPTCHA backhaul logic vulnerability exists in the operation, and if the CAPTCHA value is not contained in the response data, it explains that the CAPTCHA backhaul logic vulnerability does not exist in the operation. Compared with the prior art, the method and system for automatically detecting the CAPTCHA backhaul logic vulnerability provided by the invention have the advantages that the automation is realized, the artificial operation is avoided, the vulnerability detection efficiency of a penetration test engineer can be improved, the practicability is high, an application range is wide, and the popularization is easy.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a highly practical method and system for automatically detecting logic loopholes in verification code return transmission. Background technique [0002] In the prior art, the problem of logical loopholes in verification codes is serious and needs to be solved urgently. Logical loopholes refer to that some logic branches cannot be processed normally or are processed incorrectly due to lax program logic or too complicated logic. Logical loopholes generally appear in sensitive operations such as account registration, password modification, password retrieval, order submission, and payment. [0003] Logical vulnerability mining has always been an "enduring" topic in security testing. Compared with traditional security vulnerabilities such as SQL injection and XSS vulnerabilities, today's attackers are more inclined to exploit loopholes in the business logic layer. and ...

AI Technical Summary

Problems solved by technology

Therefore, the attacker only needs to capture the response packet to obtain the value of the verification code, which leads the attacker to obtain the verification code and complete sensitive operations (such as any user password reset, payment order, etc.) without access to the user's mailbox and mobile phone. etc.)

Images