Application program security test method and related device

Abstract

The embodiment of the invention discloses an application program security test method and a related device, and the method comprises the steps: obtaining an external request of an application program, and generating a scanning request carrying a scanning mark through a preset scanning strategy; in the process of scanning the application program by using the scanning request, detecting whether the parameter information used by the sensitive function called by the application program comprises the scanning mark, and if so, reporting the parameter information used by the sensitive function; and analyzing the reported parameter information used by the sensitive function by using a preset vulnerability analysis strategy corresponding to the sensitive function. According to the method, the request response of the application program to the scanning request does not need to be waited, in the scanning process, it is detected that the parameter information used by the sensitive function called by the application program comprises the scanning mark which indicates that the sensitive function is the sensitive function possibly having the vulnerability, and vulnerability analysis is further performed on the parameter information used by the sensitive function; therefore, whether the application program has vulnerabilities or not is judged, and application program security testing is achieved.

Description

technical field [0001] The present application relates to the field of security testing, in particular to an application program security testing method and related devices. Background technique [0002] With the rapid development of the application program, after the application program is developed, due to negligence during the development process, limitations of the programming language used or compilation defects, etc., any application program will inevitably have certain loopholes, which will affect the application. The security of the program; therefore, it is necessary to carry out security testing on the application program and determine the vulnerabilities of the application program for subsequent vulnerability repair to improve the security of the application program. [0003] At present, the application security testing method is to collect the external request of the application and submit it to the Dynamic Application Security Testing (DAST) scanner. The DAST sc...

AI Technical Summary

Problems solved by technology

[0004] However, the above-mentioned application program security testing method relies heavily on the application program’s request response to the scanning request. In the case of network delays, algorithm defects, etc., it is easy to make mistakes in judging whether the application program has vulnerabilities; that is, the above-mentioned application program security testing method The way is not accurate enough

Images