Security testing method, apparatus, computer equipment and storage medium

Abstract

The present application relates to a security testing method, apparatus, computer equipment and storage medium. The method relates to the technical field of information security, and the method includes: generating a simulated network message according to input parameters of an application to be tested, and transmitting the simulated network message to a virtual server program in a user terminal; In the process of transmission to the virtual server program, the simulated network message is intercepted; the simulated network message is processed, and a security test is performed based on the processed simulated network message. That is, in the embodiment of the present application, a simulated network environment can be established locally on the user terminal, which can avoid the problem that the application program directly interacts with the server, so that the man-in-the-middle test module cannot obtain the input parameters and thus cannot perform the security test. The network message is processed, and the security test of the application to be tested is realized by processing the simulated network message, so as to improve the security test efficiency.

Description

technical field [0001] The present application relates to the technical field of information security, and in particular, to a security testing method, apparatus, computer equipment and storage medium. Background technique [0002] With the popularization of intelligent terminals, a large number of mobile phone software (application, APP for short) have emerged in the application market for user terminals to download and use. In order to ensure the security of the APP installed on the user terminal, before the APP is released, the APP needs to be checked for security to identify vulnerabilities. [0003] In traditional technologies, security detection is usually performed by means of a man-in-the-middle agent, which means that the APP traffic of the user terminal is hijacked by an intermediary agent detection tool, and the hijacked APP traffic is analyzed to realize security detection. [0004] However, with the continuous improvement of the security confrontation ability o...

AI Technical Summary

Problems solved by technology

[0004] However, with the continuous improvement of the security resistance capabilities of user terminals, more and more APPs have adopted security measures against intermediate agent detection tools (for example, user terminals usually directly use message encryption, secure tunnels, etc. to communicate with the server communication without forwarding traffic through an intermediate agent), the intermediate agent detection tool cannot successfully obtain the unencrypted APP traffic of the user terminal, and thus cannot perform security detection on the APP installed on the user terminal, resulting in low efficiency of security detection

Images