WO2022062478A1 - 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质 - Google Patents

一种任意账号密码重置逻辑漏洞的检测方法、装置及介质 Download PDF

Info

Publication number
WO2022062478A1
WO2022062478A1 PCT/CN2021/098852 CN2021098852W WO2022062478A1 WO 2022062478 A1 WO2022062478 A1 WO 2022062478A1 CN 2021098852 W CN2021098852 W CN 2021098852W WO 2022062478 A1 WO2022062478 A1 WO 2022062478A1
Authority
WO
WIPO (PCT)
Prior art keywords
password reset
verification code
account password
detected
webpage
Prior art date
Application number
PCT/CN2021/098852
Other languages
English (en)
French (fr)
Inventor
娄宇
范渊
Original Assignee
杭州安恒信息技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州安恒信息技术股份有限公司 filed Critical 杭州安恒信息技术股份有限公司
Priority to US18/027,913 priority Critical patent/US20230370846A1/en
Publication of WO2022062478A1 publication Critical patent/WO2022062478A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent

Definitions

  • the present application relates to the field of web page detection, and in particular, to a method, device and computer-readable storage medium for detecting a logical vulnerability of arbitrary account password reset.
  • Any account password reset logic vulnerability refers to the fact that the program logic of the request form in the web page is not rigorous or the logic is too complex, resulting in some logic branches unable to process requests normally or request processing errors.
  • Arbitrary account password reset is a high-risk business logic vulnerability. If there is an arbitrary account password reset logic vulnerability in the webpage, an attacker can use the arbitrary account password reset logic vulnerability in the webpage to fake other users to reset the user. By modifying the user's account password, the purpose of stealing and tampering with the user's user information is further achieved, thereby bringing serious security risks to the user's information security.
  • the mobile phone verification code interface sends the SMS verification code to the front-end page
  • the attacker can obtain the corresponding SMS verification code without viewing the SMS verification code through the mobile phone, and then realize the operation of resetting the password, which means that the current The webpage has an arbitrary account password reset logic vulnerability.
  • the source code of the webpage to be detected is generally checked manually by a technician, and whether the webpage to be detected has any account password reset logic loophole is determined based on their own technical experience.
  • the method in the prior art not only needs to consume a lot of human resources, but also the technical level of each technician varies, so it is difficult to comprehensively and accurately detect any account password reset logic loophole.
  • the present invention provides a method for detecting a logic loophole in any account password reset, including:
  • the method further includes:
  • the updated password reset request obtains corresponding first response information, it is determined whether the webpage to be detected has the arbitrary account password reset logic vulnerability.
  • it further includes:
  • the updated password reset request obtains the corresponding second response information, it is determined whether the webpage to be detected has the arbitrary account password reset logic vulnerability.
  • it further includes:
  • the method further includes:
  • each of the third response information it is determined whether the webpage to be detected has a logic loophole for resetting the arbitrary account password.
  • the process of generating the SMS verification code and the first preset user information and the second preset user information specifically includes:
  • the SMS verification code and/or the first preset user information and the second preset user information are generated by using a code receiving platform.
  • it further includes:
  • the present invention also provides a detection device for any account password reset logic vulnerability, including:
  • the first judgment module is used to call a preset identification program to judge whether a verification code sending request is initiated in the webpage to be detected; if so, call the second judgment module;
  • the second judging module is used to obtain a response packet corresponding to the verification code sending request from the front-end page, and determine whether there is a short message verification code in the response packet; if so, call the first determining module;
  • the first determining module is configured to determine that the webpage to be detected has an arbitrary account password reset logic vulnerability.
  • the present invention also provides another detection device for any account password reset logic loophole, including:
  • the processor is configured to implement the steps of any of the above-mentioned detection methods for any account password reset logic vulnerability when executing the computer program.
  • the present invention also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, any one of the above-mentioned account passwords can be reset. Steps of a method for detecting logic vulnerabilities.
  • the present invention provides a method for detecting any account password reset logic loophole.
  • a preset identification program By calling a preset identification program, it can identify whether the webpage to be detected initiates a verification code sending request and whether there is a corresponding short message verification code in the response packet of the front-end page.
  • the method determines whether there is any account password reset logic vulnerability on the page to be detected; not only does it avoid manual detection operations by technicians, saving a lot of human resources, but any account password reset logic vulnerability will be the process of executing business logic in the page to be detected. Therefore, according to whether there is a corresponding SMS verification code in the response packet of the front-end page, it is determined whether there is any account password reset logic vulnerability in the webpage to be detected, which can make the detection result more comprehensive and accurate.
  • the present invention also provides a detection device and a computer-readable storage medium for a logic vulnerability of any account password reset, both of which have the above beneficial effects.
  • FIG. 1 is a flowchart of a method for detecting a logic vulnerability in arbitrary account password reset provided by an embodiment of the present invention
  • FIG. 2 is a structural diagram of an apparatus for detecting a logic vulnerability of arbitrary account password reset provided by an embodiment of the present invention
  • FIG. 3 is a structural diagram of another device for detecting a logical vulnerability of arbitrary account password reset provided by an embodiment of the present invention.
  • the core of the embodiment of the present invention is to provide a method for detecting a logic vulnerability of any account password reset, which can comprehensively and accurately detect any account password reset logic vulnerability on the basis of reducing the consumption of human resources;
  • a core is to provide a detection device and a computer-readable storage medium for any account password reset logic vulnerability, both of which have the above beneficial effects.
  • FIG. 1 is a flow chart of a method for detecting a logic vulnerability of arbitrary account password reset provided by an embodiment of the present invention. As shown in Figure 1, a detection method for any account password reset logic vulnerability includes:
  • S10 Invoke a preset identification program to determine whether a verification code sending request is initiated in the webpage to be detected;
  • an identification program is preset, and the identification program includes a verification code sending request identification program and a short message verification code identification program, and then the verification code sending request identification program is used to determine whether a verification code sending request is initiated in the webpage to be detected,
  • the specific process is as follows:
  • the first preset user information includes information such as a mobile phone number, which is not limited in this embodiment;
  • a response packet corresponding to the verification code sending request is obtained from the front-end page, and it is determined whether there is an SMS verification code in the response packet.
  • the process of judging whether there is a verification code in the response packet specifically includes:
  • the SMS verification code for resetting the password is generally a 5 to 6-digit pure numeric string, so it is judged whether maxCount is 5 or 6. If it is, the SMS verification code is the string pointed to by checkCode.
  • An embodiment of the present invention provides a method for detecting a logic loophole in any account password reset, by calling a preset identification program to identify whether the webpage to be detected initiates a verification code sending request and whether there is a corresponding short message verification in the response packet of the front-end page
  • the method of code to determine whether there is any account password reset logic loophole in the webpage to be detected; not only avoids the manual detection operation by technicians and saves a lot of human resources, but also any account password reset logic loophole will execute business logic in the webpage to be detected. Therefore, according to whether there is a corresponding SMS verification code in the response packet of the front-end page, it is determined whether there is any account password reset logic loophole in the webpage to be detected, which can make the detection result more comprehensive and accurate.
  • this embodiment further describes and optimizes the technical solution. Specifically, this embodiment obtains the response packet corresponding to the verification code sending request from the front-end page, and judges whether there is any content in the response packet. After the SMS verification code, it further includes:
  • the updated password reset request obtains the corresponding first response information, it is determined whether the webpage to be detected has any account password reset logic vulnerability.
  • the process of identifying a password reset request includes:
  • the webpage to be detected initiates a password reset request, and the password reset request includes a SMS verification code
  • the first preset user information in the reset password request is replaced with the second preset user information, and the reset password request is updated; Send the reset password request to the system, and get the first response information fed back by the system; determine whether a string of one of "1", “ok”, “success”, and "true” independently appears in the first response information; If it appears, it means that even if the user information in the reset password request is changed, the reset password request will still be successfully responded, so it is determined that the webpage to be detected has any account password reset logic loophole; if it does not appear, it means that the The password reset request is not successfully responded, so it is determined that the webpage to be detected does not have any account password reset logic vulnerability.
  • the embodiment of the present invention can further comprehensively and accurately detect any account password reset logic loophole in the webpage to be detected by further modifying the user information in the reset password request and reconstructing the reset password request.
  • this embodiment further illustrates and optimizes the technical solution. Specifically, this embodiment further includes:
  • a random verification code is generated in advance, and an exhaustive dictionary containing the random verification code is constructed, and then each random verification code in the exhaustive dictionary is used to replace the SMS verification code in the password reset request, and the update Then send the updated password reset request to the system, and get the second response information fed back by the system; determine whether "1", “ok”, “success”, "" A string of one of "true”; if it appears, it means that even if the SMS verification code in the reset password request is replaced, the reset password request will be successfully responded, so it is determined that the webpage to be tested has any account password reset logic vulnerability ; If it does not appear, it means that the password reset request has not been successfully responded, so it is determined that the webpage to be detected does not have any account password reset logic loophole.
  • the embodiment of the present invention can further comprehensively and accurately detect any account password reset logic loophole in the webpage to be detected.
  • this embodiment further illustrates and optimizes the technical solution. Specifically, this embodiment further includes:
  • the valid duration can be further set for the SMS verification code, that is, when the SMS verification code is entered after the valid duration is exceeded, the SMS verification code should be invalid, that is, the request to reset the password should fail.
  • the timing is started when the SMS verification code is sent, and the timing is stopped when the second response information is obtained, the time when the second response information is determined is obtained, and the time when the second response information is determined is determined.
  • Whether it is within the preset time range that is, to detect whether the webpage to be detected can obtain a random verification code that can make the system respond successfully by exhaustive means within the preset time range. If the exhaustive successful time exceeds the preset time range, It means that the SMS verification code does not have a corresponding valid duration, so it is determined that there is a logic loophole in the reset of any account password on the webpage to be detected.
  • the embodiment of the present invention can further comprehensively and accurately detect any account password reset logic loophole that exists in the webpage to be detected by further verifying whether the corresponding valid duration is set for the SMS verification code.
  • the method further includes:
  • each third response information it is determined whether the webpage to be detected has any account password reset logic vulnerability.
  • the short message verification code in the password reset request is updated in an exhaustive manner with random verification codes, and after the response is successful , and further determine the corresponding target random verification code according to the second response information of the successful response; perform multiple password reset operations based on the reset password request corresponding to the target random verification code, and obtain the corresponding third response information respectively ; Determine whether each third response information is the third response information indicating that the reset password request response is successful, if two or more reset password request responses are successful, it means that the reset password request including the same target random verification code can be used for multiple times The password reset operation is performed; in fact, a verification code should be invalidated after being used. Therefore, according to the method of this embodiment, any account password reset logic loophole in the webpage to be detected can be further comprehensively detected.
  • this embodiment further describes and optimizes the technical solution.
  • the process of generating the SMS verification code and the first preset user information and the second preset user information Specifically include:
  • the SMS verification code and/or the first preset user information and the second preset user information are generated by using the code receiving platform.
  • the code receiving platform is used to generate a short message verification code, and the corresponding short message verification code is input into the request form in the web page to be detected by automatically receiving the code, so that the user can avoid manual input operation. Further reduce manual intervention and save human resources.
  • the process of generating a password reset request with user information and replacing the first preset user information in the password reset request with the second preset user information can reduce manual intervention and save human resources.
  • this embodiment further illustrates and optimizes the technical solution. Specifically, this embodiment further includes:
  • the detection time is further obtained, and then the detection time and the detected corresponding arbitrary account password reset logic vulnerability are recorded. Details.
  • the detection time of any account password reset logic vulnerability on the page to be detected is determined by further recording. Therefore, the information about any account password reset logic vulnerability on the page to be detected can be obtained by checking the recorded information later. detection, so as to further improve the user experience.
  • the embodiments of a method for detecting a logic vulnerability of arbitrary account password reset provided by the present invention are described in detail above.
  • the present invention also provides a detection device for a logic vulnerability of any account password reset corresponding to the method.
  • the computer-readable storage medium since the embodiments of the apparatus and the computer-readable storage medium part correspond to the embodiments of the method part, the embodiments of the apparatus and the computer-readable storage medium part refer to the description of the embodiments of the method part, I won't go into details here.
  • FIG. 2 is a structural diagram of a detection device for an arbitrary account password reset logic vulnerability provided by an embodiment of the present invention. As shown in FIG. 2 , a detection device for an arbitrary account password reset logic vulnerability includes:
  • the first judging module 21 is used to call a preset recognition program to judge whether a verification code sending request is initiated in the webpage to be detected; if so, call the second judging module 22;
  • the second judging module 22 is used to obtain a response packet corresponding to the verification code sending request from the front-end page, and determine whether there is a short message verification code in the response packet; if so, call the first determining module 23;
  • the first determination module 23 is configured to determine that any account password reset logic loophole exists in the webpage to be detected.
  • the apparatus for detecting a logical vulnerability of any account password reset provided by the embodiment of the present invention has the beneficial effects of the above-mentioned detection method for a logical vulnerability of any account password reset.
  • another device for detecting a logical vulnerability of any account password reset further includes:
  • the third judgment module is used to judge whether the webpage to be detected initiates a password reset request when there is no SMS verification code in the response packet; if so, call the first update module;
  • a first update module configured to replace the first preset user information in the reset password request with the second preset user information, and update the reset password request;
  • the second determining module is configured to determine whether the webpage to be detected has any account password reset logic loophole according to whether the updated password reset request obtains the corresponding first response information.
  • another device for detecting a logical vulnerability of any account password reset further includes:
  • the second update module is used to replace the SMS verification code in the reset password request with a randomly generated random verification code if the first response information is not obtained, and update the reset password request;
  • the third determining module is configured to determine whether the webpage to be detected has any account password reset logic loophole according to whether the updated password reset request obtains corresponding second response information.
  • another device for detecting a logical vulnerability of any account password reset further includes:
  • a fourth determination module configured to determine whether the time when the second response information is determined is within the preset duration; if not, call the fourth determination module;
  • the fourth determination module is used to determine that any account password reset logic loophole exists in the webpage to be detected.
  • another device for detecting a logical vulnerability of any account password reset further includes:
  • a setting module configured to determine a target random verification code corresponding to the second response information after the second response information is obtained within a preset duration
  • an update module configured to perform multiple password reset operations using the password reset request corresponding to the target random verification code, and obtain corresponding third response information respectively;
  • the fifth determination module is configured to determine whether the webpage to be detected has any account password reset logic loophole according to each third response information.
  • another device for detecting a logical vulnerability of any account password reset further includes:
  • the recording module is used to record the detection time when it is determined that any account password reset logic vulnerability exists on the page to be detected.
  • FIG. 3 is a structural diagram of another device for detecting a logical vulnerability in resetting an arbitrary account password according to an embodiment of the present invention.
  • a device for detecting a logical vulnerability in resetting an arbitrary account password includes:
  • memory 31 for storing computer programs
  • the processor 32 is configured to implement the steps of the above-mentioned method for detecting a logic vulnerability of any account password reset when executing the computer program.
  • the apparatus for detecting a logical vulnerability of any account password reset provided by the embodiment of the present invention has the beneficial effects of the above-mentioned detection method for a logical vulnerability of any account password reset.
  • the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the detection method of the above-mentioned arbitrary account password reset logic vulnerability is realized. step.
  • the computer-readable storage medium provided by the embodiment of the present invention has the beneficial effects of the above-mentioned detection method for a logical vulnerability of any account password reset.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种任意账号密码重置逻辑漏洞的检测方法、装置及计算机可读存储介质，方法包括：调用预设的识别程序判断待检测网页中是否发起验证码发送请求；如果是，则从前端页面获取与验证码发送请求对应的响应包，并判断响应包中是否存在短信验证码；若存在，则确定出待检测网页存在任意账号密码重置逻辑漏洞。可见，本方法不仅避免技术人员手动进行检测操作，节省大量的人力资源，而且任意账号密码重置逻辑漏洞将会对待检测网页中执行业务逻辑的过程造成影响，因此依据前端页面的响应包中是否存在对应的短信验证码来确定待检测网页中是否存在任意账号密码重置逻辑漏洞，能够使得检测结果更加全面准确。

Description

一种任意账号密码重置逻辑漏洞的检测方法、装置及介质
本申请要求于2020年9月22日提交中国专利局、申请号为202011002902.0、发明名称为“一种任意账号密码重置逻辑漏洞的检测方法、装置及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网页检测领域，特别涉及一种任意账号密码重置逻辑漏洞的检测方法、装置及计算机可读存储介质。
背景技术
随着计算机技术的快速发展以及业务逻辑的复杂化，使得网站网页中存在任意账号密码重置逻辑漏洞的可能性越来越大。任意账号密码重置逻辑漏洞是指由于网页中的请求表单的程序逻辑不严谨或逻辑太复杂，导致一些逻辑分支不能够正常处理请求或请求处理错误。任意账号密码重置是一种高危害的业务逻辑漏洞，若网页中存在任意账号密码重置逻辑漏洞，攻击者便可以利用网页中的任意账号密码重置逻辑漏洞，伪造其他用户重置该用户的登录密码，通过修改用户的账号密码，从而进一步实现盗取、篡改用户的用户信息等目的，从而给用户的信息安全带来严重的安全隐患。例如，如果手机验证码接口将短信验证码发送到前端页面，那么攻击者可以在不通过手机查看短信验证码情况下获取到对应的短信验证码，进而实现重置密码的操作，即表示当前的网页存在任意账号密码重置逻辑漏洞。
现有技术中，一般是通过技术人员来手动检查待检测网页的源代码，结合自身技术经验来确定待检测网页是否存在任意账号密码重置逻辑漏洞。但是，现有技术的方法，不仅需要消耗大量的人力资源，而且各技术人员的技术水平参差不齐，难以全面准确地检测出任意账号密码重置逻辑漏洞。
因此，如何在减少对人力资源的消耗的基础上，全面准确地检测出任意账号密码重置逻辑漏洞，是本领域技术人员目前需要解决的技术问题。
发明内容
有鉴于此，本发明的目的在于提供一种任意账号密码重置逻辑漏洞的检测方法，能够在减少对人力资源的消耗的基础上，全面准确地检测出任意账号密码重置逻辑漏洞；本发明的另一目的是提供一种任意账号密码重置逻辑漏洞的检测装置及计算机可读存储介质，均具有上述有益效果。
为解决上述技术问题，本发明提供一种任意账号密码重置逻辑漏洞的检测方法，包括：
调用预设的识别程序判断待检测网页中是否发起验证码发送请求；
如果是，则从前端页面获取与所述验证码发送请求对应的响应包，并判断所述响应包中是否存在短信验证码；
若存在，则确定出所述待检测网页存在任意账号密码重置逻辑漏洞。
优选地，在所述从前端页面获取与所述验证码发送请求对应的响应包，并判断所述响应包中是否存在短信验证码之后，进一步包括：
若不存在，判断所述待检测网页是否发起重置密码请求；
若是，则利用第二预设用户信息替换所述重置密码请求中的第一预设用户信息，并更新所述重置密码请求；
根据更新后的所述重置密码请求是否得到对应的第一响应信息确定所述待检测网页是否存在所述任意账号密码重置逻辑漏洞。
优选地，进一步包括：
若未得到所述第一响应信息，利用随机生成的随机验证码替换所述重置密码请求中的所述短信验证码，并更新所述重置密码请求；
根据更新后的所述重置密码请求是否得到对应的第二响应信息确定所述待检测网页是否存在所述任意账号密码重置逻辑漏洞。
优选地，进一步包括：
判断确定出所述第二响应信息的时间是否在预设时长范围内；
若否，则确定出所述待检测网页存在所述任意账号密码重置逻辑漏洞。
优选地，在所述预设时长范围内得出所述第二响应信息之后，进一步包括：
确定出与所述第二响应信息对应的目标随机验证码；
利用所述目标随机验证码对应的所述重置密码请求执行多次重置密码的操作，并分别得到对应的第三响应信息；
根据各所述第三响应信息判断所述待检测网页是否存在所述任意账号密码重置逻辑漏洞。
优选地，生成所述短信验证码和所述第一预设用户信息和所述第二预设用户信息的过程具体包括：
利用接码平台生成所述短信验证码和/或所述第一预设用户信息和所述第二预设用户信息。
优选地，进一步包括：
记录确定出所述待检测页面存在所述任意账号密码重置逻辑漏洞的检测时间。
为解决上述技术问题，本发明还提供一种任意账号密码重置逻辑漏洞的检测装置，包括：
第一判断模块，用于调用预设的识别程序判断待检测网页中是否发起验证码发送请求；如果是，则调用第二判断模块；
所述第二判断模块，用于从前端页面获取与所述验证码发送请求对应的响应包，并判断所述响应包中是否存在短信验证码；若存在，则调用第一确定模块；
所述第一确定模块，用于确定出所述待检测网页存在任意账号密码重置逻辑漏洞。
为解决上述技术问题，本发明还提供另一种任意账号密码重置逻辑漏洞的检测装置，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序时实现上述任一种任意账号密码重置逻辑漏洞的检测方法的步骤。
为解决上述技术问题，本发明还提供一种计算机可读存储介质，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现上述任一种任意账号密码重置逻辑漏洞的检测方法的步骤。
本发明提供的一种任意账号密码重置逻辑漏洞的检测方法，通过调用预设的识别程序，识别待检测网页是否发起验证码发送请求以及前端页面的响应包中是否存在对应的短信验证码的方式确定出待检测网页是否存在任意账号密码重置逻辑漏洞；不仅避免技术人员手动进行检测操作，节省大量的人力资源，而且任意账号密码重置逻辑漏洞将会对待检测网页中执行业务逻辑的过程造成影响，因此依据前端页面的响应包中是否存在对应的短信验证码来确定待检测网页中是否存在任意账号密码重置逻辑漏洞，能够使得检测结果更加全面准确。
为解决上述技术问题，本发明还提供了一种任意账号密码重置逻辑漏洞的检测装置及计算机可读存储介质，均具有上述有益效果。
附图说明
为了更清楚地说明本发明实施例或现有技术的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单的介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1为本发明实施例提供的一种任意账号密码重置逻辑漏洞的检测方法的流程图；
图2为本发明实施例提供的一种任意账号密码重置逻辑漏洞的检测装置的结构图；
图3为本发明实施例提供的另一种任意账号密码重置逻辑漏洞的检测装置的结构图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的 范围。
本发明实施例的核心是提供一种任意账号密码重置逻辑漏洞的检测方法，能够在减少对人力资源的消耗的基础上，全面准确地检测出任意账号密码重置逻辑漏洞；本发明的另一核心是提供一种任意账号密码重置逻辑漏洞的检测装置及计算机可读存储介质，均具有上述有益效果。
为了使本领域技术人员更好地理解本发明方案，下面结合附图和具体实施方式对本发明作进一步的详细说明。
图1为本发明实施例提供的一种任意账号密码重置逻辑漏洞的检测方法的流程图。如图1所示，一种任意账号密码重置逻辑漏洞的检测方法包括：
S10：调用预设的识别程序判断待检测网页中是否发起验证码发送请求；
S20：如果是，则从前端页面获取与验证码发送请求对应的响应包，并判断响应包中是否存在短信验证码；
S30：若存在，则确定出待检测网页存在任意账号密码重置逻辑漏洞。
具体的，在本实施例中，预先设置识别程序，识别程序包括验证码发送请求识别程序和短信验证码识别程序，然后利用验证码发送请求识别程序判断待检测网页中是否发起验证码发送请求，具体过程如下：
判断请求表单所在的待检测网页的URL(Uniform Resource Locator，统一资源定位符)的文件名中是否同时包含“send”和“sms”字符串；
若是，则判断是否存在第一请求参数；
若存在，则判断第一请求参数中是否存在第一预设用户信息；其中，第一预设用户信息包括手机号等信息，本实施例对此不做限定；
若存在，则判断与验证码发送请求对应的响应信息中是否为文本或者json信息；
若是，则判断响应信息中是否包含单独的字符串“1”、“true”、“ok”，“scuess”之一；若包含，则确定出该请求是验证码发送请求；若不包含，则确定出该请求不是验证码发送请求。
具体的，若确定出待检测网页中发起验证码发送请求，则从前端页面获取与验证码发送请求对应的响应包，并判断响应包中是否存在短信验证码。
具体的，判断响应包中是否存在验证码的过程，具体包括：
首先定义count＝0，index＝1，maxCount＝0，checkCode＝“”；其中，count为连续数字字符的数量，index为指向的字符，maxCount为最大连续数字字符的数量，checkCode为最终确定出的短信验证码；从index指向的字符开始识别，每访问一次index＝index+1；当该字符为数字字符时，count＝count+1；当该字符为非数字字符时，判断count>maxCount是否成立；若成立，则maxCount＝count，记录这串连续数字字符记录到checkCode，并将count设置为0。根据重置密码的短信验证码一般都是5至6位纯数字字符串，因此判断maxCount是否为5或者6，如果是，那么短信验证码为checkCode指向的字符串。
具体的，若确定出响应包中存在短信验证码，则表示可以从前端页面获取对应的短信验证码，而不需要通过手机获取对应的短信验证码，因此确定出待检测网页存在任意账号密码重置逻辑漏洞。
本发明实施例提供的一种任意账号密码重置逻辑漏洞的检测方法，通过调用预设的识别程序，识别待检测网页是否发起验证码发送请求以及前端页面的响应包中是否存在对应的短信验证码的方式确定出待检测网页是否存在任意账号密码重置逻辑漏洞；不仅避免技术人员手动进行检测操作，节省大量的人力资源，而且任意账号密码重置逻辑漏洞将会对待检测网页中执行业务逻辑的过程造成影响，因此依据前端页面的响应包中是否存在对应的短信验证码来确定待检测网页中是否存在任意账号密码重置逻辑漏洞，能够使得检测结果更加全面准确。
在上述实施例的基础上，本实施例对技术方案作了进一步的说明和优化，具体的，本实施例在从前端页面获取与验证码发送请求对应的响应包，并判断响应包中是否存在短信验证码之后，进一步包括：
若不存在，判断待检测网页是否发起重置密码请求；
若是，则利用第二预设用户信息替换重置密码请求中的第一预设用户信息，并更新重置密码请求；
根据更新后的重置密码请求是否得到对应的第一响应信息确定待检测网页是否存在任意账号密码重置逻辑漏洞。
在本实施例中，是在从前端页面获取与验证码发送请求对应的响应包，判断响应包中不存在短信验证码之后，进一步判断待检测网页是否发起重置密码请求。
具体的，识别重置密码请求的过程包括：
判断是否存在第二请求参数；
若存在，则判断该第二请求参数中是否存在预先输入的短信验证码；
若存在，则表示待检测网页发起重置密码请求，该重置密码请求中包含短信验证码；
若不存在，表示待检测网页发起的请求不是重置密码请求。
需要说明的是，若确定出待检测网页发起重置密码请求，则利用第二预设用户信息替换重置密码请求中的第一预设用户信息，并更新重置密码请求；然后将更新后的重置密码请求发送给***，并得到***反馈的第一响应信息；判断该第一响应信息中是否独立出现“1”、“ok”、“success”，“true”之一的字符串；如果出现，则表示即使更换了重置密码请求中的用户信息，该重置密码请求仍然会被成功响应，因此确定出待检测网页存在任意账号密码重置逻辑漏洞；如果没有出现，则表示该重置密码请求没有被成功响应，因此确定出待检测网页不存在任意账号密码重置逻辑漏洞。
可见，本发明实施例通过进一步修改重置密码请求中的用户信息，重新构造重置密码请求，能够进一步全面准确地检测出待检测网页存在的任意账号密码重置逻辑漏洞。
在上述实施例的基础上，本实施例对技术方案作了进一步的说明和优化，具体的，本实施例进一步包括：
若未得到第一响应信息，利用随机生成的随机验证码替换重置密码请求中的短信验证码，并更新重置密码请求；
根据更新后的重置密码请求是否得到对应的第二响应信息确定待检测网页是否存在任意账号密码重置逻辑漏洞。
具体的，在本实施例中，预先生成随机验证码，并构造包含随机验证码的穷举词典，然后利用穷举词典中的各随机验证码替换重置密码请求中的短信验证码，更新重置密码请求；然后将更新后的重置密码请求发送给***，并得到***反馈的第二响应信息；判断该第二响应信息中是否独立出现“1”、“ok”、“success”，“true”之一的字符串；如果出现，则表示即使更换了重置密码请求中的短信验证码，该重置密码请求会被成功响应，因此确定出待检测网页存在任意账号密码重置逻辑漏洞；如果没有出现，则表示该重置密码请求没有被成功响应，因此确定出待检测网页不存在任意账号密码重置逻辑漏洞。
可见，本发明实施例通过进一步修改重置密码请求中的短信验证码，重新构造重置密码请求，能够进一步全面准确地检测出待检测网页存在的任意账号密码重置逻辑漏洞。
在上述实施例的基础上，本实施例对技术方案作了进一步的说明和优化，具体的，本实施例进一步包括：
判断确定出第二响应信息的时间是否在预设时长范围内；
若否，则确定出待检测网页存在任意账号密码重置逻辑漏洞。
可以理解的是，在实际操作中，可以进一步为短信验证码设置有效时长，即在超过该有效时长之后再输入短信验证码时，该短信验证码应该失效，即重置密码请求应该请求失败。具体的，在本实施例中，在发送短信验证码时开始计时，在获取到第二响应信息时停止计时，得出确定出第二响应信息的时间，并判断确定出第二响应信息的时间是否在预设时长范围内，即检测待检测网页是否能够在预设时长范围内通过穷举的方式得出能够让***成功响应的随机验证码，若穷举成功的时间超过预设时长范围，则表示短信验证码并没有设置对应的有效时长，因此确定出待检测网页存在任意账号密码重置逻辑漏洞。
可见，本发明实施例通过进一步验证是否为短信验证码设置对应的有 效时长，能够进一步全面准确地检测出待检测网页存在的任意账号密码重置逻辑漏洞。
作为优选的实施方式，在预设时长范围内得出第二响应信息之后，进一步包括：
确定出与第二响应信息对应的目标随机验证码；
利用目标随机验证码对应的重置密码请求执行多次重置密码的操作，并分别得到对应的第三响应信息；
根据各第三响应信息判断待检测网页是否存在任意账号密码重置逻辑漏洞。
具体的，在本实施例中，是在预设时长范围内得出与第二响应信息之后，即利用随机验证码穷举的方式更新重置密码请求中的短信验证码，并在响应成功之后，进一步根据该响应成功的第二响应信息确定出对应的目标随机验证码；基于该目标随机验证码对应的重置密码请求执行多次重置密码的操作，并分别得到对应的第三响应信息；判断各第三响应信息是否为表示重置密码请求响应成功的第三响应信息，若两个以上重置密码请求响应成功，则表示可以利用包括同一目标随机验证码的重置密码请求多次进行密码重置操作；而实际上，一个验证码在被使用之后就应该使其失效，因此按照本实施例的方法，能够进一步全面地检测出待检测网页中的任意账号密码重置逻辑漏洞。
在上述实施例的基础上，本实施例对技术方案作了进一步的说明和优化，具体的，本实施例中，生成短信验证码和第一预设用户信息和第二预设用户信息的过程具体包括：
利用接码平台生成短信验证码和/或第一预设用户信息和第二预设用户信息。
具体的，在本实施例中，具体是利用接码平台生成短信验证码，通过自动接码的方式向待检测网页中的请求表单中输入对应的短信验证码，因此能够避免用户手动输入操作，进一步减少人工的介入，节省人力资源。
另外，也可以利用接码平台生成第一预设用户信息和第二预设用户信息，并通过自动接码的方式输入第一预设用户信息和第二预设用户信息，使得利用第一预设用户信息生成重置密码请求，以及利用第二预设用户信息替换重置密码请求中的第一预设用户信息的过程均能够减少人工的介入，节省人力资源。
在上述实施例的基础上，本实施例对技术方案作了进一步的说明和优化，具体的，本实施例进一步包括：
记录确定出待检测页面存在任意账号密码重置逻辑漏洞的检测时间。
具体的，在本实施例中，是在确定出待检测网页存在任意账号密码重置逻辑漏洞时，进一步获取该检测时间，然后记录该检测时间以及检测出的对应的任意账号密码重置逻辑漏洞的详细信息。
需要说明的是，本实施例通过进一步记录确定出待检测页面存在任意账号密码重置逻辑漏洞的检测时间，因此后续可以通过查看记录的信息，获取对待检测网页的任意账号密码重置逻辑漏洞的检测情况，从而能够进一步提升用户的使用体验。
上文对于本发明提供的一种任意账号密码重置逻辑漏洞的检测方法的实施例进行了详细的描述，本发明还提供了一种与该方法对应的任意账号密码重置逻辑漏洞的检测装置及计算机可读存储介质，由于装置及计算机可读存储介质部分的实施例与方法部分的实施例相互照应，因此装置及计算机可读存储介质部分的实施例请参见方法部分的实施例的描述，这里暂不赘述。
图2为本发明实施例提供的一种任意账号密码重置逻辑漏洞的检测装置的结构图，如图2所示，一种任意账号密码重置逻辑漏洞的检测装置包括：
第一判断模块21，用于调用预设的识别程序判断待检测网页中是否发起验证码发送请求；如果是，则调用第二判断模块22；
第二判断模块22，用于从前端页面获取与验证码发送请求对应的响应包，并判断响应包中是否存在短信验证码；若存在，则调用第一确定模块23；
第一确定模块23，用于确定出待检测网页存在任意账号密码重置逻辑漏洞。
本发明实施例提供的任意账号密码重置逻辑漏洞的检测装置，具有上述任意账号密码重置逻辑漏洞的检测方法的有益效果。
作为优选的实施方式，另一种任意账号密码重置逻辑漏洞的检测装置进一步包括：
第三判断模块，用于在响应包中不存在短信验证码时，判断待检测网页是否发起重置密码请求；若是，则调用第一更新模块；
第一更新模块，用于利用第二预设用户信息替换重置密码请求中的第一预设用户信息，并更新重置密码请求；
第二确定模块，用于根据更新后的重置密码请求是否得到对应的第一响应信息确定待检测网页是否存在任意账号密码重置逻辑漏洞。
作为优选的实施方式，另一种任意账号密码重置逻辑漏洞的检测装置进一步包括：
第二更新模块，用于若未得到第一响应信息，利用随机生成的随机验证码替换重置密码请求中的短信验证码，并更新重置密码请求；
第三确定模块，用于根据更新后的重置密码请求是否得到对应的第二响应信息确定待检测网页是否存在任意账号密码重置逻辑漏洞。
作为优选的实施方式，另一种任意账号密码重置逻辑漏洞的检测装置进一步包括：
第四判断模块，用于判断确定出第二响应信息的时间是否在预设时长范围内；若否，则调用第四确定模块；
第四确定模块，用于确定出待检测网页存在任意账号密码重置逻辑漏 洞。
作为优选的实施方式，另一种任意账号密码重置逻辑漏洞的检测装置进一步包括：
设置模块，用于在预设时长范围内得出第二响应信息之后，确定出与第二响应信息对应的目标随机验证码；
更新模块，用于利用目标随机验证码对应的重置密码请求执行多次重置密码的操作，并分别得到对应的第三响应信息；
第五确定模块，用于根据各第三响应信息判断待检测网页是否存在任意账号密码重置逻辑漏洞。
作为优选的实施方式，另一种任意账号密码重置逻辑漏洞的检测装置进一步包括：
记录模块，用于记录确定出待检测页面存在任意账号密码重置逻辑漏洞的检测时间。
图3为本发明实施例提供的另一种任意账号密码重置逻辑漏洞的检测装置的结构图，如图3所示，一种任意账号密码重置逻辑漏洞的检测装置包括：
存储器31，用于存储计算机程序；
处理器32，用于执行计算机程序时实现如上述任意账号密码重置逻辑漏洞的检测方法的步骤。
本发明实施例提供的任意账号密码重置逻辑漏洞的检测装置，具有上述任意账号密码重置逻辑漏洞的检测方法的有益效果。
为解决上述技术问题，本发明还提供一种计算机可读存储介质，计算机可读存储介质上存储有计算机程序，计算机程序被处理器执行时实现如上述任意账号密码重置逻辑漏洞的检测方法的步骤。
本发明实施例提供的计算机可读存储介质，具有上述任意账号密码重 置逻辑漏洞的检测方法的有益效果。
以上对本发明所提供的任意账号密码重置逻辑漏洞的检测方法、装置及计算机可读存储介质进行了详细介绍。本文中应用了具体实施例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想。应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以对本发明进行若干改进和修饰，这些改进和修饰也落入本发明权利要求的保护范围内。
说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。
专业人员还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。

Claims (10)

  1. 一种任意账号密码重置逻辑漏洞的检测方法，其特征在于，包括：
    调用预设的识别程序判断待检测网页中是否发起验证码发送请求；
    如果是，则从前端页面获取与所述验证码发送请求对应的响应包，并判断所述响应包中是否存在短信验证码；
    若存在，则确定出所述待检测网页存在任意账号密码重置逻辑漏洞。
  2. 根据权利要求1所述的方法，其特征在于，在所述从前端页面获取与所述验证码发送请求对应的响应包，并判断所述响应包中是否存在短信验证码之后，进一步包括：
    若不存在，判断所述待检测网页是否发起重置密码请求；
    若是，则利用第二预设用户信息替换所述重置密码请求中的第一预设用户信息，并更新所述重置密码请求；
    根据更新后的所述重置密码请求是否得到对应的第一响应信息确定所述待检测网页是否存在所述任意账号密码重置逻辑漏洞。
  3. 根据权利要求2所述的方法，其特征在于，进一步包括：
    若未得到所述第一响应信息，利用随机生成的随机验证码替换所述重置密码请求中的所述短信验证码，并更新所述重置密码请求；
    根据更新后的所述重置密码请求是否得到对应的第二响应信息确定所述待检测网页是否存在所述任意账号密码重置逻辑漏洞。
  4. 根据权利要求3所述的方法，其特征在于，进一步包括：
    判断确定出所述第二响应信息的时间是否在预设时长范围内；
    若否，则确定出所述待检测网页存在所述任意账号密码重置逻辑漏洞。
  5. 根据权利要求4所述的方法，其特征在于，在所述预设时长范围内得出所述第二响应信息之后，进一步包括：
    确定出与所述第二响应信息对应的目标随机验证码；
    利用所述目标随机验证码对应的所述重置密码请求执行多次重置密码的操作，并分别得到对应的第三响应信息；
    根据各所述第三响应信息判断所述待检测网页是否存在所述任意账号密码重置逻辑漏洞。
  6. 根据权利要求3所述的方法，其特征在于，生成所述短信验证码和所述第一预设用户信息和所述第二预设用户信息的过程具体包括：
    利用接码平台生成所述短信验证码和/或所述第一预设用户信息和所述第二预设用户信息。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，进一步包括：
    记录确定出所述待检测页面存在所述任意账号密码重置逻辑漏洞的检测时间。
  8. 一种任意账号密码重置逻辑漏洞的检测装置，其特征在于，包括：
    第一判断模块，用于调用预设的识别程序判断待检测网页中是否发起验证码发送请求；如果是，则调用第二判断模块；
    所述第二判断模块，用于从前端页面获取与所述验证码发送请求对应的响应包，并判断所述响应包中是否存在短信验证码；若存在，则调用第一确定模块；
    所述第一确定模块，用于确定出所述待检测网页存在任意账号密码重置逻辑漏洞。
  9. 一种任意账号密码重置逻辑漏洞的检测装置，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序时实现如权利要求1至7任一项所述的任意账号密码重置逻辑漏洞的检测方法的步骤。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至7任一项所述的任意账号密码重置逻辑漏洞的检测方法的步骤。
PCT/CN2021/098852 2020-09-22 2021-06-08 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质 WO2022062478A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/027,913 US20230370846A1 (en) 2020-09-22 2021-06-08 Method and apparatus for detecting arbitrary account password reset logic vulnerability, and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011002902.0 2020-09-22
CN202011002902.0A CN112165473B (zh) 2020-09-22 2020-09-22 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质

Publications (1)

Publication Number Publication Date
WO2022062478A1 true WO2022062478A1 (zh) 2022-03-31

Family

ID=73862673

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/098852 WO2022062478A1 (zh) 2020-09-22 2021-06-08 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质

Country Status (3)

Country Link
US (1) US20230370846A1 (zh)
CN (1) CN112165473B (zh)
WO (1) WO2022062478A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115758374A (zh) * 2022-11-04 2023-03-07 杭州孝道科技有限公司 一种账号枚举漏洞检测方法、***及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112165473B (zh) * 2020-09-22 2022-08-16 杭州安恒信息技术股份有限公司 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150358306A1 (en) * 2014-01-02 2015-12-10 Juniper Networks, Inc. Protecting sensitive web transactions using a communication channel associated with a user
CN107896218A (zh) * 2017-11-29 2018-04-10 郑州云海信息技术有限公司 一种自动化检测验证码回传逻辑漏洞的方法及***
CN109246094A (zh) * 2018-08-27 2019-01-18 中国联合网络通信集团有限公司 用户终端的验证方法、装置及存储介质
CN112165473A (zh) * 2020-09-22 2021-01-01 杭州安恒信息技术股份有限公司 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9386011B2 (en) * 2013-08-29 2016-07-05 Aol Inc. Systems and methods for managing resetting of user online identities or accounts
CN104200167B (zh) * 2014-08-05 2017-08-18 杭州安恒信息技术有限公司 自动化渗透测试方法及***
US10404689B2 (en) * 2017-02-09 2019-09-03 Microsoft Technology Licensing, Llc Password security
CN109922035B (zh) * 2017-12-13 2021-11-19 华为技术有限公司 密码重置的方法、请求端和校验端
EP3716564B1 (en) * 2017-12-13 2022-02-16 Huawei Technologies Co., Ltd. Method for resetting password, request terminal and check terminal
CN109460661A (zh) * 2018-09-17 2019-03-12 平安科技（深圳）有限公司 一种逻辑安全漏洞检测方法、装置及终端设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150358306A1 (en) * 2014-01-02 2015-12-10 Juniper Networks, Inc. Protecting sensitive web transactions using a communication channel associated with a user
CN107896218A (zh) * 2017-11-29 2018-04-10 郑州云海信息技术有限公司 一种自动化检测验证码回传逻辑漏洞的方法及***
CN109246094A (zh) * 2018-08-27 2019-01-18 中国联合网络通信集团有限公司 用户终端的验证方法、装置及存储介质
CN112165473A (zh) * 2020-09-22 2021-01-01 杭州安恒信息技术股份有限公司 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ARTHURKILLER @ VULNERABILITY BOX SECURITY RESEARCH TEAM: "Analysis of Common Logic Vulnerabilities in Web Security Testing (Actual Combat)", CSDN, 31 August 2016 (2016-08-31), pages 1 - 16, XP055915039, Retrieved from the Internet <URL:https://blog.csdn.net/Hydrakingbo/article/details/52388183> [retrieved on 20220425] *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115758374A (zh) * 2022-11-04 2023-03-07 杭州孝道科技有限公司 一种账号枚举漏洞检测方法、***及存储介质
CN115758374B (zh) * 2022-11-04 2023-08-04 杭州孝道科技有限公司 一种账号枚举漏洞检测方法、***及存储介质

Also Published As

Publication number Publication date
CN112165473A (zh) 2021-01-01
US20230370846A1 (en) 2023-11-16
CN112165473B (zh) 2022-08-16

Similar Documents

Publication Publication Date Title
US20210058354A1 (en) Determining Authenticity of Reported User Action in Cybersecurity Risk Assessment
US9954855B2 (en) Login method and apparatus, and open platform system
US10674009B1 (en) Validating automatic number identification data
US9813441B2 (en) Detecting and breaking CAPTCHA automation scripts and preventing image scraping
JP5568145B2 (ja) 人間の存在を検出するためのバイオメトリックセンサ及び関連方法
WO2022062478A1 (zh) 一种任意账号密码重置逻辑漏洞的检测方法、装置及介质
WO2019169759A1 (zh) 模拟接口的创建装置、方法及计算机可读存储介质
US11770385B2 (en) Systems and methods for malicious client detection through property analysis
CN110392054A (zh) 登录校验方法、装置、***、设备和可读存储介质
CN103780450B (zh) 浏览器访问网址的检测方法和***
CN107733883B (zh) 一种检测批量注册账号的方法及装置
CN108028843A (zh) 被动式web应用防火墙
CN111147363B (zh) 在消息交换会话中传递第三方应用信息的方法和***
CN107357562A (zh) 一种信息填充方法、装置及客户端
CN108259436A (zh) 用户身份认证处理方法、应用服务器以及认证***服务器
US20080022004A1 (en) Method And System For Providing Resources By Using Virtual Path
CN111049795B (zh) 分布式Web应用的敏感数据未加密漏洞的检测方法及装置
CN113901482A (zh) 漏洞检测方法及装置
CN111767493A (zh) 一种网站的内容数据的展示方法、装置、设备及存储介质
CN116800544B (zh) 一种用户认证方法及***及装置及介质
CN113836509B (zh) 信息采集方法、装置、电子设备和存储介质
US11323476B1 (en) Prevention of credential phishing based upon login behavior analysis
CN110011992B (zh) ***登录方法及电子设备
JP2008171329A (ja) 認証装置及びプログラム
CN105988789B (zh) 第三方应用呼起方法、呼起平台和终端

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21870861

Country of ref document: EP

Kind code of ref document: A1