CN108696490A - The recognition methods of account permission and device - Google Patents

Abstract

The embodiment of the present invention discloses a method for identifying account authority, including: logging in the first account on the website to be tested, obtaining the first login state information of the first account; obtaining preset scanning rules, the scanning rules include the The test address of the test website and the attribute type of the target account; modify the first login state information according to the attribute value of the second account under the attribute type of the target account to obtain the second login state information; use the second login state information to access all The website to be tested receives the first response content sent by the website to be tested; obtains the characteristic information of the first response content according to the matching rules defined in the scanning rules, and determines according to the characteristic information and the matching rules Whether the first account exceeds the authority. In addition, the embodiment of the present invention also discloses an account authority identification device. By adopting the embodiment of the present invention, the efficiency of account unauthorized authorization can be improved.

Description

Method and device for identifying account authority

technical field

The present invention relates to the technical field of the Internet, in particular to an account authority identification method and device.

Background technique

With the continuous development of Internet technology, more and more applications or functions are realized through the Internet, that is, loopholes in the Internet that may lead to user data or other security issues should be avoided as much as possible. Among the existing Internet loopholes, the unauthorized loophole is an important loophole that cannot be ignored.

Violation of authority vulnerability refers to the fact that the website does not strictly divide the authority, so that user A can use certain methods or means to access the authority control system of user B, so as to achieve other sensitive operations such as stealing information, modifying information, adding information, and deleting information. For example, when accessing a web page through a URL (Uniform Resource Locator, UniformResourceLocator), due to web program design flaws, using the guessability of URL incoming parameters and changing the input parameter values, it may cause horizontal unauthorized access and get others private information.

Because once the unauthorized vulnerability exists, the attacker can forge the identity of others to conduct transactions, pay, change passwords, obtain other people's private information, etc., which will cause great hidden dangers to the user's account security. vulnerabilities are detected. Among the current common detection methods for unauthorized vulnerabilities, the detection of unauthorized vulnerabilities is mainly through manual penetration testing, and then professional penetration testers conduct authority identification for different account systems of the website, and use technical means to detect whether the website is genuine or not. Effectively distinguish the permissions of different users. It is not only inefficient to manually identify the permissions of different account systems, but also consumes manpower and material resources, and it cannot ensure that the accounts within the test range are covered and detected, that is, it cannot be guaranteed to detect all vulnerabilities.

To sum up, the existing methods for detecting unauthorized vulnerabilities have the problem of low detection efficiency due to the long time-consuming and incomplete detection of vulnerabilities due to manual detection.

Contents of the invention

Based on this, in order to solve the technical problems of time-consuming, incomplete vulnerability detection and low detection efficiency in the detection method of unauthorized vulnerability in the prior art, an identification method of account authority is proposed.

A method for identifying account permissions, comprising:

Log in the first account on the website to be tested, and obtain the first login state information of the first account;

Acquiring preset scanning rules, the scanning rules include the test address of the website to be tested and the attribute type of the target account;

Modifying the first login state information according to the attribute value of the second account under the attribute type of the target account to obtain the second login state information;

accessing the website to be tested by using the second login state information, and receiving the first response content sent by the website to be tested;

Obtain feature information of the first response content according to a matching rule defined in the scan rule, and determine whether the first account is unauthorized according to the feature information and the matching rule.

Optionally, in one embodiment, after obtaining the first login status information of the first account, the method further includes: using the login status information of the first account to access the website to be tested, and receiving the first login status information sent by the website to be tested. 2. Response content: if the second response content includes the feature information of the first account, execute the acquisition of the preset scanning rule.

Optionally, in an embodiment, determining whether the first account exceeds the authority according to the characteristic information and the matching rule is: when the characteristic information of the second response content matches the first account , determining that the first account has not exceeded the authority; in the case that the characteristic information of the second response content matches the second account, determining that the first account has exceeded the authority.

Optionally, in an embodiment, after receiving the second response content sent by the website to be tested, it further includes: if the second response content does not contain the feature information of the first account, determining the The test address of the website to be tested does not have the identification function of account authority, and the test address of the website to be tested is switched.

Optionally, in one embodiment, the login status information is UIN code, cookie or session ID.

In addition, in order to solve the technical problems of time-consuming and incomplete detection of loopholes in the detection method of unauthorized loopholes in the prior art, a device for identifying account permissions is also proposed.

An identification device for account authority, comprising:

A login state information acquisition module, configured to log in the first account on the website to be tested, and obtain the first login state information of the first account;

A scan rule acquiring module, configured to acquire preset scan rules, the scan rules including the test address of the website to be tested and the attribute type of the target account;

A login status information modifying module, configured to modify the first login status information according to the attribute value of the second account under the attribute type of the target account, to obtain the second login status information;

A response content receiving module, configured to use the second login state information to access the website to be tested, and receive the first response content sent by the website to be tested;

An unauthorized judging module, configured to acquire feature information of the first response content according to a matching rule defined in the scanning rule, and determine whether the first account is unauthorized according to the feature information and the matching rule.

Optionally, in one embodiment, the above device further includes a test website detection module, configured to use the login status information of the first account to access the website to be tested, and receive the second response content sent by the website to be tested ; Invoking the scan rule acquisition module when the second response content contains the characteristic information of the first account.

Optionally, in an embodiment, the unauthorized judging module is further configured to determine that the first account has not exceeded the authorized account when the characteristic information of the second response content matches the first account; If the characteristic information of the content of the second response matches the second account, it is determined that the first account has exceeded the authority.

Optionally, in one embodiment, the test website detection module is further configured to determine that the test address of the website to be tested does not have The identification function of the account authority switches the test address of the website to be tested.

Optionally, in one embodiment, the login status information is UIN code, cookie or session ID.

In addition, in order to solve the technical problem of low detection efficiency due to the long time-consuming manual detection and incomplete detection of vulnerabilities in the detection method of unauthorized vulnerabilities in the prior art, a computer-readable storage medium is also proposed. Instructions are stored in the readable storage medium, and when the instructions are run on the computer, the computer is made to execute the aforementioned method for identifying account authority.

Implementing the embodiment of the present invention will have the following beneficial effects:

After adopting the identification method and device of the above-mentioned account authority, when it is necessary to detect whether there is an account unauthorized vulnerability in a certain website to be tested, the identity information in the login status information corresponding to the first account can be Change it to the identity information corresponding to the second account, then request data from the website to be tested, and judge whether the account feature information contained in the data returned by the website to be tested has account unauthorized according to the matching rules defined in the scanning rules. That is to say, after adopting the embodiment of the present invention, there is no need for inspectors to manually compare and modify the identification parameters of the account, and the target account attribute type determined in the scanning rules will automatically be automatically compared to the target account attribute type. The attribute value of the first account is changed to the attribute value of the second account. That is to say, the inspector only needs to define the attribute type of the target account in the scan rule to automatically detect whether there is an unauthorized account, which reduces the detection of account unauthorized The required time consumption improves the efficiency of account unauthorized detection.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

in:

Fig. 1 is a schematic flow chart of a method for identifying account authority in an embodiment;

Fig. 2 is a schematic diagram of data transmission between various modules of the terminal implementing the identification method of account authority in an embodiment;

FIG. 3 is a schematic flowchart of a method for identifying account authority in the prior art;

FIG. 4 is a schematic flowchart of a method for identifying account authority in an embodiment;

Fig. 5 is a schematic structural diagram of an identification device for account authority in an embodiment;

Fig. 6 is a schematic structural diagram of a computer device running the aforementioned identification method for account authority in an embodiment.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

In order to solve the technical problem of low detection efficiency due to the time-consuming manual detection and incomplete detection of vulnerabilities in the detection method of unauthorized vulnerabilities in the prior art, in this embodiment, a method for identifying account permissions is proposed. The implementation of the method may depend on a computer program, which may run on a computer system based on the Von Neumann architecture, and the computer program may be an application program for detecting account unauthorized vulnerabilities. The computer system may be a server or a terminal such as a smart phone, a tablet computer, or a personal computer running the above-mentioned computer program.

Specifically, as shown in FIG. 1, the identification method of the above-mentioned account authority includes the following steps S102-S110:

Step S102: Log in the first account on the website to be tested, and obtain the first login state information of the first account.

The detection of account unauthorized is carried out for a certain website, that is, the website to be tested. In this embodiment, when a website containing multiple accounts needs to be detected for an unauthorized vulnerability, the website is the website to be tested.

In this embodiment, it is necessary to detect whether there is an account unauthorized phenomenon in a certain account, and this account is the first account. It should be noted that, in the embodiment, if it is necessary to check whether there is a loophole of account unauthorized access for all accounts included in the website, all accounts can be traversed, and steps S102-S110 can be executed for each traversed account.

Whether account A exceeds authority refers to whether user A can access the authority control system of user B through certain methods or means on the website to be tested, or perform operations such as respecting, deleting, and adding information on user B. In this embodiment, it is judged whether the relevant data under the second account can be accessed under the first account.

First, on the website to be tested, log in to the website to be tested through the account number, password and other identity verification information corresponding to the first account. Information access, that is to say, whether the user currently has access to a certain data or whether the user can currently modify the accessed data is determined by whether the first account logged in has the corresponding authority. .

After the first account login is successful, obtain the login state information with the first account, for example, the login state information can be the UIN (Unique Identification Number, unique identification code) code corresponding to the first account, or cookies information, or Session ID It is equal to the data uniquely corresponding to the identity information of the first account, and can be used to verify the unique identification information of the identity information of the current account.

Specifically, the UIN code is the identity verification code assigned to the registrant during the account registration process, and the UIN code is permanent and cannot be modified, unless the UIN is deleted due to the change of the registrant's identity. That is to say, the UIN code corresponding to the first account is definite and different from the UIN codes of other users. The UIN code can uniquely identify the first account currently logged in. If the logged-in account is changed or tampered with, its UIN code will also change accordingly.

Cookie (or cookies) is the data (browser cache) stored on the user's local terminal by the website in order to identify the user's identity. When visiting the website, the cookie can be sent to the server together with the HTTP request. Find the user identity information or user verification information that matches the cookie. That is to say, if the cookie changes, the user identity information found by the server that matches the current cookie will also change.

Session ID is the identifier corresponding to the session generated by the server when creating a session for the request of the first account, and the session is a data block of authentication information corresponding to the first account stored in the server, and can be searched in the session list through the Session ID Go to the session corresponding to the Session ID, and then determine the authentication information corresponding to the Session ID. That is to say, once the Session ID is changed or tampered with, when the user authentication information is searched, it may not be found or the found user authentication information may also change.

In summary, the login status information can uniquely determine the current account, and if the login status information changes, the corresponding account will also change. In this embodiment, the login state information may be a combination of one or more parameters among UIN code, cookies information, Session ID and other parameters that can identify user identity information.

In this embodiment, the acquisition of the login state information may be realized through the interface function of pulling the login state. For example, the cookie after the first account is logged in is obtained through the pull interface function in the login state.

Step S104: Obtain a preset scanning rule, the scanning rule includes the test address of the website to be tested and the attribute type of the target account.

In this embodiment, after obtaining the login status information of the first account through the login status pull interface, the scanner sends the access to the website to be tested to the server, and judges according to the data returned by the website, and judges that the first account Whether the account has account unauthorized. A scanner is a program that automatically detects security weaknesses of local or remote hosts. It can quickly and accurately discover the vulnerabilities of the scanned target and provide the user with the scanning results; the working principle is that the scanner sends a data packet to the target computer, and then according to The information fed back by the other party is used to judge sensitive information such as the other party's operating system type, development port, and provided services.

Specifically, in this embodiment, it is first necessary to determine the test address corresponding to the website to be tested, that is, the access address.

Further, it is also necessary to determine the attribute type of the target account that the current scanner needs in the process of judging whether the first account has account unauthorized access. It should be noted that the attribute type of the target account is an attribute item type used by one or more specified attribute item pairs in at least one attribute item included in the login state information. For example, if the login state information of the first account includes the UIN code of the first account, as well as the account identifier and account nickname, the attribute type of the target account is one or more of the UIN code, account identifier and account nickname.

Step S106: Modify the first login state information according to the attribute value of the second account under the attribute type of the target account to obtain the second login state information.

As mentioned above, in this embodiment, it is necessary to determine whether the first account can access data under the second account without authorization or perform a certain functional operation. It should be noted that, in this embodiment, the second account may be an associated account associated with the first account, or any account on the website to be tested.

After the attribute type of the target account is determined, the attribute value of the second account under the attribute type of the target account is determined, and among the multiple attribute items contained in the first login state information corresponding to the first account, the attribute value corresponding to the attribute type of the target account will be The attribute value of the corresponding attribute item is modified to the attribute value of the second account under the attribute type of the target account, so as to obtain the second login state information.

For example, in the case that the attribute type of the target account is a UIN code, the UIN code in the first login state information is changed to the UIN code corresponding to the second account.

Step S108: Use the second login status information to access the website to be tested, and receive the first response content sent by the website to be tested.

In this embodiment, if the first login status information is used to access the website to be tested, that is, to access the website to be tested through the identity authority corresponding to the first account, and perform operations corresponding to the authority of the first account.

However, the second login status information is used to access the website to be tested, because in the second login status information, only the attribute values under the attribute type of the target account are changed to the attribute values of the second account under the attribute type of the target account, and no other information is modified. , and the second account has not logged into the website to be tested. In this case, use the second login state information that includes the attribute value of the second account under the attribute type of the target account to access the website to be tested, and receive the corresponding content returned by the server of the website to be tested, which is divided into the following: Cases:

First, because when the server receives an access request, it will verify the relevant information contained in the second login state information carried, for example, perform identity verification according to the UIN code contained in the login state information to determine The corresponding account is the second account, therefore, the returned content is related to the second account;

Second, because the server did not verify the attribute value of the target account attribute type contained in the second login status information carried when receiving the access request, because the server does not know that the login status information is related to the second account , therefore, the returned content has nothing to do with the second account, that is, it will continue to operate according to the relevant permissions of the first account.

Specifically, the process of judging whether there is an account unauthorized account in the first account is step S110: Acquire the characteristic information of the first response content according to the matching rules defined in the scanning rules, and determine the Whether the above-mentioned first account exceeds the authority.

Because in the process of detecting account unauthorized access, all attributes of the account need to be detected comprehensively. Therefore, in the process of account unauthorized detection, the attribute type of the target account in the scanning rule is determined according to the needs of actual detection.

In addition, the scanning rules include not only the attribute type of the target account, but also the matching rules used in the process of analyzing the response content returned by the server in the specific process of judging whether the account exceeds the authority.

In this embodiment, the comparison and verification are not performed on all the content returned by the server, but only on part of the content that can determine whether the account is unauthorized. For example, in a specific embodiment, after the user logs in to the website, the logo corresponding to the logged-in account (for example, Hi, Apple!) will be displayed on the web page view of the website, so that the user can use the displayed account logo to Determine the account corresponding to the current web view. In this case, it is only necessary to judge the account identifier corresponding to the logged-in account displayed in the webpage view to know the account accompanying the login status information corresponding to the webpage view.

In a specific embodiment, the characteristic information of the first response content is acquired according to the characteristic information of the response content determined by the matching rule, and then it is determined whether the first account is unauthorized according to the characteristic information and the matching rule.

For example, the above-mentioned process of determining whether the first account has exceeded the authority is: in the case that the characteristic information of the second response content matches the first account, determine that the first account has not exceeded the authority; In a case where the feature information matches the second account, it is determined that the first account is unauthorized.

That is to say, if an access request to the website to be tested is initiated through the second login state information, if the preset characteristic information in the response content returned by the server matches the first account, the first account has not exceeded the authority, and if the server The preset feature information in the returned response content does not match the first account, for example, if it matches the second account, the first account is out of authority.

For example, the characteristic information reflects the identity information of the originator determined by the server in the process of judging the identity of the originator of the HTTP request and the corresponding authority after receiving the HTTP request, such as the UIN code of the originator; if the response returned by the server If the UIN code contained in the characteristic information in the content corresponds to the first account, it is determined that the characteristic information matches the first account; otherwise, if the UIN code contained in the characteristic information in the response content returned by the server corresponds to the second account, then It is determined that the feature information matches the second account.

As shown in FIG. 2 , FIG. 2 shows the interactive relationship between the terminal implementing the identification method of the above account authority and the website to be tested (target website). After logging in the website to be tested through the registered first account on the terminal, the login status information of the first account logged in is obtained through the login status pull interface and sent to the scanner; the scanner uses the login status information and the URL of the website to be tested Wait for the valid data (payload) to be encapsulated to generate a corresponding HTTP request and then sent to the server corresponding to the website to be tested, and receive the data returned by the server; the scanner analyzes the received data to determine whether there is an unauthorized vulnerability, among which, The relevant rules in the process of generating the HTTP request by the scanner and the rules for analyzing the returned data are scanning rules corresponding to the scanner, and the scanning rules are provided and set by the rule engine connected to the scanner.

Further, in this embodiment, before detecting whether the first account can override the data corresponding to the second account, it is also necessary to determine whether the current website has an account identification function. For example, if all users on the website to be tested have or, when any account initiates a data access request or operation request on the website to be tested, it does not verify the account or whether the account has permission; hereby In this case, there is no question of whether the account exceeds the authority.

As shown in Fig. 3, Fig. 3 shows a schematic flow diagram of an identification method for account authority. Before judging whether the first account has unauthorized access, it is also necessary to determine whether the test website supports the detection and judgment of account unauthorized access.

Specifically, in one embodiment, after obtaining the first login status information of the first account, it further includes: using the login status information of the first account to access the website to be tested, and receiving the second login status information sent by the website to be tested. Response content; if the second response content contains the characteristic information of the first account, execute the acquisition of the preset scanning rule; if the second response content does not contain the first account information In the case of feature information, it is determined that the test address of the website to be tested does not have the identification function of account authority, and the test address of the website to be tested is switched.

That is to say, if there is no logic for judging the authority of the account in the website to be tested, and there is no logic for subsequent judgments beyond the authority, when the login status information of the first account is used to access the website to be tested, the server of the website to be tested returns The response content of should not contain any relevant data corresponding to the first account. Therefore, when using the login status information of the first account to access the website to be tested, if the response content returned by the website to be tested does not contain the characteristic information corresponding to the first account, there is no need to continue to detect the website to be tested for account violation , directly suspend the execution of this method.

In one embodiment, the website to be tested is a shopping website, and the test address of the website to be tested determined in step S104 is a product link in the shopping website; generally speaking, the address corresponding to the product link of the shopping website generally does not need to The user's identity is verified. In this case, if the response information returned by the server does not contain the characteristic information corresponding to the first account, it is considered that the test address of the website to be tested does not have the detection function of account unauthorized, and the test address needs to be switched. For example, switch to the account login address or payment link of the website to be tested, which needs to verify the user's identity, and execute steps S102-S110 again.

In other words, if a certain test address of the website under test does not have the detection function of account authority, it does not mean that all the test addresses of the website under test do not have the detection function of account authority. The test results ignore the detection of possible account unauthorized vulnerabilities under other addresses, and it is necessary to switch to other test addresses under the website to be tested for account unauthorized detection.

Conversely, if the returned response content contains characteristic information corresponding to the first account, it means that there is logic to verify the identity of the account in the website to be tested, and further judgment can be made on whether the authority is exceeded. Therefore, execute Steps S104-S110 to determine whether the first account exceeds the authority.

In the related technical solution, as shown in FIG. 4 , FIG. 4 shows a schematic diagram of a detection process of whether there is an unauthorized account in an account in the related technical solution. Specifically, the inspector logs in to account A, then initiates a data operation request and truncates the request packet, replaces the identity identifier corresponding to A in the request packet with the identity request corresponding to B, then submits the modified request, and returns the request according to the website to determine whether the operation is successful, if so, mark the loophole, otherwise, there is no loophole. Among them, it is necessary for the inspector to manually compare the identification parameters of the two accounts A and B, and determine that all the identification parameters in the data operation request of the A account are changed to the specific values corresponding to the B account, which takes a lot of time.

However, through the embodiment of the present invention, there is no need for the detection personnel to manually compare and modify the identification parameters of the account, and the attribute value of the first account under the attribute type of the target account will be automatically calculated according to the attribute type of the target account determined in the scanning rule. Change it to the attribute value of the second account, that is to say, the inspector only needs to define the attribute type of the target account in the scan rule to automatically detect whether the account has an unauthorized vulnerability, which reduces the time spent on account unauthorized detection and improves Improve the efficiency of account unauthorized detection.

In addition, in order to solve the technical problems of low detection efficiency due to the long time-consuming manual detection and incomplete detection of vulnerabilities in the detection method of the unauthorized vulnerability in the prior art, in one embodiment, as shown in Figure 5, it is also proposed An identification device for account authority is provided, including a login status information acquisition module 102, a scanning rule acquisition module 104, a login status information modification module 106, a response content receiving module 108 and an unauthorized judging module 110, wherein:

The login state information acquisition module 102 is used to log in the first account on the website to be tested, and obtain the first login state information of the first account;

Scanning rule obtaining module 104, is used for obtaining preset scanning rule, and described scanning rule comprises the test address of website to be tested and target account attribute type;

The login status information modification module 106 is configured to modify the first login status information according to the attribute value of the second account under the attribute type of the target account to obtain the second login status information;

A response content receiving module 108, configured to use the second login status information to access the website to be tested, and receive the first response content sent by the website to be tested;

The unauthorized judging module 110 is configured to obtain characteristic information of the first response content according to the matching rules defined in the scanning rules, and determine whether the first account is unauthorized according to the characteristic information and the matching rules.

Optionally, in one embodiment, as shown in FIG. 5 , the above device further includes a testing website detection module 112, configured to use the login status information of the first account to access the website to be tested, and receive the website to be tested. The second response content sent by the website; in the case that the second response content includes the characteristic information of the first account, the scanning rule acquisition module 104 is invoked.

Optionally, in one embodiment, the unauthorized judging module 110 is further configured to determine that the first account is not authorized when the characteristic information of the second response content matches the first account; If the feature information of the second response content matches the second account, it is determined that the first account is unauthorized.

Optionally, in one embodiment, the test website detection module 112 is further configured to determine that the test address of the website to be tested is not With the identification function of account authority, the test address of the website to be tested is switched.

Optionally, in one embodiment, the login status information is UIN code, cookie or session ID.

Implementing the embodiment of the present invention will have the following beneficial effects:

After adopting the identification method and device of the above-mentioned account authority, when it is necessary to detect whether there is an account unauthorized vulnerability in a certain website to be tested, the identity information in the login status information corresponding to the first account can be Change it to the identity information corresponding to the second account, then request data from the website to be tested, and judge whether the account feature information contained in the data returned by the website to be tested has account unauthorized according to the matching rules defined in the scanning rules. That is to say, after adopting the embodiment of the present invention, there is no need for inspectors to manually compare and modify the identification parameters of the account, and the target account attribute type determined in the scanning rules will automatically be automatically compared to the target account attribute type. The attribute value of the first account is changed to the attribute value of the second account. That is to say, the inspector only needs to define the attribute type of the target account in the scan rule to automatically detect whether there is an unauthorized account, which reduces the detection of account unauthorized The required time consumption improves the efficiency of account unauthorized detection.

In one embodiment, as shown in FIG. 6 , FIG. 6 shows a terminal of a computer system based on the Von Neumann system running the above account authority identification method. The computer system can be a terminal device such as a smart phone, a tablet computer, a palmtop computer, a notebook computer or a personal computer. Specifically, it may include an external input interface 1001, a processor 1002, a memory 1003, and an output interface 1004 connected through a system bus. Wherein, the external input interface 1001 may optionally include at least a network interface 10012 . The memory 1003 may include an external memory 10032 (such as a hard disk, an optical disk, or a floppy disk, etc.) and an internal memory 10034 . The output interface 1004 may at least include devices such as a display screen 10042 .

In this embodiment, the operation of this method is based on a computer program, and the program file of the computer program is stored in the external memory 10032 of the aforementioned computer system based on the Von Neumann architecture, and is loaded into the internal memory 10034 during operation, and then After being compiled into machine code, it is delivered to the processor 1002 for execution, so that a logical login status information acquisition module 102, scanning rule acquisition module 104, login status information modification module 106, Response content receiving module 108 , unauthorized judging module 110 and testing website detecting module 112 . In addition, during the execution of the identification method of the above-mentioned account authority, the input parameters are all received through the external input interface 1001, and transmitted to the memory 1003 for buffering, and then input to the processor 1002 for processing, and the processed result data may be buffered in the memory 1003 Subsequent processing is carried out, or is transmitted to the output interface 1004 for output.

Specifically, the processor 1002 is configured to perform the following operations:

Log in the first account on the website to be tested, and obtain the first login state information of the first account;

Acquiring preset scanning rules, the scanning rules include the test address of the website to be tested and the attribute type of the target account;

Modifying the login state information according to the second account to obtain the second login state information;

accessing the website to be tested by using the second login state information, and receiving the first response content sent by the website to be tested;

Obtain feature information of the first response content according to a matching rule defined in the scan rule, and determine whether the first account is unauthorized according to the feature information and the matching rule.

Optionally, in one embodiment, the processor 1002 is further configured to use the login status information of the first account to access the website to be tested, and receive the second response content sent by the website to be tested; Second, if the response content includes the characteristic information of the first account, execute the acquisition of the preset scanning rule.

Optionally, in an embodiment, the processor 1002 is further configured to determine that the first account has not exceeded the authority when the characteristic information of the second response content matches the first account; If the characteristic information of the content of the second response matches the second account, it is determined that the first account has exceeded the authority.

Optionally, in one embodiment, the processor 1002 is further configured to determine that the test address of the website to be tested does not have an account if the second response content does not contain the characteristic information of the first account. The permission identification function switches the test address of the website to be tested.

The above disclosures are only preferred embodiments of the present invention, and certainly cannot limit the scope of rights of the present invention. Therefore, equivalent changes made according to the claims of the present invention still fall within the scope of the present invention.

Claims (11)

1. A method for identifying account authority, comprising: Log in the first account on the website to be tested, and obtain the first login state information of the first account; Acquiring preset scanning rules, the scanning rules include the test address of the website to be tested and the attribute type of the target account; Modifying the login state information according to the second account to obtain the second login state information; accessing the website to be tested by using the second login state information, and receiving the first response content sent by the website to be tested; Obtain feature information of the first response content according to a matching rule defined in the scan rule, and determine whether the first account is unauthorized according to the feature information and the matching rule. 2. The method for identifying account authority according to claim 1, characterized in that, after obtaining the first login status information of the first account, the method further includes: accessing the website to be tested by using the login status information of the first account, and receiving the second response content sent by the website to be tested; In a case where the second response content includes the characteristic information of the first account, the acquiring of the preset scanning rule is executed. 3. The method for identifying account authority according to claim 1, wherein the determining whether the first account exceeds authority according to the characteristic information and the matching rule is as follows: If the feature information of the second response content matches the first account, it is determined that the first account has not exceeded its authority; If the feature information of the second response content matches the second account, it is determined that the first account is unauthorized. 4. The method for identifying account authority according to claim 2, characterized in that, after receiving the second response content sent by the website to be tested, the method further includes: If the second response content does not include the characteristic information of the first account, it is determined that the test address of the website to be tested does not have the identification function of account authority, and the test address of the website to be tested is switched. 5. The method for identifying account authority according to any one of claims 1 to 4, wherein the login state information is UIN code, cookie or session ID. 6. An identification device for account authority, characterized in that it comprises: A login state information acquisition module, configured to log in the first account on the website to be tested, and obtain the first login state information of the first account; A scan rule acquiring module, configured to acquire preset scan rules, the scan rules including the test address of the website to be tested and the attribute type of the target account; A login status information modifying module, configured to modify the first login status information according to the attribute value of the second account under the attribute type of the target account, to obtain the second login status information; A response content receiving module, configured to use the second login state information to access the website to be tested, and receive the first response content sent by the website to be tested; An unauthorized judging module, configured to acquire feature information of the first response content according to a matching rule defined in the scanning rule, and determine whether the first account is unauthorized according to the feature information and the matching rule. 7. The identification device of account authority according to claim 6, characterized in that, the device also includes a testing website detection module for using the login status information of the first account to access the website to be tested, and receiving the website to be tested. The second response content sent by the website to be tested; in the case that the second response content includes the characteristic information of the first account, the scanning rule acquisition module is invoked. 8. The device for identifying authority of an account according to claim 6, wherein the unauthorized judging module is further configured to determine if the characteristic information of the second response content matches the first account. The first account has not exceeded the authority; in the case that the feature information of the second response content matches the second account, it is determined that the first account has exceeded the authority. 9. The device for identifying account authority according to claim 7, wherein the test website detection module is further configured to, when the second response content does not include the feature information of the first account, It is determined that the test address of the website to be tested does not have the identification function of account authority, and the test address of the website to be tested is switched. 10. The device for identifying account authority according to any one of claims 6 to 9, wherein the login state information is UIN code, cookie or session ID. 11. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, it causes the computer to execute the above method for identifying account authority.