Granted Patent B2

US 12,317,080 · App. 18/027,913 · Granted May 27, 2025

Inventors: Yu Lou (Zhejiang, CN); Yuan Fan (Zhejiang, CN)

Assignee: DBAPPSECURITY CO., LTD

H04W12/12H04W12/033H04W12/61

Abstract

Claims (62)

1. A method for detecting a logic vulnerability allowing arbitrary password reset for an account, comprising:

invoking a preset identification program to determine whether a request for a verification code is initiated in a to-be-detected webpage;

obtaining, from a front-end page, a response packet sent in response to the request for a verification code, and determining whether there is a short message service (SMS) verification code in the response packet, on determining that a request for a verification code is initiated in the to-be-detected webpage;

determining that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, on determining that there is an SMS verification code in the response packet;

determining whether a request for password reset is initiated in the to-be-detected webpage, on determining that there is no SMS verification code in the response packet;

replacing first preset user information in the request for password reset with second preset user information, to update the request for password reset, on determining that a request for password reset is initiated in the to-be-detected webpage; and

determining whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, based on a first response to the updated request for password reset.

2. The method according to claim 1 , further comprising:

replacing an SMS verification code in the request for password reset with a random verification code, to update the request for password reset, on not receiving the first response; and

determining whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, based on a second response to the updated request for password reset.

3. The method according to claim 2 , further comprising:

determining whether the second response obtained within a preset time period; and

determining that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, on determining that the second response is not obtained within a preset time period.

4. The method according to claim 3 , further comprising:

determining a target random verification code corresponding to the second response, after obtaining the second response within the preset time period;

performing a password reset operation for a plurality of times by using the request for password reset corresponding to the target random verification code, to obtain a plurality of third responses; and

determining, based on the third responses, whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage.

5. The method according to claim 3 , wherein

at least one of the SMS verification code, the first preset user information, or the second preset user information is generated through a code receiving platform.

6. The method according to claim 1 , further comprising:

recording a time instant when it is determined that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage.

7. An apparatus for detecting a logic vulnerability allowing arbitrary password reset for an account, comprising:

a memory storing a computer program; and

a processor, wherein

the computer program, when executed by the processor, configures the apparatus to

invoke a preset identification program to determine whether a request for a verification code is initiated in a to-be-detected webpage;

obtain, from a front-end page, a response packet sent in response to the request for a verification code, and determine whether there is a short message service (SMS) verification code in the response packet, on determining that a request for a verification code is initiated in the to-be-detected webpage;

determine that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, on determining that there is an SMS verification code in the response packet;

determine whether a request for password reset is initiated in the to-be-detected webpage, on determining that there is no SMS verification code in the response packet;

replace first preset user information in the request for password reset with second preset user information, to update the request for password reset, on determining that a request for password reset is initiated in the to-be-detected webpage; and

determine whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, based on a first response to the updated request for password reset.

8. A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program, when executed by a processor, is configured to

invoke a preset identification program to determine whether a request for a verification code is initiated in a to-be-detected webpage;

obtain, from a front-end page, a response packet sent in response to the request for a verification code, and determine whether there is a short message service (SMS) verification code in the response packet, on determining that a request for a verification code is initiated in the to-be-detected webpage;

determine that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, on determining that there is an SMS verification code in the response packet;

determine whether a request for password reset is initiated in the to-be-detected webpage, on determining that there is no SMS verification code in the response packet;

replace first preset user information in the request for password reset with second preset user information, to update the request for password reset, on determining that a request for password reset is initiated in the to-be-detected webpage; and

determine whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, based on a first response to the updated request for password reset.

9. The apparatus according to claim 7 , further configured to:

replace an SMS verification code in the request for password reset with a random verification code, to update the request for password reset, on not receiving the first response; and

determine whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, based on a second response to the updated request for password reset.

10. The apparatus according to claim 9 , further configured to:

determine whether the second response is obtained within a preset time period; and

determine that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, on determining that the second response is not obtained within the preset time period.

11. The apparatus according to claim 10 , further configured to:

determine a target random verification code corresponding to the second response, after obtaining the second response within the preset time period;

perform a password reset operation for a plurality of times by using the request for password reset corresponding to the target random verification code, to obtain a plurality of third responses; and

determine, based on the third responses, whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage.

12. The apparatus according to claim 9 , further configured to:

record a time instant when it is determined that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage.

13. The computer-readable storage medium according to claim 8 , wherein the computer program, when executed by the processor, is further configured to:

replace an SMS verification code in the request for password reset with a random verification code, to update the request for password reset, on not receiving the first response; and

determine whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, based on a second response to the updated request for password reset.

14. The computer-readable storage medium according to claim 13 , wherein the computer program, when executed by the processor, is further configured to:

determine whether the second response is obtained within a preset time period; and

determine that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage, on determining that the second response is not obtained within the preset time period.

15. The computer-readable storage medium according to claim 14 , wherein the computer program, when executed by the processor, is further configured to:

determine a target random verification code corresponding to the second response, after obtaining the second response within the preset time period;

perform a password reset operation for a plurality of times by using the request for password reset corresponding to the target random verification code, to obtain a plurality of third responses; and

determine, based on the third responses, whether the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage.

16. The computer-readable storage medium according to claim 10 , wherein the computer program, when executed by the processor, is further configured to:

record a time instant when it is determined that the logic vulnerability allowing arbitrary password reset for an account exists in the to-be-detected webpage.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (14)