Detecting Social Login Security Flaws Using Database Query Features

摘要

Techniques for detecting security flaws are described herein. An example system includes a processor to perform a login attempt into a website to be tested using a first social login account and a first verification to determine whether the first social login account is logged in. The processor can monitor a database associated with the website for queries. The processor can perform a second login attempt into the website using a second social login account and a second verification to determine whether the second social login account is logged in. The processor can perform a third login attempt using a third social login account. The processor can detect a second set of features based on the queries during the third login attempt. The processor can detect a social login security flaw based on the first and second verification, and the first and second set of detected features.

主权项

1. A system, comprising a processor to:
perform a login attempt into a service to be tested using a first social login account and a first verification to determine whether the first social login account is logged in; monitor a database associated with the website for queries; perform a second login attempt into the website using a second social login account and a second verification to determine whether the second social login account is logged in, the processor to detect a first set of features based on the queries during the second login attempt; perform a third login attempt using a third social login account, wherein the third social login account uses an identity provider used by the second social login account and comprises account information different from account information of the second login account; detect a second set of features based on the queries during the third login attempt; and detect a social login security flaw based on the first verification, the second verification, the first set of detected features, and the second set of detected features.