业务逻辑漏洞常见类型分析与JWT测试示例研究  

Analysis of Common Types of Business Logic Vulnerabilities and Research on JWT Testing Examples

作　　者：胡传甫 王昕葳 周宬 王少青 Hu Chuanfu;Wang Xinwei;Zhou Cheng;Wang Shaoqing(Jiaxing Nanyang Polytechnic Institute,Jiaxing,Zhejiang 314000,China;Jiaxing Public Security Bureau;Jiaxing News Media Center)

机构地区：[1]嘉兴南洋职业技术学院,浙江嘉兴314000 [2]嘉兴市公安局 [3]嘉兴市新闻传媒中心

出　　处：《计算机时代》2025年第2期6-10,共5页Computer Era

基　　金：嘉兴南洋职业技术学院2024年度校级课题“业务逻辑漏洞案例研究”(立项号Qt24001)。

摘　　要：业务逻辑漏洞是在程序的设计与开发过程中由于应用自身的业务流程存在逻辑缺陷而产生的一种隐蔽性极强的系统级漏洞。业务逻辑漏洞可按照业务流程的功能模块进行分类,包括登录认证、密码找回、验证码、业务流程、业务接口调用、业务办理等,常用测试工具有Burp Suite,htpwdScan和JSFinder。本文简要分析了JWT安全威胁,以登录认证模块的逻辑漏洞为示例展示了JWT攻击测试过程,并提出了一些防范与修复建议。Business logic vulnerabilities are highly covert system level vulnerabilities that arise during the design and development process of a program due to logical flaws in the application's own business processes.Business logic vulnerabilities can be classified according to the functional modules of business processes,including login authentication,password retrieval,verification codes,business processes,business interface calls,business processing,etc.Common testing tools include Burp Suite,htpwdScan,and JSFinder.This article briefly analyzes JWT security threats,using logical vulnerabilities in login authentication modules as an example to demonstrate the JWT attack testing process,and proposes some prevention and repair suggestions.

关 键 词：逻辑漏洞 漏洞测试 短信炸弹 垂直越权 漏洞修复 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]