Automatic penetration testing system and method for WEB system

Abstract

The invention provides an automatic permeability test system for a WEB system, comprising three layers: a GUI presentation layer for alternating interface with a user, a logical layer as runs of control core, executing scanning and confidence program of the system and associative functions, and a data layer for storing and maintaining kinds of scan rules and configuration information in a task execution process. The system can automatically carry out a penetrating scan or a conventional scan to a WEB station based on a WEB scan task in the GUI layer, analyzing the scan result combined with the relative inserters, finds the possible security problems of the WEB station, and then generates a detecting report for reporting a formed aggregate risk list. The invention is used to perform an automatic security test, is capable of replacing the present manual security test and permeability test, greatly reduces the cost of software security test in software develop at present, and also greatly increases accuracy of security test.

Description

technical field [0001] The invention relates to a security scanning technology of a WEB system, specifically, an automatic penetration testing system and method for a WEB system, and belongs to the technical field of software security in information security. Background technique [0002] At present, the commonly used web system security scanning tools are briefly listed as follows: [0003] Nikto, as an open source web server scanner, is used to perform comprehensive tests on web servers for multiple items (including 3500 potentially dangerous files / CGIs, over 900 server versions, and version-specific issues on more than 250 servers). Its scan items and plugins are updated frequently and can be updated automatically (if required). However, not every inspection can find security problems, although this is the case in most cases. Some items only provide information type checks, which can be used to find some items that do not have security vulnerabilities, [0004] Paros p...

AI Technical Summary

Problems solved by technology

[0014] However, there are deficiencies in the above method: firstly, the rule base problem of system configuration

However, the rule base of this system configuration has limitations: if the rule base is not designed accurately, the accuracy of the forecast cannot be discussed

If the vulnerability database information is incomplete or cannot be updated in time, it will not only fail to play the role of vulnerability scanning, but also create an illusion for system administrators, making it impossible for them to take effective measures to eliminate potential security risks in a timely manner.

Images