Automatic penetration testing method and system

Abstract

The invention discloses an automated penetration testing method and system, including an automatic penetration method and a manual penetration method; in the manual penetration method, it is necessary to select a penetration mode for automatic penetration; the penetration mode includes loophole penetration, brute force cracking, and WEB penetration and social engineering tests. The present invention has the advantages of loophole hazard display, comprehensive coverage inspection, and automatic penetration. By utilizing the discovered loopholes, the present invention displays the hazards caused by the loopholes, deters development and operation and maintenance personnel, forms indirect security awareness education for them, and improves personnel security. Security awareness; comprehensive coverage inspection, through security inspection of networks, applications, and personnel; through automated penetration, improve the efficiency and comprehensiveness of security personnel inspections.

Description

technical field [0001] The invention belongs to the field of information, and in particular relates to an automatic penetration testing method and system. Background technique [0002] Glossary: [0003] SMTP (SimpleMailTransferProtocol) is the Simple Mail Transfer Protocol. [0004] CMS is the abbreviation of Content Management System, which means "content management system". [0005] APT (Advanced Persistent Threat): advanced persistent threat. [0006] Domestic network security scanners are all inspection tools, which can only find vulnerabilities, without in-depth verification and utilization of vulnerabilities, there are many false positives, and they cannot intuitively reflect which vulnerabilities are real high-risk vulnerabilities that will be directly exploited by hackers. Often after the scan is completed, people need to manually verify the scan results, and if they go deeper, they will use vulnerabilities to conduct penetration tests to check the harm they can ...

AI Technical Summary

Problems solved by technology

Since it is only a simple detection without in-depth verification, there will be many false positives, causing repair problems

[0011] 2: It only lists the vulnerabilities and risks of vulnerabilities. It cannot show the real danger points and the harm caused by the vulnerabilities, and cannot form a positive effect. Sometimes the actual system maintenance personnel will be disgusted because too many vulnerabilities are found.

[0016] 2: Manual penetration testing relies too much on the experience of technicians, resulting in incomplete coverage of penetration testing

Images