Penetration test method and device

Abstract

The embodiment of the invention provides a penetration test method and device. According to the invention, a test terminal generates an attack chain, wherein the attack chain includes more than one attack surface to be used, and each attack surface to be used includes more than one available attack plug-in; the available attack plug-ins in the attack chain are loaded; the available attack plug-insin each attack surface to be used are sequentially put into operation according to the priority of each attack surface to be used in the attack chain until a penetration target specified by the useris reached; and the obtained penetration test result is displayed. According to the design, the automatic penetration test can be realized, and the time and labor cost required by the penetration testcan be reduced.

Description

technical field [0001] The present application relates to the technical field of network security, in particular, to a penetration testing method and device. Background technique [0002] With the development of Internet technology, the application of the network is becoming more and more extensive, and the network security is becoming more and more important. At present, the best way to ensure network security is penetration testing, that is, to let professional network security personnel do security testing and evaluation. [0003] However, in related technologies, the penetration testing process is discontinuous. After completing the test of an attack point, it is necessary to manually verify whether it is successful. If it is successful, it can be verified at a deeper attack level. If it is unsuccessful, it needs to go back and consider other methods. Conducting penetration testing, the process tends to consume a lot of time and can interrupt the train of thought of the...

AI Technical Summary

Problems solved by technology

[0003] However, in related technologies, the penetration testing process is discontinuous. After completing the test of an attack point, it is necessary to manually verify whether it is successful. If it is successful, it can be verified at a deeper attack level. If it is unsuccessful, it needs to return to consider other methods. Conduct penetration testing, which tends to consume a lot of time and can interrupt the penetrator's train of thought

It can be seen that the implementation steps of penetration testing in related technologies are too fragmented and the labor cost is too high

Images