Agent-based vulnerability scanning method

Abstract

The invention discloses a vulnerability scanning method based on agency, which comprises the following steps: S1), establishing an IP agency node, and configuring agency authorization and a CA certificate; S2), after the configuration is completed, accessing a target website or a mobile app, and responding to the request; S3), formatting the information of the user access flow by the agent node, and sending the formatted information to a Redis queue; S4), monitoring the redis queue by adopting distributed vulnerability scanning nodes, consuming if a task exists, and performing vulnerability scanning on a target in the task; and S5), if the vulnerability scanning is matched with the vulnerability rule, inputting the vulnerability information into the database. According to the agent-based vulnerability scanning method provided by the invention, the problem that a traditional vulnerability scanning tool cannot bypass blind spots of man-machine and short message verification can be solved, so that the situations of full-flow and full-terminal scanning of services and missing scanning reduction are achieved, the scanning efficiency is improved, the vulnerability discovery difficulty isreduced, and everyone can carry out security testing.

Description

technical field [0001] The invention relates to a vulnerability scanning method, in particular to an agent-based vulnerability scanning method, which belongs to the field of network security. Background technique [0002] With the rapid development of the Internet, security incidents have occurred frequently in recent years, and security vulnerabilities are often reported by the media. Among various vulnerabilities, the most common and common one is application security vulnerabilities. Therefore, how to discover these security vulnerabilities is a big test for security engineers in enterprises. The current common practice is to scan websites through automated vulnerability scanning tools, but traditional vulnerability scanning tools generally cannot scan mobile apps, IOT devices, etc., and cannot bypass man-machine verification and SMS verification. Therefore, the login status information cannot be obtained, and most of the links will be missed, resulting in security holes...

AI Technical Summary

Problems solved by technology

The current common practice is to scan websites through automated vulnerability scanning tools, but traditional vulnerability scanning tools generally cannot scan mobile apps, IOT devices, etc., and cannot bypass man-machine verification and SMS verification. Therefore, the login status information cannot be obtained, and most of the links will be missed, resulting in security holes that cannot be found

Images