A penetration testing method, device, equipment and readable storage medium

Abstract

The present invention discloses a penetration test method, device, equipment and readable storage medium, the method comprising: obtaining fingerprint features of a target system; inputting the fingerprint features into a trained A3C model to obtain a vulnerability payload matching the fingerprint features; sending the vulnerability payload to the target system and receiving a session fed back by the target system; establishing a target session of meterpreter based on the session, and executing a post-penetration script in the target session to obtain a penetration test detection report. Compared with manually searching for matching vulnerability payloads, the present application uses an A3C model to automatically search for vulnerability payloads matching fingerprint features, which can reduce manpower consumption, consume less time, and effectively improve the efficiency of penetration testing.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a penetration testing method, device, equipment and readable storage medium. Background Art

[0002] Penetration testing is a process in which a trusted third party conducts in-depth vulnerability mining on the target application system and its host server by simulating attack methods and vulnerability mining techniques that hackers may use, discovers vulnerabilities in the system, and verifies the exploitability of the vulnerabilities.

[0003] Penetration testing is divided into seven stages: preliminary interaction, information collection, threat modeling, vulnerability analysis, penetration attack, post-penetration attack, and report generation. Among them, information collection and penetration attack are often the two most time-consuming steps, and are also the two aspects that most need to improve efficiency during the automation implementation process.

[0004] At present, information collection and penetration attacks often require the participation of testers to complete, which is a waste of manpower and time-consuming. In other words, penetration testing is not efficient and can hardly meet actual testing needs.

[0005] In summary, how to effectively improve the efficiency of penetration testing is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0006] The purpose of the present invention is to provide a penetration testing method, device, equipment and readable storage medium to improve the efficiency of penetration testing.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] A penetration testing method, comprising:

[0009] Obtain fingerprint features of the target system;

[0010] Input the fingerprint feature into the trained A3C model to obtain a vulnerability payload matching the fingerprint feature;

[0011] Sending the vulnerability payload to the target system and receiving a session of feedback from the target system;

[0012] A target session of meterpreter is established based on the session, and a post-penetration script is executed in the target session to obtain a detection report of the penetration test.

[0013] Preferably, the step of obtaining fingerprint features of the target system includes:

[0014] Acquire response data of the target system; the response data includes operating system layer response data, port service layer response data and support layer response data;

[0015] The trained naive Bayes classifier is used to extract features from the response data to obtain the fingerprint features; the fingerprint features include operating system layer features, port service layer features and support layer features.

[0016] Preferably, the response data is the operating system layer response data, and obtaining the response data of the target system includes:

[0017] Sending TCP packets and UDP packets to the target system to obtain a response message;

[0018] The TTL, window size, congestion control, and SEQ growth rate of the response message are determined as the operating system layer response data.

[0019] Preferably, the response data is the port service layer response data, and obtaining the response data of the target system includes:

[0020] A connection is established with a port in the target system, and the port service layer response data is obtained using the connection.

[0021] Preferably, the response data is the support layer response data, and obtaining the response data of the target system includes:

[0022] Obtaining web page content of the target system using a headless browser;

[0023] The supporting layer response data is extracted from the webpage content.

[0024] Preferably, the process of training the naive Bayes classifier comprises:

[0025] Obtain response data from multiple systems and mark reference fingerprint features;

[0026] Divide the labeled response data into training samples and test samples;

[0027] Extracting characteristic variables of the training samples;

[0028] Using the characteristic variables, obtaining the correlation between the fingerprint characteristics and the target system;

[0029] Constructing a naive Bayes classifier based on the association relationship, and inputting the test sample into the naive Bayes classifier for feature classification to obtain a test fingerprint feature;

[0030] The test fingerprint feature is compared with the reference fingerprint feature, and the comparison result is used to optimize the naive Bayes classifier to obtain a trained naive Bayes classifier.

[0031] Preferably, the process of training the A3C model includes:

[0032] Build a vulnerability drill system;

[0033] Using the fingerprint feature as an input variable, and sequentially using the payloads in the vulnerability library to perform penetration testing on the vulnerability drill system;

[0034] Using the penetration test results, adjusting the neuron weights in the A3C model;

[0035] When the A3C model reaches a preset convergence condition, the penetration test is stopped to obtain the trained A3C model.

[0036] A penetration testing device, comprising:

[0037] Fingerprint feature acquisition module, used to acquire fingerprint features of the target system;

[0038] A vulnerability payload acquisition module, used to input the fingerprint feature into the trained A3C model to obtain a vulnerability payload matching the fingerprint feature;

[0039] A session acquisition module, used to send the vulnerability payload to the target system and receive a session feedback from the target system;

[0040] The penetration test module is used to establish a target session of meterpreter based on the session, and execute a post-penetration script in the target session to obtain a detection report of the penetration test.

[0041] A penetration testing device, comprising:

[0042] Memory for storing computer programs;

[0043] A processor is used to implement the steps of the above-mentioned penetration testing method when executing the computer program.

[0044] A readable storage medium stores a computer program, which implements the steps of the above-mentioned penetration testing method when executed by a processor.

[0045] The method provided by the embodiment of the present invention is applied to obtain the fingerprint features of the target system; the fingerprint features are input into the trained A3C model to obtain a vulnerability payload matching the fingerprint features; the vulnerability payload is sent to the target system, and a session feedback from the target system is received; a target session of meterpreter is established based on the session, and a post-penetration script is executed in the target session to obtain a detection report of the penetration test.

[0046] In this application, the fingerprint features of the target system are first obtained, and then the fingerprint features are input into the A3C model to obtain a vulnerability payload that matches the fingerprint features. That is, the original manual search for vulnerability payloads is converted into an automated processing of the penetration trajectory stage using the reinforcement learning algorithm of the A3C model, which can greatly save manpower and time. After obtaining the vulnerability payload, the vulnerability payload can be sent to the target system, and then the session feedback from the target system is received. Based on this session, a more powerful and stable meterpreter target session is built, and then the post-penetration script is executed to obtain a detection report for the penetration test. Compared with manually searching for matching vulnerability payloads, this application uses the A3C model to automatically find vulnerability payloads that match fingerprint features, which can reduce manpower consumption, consume less time, and effectively improve the efficiency of penetration testing.

[0047] Correspondingly, the embodiments of the present invention also provide a penetration testing device, equipment and readable storage medium corresponding to the above-mentioned penetration testing method, which have the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 This is a flowchart of a penetration testing method in an embodiment of the present invention;

[0050] Figure 2 A schematic diagram of an A3C model training architecture in an embodiment of the present invention;

[0051] Figure 3 This is a schematic diagram of the structure of a penetration testing device in an embodiment of the present invention;

[0052] Figure 4 This is a schematic diagram of the structure of a penetration testing device in an embodiment of the present invention;

[0053] Figure 5It is a schematic diagram of the specific structure of a penetration testing device in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0055] Please refer to Figure 1 , Figure 1 This is a flow chart of a penetration testing method in an embodiment of the present invention, the method comprising the following steps:

[0056] S101, obtaining fingerprint features of a target system.

[0057] The target system can be any application system that needs to be subjected to penetration testing. The fingerprint feature is a unique feature of the target system, and the target system can be uniquely identified based on the fingerprint feature.

[0058] For example, the fingerprint feature can be at least one of the features of the operating system layer, the port service layer, and the support layer of the target system. The support layer refers to the language, framework, and third-party library used, such as js language, vue, etc.

[0059] In this embodiment, the fingerprint feature in the target system can be acquired in advance and stored in a readable storage medium. In this way, the fingerprint feature can be obtained by directly reading the storage medium.

[0060] Of course, the fingerprint feature can also be obtained by receiving the fingerprint feature sent by other devices or applications.

[0061] Preferably, information can be directly collected from the target system to obtain the fingerprint feature. The specific implementation process includes:

[0062] Step 1: Obtain the response data of the target system; the response data includes the operating system layer response data, the port service layer response data and the support layer response data;

[0063] Step 2: Use the trained naive Bayes classifier to extract features from the response data to obtain fingerprint features; the fingerprint features include operating system layer features, port service layer features and support layer features.

[0064] For ease of description, the above two steps are combined for explanation below.

[0065] Considering that in the relevant penetration testing technology, the information collection phase requires penetration testers to use various collection technologies to try to obtain more information about the target organization's network topology, system configuration, security defense, and port services. However, whether the information collection is sufficient largely determines the success or failure of the penetration test, and accurate information collection results will make the path selection of the penetration test richer.

[0066] Most of the automation technologies for collecting relevant information are based on text matching of the content returned by the scanner to identify the information of the target system. Although this method is simple to implement, it has problems such as low recognition accuracy and insufficient recognition range.

[0067] Based on this, in this embodiment, based on the information collection automation technology, the naive Bayes algorithm in statistical learning is added to optimize the problems of low recognition accuracy and insufficient recognition range. That is, in this embodiment, the relevant response data of the target system can be obtained, and the naive Bayes classifier can be used to extract features from the response data, thereby obtaining the operating system layer features, port service layer features, and support layer features of the target system.

[0068] Different methods are used to obtain the response data corresponding to different layers, which are explained in the following enumeration:

[0069] Case 1: The response data is the response data of the operating system layer. The above step 1 obtains the response data of the target system, including:

[0070] Step 1: Send TCP and UDP packets to the target system and get response messages;

[0071] Step 1: Determine the TTL, window size, congestion control, and SEQ growth rate of the response message as operating system layer response data.

[0072] That is, for the collection of fingerprint information at the operating system layer: by sending TCP packets and UDP packets, a response message can be obtained, thereby determining the TTL (Time To Live, that is, the field specifies the maximum number of network segments allowed to pass before the IP packet is discarded by the router), window size, congestion control, SEQ (sequence number of data segment) growth rate and other information of the response message. Integrating this information can be used as a characteristic variable to identify the operating system.

[0073] Case 2: the response data is the port service layer response data. The above step 1 obtains the response data of the target system, specifically including: establishing a connection with the port in the target system, and using the connection to obtain the port service layer response data.

[0074] That is, for the collection of port service layer information: the object obtains response data by establishing a connection with the specified port. For ports that cannot obtain data immediately after the connection is established, a series of request packets of common applications are sent until the response data is received. Among them, the specified port refers to the default port used by some typical applications or processes, such as port 22 of the ssh service; and, for the possible change of the default port, the packets of common services can be added to the large-scale port scan to detect and collect data.

[0075] Case 3: The response data is the support layer response data. The above step 1 obtains the response data of the target system, including:

[0076] Step 1: Use a headless browser to obtain the web content of the target system;

[0077] Step 2: Extract the support layer response data from the web page content.

[0078] That is, for the service port initially identified as http / https, further support layer information collection can be performed. In order to collect more information, the content of the web page, style sheet, loading script, global variables, cookies (referring to the data stored on the user's local terminal for the website to identify the user's identity and conduct session tracking), response header and other information can be obtained as support layer feature variables by starting a headless browser. Among them, a headless browser refers to a browser without a user graphical interface (GUI).

[0079] The role of the naive Bayes classifier is to perform naive Bayes classification on the return data packet that responds to the sent detection packet, that is, to analyze which feature fingerprint has the highest probability of appearing when the response packet is returned. Accordingly, the process of training the naive Bayes classifier includes:

[0080] Step 1: Obtain response data from multiple systems and mark reference fingerprint features;

[0081] Step 2: Divide the labeled response data into training samples and test samples;

[0082] Step 3: Extract characteristic variables of training samples;

[0083] Step 4: Using feature variables, obtain the correlation between fingerprint features and target systems;

[0084] Step 5: construct a naive Bayes classifier based on the association relationship, and input the test sample into the naive Bayes classifier for feature classification to obtain the test fingerprint feature;

[0085] Step 6: Compare the test fingerprint features with the reference fingerprint features, and use the comparison results to optimize the naive Bayes classifier to obtain a trained naive Bayes classifier.

[0086] For ease of description, the above training processes are combined for illustration below.

[0087] First, big data technology can be used to obtain different types and versions of operating systems, different services, and web systems using different frameworks, and to obtain and mark the response data of these systems.

[0088] Then, the labeled response data are divided into training samples and test samples, feature variables are extracted from the training samples, and then the relationship between these feature data and the target system is learned, and the naive Bayes classifiers at various levels are summarized.

[0089] Finally, the inductive naive Bayes classifier is used to classify the test samples and output fingerprint features. When the accuracy of the naive Bayes classifier reaches the preset threshold, the classifier training can be determined to be completed.

[0090] S102: Input the fingerprint feature into the trained A3C model to obtain a vulnerability payload matching the fingerprint feature.

[0091] Among them, the A3C model, A3C refers to Asynchronous Advantage Actor-Critic.

[0092] By taking the fingerprint feature as input data and then using the A3C model to match and search the input data, we can get the vulnerability payload that matches the fingerprint feature.

[0093] In a specific embodiment of the present invention, please refer to Figure 2 , the process of training the A3C model includes:

[0094] Step 1: Build a vulnerability drill system;

[0095] Step 2: Use the fingerprint feature as an input variable and use the payloads in the vulnerability library to perform penetration testing on the vulnerability drill system in turn;

[0096] Step 3: Use the penetration test results to adjust the neuron weights in the A3C model;

[0097] Step 4: When the A3C model reaches the preset convergence condition, stop the penetration test and obtain the trained A3C model.

[0098] For ease of description, the above four steps are combined for explanation below.

[0099] Since the A3C model is used as a reinforcement learning model, there is no need to prepare a training data set specifically. The process of training the A3C model includes: building a vulnerability drill system (metasploitable) as a training server. A3C uses fingerprint information such as operating system type, operating system version, service software information, etc. as input variables, and tries to penetrate the training server with payloads in the metasploit (an open source security vulnerability detection tool) vulnerability library in turn, and uses the results of penetration as feedback to continuously adjust the weights of neural neurons until a suitable model is finally obtained. Before training, all fingerprint results are known. According to the error comparison between the results obtained after the start of training and the known results, the parameters are adjusted until the result is not much different from the expected result (such as the difference is less than the preset value, or the accuracy reaches the specified ratio).

[0100] The automated penetration attack is to pass the fingerprint feature obtained in step S101 as an input variable into the trained A3C model, and the A3C model outputs the vulnerability payload that best matches the fingerprint feature.

[0101] S103: Send the vulnerability payload to the target system and receive a session feedback from the target system.

[0102] Send the payload to the target system through metasploit to obtain the session.

[0103] S104: Establish a target session of meterpreter based on the session, and execute a post-penetration script in the target session to obtain a detection report of the penetration test.

[0104] On the basis of the acquired session, a more stable and powerful meterpreter session in metasploit is established, and then the pre-defined post-penetration script is automatically executed. The post-penetration script is the content of the project required for the post-penetration test. The post-penetration script can be pre-set according to the user's definition. For the specific content of the post-penetration script, please refer to the relevant post-penetration test plan, which will not be repeated here.

[0105] Among them, Meterpreter is an extension module in the Metasploit framework, which is used as an attack payload after a successful overflow. The attack payload returns a control channel after a successful overflow attack. Using it as an attack payload can obtain a link to a Meterpreter shell of the target system. As a penetration module, the Meterpreter shell has many useful functions, such as adding a user, hiding something, opening a shell, getting a user password, uploading and downloading files from a remote host, running cmd.exe, capturing the screen, getting remote control, capturing keystroke information, clearing applications, displaying the system information of the remote host, and displaying the network interface and IP address of the remote machine. In addition, Meterpreter can evade intrusion detection systems. It hides itself on the remote host without changing the files in the system hard disk, so it is difficult for HIDS (host-based intrusion detection system) to respond to it. In addition, the system time changes when it is running, so it will become very difficult for an experienced person to track it or terminate it.

[0106] Meterpreter can also simplify the task of creating multiple sessions. These sessions can be used for penetration. In the Metasploit Framework, Meterpreter is a post-penetration tool. It is a dynamically extensible Payload that can be extended through the network during operation. This tool is based on the concept of "memory DLL injection". It can create a new process and call the injected DLL to allow the target system to run the injected DLL file. Among them, the communication between the attacker and the Meterpreter in the target device is implemented through the Stager socket. As a post-penetration module, meterpreter has many types, and the commands are composed of core commands and extension library commands, which greatly enriches the attack methods.

[0107] It should be noted that meterpreter will send the second stage code and meterpreter server dll after the vulnerability is successfully exploited, so there is often no executable command when the network is unstable, or the command is missing after the session is established and help is executed. This situation often occurs when connecting to a VPN and using psexec and bind_tcp in the intranet.

[0108] Preferably, for the convenience of user viewing, the test report can also be output in PDF or Html format.

[0109] The method provided by the embodiment of the present invention is applied to obtain the fingerprint features of the target system; the fingerprint features are input into the trained A3C model to obtain a vulnerability payload matching the fingerprint features; the vulnerability payload is sent to the target system, and a session feedback from the target system is received; a target session of meterpreter is established based on the session, and a post-penetration script is executed in the target session to obtain a detection report of the penetration test.

[0110] In this application, the fingerprint features of the target system are first obtained, and then the fingerprint features are input into the A3C model to obtain a vulnerability payload that matches the fingerprint features. That is, the original manual search for vulnerability payloads is converted into an automated processing of the penetration trajectory stage using the reinforcement learning algorithm of the A3C model, which can greatly save manpower and time. After obtaining the vulnerability payload, the vulnerability payload can be sent to the target system, and then the session feedback from the target system is received. Based on this session, a more powerful and stable meterpreter target session is built, and then the post-penetration script is executed to obtain a detection report for the penetration test. Compared with manually searching for matching vulnerability payloads, this application uses the A3C model to automatically find vulnerability payloads that match fingerprint features, which can reduce manpower consumption, consume less time, and effectively improve the efficiency of penetration testing.

[0111] Corresponding to the above method embodiment, the embodiment of the present invention further provides a penetration testing device. The penetration testing device described below and the penetration testing method described above can refer to each other.

[0112] See also Figure 3 As shown, the device includes the following modules:

[0113] Fingerprint feature acquisition module 101, used to acquire fingerprint features of the target system;

[0114] The vulnerability payload acquisition module 102 is used to input the fingerprint feature into the trained A3C model to obtain the vulnerability payload matching the fingerprint feature;

[0115] The session acquisition module 103 is used to send the vulnerability payload to the target system and receive the session feedback from the target system;

[0116] The penetration test module 104 is used to establish a target session of meterpreter based on the session, and execute a post-penetration script in the target session to obtain a detection report of the penetration test.

[0117] The device provided by the embodiment of the present invention is used to obtain the fingerprint features of the target system; the fingerprint features are input into the trained A3C model to obtain a vulnerability payload matching the fingerprint features; the vulnerability payload is sent to the target system, and a session fed back by the target system is received; a target session of meterpreter is established based on the session, and a post-penetration script is executed in the target session to obtain a detection report of the penetration test.

[0118] In this application, the fingerprint features of the target system are first obtained, and then the fingerprint features are input into the A3C model to obtain a vulnerability payload that matches the fingerprint features. That is, the original manual search for vulnerability payloads is converted into an automated processing of the penetration trajectory stage using the reinforcement learning algorithm of the A3C model, which can greatly save manpower and time. After obtaining the vulnerability payload, the vulnerability payload can be sent to the target system, and then the session feedback from the target system is received. Based on this session, a more powerful and stable meterpreter target session is built, and then the post-penetration script is executed to obtain a detection report for the penetration test. Compared with manually searching for matching vulnerability payloads, this application uses the A3C model to automatically find vulnerability payloads that match fingerprint features, which can reduce manpower consumption, consume less time, and effectively improve the efficiency of penetration testing.

[0119] In a specific embodiment of the present invention, the fingerprint feature acquisition module 101 includes:

[0120] A response data acquisition unit is used to acquire the response data of the target system; the response data includes operating system layer response data, port service layer response data and support layer response data;

[0121] The fingerprint feature extraction unit is used to extract features from the response data using the trained naive Bayes classifier to obtain fingerprint features; the fingerprint features include operating system layer features, port service layer features and support layer features.

[0122] In a specific embodiment of the present invention, the response data is operating system layer response data, and the response data acquisition unit is specifically used to send TCP packets and UDP packets to the target system to obtain a response message; the TTL, window size, congestion control, and SEQ growth rate of the response message are determined as operating system layer response data.

[0123] In a specific implementation of the present invention, the response data is port service layer response data, and the response data acquisition unit is specifically used to establish a connection with a port in the target system and acquire the port service layer response data using the connection.

[0124] In a specific implementation of the present invention, the response data is support layer response data, and the response data acquisition unit is specifically used to acquire web page content of the target system using a headless browser; and extract the support layer response data from the web page content.

[0125] In a specific embodiment of the present invention, a classifier training module is used to obtain response data of multiple systems and mark reference fingerprint features; divide the marked response data into training samples and test samples; extract feature variables of the training samples; use the feature variables to obtain the association between the fingerprint features and the target system; construct a naive Bayes classifier based on the association relationship, and input the test samples into the naive Bayes classifier for feature classification to obtain test fingerprint features; compare the test fingerprint features with the reference fingerprint features, and use the comparison results to optimize the naive Bayes classifier to obtain a trained naive Bayes classifier.

[0126] In a specific embodiment of the present invention, an A3C model training module is used to build a vulnerability drill system; the fingerprint feature is used as an input variable, and the vulnerability drill system is penetrated and tested in sequence using the payloads in the vulnerability library; the neuron weights in the A3C model are adjusted using the penetration test results; when the A3C model reaches a preset convergence condition, the penetration test is stopped to obtain a trained A3C model.

[0127] In a specific embodiment of the present invention, it also includes:

[0128] The report output module is used to output the test report in PDF or Html format.

[0129] Corresponding to the above method embodiment, an embodiment of the present invention further provides a penetration testing device. The penetration testing device described below and the penetration testing method described above can refer to each other.

[0130] See also Figure 4 As shown, the penetration testing equipment includes:

[0131] A memory 332, for storing computer programs;

[0132] The processor 322 is used to implement the steps of the penetration testing method of the above method embodiment when executing the computer program.

[0133] For details, please refer to Figure 5 , Figure 5A specific structural diagram of a penetration testing device provided for this embodiment, the penetration testing device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer applications 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the central processing unit 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the penetration testing device 301.

[0134] The penetration testing device 301 may also include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0135] The steps in the penetration testing method described above can be implemented by the structure of the penetration testing equipment.

[0136] Corresponding to the above method embodiment, an embodiment of the present invention further provides a readable storage medium. The readable storage medium described below and the penetration testing method described above can refer to each other.

[0137] A readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the penetration testing method of the above method embodiment.

[0138] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0139] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A penetration testing method, characterized in that: include: Obtain fingerprint features of the target system; Input the fingerprint feature into the trained A3C model to obtain a vulnerability payload matching the fingerprint feature; Sending the vulnerability payload to the target system through the vulnerability drill system, and receiving a session of feedback from the target system; A target session of meterpreter is established based on the session, and a post-penetration script is executed in the target session to obtain a detection report of the penetration test; Wherein, the step of obtaining the fingerprint features of the target system includes: Acquire response data of the target system; the response data includes operating system layer response data, port service layer response data and support layer response data; The trained naive Bayes classifier is used to extract features from the response data to obtain the fingerprint features; the fingerprint features include operating system layer features, port service layer features and support layer features.

2. The penetration testing method according to claim 1, characterized in that: The response data is the operating system layer response data, and obtaining the response data of the target system includes: Sending TCP packets and UDP packets to the target system to obtain a response message; The TTL, window size, congestion control, and SEQ growth rate of the response message are determined as the operating system layer response data.

3. The penetration testing method according to claim 1, characterized in that: The response data is the port service layer response data, and obtaining the response data of the target system includes: A connection is established with a port in the target system, and the port service layer response data is obtained using the connection.

4. The penetration testing method according to claim 1, characterized in that: The response data is the support layer response data, and obtaining the response data of the target system includes: Obtaining web page content of the target system using a headless browser; The supporting layer response data is extracted from the webpage content.

5. The penetration testing method according to any one of claims 1 to 4, characterized in that: The process of training the naive Bayes classifier includes: Obtain response data from multiple systems and mark reference fingerprint features; Divide the labeled response data into training samples and test samples; Extracting characteristic variables of the training samples; Using the characteristic variables, obtaining the correlation between the fingerprint characteristics and the target system; Constructing a naive Bayes classifier based on the association relationship, and inputting the test sample into the naive Bayes classifier for feature classification to obtain a test fingerprint feature; The test fingerprint feature is compared with the reference fingerprint feature, and the comparison result is used to optimize the naive Bayes classifier to obtain a trained naive Bayes classifier.

6. The penetration testing method according to any one of claims 1 to 4, characterized in that: The process of training the A3C model includes: Build a vulnerability drill system; Using the fingerprint feature as an input variable, and sequentially using the payloads in the vulnerability library to perform penetration testing on the vulnerability drill system; Using the penetration test results, adjusting the neuron weights in the A3C model; When the A3C model reaches a preset convergence condition, the penetration test is stopped to obtain the trained A3C model.

7. A penetration testing device, characterized in that: include: Fingerprint feature acquisition module, used to acquire fingerprint features of the target system; A vulnerability payload acquisition module, used to input the fingerprint feature into the trained A3C model to obtain a vulnerability payload matching the fingerprint feature; A session acquisition module, used to send the vulnerability payload to the target system through the vulnerability drill system, and receive a session feedback from the target system; A penetration test module, used to establish a target session of meterpreter based on the session, and execute a post-penetration script in the target session to obtain a detection report of the penetration test; Among them, the fingerprint feature acquisition module is specifically used to obtain the response data of the target system; the response data includes operating system layer response data, port service layer response data and support layer response data; using the trained naive Bayes classifier, the response data is subjected to feature extraction to obtain the fingerprint feature; the fingerprint feature includes operating system layer feature, port service layer feature and support layer feature.

8. A penetration testing device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the penetration testing method as claimed in any one of claims 1 to 6 when executing the computer program.

9. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the penetration testing method according to any one of claims 1 to 6.

Images