A method for checking weak application passwords, a host, a control terminal, a system and a medium

Abstract

The present application discloses a method for checking weak passwords for applications, a host, a control terminal, a system and a storage medium, including at least one host with a host agent installed, obtaining its own weak password application process list and weak password monitoring IP port list; the control terminal configures each host by itself through a real-time updated cracking program and a real-time updated password dictionary, and sends them to the corresponding host; the host generates the specified protocol information of the weak password application process corresponding to each weak password monitoring IP port using the real-time updated cracking program according to the real-time updated password dictionary, the user account of the host and the weak password monitoring IP port list; the host uses the specified protocol information to perform password verification on the weak password monitoring IP port and the corresponding weak password application process, and uploads the successful verification result to the control terminal. Through the application of this application, a large number of hosts can be checked in parallel, without relying on an external network, occupying less resources and having high verification efficiency.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to an application weak password verification method, a host, a control terminal, a system and a storage medium. Background Art

[0002] When using computer applications, users usually need to enter their username and password on the application's login page before they can enter the corresponding operation. The login password is the key line of defense against hacker intrusion. Therefore, it is necessary to regularly check the login password to promptly discover and eliminate weak passwords that are less secure and easily cracked by hackers, such as 123456.

[0003] In the prior art, to crack a weak application password, you first need to obtain the listening IP port number corresponding to the application process, complete the port connection, use the built-in password dictionary or brute force to verify the password, and manually execute the cracking script in the Internet environment according to the obtained port number, and obtain the execution result once. However, this method is easily affected by the external network and causes missed reports. Moreover, when the cracker executes the cracking program to crack, the cracking efficiency is low, the server resources are high, and it does not have the ability to crack a large number of machines at the same time. At the same time, it does not have the function of automatically cracking a large number of hosts in real time after the cracking program or password dictionary is updated. Summary of the invention

[0004] The present application provides a method for verifying weak application passwords, which can verify massive hosts in parallel, does not rely on external networks, occupies few resources, and has high verification efficiency.

[0005] In order to solve the above problems, a technical solution adopted by the present application is: to provide a method for checking weak application passwords, the method comprising:

[0006] At least one host with a host agent program installed obtains its own weak password application process list and weak password monitoring IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port;

[0007] The control end configures the real-time updated cracking program and the real-time updated password dictionary for each host by itself, and sends the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host;

[0008] The host generates the specified protocol information of the weak password application process corresponding to each weak password listening IP port using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the weak password listening IP port list;

[0009] The host uses the specified protocol information to perform password verification on the weak password listening IP port and the corresponding weak password application process, and uploads the successful verification result to the control end.

[0010] Another technical solution adopted by the present application is: providing a host for applying weak password verification, the host comprising:

[0011] The process and port acquisition module is used to obtain the host's own weak password application process list and weak password monitoring IP port list;

[0012] A receiving and updating module, used for receiving, by the host, a password dictionary and a cracking program updated in real time from the control terminal;

[0013] The designated protocol acquisition module is used for the host to generate the designated protocol information of the weak password application process corresponding to each weak password monitoring IP port by using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the list of weak password monitoring IP ports;

[0014] The verification and reporting module is used by the host to use the specified protocol information to perform password verification on each weak password listening IP port and the corresponding weak password application process, and upload the successful verification result to the control end.

[0015] Another technical solution adopted by the present application is: providing a control terminal for applying weak password verification, the control terminal comprising:

[0016] A configuration distribution module, used to configure each host's real-time updated cracking program and real-time updated password dictionary, and distribute the real-time updated cracking program and real-time updated password dictionary corresponding to each host to the corresponding host;

[0017] The receiving management module is used to receive the successful verification result uploaded by the host.

[0018] Another technical solution adopted by the present application is to provide a system for checking weak application passwords, the system comprising:

[0019] The control end configures the real-time updated cracking program and the real-time updated password dictionary for each host, and sends the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host; and

[0020] at least one host, each of which has a host agent installed;

[0021] The host obtains its own weak password application process list and weak password monitoring IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port;

[0022] The host generates the specified protocol information of the weak password application process corresponding to each weak password listening IP port using the real-time updated cracking program according to the real-time updated password dictionary, the host user account and the weak password listening IP port list; and,

[0023] The host uses the specified protocol information to perform password verification on the weak password listening IP port and the corresponding weak password application process, and uploads the successful verification result to the control end.

[0024] In another technical solution of the present application, a computer-readable storage medium is provided, which stores computer instructions, wherein the computer instructions are operated to execute the application weak password verification method in the solution.

[0025] The beneficial effects that can be achieved by the technical solution of the present application are: the present application proposes a method, host, control terminal, system and storage medium for applying weak password verification, which can verify massive hosts in parallel, does not rely on external networks, occupies less resources and has high verification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0027] Figure 1 A flowchart of a method for checking weak application passwords provided in Example 1 of the present application;

[0028] Figure 2 A flowchart of a method for checking weak application passwords provided in Example 2 of the present application;

[0029] Figure 3 A schematic diagram of the host structure for applying weak password verification provided in Example 3 of the present application;

[0030] Figure 4 A schematic diagram of the control terminal structure for applying weak password verification provided in the fourth embodiment of the present application;

[0031] Figure 5 This is a structural diagram of the application weak password verification system provided in Example 5 of the present application.

[0032] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0033] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0034] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0035] The following is a detailed description of how the technical solution of the present application solves the above technical problems with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0036] Embodiment 1

[0037] Figure 1 This is a flow chart of the weak password verification method for the application provided in Example 1 of the present application, such as Figure 1 As shown, the method in this embodiment may include:

[0038] Process S101: at least one host with a host agent program installed obtains its own weak password application process list and weak password monitoring IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port;

[0039] Process S102: The control end configures the real-time updated cracking program and the real-time updated password dictionary for each host, and sends the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host;

[0040] Process S103: The host generates the specified protocol information of the weak password application process corresponding to each weak password listening IP port using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the list of weak password listening IP ports;

[0041] Process S104: The host uses the specified protocol information to perform password verification on the weak password monitoring IP port and the corresponding weak password application process, and uploads the successful verification result to the control end.

[0042] Through the application of the weak password verification method applied in this application, massive hosts can be verified in parallel, without relying on external networks, occupying less resources and with high verification efficiency.

[0043] Embodiment 2

[0044] Figure 2 This is a flow chart of the weak password verification method for the application provided in Example 2 of the present application, such as Figure 2 As shown, the method in this embodiment may include:

[0045] Referring to process S101 in the first embodiment: at least one host with a host agent program installed obtains its own weak password application process list and weak password monitoring IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port. This process narrows the detection scope to facilitate further password verification of weak password application processes.

[0046] Optionally, in the second embodiment, process S101 may include the host calling its own application program interface and reading the application program interface to obtain the host's application process list and monitoring IP port list. This process is to avoid the environment dependence and performance problems caused by using a third-party library.

[0047] Optionally, the process of the host calling its own application program interface and reading the application program interface to obtain the application process list and the listening IP port list includes the host agent program using a C language binary program to read the application program interface to obtain the application process list and the listening IP port list. This process is to avoid the environment dependence and performance problems caused by the use of third-party libraries.

[0048] Specifically, the host calls its own application program interface and uses a C language binary program to read the application program interface to obtain an application process list and a listening IP port list. For example, when the host uses a Linux server, a high-performance C language binary program is used to directly read the application process list and the listening IP port list under / proc / net / under the Linux server, avoiding the use of third-party modules, such as the Python module using Psutil to obtain the application process list and the listening IP port list, which may cause poor performance and occupy resources.

[0049] Specifically, the host screens the application process list to obtain a weak password application process list, and obtains a weak password listening IP port list corresponding to the weak password application process list according to the weak password application process list and the listening IP port list, for example, filtering out database application processes related to weak passwords from the application process list: ftp, mysql, telnet, postgres, mongodb, memcached, redis, elasticsearch, etc. Then, according to the filtered weak password application process list, a weak password listening IP port list is obtained, and the weak password listening IP port list includes: 21 (corresponding to the default listening port of the ftp application), 3306 (corresponding to the default listening port of the mysql application), 23 (corresponding to the default listening port of the telnet application), 5432 (corresponding to the default listening port of the postgres application), 27017 (corresponding to the default listening port of the mongodb application), 11211 (corresponding to the default listening port of the memcached application), 6379 (corresponding to the default listening port of the redis application), 9200 (corresponding to the default listening port of the elasticsearch application), etc.

[0050] Referring to process S102 in the first embodiment: the control end configures the real-time updated cracking program and the real-time updated password dictionary of each host, and sends the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host. This process facilitates further use of the real-time updated cracking program and the real-time updated password dictionary to generate the specified protocol information.

[0051] Among them, the process in which the control end configures each host's cracking program and password dictionary that are updated in real time can be that the control end updates its own configuration based on external information. The self-configuration update here is its own function, and the external information can be the update information imported into the control end by professionals, and this application does not limit it.

[0052] Optionally, in the second embodiment, process S102 may include: the control end receives the current information reported by each host, the current information includes the hash value of the current password dictionary and the current cracking program of the host, and the host account of the host; the control end searches for the password dictionary and the hash value of the cracking program corresponding to the host account from its program memory, and compares it with the hash value of the current password dictionary and the current cracking program reported by the host. If they are not equal, the password dictionary and the cracking program corresponding to the host account in the control end are determined as the password dictionary and the cracking program updated in real time, and the control end sends the cracking program and the password dictionary updated in real time to the corresponding host. This process facilitates further use of the cracking program and the password dictionary updated in real time to generate the specified protocol information.

[0053] Specifically, the control end can establish a TCP long connection with the host, where the TCP long connection is TCP keepalive. The purpose of this connection method is to maintain the connection between the control end and the host end, and one party will send a heartbeat packet to the other party from time to time. The host calculates the hash value of the current password dictionary and the current cracking program. The current password dictionary and the current cracking program here are sent down by the control end before. At this time, they are still the password dictionary and the cracking program that have not been updated. The host can package the hash value of the current password dictionary and the current cracking program and the host account into a data packet, that is, the current information. The current information (data packet) is uploaded to the control end. After the control end receives the current information (data packet), it parses the current information (data packet) to obtain the host account, current password dictionary and hash value of the current cracking program reported to the host. The host account is searched in the hash table of the program memory of the control end. If the host account is found, it means that this host is not reported for the first time, and the hash values ​​of the password dictionary and the cracking program corresponding to the host account in the program memory of the control end need to be compared with the hash values ​​of the current password dictionary and the current cracking program reported by the host. If they are not equal, the password dictionary and the cracking program corresponding to the host account in the program memory of the control end are determined to be the cracking program and the password dictionary updated in real time for the host account, and the control end sends the cracking program and the password dictionary updated in real time to the host corresponding to the host account, and automatically uses the cracking program and the password dictionary updated in real time as the current password dictionary and the current cracking program of the host; if the hash values ​​of the current password dictionary and the current cracking program reported by the host are equal to the hash values ​​of the password dictionary and the cracking program corresponding to the host account in the program memory of the control end, it means that the cracking program and the password dictionary have not been updated, and the control end does not need to send them, then the current password dictionary and the current cracking program of the host are still the original password dictionary and the cracking program.

[0054] Specifically, the process in which the control terminal sends the real-time updated cracking program and the real-time updated password dictionary to the corresponding host includes first sending FILE_UPDATE_HEADER (file update header), then sending the real-time updated cracking program and the real-time updated password dictionary, and finally sending FILE_CLOSE_HEADER (file update tail). When the host receives the message sent by the control terminal, it parses the message. If the message header is FILE_UPDATE_HEADER, it means that the host needs to update the local cracking program and password dictionary, create a new file locally, and update the received content. If the message header is FILE_CLOSE_HEADER, it means that the file reception from the control terminal is completed, and the host has obtained the real-time updated cracking program and the real-time updated password dictionary sent by the control terminal.

[0055] Optionally, in the second embodiment, the weak password verification method of the present application also includes that the control end searches for the password dictionary and the hash value of the cracking program corresponding to the host account from its program memory. If the host account does not exist in the program memory, the current password dictionary and the hash value of the current cracking program reported by the host, as well as the host account, are added to the program memory. This process creates a new host in the program memory of the control end for the host that has not been reported, so that the next time the host reports, the corresponding host account, as well as the password dictionary and the hash value of the cracking program corresponding to the host account can be found in the control end, which is convenient for further comparison, thereby updating the password dictionary and the cracking program of the host in real time.

[0056] Specifically, the host calculates the hash value of the current password dictionary and the current cracking program. The current password dictionary and the current cracking program here are sent down by the control end before, and at this time they are still the password dictionary and the cracking program that have not been updated. The host can package the hash value of the current password dictionary and the current cracking program and the host account into a data packet and upload it to the control end. After the control end receives the data packet, it parses the data packet to obtain the host account of the reporting host, the current password dictionary and the hash value of the current cracking program. The host account is searched in the hash table of the control end program memory. If the host account is not found, it means that the host is reporting for the first time. The hash value and host account of the current password dictionary and the current cracking program of the host are added to the control end program memory hash table in the Key-Vaule way. The control end can configure the cracking program and password dictionary of the host in the program memory by itself. The next time the host reports the hash value of the current password dictionary and the current cracking program, as well as the host account to the control end, the control end searches for the host account of the host from its program memory. Since it has been added to the program memory hash table before, the host account of the host can be found, and the hash values ​​of the password dictionary and cracking program corresponding to the host in the program memory hash table are compared with the hash values ​​of the current password dictionary and the current cracking program reported by the host. If they are not equal, the password dictionary and cracking program corresponding to the host account in the program memory are determined to be the cracking program and the password dictionary that have been updated in real time, and the control end sends the cracking program and the password dictionary that have been updated in real time to the host.

[0057] Referring to process S103 in the first embodiment: the host generates the specified protocol information of the weak password application process corresponding to each weak password listening IP port using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the weak password listening IP port list. This process facilitates the host to further use the specified protocol information to perform password verification on the weak password listening IP port and the corresponding weak password application process.

[0058] Optionally, in the second embodiment, process S103 may include that the host establishes a connection between each weak password listening IP port and its corresponding weak password application process; the host uses a cracking program updated in real time to splice the weak password listening IP port number, the corresponding weak password application process name, the user account, and the password dictionary updated in real time to generate the specified protocol information of the weak password application process corresponding to each weak password listening IP port. This process facilitates the host to further use the specified protocol information to perform password verification on the weak password listening IP port and the corresponding weak password application process.

[0059] Specifically, for example, the host establishes a connection between the mysql application process and its corresponding port number 3306, and uses a cracking program that is updated in real time to splice the port number 3306, the mysql application process, the user account on the host, and the password dictionary that is updated in real time to obtain the specified protocol information corresponding to the mysql application process. The specified protocol information here actually includes multiple pieces, because the account and password key-value pairs will be arranged and combined during the splicing process, for example: Admin and 123456, Admin and 111111, user and 123456, user and 111111, etc., so it includes a variety of situations.

[0060] Referring to process S104 in the first embodiment: the host uses the specified protocol information to perform password verification on the weak password monitoring IP port and the corresponding weak password application process, and uploads the successful verification result to the control end.

[0061] Specifically, in Example 2, the host sends the specified protocol information to the corresponding weak password listening IP port, for example, sends one of the multiple specified protocol information corresponding to the mysql application process, such as 3306+mysql+Admin+123456, to the 3306 port. If 3306+mysql+Admin+123456 fails to be cracked, it is judged that the return information of the 3306 port is a verification failure, then 3306+mysql+Admin+111111 is sent to the 3306 port. If 3306+mysql+Admin+111111 still fails to be cracked, it is judged that the return information of the 3306 port is a verification failure, then 3306+mysql+user+123456 is continued to be sent to the 3306 port. If 3306+mysql+user+123456 is cracked successfully, it is judged that the return information of the 3306 port is a verification success. If the cracking of 3306+mysql+user+123456 fails, it will continue to traverse the multiple specified protocol information corresponding to the mysql application process until the cracking is successful or until the last one fails. The host receives the return information of the weak password monitoring IP port, which is the result of the password verification of the corresponding weak password monitoring IP port and weak password application process, including successful verification and failed verification; the return information is judged to obtain the result of successful password verification, and the successful verification result is uploaded to the control end.

[0062] Preferably, the process of uploading the successful verification result to the control end includes concatenating the successfully verified weak password application process name, weak password monitoring IP port number, user account and password into a string. For example, if the mysql application process can be successfully cracked using the account Admin and the password 123456, the password 123456, the application mysql, the host account 001 and the user account Admin are concatenated into a json string as shown below:

[0063] '{"passwd":"123456","application":"mysql","agent_id":"001","user":"admin"}

[0064] Uploading the json string to the control end facilitates the centralized control of the successful verification results, thereby further improving the security level of the host system, reducing the risk of the host being hacked by external hackers, and effectively ensuring system and data security.

[0065] Optionally, in the second embodiment, the weak password verification method of the present application also includes that the host monitors its own CPU occupancy and memory usage in real time; if the CPU occupancy is greater than the CPU occupancy threshold and the memory usage is greater than the memory usage threshold, the password verification work of the host stops running; if the CPU occupancy is not greater than the CPU occupancy threshold and / or the memory usage is not greater than the memory usage threshold, the password verification work of the host starts running. This process is to avoid the situation where the memory usage is too high or the CPU occupancy is too high due to the password verification work, which affects the host's own business.

[0066] Specifically, for example, the CPU usage threshold is 10%, and the memory usage threshold is 10%. When the CPU usage is not greater than 10% and / or the memory usage is not greater than 10%, the host's password verification work starts automatically; when the CPU usage is greater than 10% and the memory usage is greater than 10%, the host's password verification work stops automatically.

[0067] Embodiment 3

[0068] Figure 3 A schematic diagram of the host structure for applying weak password verification provided in Example 3 of the present application is shown in FIG. Figure 3 As shown, the host in this embodiment may include:

[0069] Module 301: a process and port acquisition module, configured to acquire a weak password application process list and a weak password monitoring IP port list from the host, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port;

[0070] Module 302: receiving update module, used for receiving the real-time updated password dictionary and the real-time updated cracking program sent by the control terminal from the host;

[0071] Module 303: a designated protocol acquisition module, configured to generate designated protocol information of a weak password application process corresponding to each weak password monitoring IP port by the host according to the real-time updated password dictionary, the host user account and the weak password monitoring IP port list, using the real-time updated cracking program;

[0072] Module 304: a verification and reporting module, which is used by the host to use the specified protocol information to perform password verification on each weak password monitoring IP port and the corresponding weak password application process, and upload the successful verification result to the control end.

[0073] Optionally, module 301 is specifically used for:

[0074] The host calls its own application program interface and reads the application program interface to obtain an application process list and a listening IP port list; the host filters the application process list to obtain a weak password application process list, and obtains a weak password listening IP port list corresponding to the weak password application process list based on the weak password application process list and the listening IP port list.

[0075] The host may call its own application program interface and read the application program interface to obtain the application process list and the listening IP port list. Alternatively, the host may use a C language binary program to read the application program interface to obtain the application process list and the listening IP port list.

[0076] Optionally, module 303 is specifically used for:

[0077] The host establishes a connection between each weak password listening IP port and its corresponding weak password application process; the host uses a cracking program that is updated in real time to splice the weak password listening IP port number, the corresponding weak password application process name, the user account, and the password dictionary that is updated in real time to generate the specified protocol information of the weak password application process corresponding to each weak password listening IP port.

[0078] Optionally, in the third embodiment, the host for applying weak password verification of the present application may further include a load detection module 305, which is specifically used to:

[0079] The host monitors its own CPU usage and memory usage in real time; if the CPU usage is greater than the CPU usage threshold and the memory usage is greater than the memory usage threshold, the host's password verification work will automatically stop running; if the CPU usage is not greater than the CPU usage threshold and / or the memory usage is not greater than the memory usage threshold, the host's password verification work will automatically start running.

[0080] Embodiment 4

[0081] Figure 4 A schematic diagram of the control terminal structure for applying weak password verification provided in the fourth embodiment of the present application is as follows: Figure 4 As shown, the control end in this embodiment may include:

[0082] Module 401: a configuration and delivery module, used to configure the real-time updated cracking program and the real-time updated password dictionary of each host, and deliver the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host;

[0083] Module 402: A receiving management module, used to receive a successful verification result uploaded by a host.

[0084] Optionally, in the fourth embodiment, the control terminal for applying weak password verification of the present application may further include an account creation module 403, which is specifically used to:

[0085] The control end searches for the password dictionary and the hash value of the cracking program corresponding to the host account in its program memory. If the host account does not exist in the program memory, the current password dictionary and the hash value of the current cracking program reported by the host, as well as the host account, are added to the program memory.

[0086] Embodiment 5

[0087] Figure 5 The structural diagram of the weak password verification system for applications provided in the fifth embodiment of the present application is as follows: Figure 5 As shown, the system in this embodiment may include:

[0088] The control end configures the real-time updated cracking program and the real-time updated password dictionary for each host, and sends the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host; and

[0089] at least one host, each of which has a host agent installed;

[0090] The host obtains its own weak password application process list and weak password monitoring IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port;

[0091] The host generates the specified protocol information of the weak password application process corresponding to each weak password listening IP port using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the list of weak password listening IP ports; and

[0092] The host uses the specified protocol information to perform password verification on the weak password listening IP port and the corresponding weak password application process, and uploads the successful verification result to the control end.

[0093] Through the application of the weak password verification system applied in this application, massive hosts can be verified in parallel, without relying on external networks, occupying less resources and with high verification efficiency.

[0094] In another specific embodiment of the present application, a computer-readable storage medium stores computer instructions, wherein the computer instructions are operated to execute the weak password verification method described in any embodiment. The storage medium may be directly in hardware, in a software module executed by a processor, or in a combination of the two.

[0095] The software modules may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from and write information to the storage medium.

[0096] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In an alternative, the storage medium may be integrated with the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.

[0097] In the embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0098] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0099] The above are merely embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structural transformations made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for checking weak application passwords, characterized in that: include, At least one host with a host agent program installed obtains its own weak password application process list and weak password listening IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password listening IP port list includes at least one weak password listening IP port; The control end configures the cracking program and the password dictionary updated in real time for each host by itself, and sends the cracking program and the password dictionary updated in real time corresponding to each host to the corresponding host, wherein the process of the control end configuring the cracking program and the password dictionary updated in real time for each host by itself, and sending the cracking program and the password dictionary updated in real time corresponding to each host to the corresponding host includes: the control end receives the current information reported by each host, the current information includes the hash value of the current password dictionary and the current cracking program of the host, and the host account of the host; the control end searches for the hash value of the password dictionary and the cracking program corresponding to the host account from its program memory, and compares it with the hash value of the current password dictionary and the current cracking program reported by the host, if they are not equal, the password dictionary and the cracking program corresponding to the host account in the control end are determined as the password dictionary and the cracking program updated in real time; The host generates the specified protocol information of the weak password application process corresponding to each weak password listening IP port using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the weak password listening IP port list, wherein the process of the host generating the specified protocol information of the weak password application process corresponding to the weak password application process list using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the weak password listening IP port list includes: the host establishes a connection with the corresponding weak password application process through each weak password listening IP port; the host uses the cracking program updated in real time to splice the weak password listening IP port, the corresponding weak password application process, the user account and the password dictionary updated in real time to generate the specified protocol information of the weak password application process corresponding to each weak password listening IP port; and, The host uses the specified protocol information to perform password verification on the weak password monitoring IP port and the corresponding weak password application process, and uploads the successful verification result to the control end.

2. The weak password verification method of claim 1, characterized in that: The process of obtaining the weak password application process list and the weak password monitoring IP port list of the at least one host installed with the host agent program includes: The host calls its own application program interface and reads the application program interface to obtain an application process list and a listening IP port list; The host screens the application process list to obtain the weak password application process list, and obtains the weak password listening IP port list corresponding to the weak password application process list according to the weak password application process list and the listening IP port list.

3. The weak password verification method of claim 1, characterized in that: Also includes, The control end searches the password dictionary and hash value of the cracking program corresponding to the host account from its program memory. If the host account does not exist in the program memory, the current password dictionary and hash value of the current cracking program reported by the host and the host account are added to the program memory.

4. The weak password verification method according to any one of claims 1 to 2, characterized in that Also includes, The host monitors its own CPU occupancy rate and memory usage rate in real time; If the CPU usage is greater than a preset CPU usage threshold and the memory usage is greater than a preset memory usage threshold, the password verification work of the host automatically stops running; If the CPU usage is not greater than the CPU usage threshold and / or the memory usage is not greater than the memory usage threshold, the password verification work of the host is automatically started and runs.

5. A host for checking weak application passwords, characterized in that: include, A process and port acquisition module, used for obtaining a weak password application process list and a weak password monitoring IP port list from the host, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port; A receiving and updating module, configured to receive, by the host, a password dictionary and a cracking program updated in real time issued by a control terminal, wherein the control terminal receives current information reported by each of the hosts, the current information including a hash value of the current password dictionary and the current cracking program of the host, and a host account of the host; the control terminal searches for the password dictionary and the hash value of the cracking program corresponding to the host account from its program memory, and compares them with the hash values ​​of the current password dictionary and the current cracking program reported by the host; if they are not equal, the password dictionary and the cracking program corresponding to the host account in the control terminal are determined as the password dictionary and the cracking program updated in real time; The designated protocol acquisition module is used for the host to generate the designated protocol information of the weak password application process corresponding to each weak password listening IP port by using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the list of weak password listening IP ports, wherein the host establishes a connection with the corresponding weak password application process through each weak password listening IP port; the host uses the cracking program updated in real time to splice the weak password listening IP port, the corresponding weak password application process, the user account and the password dictionary updated in real time to generate the designated protocol information of the weak password application process corresponding to each weak password listening IP port; The verification and reporting module is used for the host to use the specified protocol information to perform password verification on each weak password monitoring IP port and the corresponding weak password application process, and upload the successful verification result to the control end.

6. A control terminal for checking weak application passwords, characterized in that: include, A configuration and delivery module is used to configure the real-time updated cracking program and the real-time updated password dictionary of each host, and deliver the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host, and the control end receives the current information reported by each host, and the current information includes the hash value of the current password dictionary and the current cracking program of the host, and the host account of the host; The control end searches for the password dictionary and the hash value of the cracking program corresponding to the host account from its program memory, and compares them with the hash values ​​of the current password dictionary and the current cracking program reported by the host. If they are not equal, the password dictionary and the cracking program corresponding to the host account in the control end are determined as the password dictionary and the cracking program updated in real time. A receiving management module, used for receiving a successful verification result uploaded by the host; The host includes a process and port acquisition module, which is used for the host to obtain its own weak password application process list and weak password listening IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password listening IP port list includes at least one weak password listening IP port; a receiving update module; and a designated protocol acquisition module, which is used for the host to generate a designated protocol information of the weak password application process corresponding to each weak password listening IP port according to the real-time updated password dictionary, the user account of the host and the weak password listening IP port list, using the real-time updated cracking program. information, wherein the host establishes a connection with the corresponding weak password application process through each weak password listening IP port; the host uses the cracking program that has been updated in real time to splice the weak password listening IP port, the corresponding weak password application process, the user account and the password dictionary that has been updated in real time to generate the specified protocol information of the weak password application process corresponding to each weak password listening IP port; a verification and reporting module is used for the host to use the specified protocol information to perform password verification on each weak password listening IP port and the corresponding weak password application process, and upload the successful verification result to the control end.

7. A weak password verification system for applications, characterized in that: include, The control end configures the real-time updated cracking program and the real-time updated password dictionary of each host, and sends the real-time updated cracking program and the real-time updated password dictionary corresponding to each host to the corresponding host; as well as at least one host, each of which has a host agent installed; The host obtains its own weak password application process list and weak password monitoring IP port list, wherein the weak password application process list includes at least one weak password application process, and the weak password monitoring IP port list includes at least one weak password monitoring IP port; The host generates the designated protocol information of the weak password application process corresponding to each weak password monitoring IP port using the cracking program updated in real time according to the password dictionary updated in real time, the user account of the host and the weak password monitoring IP port list; as well as, The host uses the specified protocol information to perform password verification on the weak password monitoring IP port and the corresponding weak password application process, and uploads the successful verification result to the control end; The control end receives the current information reported by each of the hosts, the current information including the hash value of the current password dictionary and the current cracking program of the host, and the host account of the host; the control end searches for the password dictionary and the hash value of the cracking program corresponding to the host account from its program memory, and compares them with the hash values ​​of the current password dictionary and the current cracking program reported by the host; if they are not equal, the password dictionary and the cracking program corresponding to the host account in the control end are determined as the password dictionary and the cracking program updated in real time; The host establishes a connection with the corresponding weak password application process through each weak password listening IP port; the host uses the cracking program that has been updated in real time to splice the weak password listening IP port, the corresponding weak password application process, the user account and the password dictionary that has been updated in real time to generate the specified protocol information of the weak password application process corresponding to each weak password listening IP port.

8. A computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are operated to execute the application weak password verification method according to any one of claims 1 to 4.

Images