Fuzz testing method, apparatus, device, and computer-readable storage medium

Abstract

Embodiments of this disclosure provide a fuzz testing method, apparatus, device, and computer-readable storage medium. The method includes: determining a fuzz testing target; sequentially invoking corresponding brute-force dictionaries according to a preset dictionary invocation strategy; and testing the fuzz testing target based on the corresponding brute-force dictionaries. In this manner, different brute-force dictionaries can be invoked to automatically test the fuzz testing target, thereby improving the flexibility of weak password testing methods.

Description

Technical Field

[0001] This disclosure relates to the field of vulnerability discovery technology, and more particularly to the field of testing technology. Background Technology

[0002] Currently, password brute-force based on existing brute-force dictionaries has become a widely used method for weak password testing. However, this method can only simulate human testing of the target against a pre-selected and configured dictionary. Specifically, it usually uses a general static brute-force dictionary library that has been exposed on the public network for testing. This testing method has a relatively large number of packets sent and the testing method is relatively fixed, with poor flexibility.

[0003] In addition, the difference between commonly used static brute-force dictionary libraries and the brute-force dictionary samples actually used by attackers is too large, resulting in poor test results and failing to achieve true defensive detection. Summary of the Invention

[0004] This disclosure provides a fuzz testing method, apparatus, device, and storage medium.

[0005] According to a first aspect of this disclosure, a fuzz testing method is provided. The method includes:

[0006] Define the target of the fuzz test;

[0007] The corresponding brute-force dictionaries are called sequentially according to the dictionary call order indicated by the preset dictionary call strategy.

[0008] The fuzz test target is tested according to the corresponding brute-force dictionary.

[0009] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein testing the Fuzz test target according to the corresponding brute-force dictionary includes:

[0010] The dictionaries in the corresponding brute-force dictionary database are filtered according to the pre-set dictionary filtering parameters;

[0011] The fuzz test target is tested using the filtered dictionary from the corresponding brute-force dictionary library.

[0012] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the dictionary library invocation order includes:

[0013] Call the static brute-force dictionary library; or

[0014] Call the dynamic brute-force dictionary library; or

[0015] First, the static brute-force dictionary is called, then the dynamic brute-force dictionary is called; where:

[0016] The static brute-force dictionary library includes a protocol brute-force dictionary library and a general brute-force dictionary library;

[0017] The process of calling the static brute-force dictionary library includes: first calling the protocol brute-force dictionary library and then calling the general brute-force dictionary library.

[0018] As described above and in any possible implementation, a further implementation is provided, wherein the invocation of the dynamic brute-force dictionary library includes:

[0019] According to dictionary priority, each dictionary in the dynamic brute-force dictionary library is called, where the dictionary priority is determined based on the historical brute-force success frequency of each dictionary.

[0020] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the method further includes:

[0021] The dictionary that appears more frequently than a preset frequency in each protocol under the internal source will be used as the first dictionary;

[0022] Use the dictionary of the top N most frequent occurrences of each protocol from external sources as the second dictionary;

[0023] Based on the first dictionary and the second dictionary, construct the protocol brute-force dictionary library, where N is a positive integer.

[0024] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the method further includes:

[0025] Dynamically collect target information;

[0026] The target information is segmented and parsed.

[0027] The target information after word segmentation and parsing is subjected to preset processing to generate the dynamic brute-force dictionary, wherein,

[0028] The preset processing includes: grouping, analyzing the correlations, arranging and combining the target information after word segmentation and parsing, and then storing it;

[0029] The target information includes: account and password;

[0030] as well as

[0031] The target information also includes: business information and / or target feature information;

[0032] The dynamically acquired target information includes at least one of the following:

[0033] Social workers collect data in real-time or at scheduled intervals;

[0034] Collect weak passwords or vulnerabilities in real time or at set times;

[0035] Domain information can be crawled in real time or at regular intervals.

[0036] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the step of performing preset processing on the target information after word segmentation and parsing to generate the dynamic brute-force dictionary includes:

[0037] After the target information after word segmentation and parsing is pre-processed, priority sorting and / or dictionary filtering parameter settings are performed to generate the dynamic brute-force dictionary library.

[0038] The dynamic brute-force dictionary is deduplicated.

[0039] According to a second aspect of this disclosure, a fuzz testing apparatus is provided. The apparatus includes:

[0040] The determination module is used to determine the target of the fuzz test;

[0041] The calling module is used to call the corresponding brute-force dictionary in sequence according to the dictionary calling order indicated by the preset dictionary calling strategy;

[0042] The testing module is used to test the fuzz test target according to the corresponding brute-force dictionary.

[0043] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0044] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the methods as described in the first and / or second aspects of this disclosure.

[0045] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0046] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the scope of this disclosure. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0047] Figure 1A flowchart of a fuzz testing method according to an embodiment of the present disclosure is shown;

[0048] Figure 2 A block diagram of a fuzz testing apparatus according to an embodiment of the present disclosure is shown;

[0049] Figure 3 A block diagram of a fuzz testing apparatus according to another embodiment of the present disclosure is shown;

[0050] Figure 4 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0052] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0053] In this disclosure, by calling the corresponding brute-force dictionary databases sequentially according to the dictionary database calling order indicated by the preset dictionary database calling strategy, the flexibility of weak password testing methods can be improved.

[0054] Figure 1 A flowchart of a Fuzz testing method 100 according to an embodiment of the present disclosure is shown. Method 100 may include:

[0055] Step 110: Determine the Fuzz test target; the Fuzz test target is one or more hosts that need to be tested for weak passwords, or even the open ports of the hosts that need to be tested for weak passwords. Fuzz testing is also known as Fuzz testing.

[0056] Step 120: Call the corresponding brute-force dictionary databases in sequence according to the dictionary database calling order indicated by the preset dictionary database calling strategy;

[0057] The default dictionary retrieval strategy can be pre-set, i.e., fixed; or

[0058] The default dictionary library calling strategy can vary depending on the Fuzz test objective, that is, it is determined according to the Fuzz test objective;

[0059] For example, if the target of the fuzz test is a company's internal network host, the dictionary database calling order indicated by the preset dictionary database calling strategy can be: calling the dictionary database composed of the crawling results obtained after crawling the company's website and the social software used by the company's employees.

[0060] For example, if the target of the fuzz test is a port on a public network, the dictionary call order indicated by the preset dictionary call strategy can be to call the general dictionary corresponding to that public network.

[0061] Step 130: Test the fuzzing target according to the corresponding brute-force dictionary database. The brute-force dictionary database contains a massive number of dictionaries, each consisting of an account and a password.

[0062] After determining the fuzzing target, the corresponding brute-force dictionary can be called sequentially according to the dictionary call order indicated by the preset dictionary call strategy. This allows for automatic testing of the fuzzing target based on the corresponding brute-force dictionary. This testing method improves the flexibility of weak password testing by calling different brute-force dictionaries according to the dictionary call order, effectively avoiding the problem of poor testing flexibility caused by always using a general static brute-force dictionary. At the same time, different brute-force dictionaries can be used selectively, thus improving the accuracy of brute-force testing and avoiding blindly sending packets.

[0063] In one embodiment, testing the fuzz test target according to the corresponding brute-force dictionary includes:

[0064] The dictionaries in the corresponding brute-force dictionary database are filtered according to the pre-set dictionary filtering parameters;

[0065] The dictionary filtering parameters can be fixed, or they can correspond to the brute-force dictionary, meaning different brute-force dictionary libraries have different dictionary filtering parameters. They can also be determined based on the brute-force dictionary library and the fuzz test target.

[0066] The dictionary filtering parameter is used to indicate which dictionaries in the corresponding brute-force dictionary database to filter out. For example, when the dictionary filtering parameter is 123, it can indicate that dictionaries corresponding to passwords starting with 123 in the brute-force dictionary database will be filtered out.

[0067] Furthermore, since the dictionary corresponds to other information associated with it (i.e., business information and / or target feature information), the dictionary filtering parameters can be composed of one or more of these other information (such as the company name in the business information and / or the contact number in the target feature information), thereby influencing the dictionary filtering through one or more of these other information.

[0068] Of course, if the filter consists of multiple items from these other information sources, each item can also be configured with a weight coefficient. This can further clarify the filtering priority. For example, if the dictionary filtering parameters are a company name + a contact number, and the weight coefficient of the company name is 0.6 while the weight coefficient of the contact number is 0.4, then since the weight coefficient of the company name is greater than that of the contact number, the corresponding brute-force dictionary can be filtered first by the company name, and then the corresponding brute-force dictionary can be filtered again by the contact number.

[0069] The fuzz test target is tested using the filtered dictionary from the corresponding brute-force dictionary library.

[0070] Based on pre-set dictionary filtering parameters, dictionaries in the corresponding brute-force dictionary library can be automatically filtered to remove unsuitable dictionaries. Then, the filtered dictionaries in the corresponding brute-force dictionary library can be used to automatically perform targeted testing on the fuzz test target. This can reduce the number of packets sent, improve the accuracy of weak password testing, avoid the need to blindly send a large number of packets to the fuzz test target, and effectively improve testing efficiency.

[0071] Of course, those skilled in the art can flexibly choose whether to set dictionary filtering parameters according to actual needs.

[0072] In one embodiment, the dictionary invocation order includes:

[0073] Call the static brute-force dictionary library; or

[0074] Call the dynamic brute-force dictionary library; or

[0075] First, the static brute-force dictionary is called, then the dynamic brute-force dictionary is called; where:

[0076] The static brute-force dictionary library includes a protocol brute-force dictionary library and a general brute-force dictionary library;

[0077] The difference between a static brute-force dictionary and a dynamic brute-force dictionary is that a static brute-force dictionary is usually composed of commonly used dictionaries that have been statistically analyzed in advance. However, this is only in terms of common use. For example, it may be the top N commonly used dictionaries compiled from the network. It has no or very low correlation with the actual business and / or certain target feature information.

[0078] The dynamic brute-force dictionary library is derived from dictionaries obtained through dynamic crawling of various social media software, company websites, sensitive IPs, etc. It is closely related to business and / or target feature information, and therefore, it is more compatible with the brute-force dictionary samples commonly used by attackers in actual business attacks. Therefore, calling the dynamic brute-force dictionary library for testing can improve the effectiveness of weak password brute-force testing, test out real weak passwords, and thus play a real defensive detection role.

[0079] Both protocol-based brute-force dictionary libraries and general brute-force dictionary libraries are static brute-force dictionary libraries. The difference is that the dictionaries in the protocol-based brute-force dictionary library are protocol-related and are commonly used dictionaries under different protocols; the general brute-force dictionary library consists of several usernames and passwords that are most likely to appear on the public network (such as 100, 10000).

[0080] The process of calling the static brute-force dictionary library includes: first calling the protocol brute-force dictionary library and then calling the general brute-force dictionary library.

[0081] The dictionary database can be called in any of the above orders, thereby increasing the flexibility of calling the brute-force dictionary database and thus increasing the flexibility of fuzz-based weak password brute-force testing.

[0082] In one embodiment, the invocation of the dynamic brute-force dictionary library includes:

[0083] According to dictionary priority, each dictionary in the dynamic brute-force dictionary library is called, where the dictionary priority is determined based on the historical brute-force success frequency of each dictionary.

[0084] Since dictionary priority is determined based on the historical success rate of each dictionary, by using dictionary priority, during weak password fuzz testing, the most likely dictionaries to be successfully brute-forced (i.e., dictionaries with high priority) in the dynamic brute-force dictionary library can be called first to brute-force the fuzz target, thereby improving the accuracy and efficiency of the test.

[0085] Secondly, when there are multiple dictionaries with the same brute-force priority in the dynamic brute-force dictionary, brute-force can be performed based on the order of these multiple dictionaries in the dynamic brute-force dictionary.

[0086] Furthermore, by utilizing dictionary priorities, the order of dictionaries in the dynamic brute-force dictionary can be adjusted. That is, the higher the priority of a dictionary, the higher its ranking in the dynamic brute-force dictionary. This makes the order of dictionaries in the dynamic brute-force dictionary more closely match the actual brute-force situation. As a result, the constructed dynamic brute-force dictionary is more accurate and better matches the brute-force dictionary samples actually used by attackers, thus ensuring better testing results and achieving true defensive detection.

[0087] In one embodiment, the method further includes:

[0088] The dictionary that appears more frequently than a preset frequency in each protocol under the internal source is used as the first dictionary; the preset frequency can be 10 times, etc.

[0089] Use the dictionary of the top N most frequent occurrences of each protocol from external sources as the second dictionary;

[0090] Based on the first dictionary and the second dictionary, construct the protocol brute-force dictionary library, where N is a positive integer, for example, N can be 20, 30, etc.

[0091] By obtaining the first dictionary commonly used for each protocol from internal sources and the second dictionary commonly used for each protocol from external sources, a protocol brute-force dictionary library can be automatically constructed, thereby obtaining the commonly used dictionary for each protocol.

[0092] Internal sources can be company projects, such as the company's attack and defense projects; external sources can be the public internet.

[0093] In one embodiment, the method further includes:

[0094] Dynamically collect target information;

[0095] The target information is segmented and parsed.

[0096] The target information after word segmentation and parsing is subjected to preset processing to generate the dynamic brute-force dictionary, wherein,

[0097] The preset processing includes: grouping, analyzing the correlations, arranging and combining the target information after word segmentation and parsing, and then storing it;

[0098] The target information includes: account and password;

[0099] as well as

[0100] The target information also includes: business information and / or target feature information.

[0101] Business information refers to all information related to business, such as business name, company, business administrator information, etc.; target characteristic information can be sensitive information such as telephone number, a designated system such as financial transaction system, or name, date, ID number, etc.

[0102] After dynamically collecting target information, word segmentation and parsing can be performed to break the target information into different words. These words are then grouped, analyzed for correlation, and combined before being stored. This facilitates the rapid construction of a dynamic brute-force dictionary, improving the efficiency and accuracy of the dictionary construction.

[0103] Grouping refers to grouping multiple words obtained after parsing the target information according to different information categories, i.e., different fields. For example, words representing age can be grouped together, and words representing names can be grouped together, etc.

[0104] Relevance analysis refers to analyzing whether multiple words obtained after segmenting and parsing target information point to the same target. For example, analyzing whether the phone number, name, address, account number, and password obtained after parsing point to the same person, company, or group. If they point to the same target, then these words are related, are related information, and correspond to each other.

[0105] Permutations and combinations can sort a dictionary of account numbers and passwords in the target information based on any one or more combinations of the target information. For example, sorting the dictionary by the first letter of the name plus the phone number, or by the first letter of the company name plus the date, etc.

[0106] In addition, word frequency analysis can be performed before permutation and combination. This makes it easier to permutate and combine the dictionary based on the word frequency analysis results. That is, count the number of times each word appears in each field, and then sort the dictionary according to the number of times each word appears in each field. Usually, one or more fields with high word frequency are used to sort the dictionary first. For example, if the most frequent field in the target information is telephone number, followed by name, then the dictionary consisting of account number and password can be sorted according to the combination of telephone number and name. In this way, the frequently used dictionary will be sorted first, which is conducive to using the dictionary to test weak passwords first, thereby improving the testing efficiency and accuracy.

[0107] Of course, word frequency analysis can be performed before or after association analysis.

[0108] In one embodiment, the dynamically acquired target information includes at least one of the following:

[0109] Social workers collect data in real-time or at scheduled intervals;

[0110] Collect weak passwords or vulnerabilities in real time or at set times;

[0111] Domain information can be crawled in real time or at regular intervals.

[0112] Dynamically collecting target information can be done in real time or at regular intervals, allowing the target information to be continuously updated. Since this information is closely related to actual business / applications, the dynamic brute-force dictionary library built using this target information is more consistent with the dictionary samples used by attackers when actually attacking the test target. It is more targeted and accurate, ensuring the test results.

[0113] In one embodiment, the step of performing pre-processing on the target information after word segmentation and parsing to generate the dynamic brute-force dictionary includes:

[0114] After the target information after word segmentation and parsing is pre-processed, priority sorting and / or dictionary filtering parameter settings are performed to generate the dynamic brute-force dictionary library; priority sorting is used to re-sort the permuted and combined dictionaries according to their priority, of course, the re-sorting is based on the dictionary priority.

[0115] The dynamic brute-force dictionary is deduplicated.

[0116] After the target information after word segmentation and parsing is pre-processed, priority sorting and / or dictionary filtering parameters are set, so that the generated dynamic brute-force dictionary can flexibly adapt to different situations, the constructed dynamic brute-force dictionary is more accurate, and the construction method is also more flexible.

[0117] In addition, deduplication of the dynamic brute-force dictionary can avoid duplicate and redundant dictionaries, making the dynamic brute-force dictionary more concise and accurate, which is beneficial to improving testing efficiency and accuracy.

[0118] The following will combine Figure 2 Further explanation of the technical solution disclosed herein:

[0119] The overall technical framework is as follows: Figure 2 As shown, the device 200 includes: an analysis and processing module, a data acquisition module, a fuzz testing module, a dynamic blasting dictionary, and a static blasting dictionary.

[0120] The main functions of each module are:

[0121] The Fuzz testing module is used to perform continuous fuzz tests on the fuzz test target using a static brute-force dictionary and / or a dynamic brute-force dictionary.

[0122] The data acquisition module is used to collect data related to targets such as discovered weak password vulnerabilities (account passwords), social engineering information, and sensitive information.

[0123] The analysis and processing module is used to parse the collected target-related data into different grouped data sources based on a certain syntax (such as splitting it into different fields such as phone number and name), and then record the data according to the group. Of course, before recording, the parsed data in different groups can also be analyzed, including word frequency analysis and field correlation analysis.

[0124] Dictionary

[0125] The core of this disclosure is the maintenance of two dictionary databases: a dynamic brute-force dictionary database and a static brute-force dictionary database. The static brute-force dictionary database is based on known knowledge bases used in attack and defense, such as various general brute-force dictionary databases on the public internet. The dynamic brute-force dictionary database is generated by adding business information and target feature information to the static brute-force dictionary database for specific permutations and combinations. The production of this dynamic brute-force dictionary database is similar to that in red team / blue team exercises, adding social engineering and information gathering methods and steps, thus enhancing its targeting and comprehensiveness.

[0126] FUZZ test module

[0127] Based on the test target, fuzzing tests are performed using proxies, different user agents (UAs), and dictionaries from the product's brute-force dictionary database. Individual usernames and passwords are exposed to the test target for iterative requests. Simultaneously, the test results are entered into a data record to increase the priority of the corresponding dictionary entries, facilitating faster result retrieval.

[0128] The following section will further explain how to obtain static and dynamic brute-force dictionary databases:

[0129] Static brute-force dictionary:

[0130] The static brute-force dictionary is a collection of default dictionaries pre-installed in the system, comprising a protocol dictionary and a general dictionary. To improve the business relevance of the static brute-force dictionary, the protocol dictionary is typically compiled by the company's red team and security personnel through weak password vulnerabilities accumulated over projects. It contains common usernames and passwords for various protocols and is maintained in a collaborative document every six months. The document fields include username, password, protocol, and source. The source field only specifies either the project (e.g., a company's attack and defense project) or the public internet.

[0131] The source is the project's usernames or passwords. For each protocol (over 60 protocols including HTTP, SSH, and SMTP), the top 10 usernames or passwords appearing more than 10 times are selected. If fewer than 10 appear, they are supplemented from public internet dictionaries. The public internet source data is based on dictionaries searched by web crawlers from GitHub and various security communities, updated every 6 months. The frequency of usernames and passwords appearing under different protocols in each dictionary is counted, and the top 20 are selected. This constitutes the Top 30 dictionary for each protocol, i.e., the protocol dictionary. The general dictionary is provided by red teams or security services, containing the 100 most likely usernames and passwords.

[0132] Dynamic brute-force dictionary

[0133] The information sources for the dynamic brute-force dictionary are divided into three types: ① social engineering data collection, ② vulnerability exploitation, and ③ sensitive information crawling. Social engineering (social software) data collection involves probing the target company's keywords, information about the company's management, publicly available names, phone numbers, ID card numbers, birthdays, usernames, passwords, etc., or directly obtaining relevant information from vulnerability intelligence. Vulnerability exploitation involves collecting weak password results from the test target. Sensitive information crawling involves using a crawler bot to crawl the domain name and subdomain information resolved by the test target's IP address, identifying and storing the names, phone numbers, ID card numbers, and birthdays that appear based on regular expressions. After collecting the data in the above three ways, a certain word segmentation and parsing are performed, and a dynamic brute-force dictionary is generated by arranging and combining the data according to a certain algorithm. For example, the dictionary (i.e., account + password) in the collected information can be sorted by using the first letter of the name of the account and password plus the phone number, the first letter of the company name plus the date, etc. This means that the dictionary is sorted in the brute-force dictionary by using the combination of one or more pieces of information corresponding to or associated with the dictionary (such as the first letter of the name and password, the first letter of the company name plus the date, etc.). This results in a brute-force dictionary that is related to the actual business and target feature information (name, company name, etc.). This brute-force dictionary is also closer to the dictionary samples actually used by attackers for brute-force attacks, thus more effectively discovering weak passwords on the test target and promptly reminding users to change these weak passwords, thereby achieving real test defense.

[0134] Of course, the dynamic brute-force dictionary will eventually be sorted again based on the priority obtained by each dictionary for the historical brute-force test success frequency of the test target, and then cached to obtain a dynamic brute-force dictionary that is more consistent with the actual test results.

[0135] The Fuzz dictionary calling logic in this disclosure

[0136] Based on the above static and dynamic brute-force dictionary libraries, fuzz testing is performed on the test target. First, the open ports and protocols of the test target are probed. Once this information is clear, 20 protocol-specific dictionaries from the protocol brute-force dictionary library are applied first, followed by a general dictionary from the general brute-force dictionary library, and finally a dynamic dictionary from the dynamic brute-force dictionary library. When applying the dynamic dictionary, dictionary invocation depends on the priority dictionary, prioritizing the dictionary with the highest priority. Duplicate dictionaries are deduplicated within a configured time period. By default, all protocols are applied when executing the dynamic dictionary, but the use of the dynamic brute-force dictionary library can be configured, and detailed configurations of the dynamic brute-force dictionary library's priority and dictionary filtering parameters can be made to influence the fuzz dictionary invocation logic, better reflecting actual business scenarios.

[0137] The following points should be noted when performing fuzz:

[0138] There may be duplicate passwords. A cache needs to be established for a certain period to remove duplicates and reduce packet transmission.

[0139] *The sorting and ranking of the dynamic brute-force dictionary can affect the Fuzz's calls to the dictionary, so the order of requests is not consistent.* The dynamic dictionary is continuously updated and may utilize existing scan data.

[0140] This method helps users discover passwords that can be brute-forced using unconventional dictionaries. From an attacker's perspective, it identifies weak passwords that may arise from a lack of security awareness in everyday password management scenarios, including social engineering passwords and mass password exploitation. It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, as some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are optional, and the actions and modules involved are not necessarily essential to this disclosure.

[0141] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0142] Figure 3 A block diagram of a Fuzz testing apparatus 3300 according to an embodiment of the present disclosure is shown. Figure 3 As shown, the device 300 includes:

[0143] Module 310 is used to determine the target of the fuzz test;

[0144] The calling module 320 is used to call the corresponding brute-force dictionary in sequence according to the dictionary call order indicated by the preset dictionary call strategy;

[0145] The testing module 330 is used to test the fuzz test target according to the corresponding brute-force dictionary library.

[0146] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0147] According to embodiments of this disclosure, this disclosure also provides an electronic device.

[0148] Figure 4A schematic block diagram of an electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0149] Device 400 includes a computing unit 401, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 402 or a computer program loaded from storage unit 408 into random access memory (RAM) 403. RAM 403 may also store various programs and data required for the operation of device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0150] Multiple components in device 400 are connected to I / O interface 405, including: input unit 406, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 404, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0151] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as method 100. For example, in some embodiments, method 100 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform method 100 by any other suitable means (e.g., by means of firmware).

[0152] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0153] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0154] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0155] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0156] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0157] Computing systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0158] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0159] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A fuzz testing method, characterized by, include: Define the target of the fuzz test; The corresponding brute-force dictionaries are invoked sequentially according to the dictionary invocation order indicated by the preset dictionary invocation strategy; wherein, the dictionary invocation order includes: Call the static brute-force dictionary library; or Call the dynamic brute-force dictionary library; or First, the static brute-force dictionary is called, then the dynamic brute-force dictionary is called; where: The static brute-force dictionary library includes a protocol brute-force dictionary library and a general brute-force dictionary library; The process of calling the static brute-force dictionary library includes: first calling the protocol brute-force dictionary library and then calling the general brute-force dictionary library; The invocation of the dynamic brute-force dictionary library includes: According to dictionary priority, each dictionary in the dynamic brute-force dictionary library is called, wherein the dictionary priority is determined based on the historical brute-force success frequency of each dictionary; Based on the corresponding brute-force dictionary, the fuzz test target is tested, including: The dictionaries in the corresponding brute-force dictionary database are filtered according to the pre-set dictionary filtering parameters; The fuzz test target is tested using the filtered dictionary from the corresponding brute-force dictionary library.

2. The method according to claim 1, characterized in that, The method further includes: The dictionary that appears more frequently than a preset frequency in each protocol under the internal source will be used as the first dictionary; Use the dictionary of the top N most frequent occurrences of each protocol from external sources as the second dictionary; Based on the first dictionary and the second dictionary, construct the protocol brute-force dictionary library, where N is a positive integer.

3. The method according to claim 1, characterized in that, The method further includes: Dynamically collect target information; The target information is segmented and parsed. The target information after word segmentation and parsing is subjected to preset processing to generate the dynamic brute-force dictionary, wherein, The preset processing includes: grouping, analyzing the correlations, arranging and combining the target information after word segmentation and parsing, and then storing it; The target information includes: account and password; as well as The target information also includes: business information and / or target feature information; The dynamically acquired target information includes at least one of the following: Social workers collect data in real-time or at scheduled intervals; Collect weak passwords or vulnerabilities in real time or at set intervals; Domain information can be crawled in real time or at regular intervals.

4. The method according to claim 3, characterized in that, The step of performing pre-processing on the target information after word segmentation and parsing to generate the dynamic brute-force dictionary includes: After the target information after word segmentation and parsing is pre-processed, priority sorting and / or dictionary filtering parameter settings are performed to generate the dynamic brute-force dictionary library. The dynamic brute-force dictionary is deduplicated.

5. A fuzz testing apparatus, comprising: The determination module is used to determine the target of the fuzz test; The calling module is used to sequentially call the corresponding brute-force dictionaries according to the dictionary calling order indicated by the preset dictionary calling strategy; wherein, the dictionary calling order includes: Call the static brute-force dictionary library; or Call the dynamic brute-force dictionary library; or First, the static brute-force dictionary is called, then the dynamic brute-force dictionary is called; where: The static brute-force dictionary library includes a protocol brute-force dictionary library and a general brute-force dictionary library; The process of calling the static brute-force dictionary library includes: first calling the protocol brute-force dictionary library and then calling the general brute-force dictionary library; The invocation of the dynamic brute-force dictionary library includes: According to dictionary priority, each dictionary in the dynamic brute-force dictionary library is called, wherein the dictionary priority is determined based on the historical brute-force success frequency of each dictionary; The testing module is used to test the fuzz test target according to the corresponding brute-force dictionary, including: The dictionaries in the corresponding brute-force dictionary database are filtered according to the pre-set dictionary filtering parameters; The fuzz test target is tested using the filtered dictionary from the corresponding brute-force dictionary library.

6. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-4.

7. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-4.

Images