A method, system, device and program product for engineering penetration testing

Abstract

The present invention relates to the technical field of penetration testing, and provides a method, system, device and program product for penetration testing engineering. The method for penetration testing engineering comprises: constructing a basic penetration testing framework; wherein the basic penetration testing framework comprises penetration testing steps required for the penetration testing and penetration testing tasks in the penetration testing steps; according to the basic penetration testing framework, instantiating in a penetration testing environment of a specified system to obtain a penetration testing plan for a specific system; performing a penetration test according to the penetration testing plan to obtain penetration testing data and penetration testing results for the specific system, and adjusting the basic penetration testing framework according to the penetration testing data, the penetration testing results and the analysis results of the penetration testing.

Description

Technical Field

[0001] The present invention relates to the field of penetration testing, and in particular to a penetration testing engineering method, system, device and program product. Background Art

[0002] With the continuous development of computer technology, various software products have become indispensable tools in enterprise production. To obtain a software product, it is necessary to pass the inspection of penetration testing. Compared with general testing, the enterprise's penetration testing team needs to be more in-depth and comprehensive when conducting penetration testing on the company's system. There are two main reasons: First, there are many isomorphic (technical framework, etc.) systems in the enterprise. If a certain technology has serious vulnerabilities, the enterprise may face a situation of total loss. Second, common forms of penetration testing (for example: attack and defense drills) pursue breadth more and cannot simulate the long-term and continuous attack mode of APT organizations. However, the industry currently does not have a set of theories or methods to provide engineering guidance for penetration testing in enterprises, resulting in quality and efficiency problems in existing tests. Specifically, there are problems in the following aspects:

[0003] (1) Isolation. The test results and information collected during each test are not reused, which causes testers to repeat some steps when penetrating homogeneous systems, thus affecting test efficiency.

[0004] (2) Non-standardization. The industry lacks a set of processes or guidance for standardized testing from the overall to the local level of the system under test, which leads to testers conducting penetration tests based on their own preferences or experience. This will seriously affect the comprehensiveness of the test results.

[0005] (3) Inaccuracy. Because testers lack standardization during the penetration test process, they will ignore the differences between different business areas, which will ultimately affect the accuracy of the test results.

[0006] Therefore, how to make penetration testing no longer isolated, make the penetration testing process more standardized, and make the penetration testing results more accurate has become a technical problem that needs to be solved urgently. Summary of the invention

[0007] The present invention provides a method, system, device and program product for engineering penetration testing, which are used to solve the technical problems of isolated penetration testing, non-standard penetration testing process and inaccurate penetration testing results in the prior art.

[0008] A first aspect of the present invention provides a method for engineering a penetration test, the method comprising:

[0009] Constructing a basic penetration testing framework; wherein the basic penetration testing framework includes penetration testing steps required for penetration testing and penetration testing tasks in the penetration testing steps;

[0010] According to the basic penetration testing framework, instantiate in the penetration testing environment of the specified system to obtain the penetration testing plan of the specific system;

[0011] Perform a penetration test according to the penetration test plan, obtain the penetration test data and penetration test results of the specific system, and adjust the basic penetration test framework according to the penetration test data, the penetration test results and the analysis results of the penetration test.

[0012] Optionally, build a basic penetration testing framework, including:

[0013] Split the penetration test into three steps: before the penetration test, during the penetration test, and after the penetration test;

[0014] According to the requirements of the penetration test, a corresponding penetration test task is set before the penetration test.

[0015] Optionally, instantiating the basic penetration testing framework in a penetration testing environment of a specified system to obtain a penetration testing solution for the specific system includes:

[0016] According to the actual situation of the designated system, the steps before the penetration test in the basic penetration test framework are completed to obtain relevant information of the designated system; wherein the relevant information of the designated system includes the penetration test requirements of the designated system, the framework and technology used by the designated system, and the attack tools required by the designated system;

[0017] According to the penetration test environment of the designated system and the relevant information of the designated system, setting the penetration test tasks during and after the penetration test in the basic penetration test framework;

[0018] The penetration test tasks during and after the penetration test are sorted according to the order of the steps of the penetration test to obtain the penetration test plan.

[0019] Optionally, according to the penetration test environment of the designated system, setting the penetration test task in the penetration test in the basic penetration test framework includes:

[0020] According to the penetration test environment of the designated system, setting a penetration test target for a corresponding penetration test task in the penetration test;

[0021] According to the framework and technology used by the designated system, corresponding penetration test tasks are set layer by layer, and the penetration test tasks are sorted according to the hierarchical relationship of the framework and technology to obtain the penetration test tasks in the penetration test.

[0022] Optionally, according to the penetration test environment of the designated system, setting a penetration test task after the penetration test in the basic penetration test framework includes:

[0023] Setting a penetration test target of the penetration test according to the penetration test requirements of the designated system;

[0024] According to the penetration test environment of the designated system and the penetration test target of the penetration test, a penetration test task after the penetration test is set.

[0025] Optionally, adjusting the basic penetration testing framework according to the penetration testing data and the penetration testing result includes:

[0026] Determine, according to the penetration test result, the completion status of the penetration test task in the penetration test; wherein the completion status includes completed and uncompleted;

[0027] According to the unfinished penetration test task, query the penetration test data to confirm the unfinished penetration test task's unfinished reason, and adjust the basic penetration test framework according to the unfinished reason;

[0028] According to the completed penetration testing task, the penetration testing method corresponding to the completed penetration testing task in the penetration testing data is queried, and saved to the corresponding part of the completed penetration testing task in the basic penetration testing framework.

[0029] In a second aspect, an embodiment of the present application provides a system for engineering penetration testing, including:

[0030] A basic construction unit, used to construct a basic penetration test framework; wherein the basic penetration test framework includes penetration test steps required for penetration testing and penetration test tasks in the penetration test steps;

[0031] A solution generation unit, used to instantiate the basic penetration test framework in the penetration test environment of the specified system to obtain the penetration test solution of the specific system;

[0032] A test execution unit is used to perform a penetration test according to the penetration test scheme, obtain penetration test data and penetration test results of the specific system, and adjust the basic penetration test framework according to the penetration test data and the penetration test results.

[0033] In a third aspect, an embodiment of the present application provides a penetration test engineering device, including:

[0034] at least one processor, and

[0035] a memory coupled to the at least one processor;

[0036] The memory stores instructions that can be executed by the at least one processor, and the at least one processor performs any one of the methods described in the first aspect by executing the instructions stored in the memory.

[0037] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes a method as described in any one of the first aspects.

[0038] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method as described in any one of the first aspects.

[0039] The technical solution in the embodiments of the present application has the following beneficial effects: the penetration testing system constructs a basic penetration testing framework; wherein the basic penetration testing framework includes the penetration testing steps required for the penetration testing and the penetration testing tasks in the penetration testing steps; according to the basic penetration testing framework, instantiation is performed in the penetration testing environment of the specified system to obtain a penetration testing plan for the specific system; penetration testing is performed according to the penetration testing plan to obtain penetration testing data and penetration testing results for the specific system, and the basic penetration testing framework is adjusted according to the penetration testing data and penetration testing results, so that by strictly setting the penetration testing process and setting corresponding small goals according to different processes, the present application can achieve standardization and customization of penetration testing, and at the same time, the test records of each penetration test are archived and integrated to ensure that the penetration testing data of the penetration test can be reused in the next similar penetration test. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of a penetration test engineering method provided by an embodiment of the present invention;

[0041] Figure 2 is a schematic diagram of a basic penetration testing framework provided by an embodiment of the present invention;

[0042] Figure 3 is a schematic diagram of a penetration test task in a penetration test provided by an embodiment of the present invention;

[0043] Figure 4It is a structural diagram of a penetration testing engineering system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0045] In the prior art, penetration testing is often designed by testers based on their own preferences or experience, which leads to technical problems such as isolation of penetration testing plans, non-standard penetration testing processes, and inaccurate penetration testing results.

[0046] To this end, the present invention provides a method, system, device and program product for engineering penetration testing, which are used to solve the technical problems of isolated penetration testing, non-standard penetration testing process and inaccurate penetration testing results in the prior art.

[0047] The following is a technical solution provided by the embodiment of the present application in conjunction with the accompanying drawings of the specification. The acquisition, storage, use, and processing of data in the technical solution of the present application are in compliance with the relevant provisions of national laws and regulations.

[0048] See also Figure 1 The present invention provides a method for engineering penetration testing, comprising:

[0049] 101. Construct a basic penetration testing framework; wherein the basic penetration testing framework includes penetration testing steps required for penetration testing and penetration testing tasks in the penetration testing steps;

[0050] 102. According to the basic penetration test framework, instantiate in the penetration test environment of the specified system to obtain the penetration test plan for the specific system;

[0051] 103. Conduct penetration testing according to the penetration testing plan, obtain penetration testing data and penetration testing results for the specific system, and adjust the basic penetration testing framework based on the penetration testing data, penetration testing results, and penetration testing analysis results.

[0052] Among them, building a basic penetration testing framework includes:

[0053] The penetration test is divided into three steps: before the penetration test, during the penetration test, and after the penetration test; according to the requirements of the penetration test, set corresponding penetration test tasks before the penetration test.

[0054] For example, see Figure 2 , Figure 2 A schematic diagram of a basic penetration test framework provided by an embodiment of the present invention. Assume that the object of this penetration test is a financial transaction system.

[0055] After receiving the penetration test task, the penetration test system first constructs a basic penetration test framework, including three steps: before the penetration test 21, during the penetration test 22, and after the penetration test 23. Among them, before the penetration test 21 also includes three penetration test tasks: penetration test requirements 211, penetration test information collection 212, and penetration test tool development 213.

[0056] Subsequently, the penetration test system instantiates the basic penetration test framework according to the penetration environment of the specific system. According to the penetration environment and penetration test tasks of the financial transaction system, the three penetration test tasks in the first 21 of the penetration test are completed, and the system entrance of the financial transaction system is obtained according to the penetration test requirements 211; according to the penetration test information collection 212, the four levels in the financial transaction system are obtained, namely, the framework, application, transaction and client; according to the penetration test tool formulation 213, a data dictionary for the financial transaction system is designed as an attack tool. After completing the penetration test tasks in the first 21 of the penetration test, according to the hierarchical information of the financial transaction system, the penetration test tasks corresponding to the framework, application, transaction and client are set in the penetration test 22 for the financial transaction system, and a customized penetration test plan for the financial transaction system is obtained.

[0057] Finally, the penetration test of the financial transaction system is completed according to the penetration test plan, and the penetration test data and the final penetration test results are obtained during the penetration test process. According to the completion status of the penetration test task in the penetration test result, the reasons for the unfinished penetration test task are analyzed and found, and corrections are made in the basic penetration test framework corresponding to the penetration test task; the penetration test data used by the completed penetration test task is saved as the attack result in the penetration test step of the penetration test task of the basic penetration test framework, which is convenient for the next penetration test call.

[0058] In actual applications, penetration testing requirements and penetration testing information collection are usually provided by the designer of the designated system for penetration testing. According to actual needs, the designer selects the entire content or part of the content of the designated system for penetration testing, and provides the relevant information required to perform the penetration test.

[0059] In the embodiment provided by the present invention, the penetration testing system constructs a basic penetration testing framework; wherein, the basic penetration testing framework includes the penetration testing steps required for the penetration testing and the penetration testing tasks in the penetration testing steps; according to the basic penetration testing framework, it is instantiated in the penetration testing environment of the specified system to obtain the penetration testing plan for the specific system; the penetration test is performed according to the penetration testing plan to obtain the penetration testing data and the penetration testing results of the specific system, and the basic penetration testing framework is adjusted according to the penetration testing data and the penetration testing results, so that by strictly setting the penetration testing process and setting corresponding small goals according to different processes, the present application can realize the standardization and customization of the penetration testing, and at the same time, the test records of each penetration test are archived and integrated to ensure that the penetration testing data of the penetration test can be reused in the next similar penetration test.

[0060] A possible implementation method is to instantiate the penetration test solution of a specific system in the penetration test environment of a specified system according to the basic penetration test framework, including:

[0061] According to the actual situation of the designated system, complete the steps before the penetration test in the basic penetration test framework to obtain relevant information of the designated system; the relevant information of the designated system includes the penetration test requirements of the designated system, the framework and technology used by the designated system, and the required attack tools of the designated system; according to the penetration test environment of the designated system and the relevant information of the designated system, set the penetration test tasks during and after the penetration test in the basic penetration test framework; sort the penetration test tasks during and after the penetration test in the order of the penetration test steps to obtain the penetration test plan.

[0062] Among them, according to the penetration test environment of the specified system, the penetration test tasks in the penetration test in the basic penetration test framework are set, including:

[0063] According to the penetration test environment of the specified system, set the penetration test objectives for the corresponding penetration test tasks in the penetration test;

[0064] According to the framework and technology used by the specified system, corresponding penetration test tasks are set layer by layer, and the penetration test tasks are sorted according to the hierarchical relationship of the framework and technology to obtain the penetration test tasks in the penetration test.

[0065] Among them, according to the penetration test environment of the specified system, the penetration test tasks after the penetration test in the basic penetration test framework are set, including:

[0066] Set the penetration test objectives of the penetration test according to the penetration test requirements of the specified system; set the penetration test tasks after the penetration test according to the penetration test environment of the specified system and the penetration test objectives of the penetration test.

[0067] For example, see Figure 3 , Figure 3 A schematic diagram of a penetration test task in a penetration test provided by an embodiment of the present invention. Assume that the designated system targeted by this penetration test is a financial transaction system.

[0068] The penetration test system completes the three penetration test tasks before the penetration test 21, obtains the system entrance of the financial transaction system according to the penetration test requirements 211; obtains the four layers in the financial transaction system, namely framework, application, transaction and client, according to the penetration test information collection 212; and designs a data dictionary for the financial transaction system as an attack tool according to the penetration test tool formulation 213.

[0069] The penetration testing system is completed according to the framework and technology used by the financial transaction system, and in the order of four levels: framework, application, transaction and client, 10 penetration testing tasks are set in the penetration test, namely: information collection 2201 and configuration and deployment mechanism detection 2202 corresponding to the framework layer; identity management detection 2203, identity authentication check 2204 and permission check 2205 corresponding to the application layer; input verification 2206, error information detection 2207, encryption service detection 2208 and business logic detection 2209 corresponding to the transaction layer; client test 2210 corresponding to the client layer; these 10 penetration testing tasks are arranged in the order of the hierarchical relationship of the framework and technology of the financial transaction system to obtain a customized penetration testing plan for the financial transaction system.

[0070] Then, the penetration test system determines the two test tasks after the penetration test 23 according to the penetration test requirements and penetration test environment of the financial transaction system, namely: penetration test result confirmation 231, which is used to determine the effectiveness of the penetration test task; penetration test result summary 232, which is used to summarize the completed penetration test tasks and the unfinished penetration test tasks.

[0071] In the embodiment provided by the present invention, the penetration testing system uses the information obtained before the penetration test to set corresponding penetration testing tasks as a customized penetration testing plan based on the relevant characteristics of the specified system, thereby improving the standardization of the penetration testing while ensuring the comprehensiveness of the penetration testing plan; and confirming and summarizing the results of the penetration testing based on the requirements of the penetration testing and the penetration testing environment, thereby avoiding the problem of inaccurate penetration testing results and facilitating the reuse of penetration testing results and penetration testing data.

[0072] A possible implementation method is to adjust the basic penetration testing framework according to the penetration testing data and the penetration testing results, including:

[0073] According to the penetration test results, determine the completion status of the penetration test tasks in the penetration test; wherein the completion status includes completed and unfinished; according to the unfinished penetration test tasks, query the penetration test data to confirm the reasons for the unfinished penetration test tasks, and adjust the basic penetration test framework according to the reasons for the unfinished penetration test tasks; according to the completed penetration test tasks, query the penetration test methods corresponding to the completed penetration test tasks in the penetration test data, and save them to the corresponding part of the completed penetration test tasks in the basic penetration test framework.

[0074] For example, after completing the penetration test plan, the penetration test system obtains the unfinished penetration test task of client test 2210. After querying the penetration test data corresponding to client test 2210, it is read that since the penetration test environment of the financial transaction system is the Internet, the port sniffer tool cannot be used to perform a sniff test on the client at this time, so the client test 2210 is not completed. The penetration test system makes adjustments in the penetration test information collection 212 before the penetration test 21 according to the penetration test data that the port sniffer tool cannot be used for testing in the Internet environment. When the penetration test information collection 212 collects that the specified system is in the Internet, it instructs the penetration test tool to prohibit the use of the port sniffer tool in the formulation 213.

[0075] When the completed penetration test task is identity management detection 2203, the penetration test system queries the corresponding penetration test data. It reads that since the English abbreviation "abcd" is obtained in the financial transaction system, a password dictionary is compiled according to the commonly used password composition form of "abcd+2 digits+1 symbol" in the enterprise, "abcd" is used as the user name, and the server login password is successfully blasted using the password dictionary, completing the identity management detection 2203. The penetration test system saves the password dictionary form to the penetration test tool formulation 213 before the penetration test 21, as a penetration test method that can be reused in similar system penetration tests.

[0076] In actual applications, the result of a completed penetration test task may also be that the penetration was not successfully completed. At this time, it means that the design of the corresponding part of the specified system is relatively safe, and the corresponding penetration test data does not need to be saved specifically.

[0077] In the embodiment provided by the present invention, the penetration testing system traces back the penetration testing data according to the penetration testing results, thereby adjusting the basic penetration testing framework according to the penetration testing data, and saving reusable penetration testing methods, thereby improving the reusability of the penetration testing results.

[0078] Based on the same inventive concept, this application provides a penetration test engineering system, see Figure 4 The penetration test engineered system includes:

[0079] A basic construction unit 401 is used to construct a basic penetration test framework; wherein the basic penetration test framework includes penetration test steps required for penetration test and penetration test tasks in the penetration test steps;

[0080] A solution generation unit 402 is used to instantiate the penetration test solution of a specific system in the penetration test environment of the specified system according to the basic penetration test framework;

[0081] The test execution unit 403 is used to perform penetration testing according to the penetration testing plan, obtain penetration testing data and penetration testing results of a specific system, and adjust the basic penetration testing framework according to the penetration testing data, penetration testing results and analysis results of the penetration testing.

[0082] In a possible implementation manner, the basic construction unit 401 is further used for:

[0083] The penetration test is divided into three steps: before the penetration test, during the penetration test, and after the penetration test; according to the requirements of the penetration test, set corresponding penetration test tasks before the penetration test.

[0084] In a possible implementation manner, the solution generating unit 402 is further configured to:

[0085] According to the actual situation of the designated system, complete the steps before the penetration test in the basic penetration test framework to obtain relevant information of the designated system; the relevant information of the designated system includes the penetration test requirements of the designated system, the framework and technology used by the designated system, and the required attack tools of the designated system; according to the penetration test environment of the designated system and the relevant information of the designated system, set the penetration test tasks during and after the penetration test in the basic penetration test framework; sort the penetration test tasks during and after the penetration test in the order of the penetration test steps to obtain the penetration test plan.

[0086] In a possible implementation manner, the solution generating unit 402 is further configured to:

[0087] According to the framework and technology used by the specified system, corresponding penetration test tasks are set layer by layer, and the penetration test tasks are sorted according to the hierarchical relationship of the framework and technology to obtain the penetration test tasks in the penetration test.

[0088] In a possible implementation manner, the solution generating unit 402 is further configured to:

[0089] Set the penetration test objectives of the penetration test according to the penetration test requirements of the specified system; set the penetration test tasks after the penetration test according to the penetration test environment of the specified system and the penetration test objectives of the penetration test.

[0090] In a possible implementation manner, the test execution unit 403 is further configured to:

[0091] According to the penetration test results, determine the completion status of the penetration test tasks in the penetration test; wherein the completion status includes completed and unfinished; according to the unfinished penetration test tasks, query the penetration test data to confirm the reasons for the unfinished penetration test tasks, and adjust the basic penetration test framework according to the reasons for the unfinished penetration test tasks; according to the completed penetration test tasks, query the penetration test methods corresponding to the completed penetration test tasks in the penetration test data, and save them to the corresponding part of the completed penetration test tasks in the basic penetration test framework.

[0092] Based on the same inventive concept, an embodiment of the present invention provides a penetration test engineering device, including:

[0093] At least one processor, the processor is used to implement the steps of the above penetration testing engineering method provided in the embodiment of the present application when executing the computer program stored in the memory.

[0094] Optionally, the processor may specifically be a central processing unit, an application specific integrated circuit (English: Application Specific Integrated Circuit, abbreviated as: ASIC), or may be one or more integrated circuits for controlling program execution.

[0095] Optionally, the data integrity protection device further includes a memory connected to at least one processor, and the memory may include a read-only memory (ROM), a random access memory (RAM), and a disk memory. The memory is used to store data required by the processor when it is running, that is, it stores instructions that can be executed by at least one processor. At least one processor executes the instructions stored in the memory to execute the instructions such as Figure 1 The method shown in the figure. Wherein, the number of memories is one or more.

[0096] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer executes the steps of the above-mentioned penetration test engineering method.

[0097] An embodiment of the present application also provides a computer program product, including a computer program, which implements the steps of the above penetration test engineering method when executed by a processor.

[0098] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0099] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0100] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0102] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A penetration test engineering method, characterized in that: include: Constructing a basic penetration testing framework; wherein the basic penetration testing framework includes penetration testing steps required for penetration testing and penetration testing tasks in the penetration testing steps; According to the basic penetration testing framework, instantiate in the penetration testing environment of the specified system to obtain the penetration testing plan of the specific system; Performing a penetration test according to the penetration test plan, obtaining penetration test data and penetration test results of the specific system, and adjusting the basic penetration test framework according to the penetration test data, the penetration test results, and the analysis results of the penetration test; Among them, according to the basic penetration testing framework, instantiating in the penetration testing environment of the specified system to obtain the penetration testing plan of the specific system includes: According to the actual situation of the designated system, the steps before the penetration test in the basic penetration test framework are completed to obtain relevant information of the designated system; wherein the relevant information of the designated system includes the penetration test requirements of the designated system, the framework and technology used by the designated system, and the attack tools required by the designated system; According to the penetration test environment of the designated system and the relevant information of the designated system, setting the penetration test tasks during and after the penetration test in the basic penetration test framework; Sorting the penetration test tasks during and after the penetration test according to the order of the steps of the penetration test to obtain the penetration test plan; Wherein, adjusting the basic penetration test framework according to the penetration test data and the penetration test result includes: Determine, according to the penetration test result, the completion status of the penetration test task in the penetration test; wherein the completion status includes completed and uncompleted; According to the unfinished penetration test task, query the penetration test data to confirm the unfinished penetration test task's unfinished reason, and adjust the basic penetration test framework according to the unfinished reason; According to the completed penetration testing task, the penetration testing method corresponding to the completed penetration testing task in the penetration testing data is queried, and saved to the corresponding part of the completed penetration testing task in the basic penetration testing framework.

2. The method according to claim 1, characterized in that Build a basic penetration testing framework, including: Split the penetration test into three steps: before the penetration test, during the penetration test, and after the penetration test; According to the requirements of the penetration test, a corresponding penetration test task is set before the penetration test.

3. The method according to claim 1, characterized in that According to the penetration test environment of the designated system, setting the penetration test task in the penetration test in the basic penetration test framework includes: According to the penetration test environment of the designated system, setting a penetration test target for a corresponding penetration test task in the penetration test; According to the framework and technology used by the designated system, corresponding penetration test tasks are set layer by layer, and the penetration test tasks are sorted according to the hierarchical relationship between the framework and technology to obtain the penetration test tasks in the penetration test.

4. The method according to claim 1, characterized in that According to the penetration test environment of the designated system, setting the penetration test task after the penetration test in the basic penetration test framework includes: Setting a penetration test target of the penetration test according to the penetration test requirements of the designated system; According to the penetration test environment of the designated system and the penetration test target of the penetration test, a penetration test task after the penetration test is set.

5. A penetration testing engineered system, characterized in that: include: A basic construction unit, used to construct a basic penetration test framework; wherein the basic penetration test framework includes penetration test steps required for penetration testing and penetration test tasks in the penetration test steps; A solution generation unit is used to instantiate the basic penetration test framework in the penetration test environment of the specified system to obtain a penetration test solution for the specific system; A test execution unit, configured to perform a penetration test according to the penetration test scheme, obtain penetration test data and penetration test results of the specific system, and adjust the basic penetration test framework according to the penetration test data, the penetration test results, and the analysis results of the penetration test; Wherein, the solution generation unit is specifically used for: According to the actual situation of the designated system, the steps before the penetration test in the basic penetration test framework are completed to obtain relevant information of the designated system; wherein the relevant information of the designated system includes the penetration test requirements of the designated system, the framework and technology used by the designated system, and the attack tools required by the designated system; According to the penetration test environment of the designated system and the relevant information of the designated system, setting the penetration test tasks during and after the penetration test in the basic penetration test framework; Sorting the penetration test tasks during and after the penetration test according to the order of the steps of the penetration test to obtain the penetration test plan; The test execution unit is specifically used for: Determine, according to the penetration test result, the completion status of the penetration test task in the penetration test; wherein the completion status includes completed and uncompleted; According to the unfinished penetration test task, query the penetration test data to confirm the unfinished penetration test task's unfinished reason, and adjust the basic penetration test framework according to the unfinished reason; According to the completed penetration testing task, the penetration testing method corresponding to the completed penetration testing task in the penetration testing data is queried, and saved to the corresponding part of the completed penetration testing task in the basic penetration testing framework.

6. A penetration test engineered device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method according to any one of claims 1 to 4 by executing the instructions stored in the memory.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images