Vulnerability detection method, device, equipment and medium

Abstract

The disclosed embodiments relate to a vulnerability detection method, apparatus, device and medium, wherein the method comprises: generating a corresponding load request according to the type of vulnerability to be detected, wherein the load request comprises: the address information of the log platform; sending the load request to the system to be tested to instruct the system to be tested to perform vulnerability scanning in response to the load request, and sending a vulnerability trigger request to the log platform according to the address information; calling the preset query interface corresponding to the log platform to send a log query request, and if the vulnerability log recorded by the log platform by parsing the vulnerability trigger request is obtained, it is determined that the system to be tested has a vulnerability. The disclosed embodiments avoid the situation where even if a no-echo vulnerability is scanned, it cannot be discovered, and realizes the effective detection of no-echo vulnerabilities, and can determine whether there is a no-echo vulnerability in the system to be tested based on the vulnerability log, thereby improving the efficiency and convenience of no-echo vulnerability detection.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a vulnerability detection method, device, equipment and medium. Background Art

[0002] With the development of computer technology, vulnerability detection becomes more and more important. In the process of vulnerability detection, the vulnerability database is used to scan the detection target to determine whether there is a corresponding vulnerability in the detection target.

[0003] In the related art, during the scanning process of the system under test, a vulnerability data packet constructed according to the vulnerability is sent to the system under test, and the echo information generated by the system under test in response to the vulnerability data packet is used to determine whether the corresponding vulnerability exists in the system under test. However, in the related art, the determination of whether there is a vulnerability depends on the echo information of the system under test. In vulnerabilities such as SQL blind injection, even if the vulnerability in the system under test is triggered, the message will not be displayed on the front-end page. This type of vulnerability is a no-echo vulnerability, that is, the system under test will not generate corresponding echo information for the vulnerability data packet, and thus this type of no-echo vulnerability cannot be detected. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a vulnerability detection method, device, equipment and medium.

[0005] The present disclosure provides a vulnerability detection method, which is applied to a test system. The method includes:

[0006] Generate a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: address information of the log platform;

[0007] Sending the load request to the system under test to instruct the system under test to perform vulnerability scanning in response to the load request, and sending a vulnerability triggering request to the log platform according to the address information;

[0008] A preset query interface corresponding to the log platform is called to send a log query request. If a vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that a vulnerability exists in the system to be tested.

[0009] In some embodiments, the log platform includes a directory access protocol LDAP log platform, and the vulnerability triggering request includes a lightweight directory access protocol LDAP request.

[0010] In some embodiments, generating a corresponding payload request according to the vulnerability type to be detected includes:

[0011] In response to a vulnerability template triggering operation, determining the vulnerability type;

[0012] According to a preset vulnerability-load relationship, one or more load requests corresponding to the vulnerability type are determined.

[0013] In some embodiments, there are multiple systems to be tested, and the vulnerability log includes the address of the system to be tested. If the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system to be tested has a vulnerability, including:

[0014] If the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, the address of the system to be tested included in the vulnerability log is obtained;

[0015] Determine whether a target system to be tested corresponding to the address of the system to be tested has a vulnerability.

[0016] In some embodiments, it also includes:

[0017] The preset query interface corresponding to the log platform is called to send the log query request. If the vulnerability log is not obtained, it is determined that there is no vulnerability in the system under test.

[0018] The present disclosure also provides a vulnerability detection method, which is applied to a system to be tested and includes:

[0019] Perform vulnerability scans in response to payload requests sent by the test system;

[0020] If a vulnerability is found during the scan, a vulnerability trigger request is sent to the log platform based on the address information of the log platform.

[0021] The disclosed embodiment also provides a vulnerability detection method, which is applied to a log platform, including:

[0022] In response to a vulnerability triggering request sent by the system to be tested, parsing the vulnerability triggering request to generate a vulnerability log;

[0023] In response to a log query request sent by the test system, it is determined whether the vulnerability log is empty, and if the vulnerability log is not empty, the vulnerability log is sent to the test system.

[0024] The present disclosure also provides a vulnerability detection device, which is applied to a test system. The device includes:

[0025] A generation module, used to generate a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: address information of the log platform;

[0026] A first sending module is used to send the load request to the system under test to instruct the system under test to perform vulnerability scanning in response to the load request, and send a vulnerability triggering request to the log platform according to the address information;

[0027] The first determination module is used to call the preset query interface corresponding to the log platform to send a log query request. If the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability.

[0028] The present disclosure also provides a vulnerability detection device, which is applied to a system to be tested, and the device includes:

[0029] A scanning module, used for performing vulnerability scanning in response to a load request sent by the test system;

[0030] The second sending module is used to send a vulnerability triggering request to the log platform according to the address information of the log platform if a vulnerability is scanned.

[0031] The present disclosure also provides a vulnerability detection device, which is applied to a log platform. The device includes:

[0032] The parsing module is used to respond to the vulnerability triggering request sent by the system to be tested, parse the vulnerability triggering request and generate a vulnerability log;

[0033] The judgment module is used to respond to the log query request sent by the test system to judge whether the vulnerability log is empty, and if the vulnerability log is not empty, send the vulnerability log to the test system.

[0034] An embodiment of the present disclosure also provides an electronic device, which includes: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the vulnerability detection method provided by the embodiment of the present disclosure.

[0035] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the vulnerability detection method provided by the embodiment of the present disclosure.

[0036] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: generating a corresponding load request according to the type of vulnerability to be detected, wherein the load request includes: the address information of the log platform; sending the load request to the system to be tested to instruct the system to be tested to respond to the load request to perform vulnerability scanning, and sending a vulnerability trigger request to the log platform according to the address information; calling the preset query interface corresponding to the log platform to send a log query request, and if the vulnerability log recorded by the log platform by parsing the vulnerability trigger request is obtained, it is determined that the system to be tested has a vulnerability. By adopting the above technical solution, in the case where the type of vulnerability to be detected is a no-echo vulnerability, if a vulnerability is scanned in the system to be tested, the system to be tested can send a vulnerability trigger request to the log platform, thereby generating a vulnerability log on the log platform, avoiding the situation in the related technology that even if the no-echo vulnerability is scanned, it cannot be discovered, realizing the effective detection of the no-echo vulnerability, and determining whether there is a no-echo vulnerability in the system to be tested according to the vulnerability log, thereby improving the efficiency and convenience of no-echo vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 A schematic diagram of a vulnerability detection method provided by an embodiment of the present disclosure;

[0040] Figure 2 A flowchart of another vulnerability detection method provided by an embodiment of the present disclosure;

[0041] Figure 3 A flowchart of another vulnerability detection method provided by an embodiment of the present disclosure;

[0042] Figure 4 A flowchart of another vulnerability detection method provided by an embodiment of the present disclosure;

[0043] Figure 5 A schematic diagram of a vulnerability detection method provided by an embodiment of the present disclosure;

[0044] Figure 6 A flowchart of another vulnerability detection method provided by an embodiment of the present disclosure;

[0045] Figure 7 A schematic diagram of the structure of a vulnerability detection device provided by an embodiment of the present disclosure;

[0046] Figure 8 A schematic diagram of the structure of another vulnerability detection device provided by an embodiment of the present disclosure;

[0047] Fig. 9 A schematic diagram of another vulnerability detection device provided in an embodiment of the present disclosure

[0048] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0049] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0050] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0051] In order to solve the above problems, the embodiments of the present disclosure provide a vulnerability detection method, which is introduced below in conjunction with specific embodiments.

[0052] Figure 1 The present invention provides a flowchart of a vulnerability detection method provided by an embodiment of the present invention. The method can be executed by a vulnerability detection device, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 1 As shown, the method is applied to a test system, comprising:

[0053] Step 101: Generate a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: address information of the log platform.

[0054] In this embodiment, a vulnerability test is performed on the system under test through a test system. The test system is a system that initiates vulnerability scans on other systems. Through vulnerability scans, it can be determined whether there are corresponding vulnerabilities in the system under test. The test system can be run on a security test host. The system under test is a system that needs to be subjected to vulnerability scanning tests. The system can be set according to user needs, etc., and this embodiment does not limit it. For example, the system under test can be any one or more of a database system, a mobile device system, a network device system, a middleware system, and a Web site system.

[0055] First, the test system generates corresponding payload requests according to the type of vulnerability to be detected.

[0056] Among them, the vulnerability type is the type to which the vulnerability belongs. The vulnerability type can be set according to user needs, etc., and this embodiment does not limit it. For example, the vulnerability type can be a no-echo vulnerability type or a subdivision type under the no-echo vulnerability type, wherein the subdivision type under the no-echo vulnerability type includes: Structured Query Language (SQL) blind injection vulnerability type, Extensible Markup Language (XML) external entity injection vulnerability type, and no-echo command execution vulnerability type. Any one or more. The load request, that is, the payload request, can be understood as a simulated attack request for the system to be tested. A vulnerability type can correspond to one or more load requests. If the vulnerability type is a no-echo vulnerability type, a no-echo payload request is generated according to the vulnerability type. In addition, the load request includes the address information of the log platform. The log platform is a platform for recording vulnerability logs. The address information of the vulnerability platform can guide the sending of vulnerability trigger requests to the vulnerability platform.

[0057] In this embodiment, there are multiple methods for determining the vulnerability type, which are not limited in this embodiment. For example, the vulnerability type can be determined by user selection or by pre-deployment. Exemplarily, if the vulnerability type is determined by user selection, a corresponding load request is generated according to the vulnerability type to be detected, including: determining the vulnerability type in response to a vulnerability template trigger operation; and determining one or more load requests corresponding to the vulnerability type according to a preset vulnerability-load relationship.

[0058] Among them, the vulnerability template is a template that integrates one or more vulnerability types. The vulnerability template can be pre-built into the test system, or can be customized by the user. This embodiment is not limited. The vulnerability template can be displayed to the user through the front-end interface and other methods for the user to choose. After the vulnerability template is displayed to the user, the user can perform a vulnerability template trigger operation on the vulnerability template through methods such as point selection, touch operation, and voice control operation. In response to the vulnerability template trigger operation, the test system can retrieve the template type relationship according to the vulnerability template. In the template type relationship, the correspondence between the vulnerability template and the vulnerability type is determined by pre-calibration and other methods, thereby determining the vulnerability type corresponding to the vulnerability template. The correspondence between the vulnerability type and the load request is recorded in the preset vulnerability load relationship. There are many ways to determine the vulnerability load relationship. This embodiment is not limited. The preset vulnerability load relationship is retrieved according to the vulnerability type, and the load request corresponding to the vulnerability type can be determined.

[0059] Step 102: Send the load request to the system under test to instruct the system under test to perform a vulnerability scan in response to the load request, and send a vulnerability trigger request to the log platform according to the address information.

[0060] The test system simulates an attack on the system to be tested by sending a load request. The system to be tested responds to the load request and performs a vulnerability scan on the vulnerability related to the load request. If a vulnerability is scanned, a vulnerability trigger request is sent to the log platform according to the address information of the log platform in the load request. Among them, the vulnerability trigger request is a request sent by the system to be tested after the vulnerability in the system to be tested is scanned. The log platform can record the relevant vulnerability log according to the received vulnerability trigger request. In some embodiments, the log platform can be installed on the same host as the test system and run on the same host. Among them, the type of vulnerability trigger request can be set according to the vulnerability type, user needs, etc., and this embodiment does not limit it. For example, the vulnerability trigger request can be a Lightweight Directory Access Protocol (LDAP) request. In this embodiment, the type of the log platform can be related to the type of the vulnerability trigger request. If the vulnerability trigger request is an LDAP request, the log platform can be an LDAP log platform.

[0061] If the payload request is a non-echo payload request, after the system under test receives the non-echo payload request, it performs a vulnerability scan according to the non-echo payload request. After scanning the non-echo vulnerability, there is no corresponding echo information for the non-echo vulnerability, and the front-end interface of the system under test will not display information related to the non-echo vulnerability. Therefore, in the related art, it is impossible to determine whether there is a non-echo vulnerability in the system under test through the front-end display of the system under test. In this embodiment, if there is a non-echo vulnerability in the system under test, a vulnerability trigger request will be sent to the log platform according to the address information in the non-echo payload request. The log platform records the vulnerability log according to the vulnerability trigger request, so that it can be determined whether there is a non-echo vulnerability in the system under test based on the vulnerability log.

[0062] Step 103, calling a preset query interface corresponding to the log platform to send a log query request, if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability.

[0063] Among them, the log platform is configured with a preset query interface, calling the preset query interface can send a log query request to the log platform, and the log query request is used to request to query the vulnerability log on the log platform. The vulnerability log is a log generated based on the vulnerability trigger request received by the log platform. This embodiment does not limit the content recorded in the vulnerability log. For example, the content recorded in the vulnerability log may include the original data of the vulnerability trigger request and / or the parsed information obtained by parsing the original data of the vulnerability trigger request, wherein the parsed information includes but is not limited to: vulnerability trigger time or vulnerability type.

[0064] It can be understood that if the log platform generates a vulnerability log by parsing the vulnerability trigger request, it means that the log platform has received the vulnerability trigger request, which means that the system under test has sent a vulnerability trigger request, that is, the system under test has scanned the vulnerability according to the load request.

[0065] In this embodiment, when it is necessary to obtain the scanning results of the vulnerability scan of the system under test, the test system can call the preset query interface in the log platform and send a log query request to the log platform. The log platform responds to the log query request to determine whether the vulnerability log is empty. If the vulnerability log is not empty, the test system can obtain the vulnerability log and determine whether there is a vulnerability in the system under test.

[0066] Optionally, a preset query interface corresponding to the log platform is called to send a log query request. If the vulnerability log is not obtained, it is determined that the system under test does not have a vulnerability. In this embodiment, the test system can call the preset query interface in the log platform and send a log query request to the log platform. The log platform determines whether the vulnerability log is empty in response to the log query request. If the vulnerability log is empty, the test system cannot obtain the vulnerability log and determines that there is no vulnerability in the system under test.

[0067] In an optional implementation, during the vulnerability scan, the test system sends a log query request to the log platform. The log platform responds to the log query request and detects whether the vulnerability log is empty. If the vulnerability log is not empty, it means that the test system can obtain the vulnerability log, and the log platform returns TRUE to the test system; if the vulnerability log is empty, it means that the test system cannot obtain the vulnerability log, and the log platform returns FALSE to the test system.

[0068] The simulation processing method provided by the embodiment of the present disclosure generates a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: the address information of the log platform; the load request is sent to the system to be tested to instruct the system to be tested to respond to the load request to perform vulnerability scanning, and a vulnerability trigger request is sent to the log platform according to the address information; the preset query interface corresponding to the log platform is called to send a log query request, and if the vulnerability log recorded by the log platform by parsing the vulnerability trigger request is obtained, it is determined that the system to be tested has a vulnerability. With the above technical solution, in the case where the vulnerability type to be detected is a no-echo vulnerability, if a vulnerability is scanned in the system to be tested, the system to be tested can send a vulnerability trigger request to the log platform, thereby generating a vulnerability log on the log platform, avoiding the situation in the related technology that even if the no-echo vulnerability is scanned, it cannot be discovered, and realizes the effective detection of the no-echo vulnerability, and can determine whether there is a no-echo vulnerability in the system to be tested based on the vulnerability log, thereby improving the efficiency and convenience of no-echo vulnerability detection.

[0069] At the same time, when detecting vulnerabilities such as SQL blind injection, the related technology needs to send a large amount of payload to the test system, but sending a large amount of payload is easily detected by the system to be tested or its protection equipment, thereby isolating most of the payload and failing to detect vulnerabilities in the system to be tested. However, in the vulnerability detection method provided in this embodiment, the vulnerability log recorded by the log platform can determine whether the system to be tested has a vulnerability, without sending a large amount of payload, reducing the amount of payload request packets, thereby improving the efficiency of vulnerability detection and avoiding vulnerability detection failures caused by excessive packet sending.

[0070] In some embodiments, there are multiple systems to be tested, and the vulnerability log includes the addresses of the systems to be tested. Figure 2 A flowchart of another vulnerability detection method provided by an embodiment of the present disclosure is shown in FIG. Figure 2 As shown in the figure, if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has vulnerabilities, including:

[0071] Step 201: If the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, the address of the system to be tested included in the vulnerability log is obtained.

[0072] In some embodiments, if there are multiple systems to be tested, the test system sends a load request to the multiple systems to be tested, and performs vulnerability scans on the multiple systems to be tested. If a vulnerability is scanned, a corresponding vulnerability trigger request is sent to the log platform. The log platform parses the vulnerability trigger request to generate a vulnerability log that records the system address of the system to be tested that sent the vulnerability trigger request. The type of the system address to be tested is not limited in this embodiment. For example, the system address to be tested can be the Internet Protocol Address (IP) address of the system to be tested.

[0073] Specifically, in this embodiment, during the process of parsing the vulnerability trigger request by the log platform, the log platform will extract the system under test address of the system under test that sends the vulnerability trigger request. When determining whether there is a vulnerability in the system under test, if the test system can obtain the vulnerability log, in order to determine the target system under test where the vulnerability exists among multiple systems under test, the system under test address in the vulnerability log is extracted.

[0074] Step 202: Determine whether a target system to be tested corresponding to the address of the system to be tested has a vulnerability.

[0075] The target system under test is a system under test whose address belongs to the address of the system under test in the vulnerability log.

[0076] Specifically, the address of the system under test recorded in the vulnerability log is matched with address information of multiple systems under test, and the system under test that is successfully matched is the target system under test, and the vulnerability exists in the target system under test.

[0077] The vulnerability detection method provided by the embodiment of the present disclosure can quickly determine the target system under test with a vulnerability in an application scenario where there are multiple systems under test by recording the system under test address of the system under test with a vulnerability, thereby improving the vulnerability detection efficiency.

[0078] Figure 3 The present invention provides a flowchart of a vulnerability detection method provided by an embodiment of the present invention. The method can be executed by a vulnerability detection device, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 3 As shown, the method is applied to the system to be tested, including:

[0079] Step 301: Perform vulnerability scanning in response to a load request sent by a test system.

[0080] In this embodiment, the test system simulates an attack by sending a load request to the system under test, and the system under test performs a vulnerability scan according to the received load request.

[0081] Step 302: If a vulnerability is found during scanning, a vulnerability triggering request is sent to the log platform according to the address information of the log platform.

[0082] In this embodiment, if the system under test finds a vulnerability according to the load request, in order to record the vulnerability found this time, the system under test sends a vulnerability trigger request to the log platform according to the address information of the log platform.

[0083] The vulnerability detection method provided by the embodiment of the present disclosure sends a vulnerability trigger request to the log platform through the system under test when a vulnerability is scanned by the system under test. When the vulnerability is a no-echo vulnerability, it can determine whether there is a vulnerability on the platform under test based on the vulnerability trigger request, thereby avoiding the situation where the no-echo vulnerability cannot be discovered.

[0084] Figure 4 The present invention provides a flowchart of a vulnerability detection method provided by an embodiment of the present invention. The method can be executed by a vulnerability detection device, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 4 As shown, the method is applied to the log platform and includes:

[0085] Step 401: In response to a vulnerability triggering request sent by the system to be tested, the vulnerability triggering request is parsed to generate a vulnerability log.

[0086] In this embodiment, the test system sends a vulnerability triggering request to the log platform. After receiving the vulnerability triggering request, the log platform parses the vulnerability triggering request, thereby generating a corresponding vulnerability log on the log platform.

[0087] Step 402, in response to the log query request sent by the test system, determining whether the vulnerability log is empty, and sending the vulnerability log to the test system if the vulnerability log is not empty.

[0088] When it is necessary to obtain the vulnerability detection results, the test system can send a log query request to the log platform. The log platform responds to the log query request sent by the test system, reads the vulnerability log, and determines whether the vulnerability log is empty. If the vulnerability log is not empty, it means that there is a vulnerability in the system under test, and the vulnerability log is sent to the test system; if the vulnerability is empty, it means that there is no vulnerability in the system under test, and the vulnerability log is not sent to the system under test.

[0089] The vulnerability detection method provided by the embodiment of the present disclosure generates a vulnerability log based on the vulnerability trigger request sent by the system to be tested through a log platform. Therefore, when the vulnerability is a non-echo vulnerability, it is possible to determine whether there is a vulnerability in the system to be tested based on the vulnerability log, thereby avoiding the situation where the non-echo vulnerability cannot be discovered.

[0090] Next, the vulnerability detection method in the embodiment of the present disclosure is further described by a specific example. Figure 5 A schematic diagram of a vulnerability detection method provided by an embodiment of the present disclosure. Figure 5 As shown, the method includes: a test system 501, a system to be tested 502, and an LDAP log platform 503. The test system 501 can send a payload request (payload) to the system to be tested 502. If the payload is successfully triggered in the system to be tested 502, an LDAP request is sent to the LDAP log platform 503, and the LDAP log platform 503 generates a vulnerability log according to the LDAP request. The test system 501 initiates a log query request to the LDAP log platform 503, and the LDAP log platform 503 queries the vulnerability log in response to the log query request, and sends the query result to the test system. If the vulnerability log is empty, the query result is FALSE, indicating that there is no vulnerability in the system to be tested 502; if the vulnerability log is not empty, the query result is TRUE, indicating that there is a vulnerability in the system to be tested 502.

[0091] For example, Figure 6 A flowchart of another vulnerability detection method provided by the embodiment of the present disclosure is shown as follows: Figure 6 As shown, the method includes:

[0092] Step 601: The test system sends a payload request to the system under test, wherein the test system may be a vulnerability scanning system or a security testing host, the type of the payload request is a Hyper Text Transfer Protocol (HTTP) request, and the payload request includes Ldap log platform address information.

[0093] Step 602: If there is a relevant vulnerability in the system under test, the payload is triggered, and the system under test sends an LDAP request to the LDAP log platform; if there is no relevant vulnerability in the system under test, the payload is not triggered and no LDAP request is sent to the LDAP log platform.

[0094] Step 603: After receiving the LDAP request sent by the system under test, the LDAP log platform generates a vulnerability log locally on the LDAP log platform.

[0095] Step 604: the test system calls a preset query interface to obtain a vulnerability log. If a vulnerability log is obtained, it is determined that a vulnerability exists in the system under test.

[0096] The vulnerability detection method provided in this embodiment provides a new way of verifying no-echo vulnerabilities by introducing the LDAP log platform, making the detection of no-echo vulnerabilities more concise and rapid. In addition, for some vulnerability types that require sending a large number of payload requests and are easily detected by the system to be tested, the use of the LDAP log platform can reduce the amount of packets sent and improve the efficiency of vulnerability detection.

[0097] Figure 7 Schematic diagram of a vulnerability detection device provided by an embodiment of the present disclosure. The device 700 can be implemented by software and / or hardware and can generally be integrated into an electronic device. Figure 7 As shown, the device is applied to a test system, including:

[0098] The generating module 701 is used to generate a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: address information of the log platform;

[0099] A first sending module 702 is used to send the load request to the system under test to instruct the system under test to perform vulnerability scanning in response to the load request, and send a vulnerability triggering request to the log platform according to the address information;

[0100] The first determination module 703 is used to call the preset interface of the log platform to send a log query request. If the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability.

[0101] In an optional implementation, the log platform includes a directory access protocol LDAP log platform, and the vulnerability triggering request includes a lightweight directory access protocol LDAP request.

[0102] In an optional implementation manner, the generating module 701 is specifically configured to:

[0103] In response to a vulnerability template triggering operation, determining the vulnerability type;

[0104] According to a preset vulnerability-load relationship, one or more load requests corresponding to the vulnerability type are determined.

[0105] In an optional implementation manner, the number of the systems to be tested is multiple, the vulnerability log includes the addresses of the systems to be tested, and the first determining module 703 is specifically configured to:

[0106] If the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, the address of the system to be tested included in the vulnerability log is obtained;

[0107] Determine whether a target system to be tested corresponding to the address of the system to be tested has a vulnerability.

[0108] In an optional implementation, the device further includes:

[0109] The second determination module is used to call the preset query interface corresponding to the log platform to send the log query request, and if the vulnerability log is not obtained, determine that there is no vulnerability in the system under test.

[0110] Figure 8 FIG. 8 is a schematic diagram of another vulnerability detection device provided in an embodiment of the present disclosure. The device 800 can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 8 As shown, the device is applied to the system to be tested, including:

[0111] Scanning module 801, used to perform vulnerability scanning in response to a load request sent by the test system;

[0112] The second sending module 802 is used to send a vulnerability triggering request to the log platform according to the address information of the log platform if a vulnerability is scanned.

[0113] Fig. 9 Schematic diagram of a vulnerability detection device provided by an embodiment of the present disclosure. The device 900 can be implemented by software and / or hardware and can generally be integrated into an electronic device. Fig. 9 As shown, the device is applied to a log platform and includes:

[0114] The parsing module 901 is used to respond to the vulnerability triggering request sent by the system under test, parse the vulnerability triggering request and generate a vulnerability log;

[0115] The judgment module 902 is used to respond to the log query request sent by the test system, judge whether the vulnerability log is empty, and send the vulnerability log to the test system if the vulnerability log is not empty.

[0116] The vulnerability detection device provided in the embodiments of the present disclosure can execute the vulnerability detection method provided in any embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Fig.10 The structure diagram of an electronic device provided by the embodiment of the present disclosure is shown in FIG. Fig.10 As shown, the electronic device 1000 includes one or more processors 1001 and a memory 1002 .

[0118] The processor 1001 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 1000 to perform desired functions.

[0119] The memory 1002 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 1001 may run the program instructions to implement the vulnerability detection method of the embodiment of the present disclosure described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0120] In one example, the electronic device 1000 may further include: an input device 1003 and an output device 1004 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0121] In addition, the input device 1003 may also include, for example, a keyboard, a mouse, and the like.

[0122] The output device 1004 can output various information to the outside, including the determined distance information, direction information, etc. The output device 1004 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0123] Of course, to simplify, Fig.10 Only some of the components related to the present disclosure in the electronic device 1000 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 1000 may also include any other appropriate components.

[0124] In addition to the above-mentioned method and device, the embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, and when the computer program instructions are executed by a processor, the processor executes the vulnerability detection method provided by the embodiment of the present disclosure.

[0125] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0126] In addition, the embodiment of the present disclosure may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the vulnerability detection method provided by the embodiment of the present disclosure.

[0127] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0128] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0129] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A vulnerability detection method, characterized in that: Applied to test systems, including: Generate a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: address information of a log platform, and the log platform includes a Lightweight Directory Access Protocol LDAP log platform; The load request is sent to the system under test to instruct the system under test to perform a vulnerability scan in response to the load request, and a vulnerability trigger request is sent to the log platform according to the address information; wherein the vulnerability trigger request is a request sent by the system under test after a vulnerability in the system under test is scanned, and the vulnerability trigger request includes a Lightweight Directory Access Protocol LDAP request, and there are multiple systems under test, and the systems under test include one or more of a database system, a mobile device system, a network device system, a middleware system, and a Web site system; Calling a preset query interface corresponding to the log platform to send a log query request, if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability; wherein the vulnerability log includes the address of the system under test; Wherein, generating a corresponding load request according to the vulnerability type to be detected includes: determining the vulnerability type in response to a vulnerability template trigger operation; determining one or more load requests corresponding to the vulnerability type according to a preset vulnerability-load relationship; wherein a vulnerability template is a template integrated with one or more vulnerability types, the vulnerability template is displayed to a user for selection through a front-end interface, the vulnerability template is used to retrieve a template type relationship, the template type relationship is pre-marked with a corresponding relationship between the vulnerability template and the vulnerability type, the preset vulnerability-load relationship records a corresponding relationship between the vulnerability type and the load request, and the vulnerability type is used to retrieve the preset vulnerability-load relationship; Among them, if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability, including: if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, the address of the system under test included in the vulnerability log is obtained; and it is determined that the target system under test corresponding to the address of the system under test has a vulnerability.

2. The method according to claim 1, characterized in that Also includes: The preset query interface corresponding to the log platform is called to send the log query request. If the vulnerability log is not obtained, it is determined that there is no vulnerability in the system under test.

3. A vulnerability detection method, characterized in that: Applied to a system to be tested, where there are multiple systems to be tested, and the system to be tested includes one or more of a database system, a mobile device system, a network device system, a middleware system, and a Web site system, including: Perform vulnerability scanning in response to a load request sent by a test system; wherein the load request is generated according to the vulnerability type to be detected, the load request includes address information of a log platform, the log platform includes a Lightweight Directory Access Protocol (LDAP) log platform, one or more of the load requests are determined according to a preset vulnerability-load relationship and correspond to the vulnerability type, the vulnerability type is determined in response to a vulnerability template trigger operation, the vulnerability template is a template integrated with one or more vulnerability types, the vulnerability template is displayed to a user for selection through a front-end interface, the vulnerability template is used to retrieve a template type relationship, the template type relationship is pre-marked with a correspondence between the vulnerability template and the vulnerability type, the preset vulnerability-load relationship records a correspondence between the vulnerability type and the load request, and the vulnerability type is used to retrieve the preset vulnerability-load relationship; If a vulnerability is scanned, a vulnerability trigger request is sent to the log platform according to the address information of the log platform, so that the test system calls the preset query interface corresponding to the log platform to send a log query request and determines that a vulnerability exists in the system under test when the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained; wherein the vulnerability trigger request includes a Lightweight Directory Access Protocol LDAP request; the determination of the existence of the system under test when the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained includes: obtaining the vulnerability log recorded by the log platform through parsing the vulnerability trigger request, obtaining the address of the system under test included in the vulnerability log; and determining that a vulnerability exists in the target system under test corresponding to the address of the system under test.

4. A vulnerability detection method, characterized in that: Applied to a log platform, the log platform includes a Lightweight Directory Access Protocol LDAP log platform, including: In response to a vulnerability triggering request sent by the system under test, the vulnerability triggering request is parsed to generate a vulnerability log; wherein the vulnerability triggering request is a request sent by the system under test after a vulnerability in the system under test is scanned, the vulnerability triggering request includes a Lightweight Directory Access Protocol LDAP request, the vulnerability triggering request is a vulnerability scan performed by the system under test in response to a load request sent by a test system and sent according to address information, the address information is included in the load request, the number of the systems under test is multiple, and the systems under test include one or more of a database system, a mobile device system, a network device system, a middleware system, and a Web site system , the vulnerability log includes the address of the system to be tested, one or more of the load requests are determined according to a preset vulnerability-load relationship and correspond to a vulnerability type, the vulnerability type is determined in response to a vulnerability template trigger operation, the vulnerability template is a template integrated with one or more vulnerability types, the vulnerability template is displayed to the user for selection through a front-end interface, the vulnerability template is used to retrieve the template type relationship, the template type relationship is pre-marked with a correspondence between the vulnerability template and the vulnerability type, the preset vulnerability-load relationship records a correspondence between the vulnerability type and the load request, and the vulnerability type is used to retrieve the preset vulnerability-load relationship; In response to a log query request sent by the test system calling a preset query interface, determining whether the vulnerability log is empty, and if the vulnerability log is not empty, sending the vulnerability log to the test system, so that if the test system obtains the vulnerability log recorded by the log platform through parsing the vulnerability trigger request, it is determined that the system under test has a vulnerability; Among them, if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability, including: if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, the address of the system under test included in the vulnerability log is obtained; and it is determined that the target system under test corresponding to the address of the system under test has a vulnerability.

5. A vulnerability detection device, characterized in that: Applications in test systems include: A generation module, used to generate a corresponding load request according to the vulnerability type to be detected, wherein the load request includes: address information of a log platform, and the log platform includes a Lightweight Directory Access Protocol LDAP log platform; A first sending module is used to send the load request to the system under test to instruct the system under test to perform a vulnerability scan in response to the load request, and send a vulnerability trigger request to the log platform according to the address information; wherein the vulnerability trigger request is a request sent by the system under test after a vulnerability in the system under test is scanned, and the vulnerability trigger request includes a Lightweight Directory Access Protocol LDAP request. There are multiple systems under test, and the systems under test include one or more of a database system, a mobile device system, a network device system, a middleware system, and a Web site system; A first determination module is used to call the preset interface of the log platform to send a log query request, and if a vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability; wherein the vulnerability log includes the address of the system under test; Wherein, the generation module is used to: determine the vulnerability type in response to the vulnerability template triggering operation; determine one or more load requests corresponding to the vulnerability type according to the preset vulnerability-load relationship; wherein the vulnerability template is a template integrated with one or more vulnerability types, the vulnerability template is displayed to the user for selection through the front-end interface, the vulnerability template is used to retrieve the template type relationship, the template type relationship is pre-marked with the corresponding relationship between the vulnerability template and the vulnerability type, the preset vulnerability-load relationship records the corresponding relationship between the vulnerability type and the load request, and the vulnerability type is used to retrieve the preset vulnerability-load relationship; Among them, if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, it is determined that the system under test has a vulnerability, including: if the vulnerability log recorded by the log platform through parsing the vulnerability trigger request is obtained, the address of the system under test included in the vulnerability log is obtained; and it is determined that the target system under test corresponding to the address of the system under test has a vulnerability.

6. An electronic device, characterized in that: The electronic device comprises: Processor and memory; The processor is used to execute the steps of the vulnerability detection method according to any one of claims 1 to 4 by calling the program or instruction stored in the memory.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute the steps of the vulnerability detection method according to any one of claims 1 to 4.

Images