A dynamic flag implementation method, device, equipment and medium

Abstract

The application discloses a dynamic flag implementation method, device, equipment and medium, and the method comprises the following steps: obtaining the target target machine authority, and sending flag request information to the referee machine by using the target target machine, wherein the flag request information comprises a team token; after the referee machine receives the flag request information, the corresponding flag is generated according to the team id corresponding to the team token, the IP of the target target machine and the current timestamp, and the generated flag is returned to the target target machine after being encrypted; after the target target machine receives the encrypted flag, if the referee machine receives the first string uploaded by the target target machine within a preset time limit, the first string comprising the team token and the flag, then the team obtains the corresponding score, and the corresponding flag is deleted. The application binds the generated flag with the team token and the request source IP address, avoids the generation of cheating behaviors, and solves the problem that the flag is repeatedly used by limiting the survival time of the flag.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information processing, and in particular to a dynamic flag implementation method and device, equipment and medium. BACKGROUND

[0002] AWD (Attack With Defence) is a popular form of information security competition. The general process is that the participating teams compete through attack and defense, program analysis, etc., and the first team to obtain a string of content with a certain format from the competition environment provided by the organizer and submit it to the organizer will win the score. In order to facilitate the call, such content is called "Flag". The existing flag generation methods can include three types, which are:

[0003] 1. Static flag, the player finds the hidden flag in the device.

[0004] The administrator configures all flags in advance when adding a competition or a drill, and embeds the flag in the virtual machine in advance. When the player successfully attacks the virtual machine, the hidden flag is found, and the flag is submitted to the platform after successfully finding it.

[0005] Potential problem: Since the flag is static and buried in the virtual machine, the player can directly submit the flag on the platform. Therefore, when there are multiple teams, a team that has successfully found the flag can inform other teams, resulting in other teams directly submitting the flag to score without actually attacking the device.

[0006] 2. No flag, live judge on-site scoring.

[0007] The competition site needs to have judges on patrol, and the judges need to be notified when the team successfully attacks the target device to score.

[0008] Potential problem: A large number of professional judges are needed to patrol the site and accurately determine whether the team has attacked the target device.

[0009] 3. Dynamic flag.

[0010] The flag submitted by each team is randomly generated and bound to the team, and the flag cannot be shared between different teams. This ensures that each team that submits the flag has indeed attacked the target machine. The flag submission behavior occurs in the virtual machine, and there is no need for a live judge to intervene in the scoring, and the entire process is fully automated.

[0011] However, the generated flag may still be reused in practice, and the existing dynamic flag generation method fails to solve the above technical problems. SUMMARY

[0012] The embodiment of the application provides a dynamic flag implementation method, device, equipment and medium, so that the generated flag can be bound to the attack team id, the generation of cheating behavior is avoided, and the problem that the flag is repeatedly used is solved.

[0013] Therefore, the first aspect of the application provides a dynamic flag implementation method, which comprises:

[0014] obtaining the target machine authority, and sending flag request information to the referee machine using the target machine, wherein the flag request information comprises an attack team token;

[0015] After the referee machine receives the flag request information, the corresponding flag is generated according to the team id corresponding to the attack team token, the target machine IP and the current timestamp, and the generated flag is returned to the target machine after being encrypted;

[0016] After the target machine receives the encrypted flag, if the referee machine receives the first string uploaded by the target machine within a preset time limit, the first string comprising the attack team token and the flag, the attack team obtains the corresponding score, and the corresponding flag is deleted.

[0017] Optionally, before the target machine authority is obtained, and the flag request information is sent to the referee machine using the target machine, the flag request information comprises an attack team token, and further comprises:

[0018] synchronizing the participating team information and the target machine information to the referee machine; the participating team information comprises the id, the team token and the team name of the participating team; and the target machine information comprises the id, the IP address, the name and the code string of the target machine.

[0019] Optionally, after the referee machine receives the flag request information, the corresponding flag is generated according to the team id corresponding to the attack team token, the target machine IP and the current timestamp, and the generated flag is returned to the target machine after being encrypted, and specifically comprises:

[0020] After the referee machine receives the flag request information, the corresponding flag is generated according to the team id corresponding to the attack team token, the target machine IP and the current timestamp, and the generated flag is returned to the target machine after being encrypted, and specifically comprises:

[0021] The team token in the flag request information is checked, and if the check fails, the flag request information is invalid;

[0022] The attack team is checked whether has submitted the flag corresponding to the target target machine through the team id corresponding to the attack team token and the submission record of the target machine, and if has submitted, the flag request information is invalid;

[0023] If the above checks are all successful, the flag is generated, the valid time of the flag is set, the generated flag is encrypted and returned to the target target machine, and the flag binds the attack team id, target target machine IP and target target machine id to which the flag belongs.

[0024] Optionally, if the referee machine receives the first string containing the attack team token and the flag uploaded by the target target machine within the preset time limit, the attack team obtains the corresponding score and deletes the corresponding flag, and the specific steps include:

[0025] After the referee machine receives the first string, the team id corresponding to the team token sent by the attack team is first checked whether matches the participating team, and the flag is checked whether matches the flag application record of the referee machine, if any item does not match, the submitted flag is invalid, and the first string includes the team token and the flag;

[0026] According to the flag application record and the set flag valid time, it is checked whether the submitted flag is overdue, if it is overdue, the submitted flag is invalid;

[0027] It is checked whether the team that submits and the team that applies for the flag is the same team, if it is not the same team, the submitted flag is invalid;

[0028] It is checked whether the IP information in the submitted request information matches the IP information in the flag application record, if it does not match, the submitted flag is invalid;

[0029] When the above checks are all passed, the database record of the successful flag submission is recorded, and the submission result is returned to the platform, the score obtained by the attack team is calculated, and the corresponding flag is deleted.

[0030] The second aspect of the application provides a dynamic flag implementation device, and the device comprises:

[0031] A request sending unit is configured to obtain target target machine authority, and send flag request information to a referee machine using the target target machine, wherein the flag request information includes an attack team token;

[0032] The first generating unit is configured to generate a corresponding flag according to the team id corresponding to the attack team token, the target target machine IP and a current time stamp when the referee machine receives the flag request information, and return the generated flag to the target target machine after encryption.

[0033] The first score obtaining unit is configured to obtain a corresponding score for the attack team and delete the corresponding flag if the referee machine receives a first string containing the attack team token and the flag uploaded by the target target machine within a preset time limit.

[0034] Optionally, the system further comprises:

[0035] The data synchronization unit is configured to synchronize the participating team information and the target machine information to the referee machine; the participating team information comprises an id, a team token and a team name of the participating team; and the target machine information comprises an id, an IP address, a name and a code string of the target machine.

[0036] Optionally, the first generating unit comprises:

[0037] The first checking unit is configured to, after receiving the flag request information, first check whether the IP of the target machine sending the flag request information corresponds to the IP of the target target machine; if the code string is contained in the flag request information, check whether the received code string corresponds to the code string of the target target machine; if the check on the IP or the code string fails, the flag request information is invalid.

[0038] The second checking unit is configured to check the team token in the flag request information; if the check fails, the flag request information is invalid.

[0039] The third checking unit is configured to check whether the attack team has submitted the flag corresponding to the target target machine by using the team id corresponding to the attack team token and the submission record of the target machine; if the attack team has submitted the flag, the flag request information is invalid.

[0040] The second generating unit is configured to, if the above checks are all successful, generate a flag, set an effective time of the flag, return the generated flag to the target target machine after encryption, and bind the attack team id to which the flag belongs, the target target machine IP and the target target machine id in the flag.

[0041] Optionally, the first score obtaining unit comprises:

[0042] The fourth checking unit is configured to, after the referee machine receives the first string, first check whether the team id corresponding to the attack team token sent by the attack team matches the participating team, and check whether the flag matches the flag application record of the referee machine, and if any of the checks fails, the submitted flag is invalid, and the first string includes the team token and the flag.

[0043] The fifth checking unit is configured to check whether the submitted flag is overdue according to the flag application record and the set flag validity time, and if the flag is overdue, the submitted flag is invalid.

[0044] The sixth checking unit is configured to check whether the submitted team and the team applying for the flag are the same team, and if not, the submitted flag is invalid.

[0045] The seventh checking unit is configured to check whether the IP information in the submitted request information matches the IP information in the flag application record, and if not, the submitted flag is invalid.

[0046] The second score obtaining unit is configured to, after the above checks pass, record the database record of the successful flag submission, return the submission result to the platform, calculate the score obtained by the attack team, and delete the corresponding flag.

[0047] The third aspect of the present application provides a dynamic flag implementation device, the device comprising a processor and a memory:

[0048] The memory is configured to store program code and transmit the program code to the processor.

[0049] The processor is configured to execute the steps of the dynamic flag implementation method according to the instructions in the program code.

[0050] The fourth aspect of the present application provides a computer readable storage medium for storing program code, and the program code is used to execute the method of the first aspect.

[0051] From the above technical solutions, the present application has the following advantages:

[0052] In the application, a dynamic flag implementation method is provided, including: obtaining target target machine authority, and sending flag request information to the referee machine using the target target machine, the flag request information including an attack team token; after the referee machine receives the flag request information, generating a corresponding flag according to the team id corresponding to the attack team token, the target target machine IP and the current timestamp, and returning the generated flag to the target target machine after encryption; after the target target machine receives the encrypted flag, if the referee machine receives a first string including the attack team token and the flag uploaded by the target target machine within a preset time limit, the attack team obtains corresponding scores, and deletes the corresponding flag.

[0053] In the application, the flag request information is sent to the referee machine, the flag request information including an attack team token, the generated flag being related to the id of the attack team, the target target machine IP and the current timestamp, so that the generated flag is bound to the identification of the attack team and the current timestamp, so that the generated flag is not easily used by other teams, and the survival time of the received flag is also limited, avoiding repeated use of the flag. BRIEF DESCRIPTION OF DRAWINGS

[0054] Figure 1 The method flowchart of one embodiment of the dynamic flag implementation method of the application;

[0055] Figure 2 The method flowchart of another embodiment of the dynamic flag implementation method of the application;

[0056] Figure 3 The structural schematic diagram of one embodiment of the dynamic flag implementation device of the application. DETAILED DESCRIPTION

[0057] In the application, the flag request information is sent to the referee machine, the flag request information including an attack team token, the generated flag being related to the id of the attack team, the target target machine IP and the current timestamp, so that the generated flag is bound to the identification of the attack team and the current timestamp, so that the generated flag is not easily used by other teams, and the survival time of the received flag is also limited, avoiding repeated use of the flag.

[0058] In order to enable personnel in the art to better understand the application scheme, the technical solutions in the embodiments of the application will be clearly and completely described below in conjunction with the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0059] Figure 1 A method flow chart of one embodiment of the dynamic flag implementation method of the present application is shown in Figure 1 Figure 1

[0060] 101. Obtain the authority of the target machine, and use the target machine to send flag request information to the referee machine, the flag request information including the attack team token;

[0061] It should be noted that the attack team first needs to occupy the corresponding target machine, and after obtaining the authority of the target machine, the target machine is used to send flag request information to the specified url (uniform resource locator, also known as web address, which is the standard address of resources on the Internet) of the referee machine. The flag request information needs to include the attack team token, so that the referee machine generates the corresponding flag according to the flag request information.

[0062] 102. After the referee machine receives the flag request information, the corresponding flag is generated according to the team id corresponding to the attack team token, the target machine IP and the current timestamp, and the generated flag is encrypted and returned to the target machine;

[0063] It should be noted that when the referee machine receives the flag request information, the referee machine can generate the corresponding flag according to the team id corresponding to the attack team token, the target machine IP and the current timestamp. At this time, the generated flag contains the unique identification id of the attack team, and also includes the current timestamp or the sum of the current timestamp and the flag survival time, so that the referee machine can judge whether the received flag is overdue or whether the received flag is generated by the attack team at the last time when the referee machine receives the flag uploaded by the target machine. When the referee machine generates the flag, the flag can be encrypted and returned to the target machine.

[0064] 103. After the target machine receives the encrypted flag, if the referee machine receives the first string uploaded by the target machine within a predetermined time limit, the first string including the attack team token and the flag, the attack team obtains the corresponding score, and deletes the corresponding flag.

[0065] ​​It should be noted that after the target target machine receives the encrypted flag, since the generated flag has a time to live limit, the attack team needs to send the flag and the attack team token to the judge machine within the preset time limit; if the judge machine receives the first string uploaded by the target target machine containing the attack team token and the flag within the preset time limit, it is determined that the attack team completes the submission of the flag within the preset time, and the attack team is given corresponding scores according to the completion, and the flag is deleted to avoid repeated use or use by other teams. Of course, in the present application, if it is judged that the current attack team cannot score, the flag will be temporarily saved; if the judge machine does not receive the flag within the preset time limit, the flag in the judge machine will also be deleted after the preset time limit, that is, if the flag is received after the preset time limit, it will be determined that the attack team cannot score.

[0066] The present application sends flag request information to the judge machine, the flag request information includes the attack team token, the generated flag is related to the id of the attack team, the target target machine IP and the current timestamp, so that the generated flag is bound with the identification of the attack team and the current timestamp, so that the generated flag is not easy to be used by other teams, and the survival time of the received flag is also limited, avoiding repeated use of the flag.

[0067] Figure 2 For another embodiment of the method flowchart of the dynamic flag implementation method of the present application, as shown in Figure 2 Figure 2

[0068] 201, synchronize the participating team information and the target machine information to the judge machine; the participating team information includes the id, team token and team name of the participating team; the target machine information includes the id, IP address, name and code string of the target machine;

[0069] It should be noted that the implementation logic of the dynamic flag in the present application is uniformly placed in the judge machine, and the judge machine refers to a virtual machine or a Docker container running a web service. The main function of the web service is to receive the flag request information of the participating team and generate a random flag string, and receive the flag string submitted by the participating team. Since only the flag submitted by the target target machine is valid, when the scene is built, the network connectivity of the judge machine and the target target machine should be ensured.

[0070] ​​In a specific embodiment, when a competition scene is created, the referee machine is also created at this time, the referee service is running on the referee machine, the database of the referee machine has no data at this time, and the referee machine cannot accept the flag submission of the players in the scene, and the referee machine does not know the information of the platform and cannot interact. Therefore, the user needs to use the rehearsal control function to issue rehearsal data to the referee machine. The issued data includes:

[0071] The unique id of the current rehearsal, after the referee machine obtains it, the rehearsal id and the IP information of the online competition platform will be stored, and these information will be used for subsequent communication. The team unique id, name and token of the team participating in the current rehearsal are sent to the referee machine. According to the score setting in the rehearsal, the corresponding virtual machine information is queried to assemble the target machine data and send it to the referee machine. Through the above steps, the state of the referee machine is truly ready.

[0072] Since the referee machine is a general component, the data required for each competition is not in the referee machine itself, and needs to be synchronized from the online competition platform. The data for synchronization includes two points: 1. Team information, including team unique id, team token and team name; 2. Target machine information, including target machine unique id, IP address, target machine name and code string. The specific contents are shown in the following table:

[0073] Team Table: team

[0074]

[0075] Target machine Table: target

[0076]

[0077]

[0078] 202、Obtain the target machine permission, and use the target machine to send a flag request information to the referee machine, the flag request information including the attack team token;

[0079] It should be noted that the attack team first needs to occupy the corresponding target machine, and then uses the target machine to send a flag request information to the specified url of the referee machine, and the flag request information needs to include the attack team token, so that the referee machine generates a corresponding flag according to the flag request information. The flag request information character sent in this application also includes the id of the attack team, the team token and the IP address of the target machine, and if the code string exists in the target machine, the code string can also be included in the flag request information character.

[0080] For example, the flag request information character can be http: / / 10.0.1.242 / flag?token=dasddwdwd. When the target target machine contains the code character string, the code character string also needs to be carried in the request parameter, and the format of the flag request information is http: / / 10.0.1.242 / flag?token=123dasdad&code=thisiscode.

[0081] 203. The referee machine receives the flag request information, first verifies whether the IP of the target machine sending the flag request information corresponds to the IP of the target target machine; if the flag request information contains the code character string, it is also verified whether the received code character string corresponds to the code character string of the target target machine; if the IP or the code character string fails the verification, the flag request information is invalid;

[0082] It should be noted that when the referee machine receives the flag request information, it can first verify whether the IP of the target machine sending the flag request information corresponds to the IP of the target target machine, and when the flag request information contains the code character string, it is also verified whether the received code character string corresponds to the code character string of the target target machine; if the IP or the code character string fails the verification, the flag request information is invalid. That is, it is necessary to detect whether the flag request information is sent by the target target machine, and to exclude information sent by other target machines.

[0083] 204. The team token in the flag request information is verified, and if the verification fails, the flag request information is invalid;

[0084] It should be noted that after the IP of the target target machine is detected, the referee machine can verify the team token in the flag request information, obtain the id corresponding to the team token, and determine whether the flag request information is sent by the participating team, so as to avoid interference of non-participating teams in the competition.

[0085] 205. By attacking the team id corresponding to the team token and the submission record of the target machine, it is verified whether the attack team has submitted the flag corresponding to the target target machine, and if so, the flag request information is invalid;

[0086] It should be noted that by judging the attack team token in the flag request information and the submission record of the target machine, it is determined whether the attack team has submitted the flag uploaded by the target target machine, and if so, the flag request information is invalid.

[0087] 206、If the above checks are all successful, a flag is generated, and the effective time of the flag is set. The generated flag is encrypted and returned to the target machine. The flag binds the attack team id, target machine IP, and target machine id.

[0088] It should be noted that when the above checks are completed, the judge machine determines that the flag string can be generated, and the encrypted flag string is issued to the target machine corresponding to the attack team. In addition, the application can set the effective time of the generated flag string, which is used for subsequent timeout detection of the received flag by the judge machine, so that the attack team needs to submit the flag in time within the effective time, otherwise it needs to be re-applied. The generated flag record is shown in the following table:

[0089] Flag Table: flag

[0090] Field Meaning id Unique identification flag 32-bit random string timestamp Time when the flag is generated, used to determine whether the flag is expired team_id Team id to which the flag belongs ip IP of the requested target machine deleted Logical deletion, updated to True when the user successfully submits the flag target_id Unique identification of the target target machine, used to avoid repeated submission

[0091] 207、After the judge machine receives the first string, it first checks whether the team id corresponding to the team token sent by the attack team matches the participating team, and checks whether the flag matches the flag application record of the judge machine. If any item does not match, the submitted flag is invalid. The first string includes the team token and the flag;

[0092] It should be noted that after the attack team receives the flag string, it needs to submit the flag to the judge machine within a specified time. The format of the first string submitted by the target machine to the judge machine is: http: / / 10.0.1.242 / flag?token=adsadwdw&flag=dadwdadawd. After the judge machine receives the first string, it can compare the token, flag, and request IP of the attack team to determine whether the submission is valid.

[0093] Specifically, first, the team token sent by the attack team can be checked to determine whether it matches the participating team, and the flag can be checked to determine whether it matches the flag application record of the judge machine, i.e., whether the target machine has sent a flag. If any item does not match, the submitted flag is invalid. The first string includes the team token token and the flag.

[0094] 208、According to the flag application record and the set flag effective time, it is checked whether the submitted flag is overdue. If it is overdue, the submitted flag is invalid;

[0095] 209. Verify whether the submitted team and the team applying for the flag are the same team, if not the same team, the submitted flag is invalid;

[0096] 210. Verify whether the IP information in the submitted request information matches the IP information in the flag application record, if not matched, the submitted flag is invalid;

[0097] It should be noted that the IP information in the submitted flag request information matches the IP information in the flag application record, if not matched, the submitted flag is invalid, that is, only when the target machine applying for the flag and the target machine submitting the flag are the same correct target machine, the submitted flag is valid.

[0098] 211. After the above verifications are passed, the database record of the successful flag submission is recorded, and the submission result is returned to the platform, the score obtained by the attack team is calculated, and the corresponding flag is deleted.

[0099] It should be noted that when the above verifications are passed, the submission information can be recorded in the database for detecting the data submitted by the target machine to the judge machine in the future. In addition, when the current flag is submitted successfully, the online competition platform can calculate the score of the attack team corresponding to the flag, and delete the flag.

[0100] The above is an embodiment of the method of the application, and the application also provides an embodiment of a dynamic flag implementation device, as shown in Figure 3 The device comprises:

[0101] The request sending unit 301 is configured to obtain the target target machine permission, and send the flag request information to the judge machine using the target target machine, wherein the flag request information comprises an attack team token;

[0102] The first generation unit 302 is configured to generate the corresponding flag according to the attack team id, the target target machine IP and the current timestamp when the judge machine receives the flag request information, and return the generated flag to the target target machine after encryption;

[0103] The first score acquisition unit 303 is configured to, after the target target machine receives the encrypted flag, if the judge machine receives the first string uploaded by the target target machine within a preset time limit, the first string comprising the attack team token and the flag, the attack team obtains the corresponding score, and the corresponding flag is deleted.

[0104] In a specific embodiment, the device further comprises:

[0105] The data synchronization unit is configured to synchronize the participating team information and the target machine information to the referee machine; the participating team information comprises an id, a team token and a team name of the participating team; and the target machine information comprises an id, an IP address, a name and a code string of the target machine.

[0106] In a specific embodiment, the first generating unit 302 further comprises:

[0107] The first checking unit is configured to, after receiving the flag request information, first check whether the IP of the target machine corresponding to the target machine sending the flag request information; if the code string is contained in the flag request information, check whether the received code string corresponds to the code string of the target machine; if the check of the IP or the code string fails, the flag request information is invalid.

[0108] The second checking unit is configured to check the team token in the flag request information; if the check fails, the flag request information is invalid.

[0109] The third checking unit is configured to check whether the attacking team has submitted the flag corresponding to the target machine by attacking the team id corresponding to the team token and the submission record of the target machine; if the attacking team has submitted the flag, the flag request information is invalid.

[0110] The second generating unit is configured to, if the above checks are all successful, generate a flag, set the valid time of the flag, encrypt the generated flag and return the encrypted flag to the target machine, and bind the flag with the attacking team id, the target machine IP and the target machine id to which the flag belongs.

[0111] The first score obtaining unit 303 comprises:

[0112] The fourth checking unit is configured to, after the referee machine receives the first string, first check whether the team id corresponding to the attacking team token sent by the attacking team matches the participating team, and check whether the flag matches the flag application record of the referee machine; if any of the checks fails, the submitted flag is invalid; the first string comprises the team token and the flag.

[0113] The fifth checking unit is configured to check whether the submitted flag is overdue according to the flag application record and the set valid time of the flag; if the flag is overdue, the submitted flag is invalid.

[0114] The sixth checking unit is configured to check whether the submitted team and the team applying for the flag are the same team; if the teams are not the same, the submitted flag is invalid.

[0115] A seventh checking unit is configured to check whether the IP information in the submitted request information matches the IP information in the flag application record, and if not, the submitted flag is invalid.

[0116] A second score obtaining unit is configured to record the database record of the successful flag submission when the above checks are passed, return the submission result to the platform, calculate the score obtained by the attack team, and delete the corresponding flag.

[0117] The application further provides an embodiment of a dynamic flag implementation device, which comprises a processor and a memory.

[0118] The application further provides an embodiment of a computer readable storage medium, which is configured to store program code, and the program code is configured to execute the embodiment of the dynamic flag implementation method.

[0119] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described herein.

[0120] The terms "first", "second", "third", "fourth" and the like in the specification of the application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0121] It should be understood that, in the application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B, and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the front and rear associated objects. "At least one of the following" or the like means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b, and c can be single or multiple.

[0122] In several embodiments provided in the application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division, and actual implementation can have another division manner. For example, a plurality of units or components can be combined or integrated into another system, or some features can be omitted or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0123] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0124] In addition, each functional unit in each embodiment of the application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0125] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (English full name: Read-Only Memory, English abbreviation: ROM), a random access memory (English full name: Random Access Memory, English abbreviation: RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0126] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for dynamic flag implementation, the method comprising: The application comprises the following steps: Synchronizing the information of participating teams and target machines to a referee machine; the information of participating teams comprises the id, team token and team name of participating teams; the information of target machines comprises the id, IP address, name and code string of target machines; Obtaining the authority of a target target machine, and sending a flag request information to the referee machine by using the target target machine, wherein the flag request information comprises an attack team token; The referee machine receives the flag request information, and firstly verifies whether the IP of the target machine sending the flag request information corresponds to the IP of the target target machine; if the code string is contained in the flag request information, it is simultaneously verified whether the received code string corresponds to the code string of the target target machine; If the verification of the IP or the code string fails, the flag request information is invalid; The team token in the flag request information is verified, and if the verification fails, the flag request information is invalid; It is verified whether the attack team has submitted the flag corresponding to the target target machine through the team id corresponding to the attack team token and the submission record of the target machine, and if the attack team has submitted the flag, the flag request information is invalid; If the above verifications are all successful, a flag is generated, the effective time of the flag is set, the generated flag is encrypted and returned to the target target machine, and the attack team id, target target machine IP and target target machine id corresponding to the flag are bound in the flag; After the referee machine receives the first string, it firstly verifies whether the team id corresponding to the team token sent by the attack team matches the participating team, and verifies whether the flag matches the flag application record of the referee machine, if any of the above is not matched, the submitted flag is invalid, and the first string comprises a team token and a flag; According to the flag application record and the set flag effective time, it is verified whether the submitted flag is overdue, and if the flag is overdue, the submitted flag is invalid; It is verified whether the submitted team and the team applying for the flag are the same team, and if they are not the same team, the submitted flag is invalid; It is verified whether the IP information in the submitted request information matches the IP information in the flag application record, and if they do not match, the submitted flag is invalid; After the above verifications are all passed, the database record of the successful flag submission is recorded, and the submission result is returned to the platform, the score obtained by the attack team is calculated, and the corresponding flag is deleted.

2. A dynamic flag implementation apparatus, characterized by, The application comprises the following steps: A data synchronization unit is configured to synchronize the information of participating teams and target machines to a referee machine; the information of participating teams comprises the id, team token and team name of participating teams; the information of target machines comprises the id, IP address, name and code string of target machines; A request sending unit is configured to obtain the authority of a target target machine, and send a flag request information to the referee machine by using the target target machine, wherein the flag request information comprises an attack team token; The first generation unit is configured to generate a corresponding flag according to the team ID corresponding to the attack team token, the target target machine IP, and a current timestamp when the referee machine receives the flag request information, and return the generated flag after encryption to the target target machine; The first score acquisition unit is configured to, when the target target machine receives the encrypted flag, if the referee machine receives a first string including the attack team token and the flag uploaded by the target target machine within a preset time limit, the attack team acquires a corresponding score, and deletes the corresponding flag; The first generation unit includes: The first verification unit is configured to, after receiving the flag request information, first verify whether the IP of the target machine sending the flag request information corresponds to the IP of the target target machine; if the flag request information includes the code string, verify whether the received code string corresponds to the code string of the target target machine; if the verification of the IP or the code string fails, the flag request information is invalid; The second verification unit is configured to verify the team token in the flag request information; if the verification fails, the flag request information is invalid; The third verification unit is configured to verify whether the attack team has submitted the flag corresponding to the target target machine through the team ID corresponding to the attack team token and the submission record of the target machine; if the attack team has submitted the flag, the flag request information is invalid; The second generation unit is configured to, if the above verifications are all successful, generate a flag, set the valid time of the flag, return the generated flag to the target target machine after encryption, and bind the attack team ID, target target machine IP, and target target machine ID of the flag in the flag; The first score acquisition unit includes: The fourth verification unit is configured to, after the referee machine receives the first string, first verify whether the team ID corresponding to the attack team token sent by the attack team matches the participating team, and verify whether the flag matches the flag application record of the referee machine; if any of the above does not match, the submitted flag is invalid. The first string includes the team token and the flag; The fifth verification unit is configured to verify whether the submitted flag is overdue according to the flag application record and the set valid time of the flag; if the flag is overdue, the submitted flag is invalid; The sixth verification unit is configured to verify whether the submitted team and the team applying for the flag are the same team; if they are not the same team, the submitted flag is invalid; The seventh verification unit is configured to verify whether the IP information in the submitted request information matches the IP information in the flag application record; if the IP information does not match, the submitted flag is invalid. The second score obtaining unit is configured to record the database record of the successful flag submission when the above checks are passed, return the submission result to the platform, calculate the score obtained by the attack team, and delete the corresponding flag.

3. A dynamic flag implementation device, characterized by The device comprises a processor and a memory: The memory is configured to store program code and transmit the program code to the processor; The processor is configured to execute the dynamic flag implementation method according to the instructions in the program code.

4. A computer-readable storage medium, characterized in that, The computer readable storage medium is configured to store program code, and the program code is configured to execute the dynamic flag implementation method.

Images