Remote penetration system and penetration method based on openwrt system

Abstract

The present application relates to a remote penetration system and penetration method of an openwrt system, which belongs to the field of data communication, and includes a penetration data acquisition terminal and a penetration test platform; the penetration data acquisition terminal includes: an identity authentication module for driving a data acquisition module; a data acquisition module for uploading attribute information and scale information to a penetration test platform, and receiving test task information returned by the penetration test platform; a data identification module for identifying the attack frequency of each target attack terminal and the attack program of each target attack terminal contained in the test task information; a data processing module for attacking the corresponding target attack terminal according to the identification result of the data identification module and a preset attack model; and a logic output module for outputting actual test information to the penetration test platform when the test is completed; the penetration test platform obtains test result information according to the actual test information and feedback test information. The present application has the effect of reducing the cost of penetration testing.

Description

Technical Field

[0001] The present application relates to the field of data communication, and in particular to a remote penetration system and penetration method based on an OpenWRT system. Background Art

[0002] In order to find security vulnerabilities in the network environment, it is often necessary to conduct penetration testing on the network environment. Penetration testing is an authorized simulated attack on a computer system to evaluate its security and provide a mechanism to prove that network defense is operating normally as expected.

[0003] Currently, the various vulnerability security tools known to the public have high entry barriers, requiring Internet application administrators to be familiar with attack and defense technical knowledge and constantly research new methods and technologies. In addition, testing from vulnerability discovery to vulnerability exploitation takes a lot of time. Therefore, the current penetration test has the defect of high cost. Summary of the invention

[0004] The present application provides a remote penetration system and a penetration method based on the OpenWRT system, which has the characteristic of reducing the cost of penetration testing.

[0005] The first purpose of this application is to provide a remote penetration system based on the openwrt system.

[0006] The above-mentioned application objective 1 of the present application is achieved through the following technical solutions:

[0007] A remote penetration system based on the openwrt system, including a penetration data collection terminal and a penetration test platform;

[0008] The penetration data acquisition terminal includes an identity authentication module, a data acquisition module, a data identification module, a data processing module and a logic output module;

[0009] The identity authentication module is used to receive the identity information output by the penetration testing platform, and is used to output a driving instruction when the identity information meets the preset identity authentication information;

[0010] The data acquisition module is used to upload its own attribute information and the collected scale information of the test environment to the penetration testing platform when receiving the driving instruction, and receive the test task information returned by the penetration testing platform within a first preset time period thereafter;

[0011] The data identification module is used to identify the target attack terminal, the attack frequency of each target attack terminal and the attack program of each target attack terminal contained in the test task information, wherein the target attack terminal is a network device to be subjected to penetration testing in the test environment;

[0012] The data processing module is used to attack the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and the preset attack model, and the data processing module is also used to output a forwarding instruction to the logic output module after the attack is completed;

[0013] The logic output module is used to output actual test information to the penetration testing platform upon receiving a forwarding instruction;

[0014] The penetration testing platform is used to generate test result information based on the actual test information and feedback test information uploaded by the test environment.

[0015] By adopting the above technical solution, the penetration test platform and the penetration data collection terminal cooperate with each other to achieve the purpose of intelligent penetration testing, and because it is a fully automated process, it saves time and labor costs. Furthermore, since the actual test information is generated by the penetration data collection terminal during the actual test process, and the feedback test information is the information generated by the test environment based on the penetration test reflection of the penetration data collection terminal, when the test result information is obtained from the actual test information and the feedback test information, it is convenient for technicians to repair the test environment in a targeted manner based on the test result information, so the test time from vulnerability discovery to vulnerability exploitation is reduced, thereby reducing the overall cost of penetration testing.

[0016] In a preferred example, the present application can be further configured as follows: the penetration data collection terminal also includes a network support module, and the network support module is used to provide network traffic for an external client connected to the penetration data collection terminal.

[0017] In a preferred example, the present application can be further configured as follows: the penetration data collection terminal also includes a VPN module, and the VPN module is used for an external client to remotely control the penetration data collection terminal.

[0018] In a preferred example, the present application can be further configured as follows: the penetration data acquisition terminal also includes a storage module, and the storage module is used to store the attribute information.

[0019] In a preferred example, the present application can be further configured as follows: the penetration data acquisition end also includes a power supply module, and the power supply module is used to supply power to the identity authentication module, the data acquisition module, the data identification module, the data processing module and the logic output module.

[0020] The second purpose of this application is to provide a remote penetration method based on the OpenWRT system.

[0021] The second application objective of the present application is achieved through the following technical solutions:

[0022] A remote penetration method based on the openwrt system, applied to the penetration data collection end, including:

[0023] Obtain identity information;

[0024] Determining whether the identity information conforms to preset identity authentication information;

[0025] If yes, retrieve the attribute information and the collected scale information of the test environment, and upload the attribute information and scale information to the penetration testing platform;

[0026] After uploading the attribute information and scale information, receiving the test task information returned by the penetration testing platform within a first preset time period;

[0027] Identifying the target attack terminals, the attack frequency of each target attack terminal, and the attack program of each target attack terminal included in the test task information;

[0028] Attack the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and the preset attack model, wherein the target attack terminal is a network device to be subjected to penetration testing in the test environment;

[0029] Determine whether the attack target terminal is completed;

[0030] If so, the actual test information is output to the penetration testing platform.

[0031] By adopting the above technical solution, during the working process of the penetration data collection end: first, the user is authenticated, and then the target attack terminal is gradually penetrated according to the test task information, and the actual results of the penetration test are transmitted to the test platform. Since the penetration test process of the penetration data collection end is an intelligent test process, the penetration test of the network equipment in the test environment can be realized without manual operation, thereby reducing the labor cost and time cost, that is, reducing the cost of penetration testing.

[0032] In a preferred example, the present application can be further configured as follows: the step of attacking the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and the preset attack model includes:

[0033] Unifying the attack frequency unit of each target attack terminal to obtain a first value;

[0034] Calculating the data packet size of the attack program of each target attack terminal to obtain a second value;

[0035] Calculate the product of the first value and the second value corresponding to each target attack terminal to obtain an attack value;

[0036] Arrange the attack value corresponding to each target attack terminal in order from small to large to obtain an attack list;

[0037] Retrieving a preset attack level list, the level list includes a first level, a second level, and a third level, the first level corresponds to a first range, the second level corresponds to a second range, and the third level corresponds to a third range;

[0038] Setting the target attack terminal whose attack value is within the first range to the first level;

[0039] Setting the target attack terminal whose attack value is within the second range to the second level;

[0040] Setting the target attack terminal whose attack value is in the third range to the third level;

[0041] The target attack terminals in the attack list are attacked in the order of the first level, the second level, and the third level.

[0042] The third purpose of this application is to provide a remote penetration method based on the OpenWRT system.

[0043] The third application objective of this application is achieved through the following technical solutions:

[0044] A remote penetration method based on the openwrt system, applied to a penetration testing platform, including:

[0045] Receive identity information input by the user;

[0046] Receive the attribute information and scale information uploaded by the penetration data collection terminal, and obtain the test task information according to the attribute information, scale information and the preset test model;

[0047] The actual test information output by the penetration data collection terminal and the feedback test information uploaded by the test environment are obtained, and the test result information is obtained based on the actual test information and the feedback information.

[0048] By adopting the above technical solution, on the one hand, the penetration test platform can cooperate with the penetration data collection terminal to achieve the purpose of intelligent penetration testing. On the other hand, the penetration test platform can obtain test result information based on actual test information and feedback test information, so that technicians can repair the test environment in a targeted manner based on the test result information, thereby reducing the test time from vulnerability discovery to vulnerability exploitation, that is, reducing the time cost of penetration testing.

[0049] In a preferred example, the present application can be further configured as follows: the step of obtaining the test task information according to the attribute information, the scale information and the preset test model includes:

[0050] Determine the attack frequency threshold of the penetration data collection terminal according to the attribute information;

[0051] Determine the target attack terminal of the attack based on the scale information and the preset selection rules;

[0052] Retrieve a preset data table, wherein the column header of the data table is an attack program, the horizontal header of the data table is an attack frequency range, and the terminal, gateway, and main control end in the test environment correspond to attack programs of three attack frequency ranges respectively;

[0053] According to the attack frequency threshold, the target attack terminal and the matching rule, the attack frequency of each target attack terminal and the attack program of each target attack terminal are matched in the data table;

[0054] The target attack terminal, the attack frequency of each target attack terminal, and the attack program of each target attack terminal are collected to form the test task information.

[0055] In summary, the present application includes at least one of the following beneficial technical effects:

[0056] 1. On the one hand, the penetration testing platform can cooperate with the penetration data collection terminal to achieve the purpose of intelligent penetration testing, and because it is a fully automated process, it saves time and labor costs;

[0057] 2. On the other hand, the actual test information is generated by the penetration data collection end during the actual test process, and the feedback test information is the information generated by the test environment based on the penetration test reflection of the penetration data collection end. Therefore, when the test result information is obtained from the actual test information and the feedback test information, it is convenient for technical personnel to repair the test environment in a targeted manner based on the test result information, thereby reducing the test time from vulnerability discovery to vulnerability exploitation, which further reduces the time cost of penetration testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a block diagram of a remote penetration system based on the openwrt system in an embodiment of the present application.

[0059] Figure 2 This is a flow chart of a remote penetration method based on an openwrt system applied to a penetration data collection terminal according to an embodiment of the present application.

[0060] Figure 3 This is an example diagram of the penetration testing platform generating test task information according to an embodiment of the present application.

[0061] Figure 4 This is a flow chart of a remote penetration method based on an openwrt system applied to a penetration testing platform in an embodiment of the present application.

[0062] Explanation of the accompanying drawings: 1. Penetration data collection terminal; 11. Identity authentication module; 12. Data acquisition module; 13. Data identification module; 14. Data processing module; 15. Logical output module; 16. Network support module; 17. VPN module; 2. Penetration testing platform. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] This application provides a remote penetration system based on the openwrt system. Figure 1 The penetration system includes a penetration data collection terminal 1 and a penetration testing platform 2.

[0065] The penetration data collection terminal 1 includes an identity authentication module 11, a data acquisition module 12, a data identification module 13, a data processing module 14 and a logic output module 15. The identity authentication module 11, the data acquisition module 12, the data identification module 13, the data processing module 14 and the logic output module 15 are connected in sequence.

[0066] The penetration data collection terminal 1 also includes a network support module 16, a VPN module 17, a storage module and a power supply module. Furthermore, the network support module 16 is such as a 4G / 5G network card, and the network support module 16 is used to provide network traffic for external clients connected to the penetration data collection terminal 1. The VPN module 17 is used to provide technical support for external clients to connect to the penetration data collection terminal 1. The storage module is used to store the attribute information of the penetration data collection terminal 1, and the attribute information includes the ID number of the penetration data collection terminal 1, the attack frequency threshold and the available time. The attack frequency threshold is the maximum amount of data that passes through the link of the penetration data collection terminal 1 per unit time. The power supply module is used to supply power to the identity authentication module 11, the data acquisition module 12, the data identification module 13, the data processing module 14, the logic output module 15, the network support module 16, the VPN module 17 and the storage module.

[0067] The penetration testing platform 2 includes a server and a display. In practical applications, the number of servers and displays can be increased as needed. The operating system of the server can be an Android system or an Apple iOS system, which is not specifically limited in the present embodiment of the application.

[0068] The penetration test platform 2 is connected to the penetration data acquisition terminal 1 and the network device in the test environment. The penetration test platform 2 can be connected to one penetration data acquisition terminal 1, or it can be connected to multiple penetration data acquisition terminals 1 at the same time, and is used to cooperate with the penetration test acquisition terminal connected to it to attack the network device in the test environment. It should be noted that the test environment is a network environment to be subjected to penetration testing, such as a public network environment or a pure intranet environment with high security requirements. In the test environment, the network devices include terminals, gateways, and master control terminals. In the test environment of this embodiment, no matter it is a terminal, a gateway or a master control terminal, as long as it is the object to be attacked, it is a target attack terminal, that is, the target attack terminal is a network device to be subjected to penetration testing in the test environment.

[0069] This application also provides a remote penetration method based on the openwrt system, refer to Figure 2 The penetration method is applied to the penetration data collection terminal 1, and the main process is described as follows:

[0070] Step S11: Obtain identity information and determine whether the identity information conforms to the preset identity authentication information. If so, proceed to the next step.

[0071] The identity information is the personal identity information that the user transmits remotely to the penetration data collection terminal 1 through the penetration test platform 2. Each penetration data collection terminal 1 stores preset identity authentication information. When the identity information received by the penetration data collection terminal 1 is the same as the identity authentication information stored internally, the user can remotely operate the penetration data collection terminal 1 through the penetration test platform 2. Setting the identity authentication information is to prevent non-management personnel from maliciously performing penetration tests on the test environment during non-testing periods, thereby causing attacks on the network equipment that is performing work, and then causing data loss. That is, setting the identity authentication information can effectively reduce the probability of malicious penetration tests.

[0072] When the identity information is the same as the identity authentication information, it is considered that the identity information is consistent with the identity authentication information. At this time, the penetration data collection terminal 1 grants the penetration test platform 2 the power to remotely operate, and even establishes a network channel. Even if there is no user remotely operating the penetration data collection terminal 1, the penetration data collection terminal 1 and the penetration test platform 2 will automatically transmit data and perform a penetration test on the test environment where the penetration data collection terminal 1 is located. On the contrary, when the identity information is inconsistent with the identity authentication information, it will be impossible to perform manual or fully intelligent penetration testing on the test environment.

[0073] Step S12: Retrieve attribute information and scale information, and upload the attribute information and scale information to the penetration testing platform 2.

[0074] From the penetration system part, it can be seen that the attribute information includes the ID number, attack frequency threshold and available time of the penetration data collection terminal 1. Therefore, when the test environment is selected, the penetration data collection terminal 1 is installed in the test environment where the penetration test is required, and then after the identity information is authenticated, the attribute information of the penetration data collection terminal 1 is uploaded to the penetration test platform 2, so that the penetration test platform 2 can obtain the penetration data collection terminal 1 currently undergoing the penetration test according to the ID number, configure the appropriate attack frequency for the penetration data collection terminal 1 according to the attack frequency threshold, and replenish the power supply for the penetration data collection terminal 1 in time according to the available time.

[0075] The scale information may be the type of network devices and the number of each type of network devices obtained by scanning the traffic data in the test environment after the penetration data collection terminal 1 is installed in the test environment. The scale information may also be the type of network devices and the number of each type of network devices manually input during installation. Whether the scale information is scanned and collected or manually input, the penetration data collection terminal 1 stores it. When the identity information is authenticated, the stored scale information is retrieved and uploaded to the penetration test platform 2 together with the attribute information.

[0076] Step S13: After uploading the attribute information and scale information, receiving the test task information returned by the penetration testing platform 2 within a first preset time period.

[0077] The test task information is obtained by the penetration test platform 2 based on the attribute information, scale information and the preset test model. The specific process is:

[0078] Step 1: Determine the attack frequency threshold of the penetration data collection terminal 1 according to the attribute information;

[0079] Step 2: Determine the target attack terminal based on the scale information and the preset selection rules;

[0080] Step 3: Retrieve a preset data table, the column header of the data table is the attack program, the horizontal header of the data table is the attack frequency range, and the terminal, gateway and main control end in the test environment correspond to the attack programs of three attack frequency ranges respectively;

[0081] Step 4: According to the attack frequency threshold, the target attack terminal and the matching rule, the attack frequency of each target attack terminal and the attack program of each target attack terminal are matched in the data table;

[0082] Step 5: The target attack terminal, the attack frequency of each target attack terminal, and the attack program of each target attack terminal are collected to form test task information.

[0083] In simple terms, the penetration test platform 2 matches the attack frequency and attack program of the target attack terminal in the data table according to the acquired attack frequency threshold and the target attack terminal. As for acquiring the attack frequency threshold, since the attribute information includes the attack frequency threshold, the penetration test platform 2 can determine the attack frequency threshold of the penetration data collection terminal 1 that uploads the attribute information according to the acquired attribute information. As for acquiring the target attack terminal, after the penetration test platform 2 receives the scale information, the distribution of network devices in the test environment is displayed in the display in the form of a grid, and a node in the grid represents a network device. If the number of network devices is within the preset value, at least one terminal, at least one gateway, and at least one master control terminal are selected for attack; if the number of network devices reaches the preset value, the grid is divided into multiple areas, and one terminal, one gateway, and one master control terminal are attacked in each area. Therefore, dividing the grid into multiple areas needs to meet the following requirements: in one area, at least one terminal, one gateway, and one master control terminal are included, and the sum of the number values ​​of the terminal, gateway, and master control terminal must be within the preset value. In this embodiment, the preset value is set to 10, and the terminal, gateway, and main control terminal are all involved in the attack, so that the penetration test is more thorough, that is, the accuracy of the penetration test is improved.

[0084] After the grid division is completed, the principle of selecting the target terminal through the selection rule is: first, mark the terminals in the area with numbers in one direction, then mark the gateways in the area with numbers according to the direction, and also mark the master terminals in the area with numbers according to the direction, so as to obtain three lists, and then select from the front to the back or from the back to the front according to the order in the three lists. For example, when the selection is from the front to the back, if the penetration test is the first one in the list, the second penetration test starts from the second one in the list, so as to achieve penetration testing of every network device in the area to ensure the comprehensiveness of the penetration test.

[0085] After obtaining the target attack terminal, a preset data table is retrieved, the column header of the data table is the attack program, and the horizontal header of the data table is the attack frequency range. Figure 3The column headings are attack program 1, attack program 2, and attack program 3, and the horizontal headings are attack frequencies of 0-15MB / S, 15MB / S-30MB / S, and 30MB / S-50MB / S. The cells with attack program 1 in the column direction and 0-15MB / S in the horizontal direction are gateway A, the cells with attack program 1 in the column direction and 15MB / S-30MB / S in the horizontal direction are gateway B, and the cells with attack program 1 in the column direction and 30MB / S-50MB / S in the horizontal direction are gateway C; the cells with attack program 2 in the column direction and 0-15MB / S in the horizontal direction are terminal A, the cells with attack program 2 in the column direction and 15MB / S-30MB / S in the horizontal direction are terminal B, and the cells with attack program 2 in the column direction and 30MB / S-50MB / S in the horizontal direction are terminal C; the cells with attack program 3 in the column direction and 0-15MB / S in the horizontal direction are master control terminal A, the cells with attack program 3 in the column direction and 15MB / S-30MB / S in the horizontal direction are master control terminal B, and the cells with attack program 3 in the column direction and 30MB / S-50MB / S in the horizontal direction are master control terminal C. At this time, if the total attack frequency value of gateway C+terminal C+master C is lower than the attack frequency threshold, the data in the output table is the test task information, that is, the test task information includes the attack frequency of each target attack terminal and the attack program of each target attack terminal. Otherwise, when the total attack frequency value of gateway C+terminal C+master C is higher than the attack frequency threshold, and the total attack frequency value of gateway B+terminal B+master B is lower than the attack frequency threshold, the attack program and attack frequency value corresponding to gateway A, gateway B, terminal A, terminal B, master A and master B are output, that is, the test task information is output.

[0086] As can be seen from the above, it takes time for the penetration test platform 2 to obtain the test task information from the received attribute information and scale information, so a first preset time period is set at the penetration data acquisition terminal 1. During this time period, if the penetration data acquisition terminal 1 receives the test task information returned by the penetration test platform 2, it proceeds to the next step. Otherwise, after the first preset time period, the penetration data acquisition terminal 1 will be restored to the initial state. At this time, if a penetration test is required, identity authentication needs to be performed again.

[0087] Step S14: Identify the target attack terminal, the attack frequency of each target attack terminal, and the attack program of each target attack terminal contained in the task information.

[0088] As can be seen from step S13, the test task information is a complete data table or a partial data table, so the test task information includes the target attack terminal, the attack frequency of each target attack terminal, and the attack program of each attack terminal. In other words, when the penetration data collection terminal 1 obtains the test task information, the target attack terminal and the attack frequency and attack program of the target attack terminal can be obtained.

[0089] Step S15: attacking the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and the preset attack model.

[0090] The specific steps to attack the corresponding target attack terminal are as follows:

[0091] Step 1: unify the attack frequency unit of each target attack terminal to obtain the first value;

[0092] Step 2: Calculate the data packet size of the attack program of each target attack terminal to obtain a second value;

[0093] Step 3: Calculate the product of the first value and the second value corresponding to each target attack terminal to obtain the attack value;

[0094] Step 4: Arrange the attack values ​​corresponding to each target attack terminal in order from small to large to obtain an attack list;

[0095] Step 5: Retrieve a preset attack level list, the level list includes a first level, a second level and a third level, the first level corresponds to a first range, the second level corresponds to a second range, and the third level corresponds to a third range;

[0096] Step 6: setting the target attack terminal whose attack value is within the first range to the first level, setting the target attack terminal whose attack value is within the second range to the second level, and setting the target attack terminal whose attack value is within the third range to the third level;

[0097] Step 7: Attack the target attack terminals in the attack list in the order of the first level, the second level, and the third level.

[0098] In simple terms, the attack frequency and the data packets of the attack program are used as influencing factors of the attack sequence. Since the larger the attack frequency and the data packet values, the greater the risk of exposure, setting an attack list and attacking the network devices in the test environment in sequence according to the attack order of the attack list is a process of increasing pressure, thereby achieving the purpose of gradually performing penetration tests on the network devices in the test environment.

[0099] Step S16: Determine whether the attack on the target terminal is completed, if so, proceed to the next step.

[0100] Determining whether the attack on the target attack terminal is completed means that the target attack terminal included in the attack list has been traversed. After traversing the target attack terminal in the attack list, the data processing module 14 outputs a forwarding instruction to the logic output module 15, indicating that the penetration work of the penetration data collection terminal 1 is completed.

[0101] Step S17: Output the actual test information to the penetration testing platform 2.

[0102] The actual test information refers to the result data of the network device actually attacked by the penetration data collection terminal 1. Since the network equipment in the test environment may be offline, it is impossible to perform penetration testing on the target attack terminal. Therefore, it is necessary to transmit the penetration results to the penetration testing platform 2 after the penetration work of the penetration data collection terminal 1 is completed.

[0103] The principle of the above-mentioned judgment on the target attack terminal that has not undergone the penetration test is: the penetration data collection terminal 1 fails to transmit the attack program, or after the penetration data collection terminal 1 transmits the attack program to the corresponding target attack terminal, it does not receive any information or instructions returned by the target attack terminal, that is, the attack program is to obtain the data of the target attack terminal, so when no information or instructions returned by the target attack terminal are received, it is considered that the penetration test of the target attack terminal has failed.

[0104] In summary, the working principle of the penetration data acquisition terminal 1 is: first, authenticate the user, then gradually perform penetration testing on the target attack terminal according to the test task information, and transmit the actual results of the penetration testing to the test platform. In this application, the penetration testing process of the penetration data acquisition terminal 1 is an intelligent testing process, which can realize penetration testing of network devices in the test environment without manual operation, thereby reducing labor costs and time costs, that is, reducing the cost of penetration testing.

[0105] It should be noted that, since the penetration data collection terminal 1 also includes a network support module 16 and a VPN module 17, the penetration data collection terminal 1 can provide technical means for remote penetration testing for external remote clients. When targeted testing of a small number of network devices is required, penetration testing can be performed through manual operation.

[0106] This application also provides a remote penetration method based on the openwrt system, refer to Figure 4 , the penetration method is applied to the penetration testing platform 2, and the main process is described as follows:

[0107] Step S21: receiving identity information input by the user.

[0108] The user can input identity information through an input device, such as a keyboard, a microphone, a scanner, etc. connected to the server. Therefore, the penetration testing platform 2 can provide the user with text, voice, table, etc. formats to input identity information, thereby improving the practicality of the penetration testing platform 2.

[0109] Step S22: receiving the attribute information and scale information uploaded by the penetration data collection terminal 1, and obtaining the test task information according to the attribute information, scale information and a preset test model.

[0110] It should be noted that the process of the penetration testing platform 2 obtaining the test task information has been described in step S13, so it will not be repeated here.

[0111] Step S23: Acquire the actual test information output by the penetration data acquisition terminal 1 and the feedback test information uploaded by the test environment, and obtain the test result information according to the actual test information and the feedback information.

[0112] The actual test information has been described in step S17, so it will not be repeated here. The feedback test information is the data information generated by the security program in the terminal, gateway, and main control terminal in the test environment when an attack behavior is detected during the penetration test.

[0113] After the penetration test platform 2 obtains the actual test information and the feedback test information, it compares whether the target attack terminal in the actual test information and the network device detected with attack behavior in the feedback test information are consistent, marks the same network devices in green, marks the network devices with differences in red, and outputs the marked network devices, that is, outputs the test result data.

[0114] It should be noted that if the target attack terminal in the actual test information and the network device detected with attack behavior in the feedback test information are exactly the same, then the security of the test environment is considered to be relatively high, because the corresponding network devices can all react when an attack occurs, which facilitates the technicians to carry out targeted repairs and further improve the security performance of the test environment. If the target attack terminal in the actual test information and the network device detected with attack behavior in the feedback test information are inconsistent, especially when the penetration test platform 2 does not receive the feedback test information during the penetration test, it means that the security of the test environment is low and cannot cope with external network attacks. At this time, it is necessary to urgently shut down the connection with the external network, or even stop using the network device, in order to re-establish a secure network barrier and pass the penetration test before continuing to use it, thereby preventing data leakage accidents.

[0115] To sum up, the penetration testing platform 2 and the penetration data collection terminal 1 cooperate with each other to achieve the purpose of intelligent penetration testing, and because it is a fully automated process, it saves time and labor costs. Furthermore, since the test result information has identified the network devices with differences, in the subsequent repair process, the technicians can perform repair work in a targeted manner, thus reducing the testing time from vulnerability discovery to vulnerability exploitation, thereby reducing the overall cost of penetration testing.

[0116] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A remote penetration system based on openwrt system, characterized in that: It includes a penetration data collection terminal (1) and a penetration testing platform (2); The penetration data collection terminal (1) comprises an identity authentication module (11), a data acquisition module (12), a data identification module (13), a data processing module (14) and a logic output module (15); The identity authentication module (11) is used to receive the identity information output by the penetration testing platform (2), and is used to output a driving instruction when the identity information conforms to preset identity authentication information; The data acquisition module (12) is used to upload its own attribute information and the collected scale information of the test environment to the penetration test platform (2) when receiving the driving instruction, and receive the test task information returned by the penetration test platform (2) within a first preset time period thereafter; The data identification module (13) is used to identify the target attack terminal, the attack frequency of each target attack terminal and the attack program of each target attack terminal contained in the test task information, wherein the target attack terminal is a network device to be subjected to penetration testing in the test environment; The data processing module (14) is used to attack the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and a preset attack model, and the data processing module (14) is also used to output a forwarding instruction to the logic output module (15) after the attack is completed; The logic output module (15) is used to output actual test information to the penetration test platform (2) when receiving a forwarding instruction; The penetration testing platform (2) is used to generate test result information based on the actual test information and the feedback test information uploaded by the test environment.

2. The remote penetration system based on the openwrt system according to claim 1 is characterized in that: The penetration data collection terminal (1) further comprises a network support module (16), wherein the network support module (16) is used to provide network traffic for an external client connected to the penetration data collection terminal (1).

3. The remote penetration system based on the openwrt system according to claim 1 is characterized in that: The penetration data collection terminal (1) further comprises a VPN module (17), wherein the VPN module (17) is used for an external client to remotely control the penetration data collection terminal (1).

4. The remote penetration system based on the openwrt system according to claim 1 is characterized in that: The infiltration data collection terminal (1) further comprises a storage module, and the storage module is used to store the attribute information.

5. The remote penetration system based on the openwrt system according to claim 1 is characterized in that: The penetration data acquisition terminal (1) further comprises a power supply module, wherein the power supply module is used to supply power to the identity authentication module (11), the data acquisition module (12), the data identification module (13), the data processing module (14) and the logic output module (15).

6. A remote penetration method based on openwrt system, characterized in that: Applied to the penetration data collection end (1), including: Acquiring identity information, wherein the identity information is output by the penetration testing platform (2); Determining whether the identity information conforms to preset identity authentication information; If yes, retrieve the attribute information and the collected scale information of the test environment, and upload the attribute information and scale information to the penetration testing platform (2); After uploading the attribute information and scale information, receiving the test task information returned by the penetration testing platform (2) within a first preset time period; Identifying the target attack terminals, the attack frequency of each target attack terminal, and the attack program of each target attack terminal included in the test task information; Attack the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and the preset attack model, wherein the target attack terminal is a network device to be subjected to penetration testing in the test environment; Determine whether the attack target terminal is completed; If so, the actual test information is output to the penetration test platform (2), and the penetration test platform (2) generates test result information based on the actual test information and the feedback test information uploaded by the test environment.

7. The remote penetration method based on the openwrt system according to claim 6 is characterized in that: The step of attacking the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal and the preset attack model includes: Unifying the attack frequency unit of each target attack terminal to obtain a first value; Calculating the data packet size of the attack program of each target attack terminal to obtain a second value; Calculate the product of the first value and the second value corresponding to each target attack terminal to obtain an attack value; Arrange the attack value corresponding to each target attack terminal in order from small to large to obtain an attack list; Retrieving a preset attack level list, the level list includes a first level, a second level, and a third level, the first level corresponds to a first range, the second level corresponds to a second range, and the third level corresponds to a third range; Setting the target attack terminal whose attack value is within the first range to the first level; Setting the target attack terminal whose attack value is within the second range to the second level; Setting the target attack terminal whose attack value is in the third range to the third level; The target attack terminals in the attack list are attacked in the order of the first level, the second level, and the third level.

8. A remote penetration method based on openwrt system, characterized in that: Applied to penetration testing platforms(2), including: Receive identity information input by the user; Receiving the attribute information and scale information uploaded by the penetration data collection terminal (1), and obtaining the test task information according to the attribute information, scale information and a preset test model; Acquire the actual test information output by the penetration data acquisition terminal (1) and the feedback test information uploaded by the test environment, and obtain the test result information according to the actual test information and the feedback information; The penetration data collection terminal (1) performs the following steps: obtaining identity information, the identity information being output by a penetration test platform (2); determining whether the identity information conforms to preset identity authentication information; if so, retrieving attribute information and the collected scale information of the test environment, and uploading the attribute information and scale information to the penetration test platform (2); after uploading the attribute information and scale information, receiving test task information returned by the penetration test platform (2) within a first preset time period; identifying the target attack terminal, the attack frequency of each target attack terminal, and the attack program of each target attack terminal contained in the test task information; attacking the corresponding target attack terminal according to the attack frequency of each target attack terminal, the attack program of each target attack terminal, and the preset attack model, the target attack terminal being a network device to be subjected to penetration testing in the test environment; determining whether the attack on the target attack terminal is completed; if so, outputting actual test information to the penetration test platform (2).

9. The remote penetration method based on the openwrt system according to claim 8, characterized in that: The step of obtaining the test task information according to the attribute information, the scale information and the preset test model includes: Determining an attack frequency threshold of the penetration data collection terminal (1) according to the attribute information; Determine the target attack terminal of the attack based on the scale information and the preset selection rules; Retrieve a preset data table, wherein the column header of the data table is an attack program, the horizontal header of the data table is an attack frequency range, and the terminal, gateway, and main control end in the test environment correspond to attack programs of three attack frequency ranges respectively; According to the attack frequency threshold, the target attack terminal and the matching rule, the attack frequency of each target attack terminal and the attack program of each target attack terminal are matched in the data table; The target attack terminal, the attack frequency of each target attack terminal, and the attack program of each target attack terminal are collected to form the test task information.

Images