A penetration testing method and a visual penetration testing platform
Through the visual penetration testing platform and method, users can select host devices and test case scripts through a graphical interface, which solves the existing penetration testing's dependence on experience and expertise, achieves simplified operations and accurate test results, and improves the efficiency and accuracy of network security work.
Patent Information
- Application Number
- CN202211540748.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-12-02
- Publication Date
- 2025-09-30
- Estimated Expiration
- 2042-12-02
AI Technical Summary
Existing penetration testing tasks require a high level of experience and professional knowledge from the executors. They are difficult for novices or general business personnel to operate and are prone to errors, resulting in inaccurate test results and posing hidden dangers to network security.
This paper provides a penetration testing method and a visual penetration testing platform. It simplifies user operations through the network topology diagram and the test case framework diagram generated by the ATT&CK framework. Users can select the host device and test case script through the graphical interface, perform test tasks in combination with the Metasploit penetration testing framework, and monitor and analyze the execution results.
It simplifies the penetration testing operation process, avoids errors caused by lack of experience or expertise, ensures the accuracy and intuitiveness of test results, improves user experience, and can better guide network security work.
Smart Images
Figure CN115987567B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a penetration testing method and a visual penetration testing platform. Background Art
[0002] Currently, penetration testing tasks are mostly performed and completed using command lines, which requires a high level of experience and expertise. Novices and general business personnel often encounter operational errors, making test results inadequate for guiding network security efforts and posing significant security risks to business networks and host devices such as servers. Therefore, research into visual penetration testing technology, aimed at users with limited experience and expertise, to simplify the testing process and provide intuitive test results, is crucial for network security efforts. Summary of the Invention
[0003] In view of this, the present invention provides a penetration testing method and a visual penetration testing platform, which can simplify the penetration testing operation process on the user side, circumvent the writing and execution of code and command lines, avoid operational errors caused by insufficient experience or professional knowledge reserves, ensure the accuracy of test results, better guide network security work, and at least partially solve the problems existing in the prior art.
[0004] The specific content of the invention is as follows:
[0005] A penetration testing method comprising:
[0006] A network topology diagram including the current host is displayed to the user; the network topology diagram includes several nodes, each of which corresponds to a host device in the current network environment.
[0007] The triggering operation of the user on the node in the network topology diagram is obtained to determine the host device selected by the user.
[0008] A test case framework diagram generated based on the ATT&CK framework is displayed to the user; the framework diagram includes several test case nodes, and each test case node corresponds to a corresponding test case script.
[0009] A user triggering operation on a test case node in the framework diagram is obtained, and at least one test case node selected by the user is determined.
[0010] The test case scripts corresponding to each test case node selected by the user are retrieved, and each retrieved test case script is sent to the host device selected by the user to perform the penetration test task.
[0011] Furthermore, the method further comprises:
[0012] Obtain test case scripts and determine the attack attributes corresponding to each test case script.
[0013] According to the attack attributes, each test case script is classified using the classification method of the ATT&CK framework, and the classified test case scripts are stored using the structure of the ATT&CK framework.
[0014] According to the attack attributes corresponding to the test case scripts stored in each storage node, a test case label corresponding to each storage node is generated, and each test case label is used as the test case node to obtain the test case framework diagram generated based on the ATT&CK framework.
[0015] Furthermore, the framework diagram also includes several scenario use case nodes. After storing the classified test case scripts in the structure of the ATT&CK framework, the method further includes:
[0016] Determine each initial test case script based on the storage structure.
[0017] Input corresponding parameters into each initial test case script to obtain the execution result corresponding to each initial test case script.
[0018] Each execution result is used as a set of input parameters to traverse the test case scripts in the immediately subsequent storage column in the storage structure to obtain a test case script that can receive the input parameters and execute, and the corresponding test case script is used as the immediately subsequent test case script of the initial test case script corresponding to the corresponding input parameter, and then the execution result of the immediately subsequent test case script is used as the input parameter to traverse the test case scripts in the next storage column until the traversal of the test case scripts in the storage structure is completed, thereby obtaining several groups of test case script sets with immediately preceding and immediately succeeding correlations that include each initial test case script.
[0019] The test case scripts in each test case script set are integrated to obtain the scenario case script corresponding to each test case script set.
[0020] Determine the attack chain corresponding to each scenario use case script, generate a scenario use case label corresponding to each scenario use case script, and use each scenario use case label as the scenario use case node.
[0021] Furthermore, the method further comprises:
[0022] Monitor the execution process of each test case script on the host device selected by the user, determine the host devices passed by the execution process, and generate a penetration test attack topology map.
[0023] Furthermore, the monitoring of the execution process of each retrieved test case script on the host device selected by the user also includes:
[0024] Obtain the execution result, parse the execution result, and convert the execution result into a text format that can be expressed in a recognizable language for the user to view.
[0025] Furthermore, the method further comprises:
[0026] Based on the execution results, the security risks existing in the current network environment and the security vulnerabilities of each host device are determined, the corresponding security tools are matched in the preset tool library, and each security tool is sent to the corresponding host device for installation to strengthen the security of the current network environment and host device.
[0027] Furthermore, the Metasploit penetration testing framework is used as the execution framework for test case scripts and scenario case scripts.
[0028] A visual penetration testing platform, comprising:
[0029] The host selection module is used to display a network topology diagram containing the current host to the user; the network topology diagram contains several nodes, each node corresponds to a host device in the current network environment; obtain the user's trigger operation on the node in the network topology diagram, and determine the host device selected by the user.
[0030] The use case selection module is used to display a test case framework diagram generated based on the ATT&CK framework to the user; the framework diagram includes several test case nodes, each test case node corresponds to a corresponding test case script; obtain the user's trigger operation on the test case node in the framework diagram, and determine at least one test case node selected by the user.
[0031] The penetration testing module is used to retrieve the test case scripts corresponding to each test case node selected by the user, and send the retrieved test case scripts to the host device selected by the user to perform the penetration testing task.
[0032] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned penetration testing method when executing the computer program.
[0033] A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the aforementioned penetration testing method.
[0034] The beneficial effects of the present invention are embodied in:
[0035] By using the present invention to perform penetration testing, users do not need to write scripts or command lines related to executing the test. Instead, they only need to select the host device used to perform the penetration test task through the network topology diagram, then select the use case script for the penetration test through the test case framework diagram, and finally execute the penetration test task. The present invention can simplify the user-side penetration testing operation process, making the penetration test work simple, intuitive, and easy to operate, avoiding operational errors caused by insufficient experience or professional knowledge, ensuring the accuracy of test results, and better guiding network security work. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0037] Figure 1 This is a flow chart of a penetration testing method according to an embodiment of the present invention;
[0038] Figure 2 This is a flow chart of another penetration testing method according to an embodiment of the present invention;
[0039] Figure 3 This is a flow chart of a method for generating a test case framework diagram according to an embodiment of the present invention;
[0040] Figure 4 This is a structural diagram of a visual penetration testing platform according to an embodiment of the present invention. DETAILED DESCRIPTION
[0041] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0042] It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments may be combined with each other; and, based on the embodiments in this disclosure, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of this disclosure.
[0043] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.
[0044] The present invention provides a penetration testing method embodiment, such as Figure 1 Shown, including:
[0045] S11: Displaying a network topology diagram including the current host to the user; the network topology diagram includes a number of nodes, each of which corresponds to a host device in the current network environment. The host device includes: a server, a user terminal and other physical devices.
[0046] S12: Acquire the user's triggering operation on the node in the network topology diagram and determine the host device selected by the user. The triggering operation includes clicking and dragging.
[0047] S13: Show the user a test case framework diagram generated based on the ATT&CK framework; the framework diagram includes several test case nodes, and each test case node corresponds to a corresponding test case script.
[0048] S14: Acquire a user's triggering operation on a test case node in the framework diagram, and determine at least one test case node selected by the user. The triggering operation includes clicking and dragging.
[0049] S15: Retrieve the test case scripts corresponding to the test case nodes selected by the user, and send the retrieved test case scripts to the host device selected by the user to perform the penetration test task.
[0050] Figure 1 The embodiment provides a visual penetration testing method. Users do not need to write scripts or command lines related to executing the test. They only need to select the host device used to execute the penetration testing task through the network topology diagram, and then select the use case script for the penetration testing through the test case framework diagram, and finally execute the penetration testing task. Figure 1The embodiments described can simplify the user-side penetration testing operation process, making penetration testing simple, intuitive, and easy to operate, avoiding operational errors caused by insufficient experience or professional knowledge, ensuring the accuracy of test results, and better guiding network security work. The test case framework diagram generated based on the ATT&CK framework contains rich and complete test case scripts, and can more intuitively provide test case scripts for various attack types and attack stages, making it convenient for users to select test case scripts as needed, helping users complete penetration testing more accurately and fully while improving the user experience.
[0051] Preferably, the method further comprises:
[0052] Obtain test case scripts and determine the attack attributes corresponding to each test case script. The attack attributes include attack type and attack purpose. Attack types include browser attacks, brute force attacks, denial of service attacks, worms, network attacks, scanning attacks, and other attacks. Attack purposes include reconnaissance, privilege escalation, defense evasion, initial intrusion, access credentials, command and control, lateral movement, and penetration and sabotage.
[0053] According to the attack attributes, each test case script is classified using the classification method of the ATT&CK framework, and each classified test case script is stored using the structure of the ATT&CK framework. According to the attack attributes corresponding to each test case script, each test case script is classified using the classification method of the ATT&CK framework, that is, each test case script is initially classified according to the attack type corresponding to each test case script, and then the attack purpose corresponding to each test case script is matched with the attack tactics contained in the ATT&CK framework, and each test case script is classified. Finally, a classification matrix is obtained, which is the structure of the ATT&CK framework. Each test case script is stored according to the structure of the matrix. The attack tactics contained in the ATT&CK framework include: initial access, execution, persistence, privilege escalation, defense bypass, credential access, exploration and discovery, lateral movement, information collection, command and control, data penetration, and influence.
[0054] Based on the attack attributes corresponding to the test case scripts stored in each storage node, a test case label corresponding to each storage node is generated. Each test case label is used as the test case node to obtain the test case framework diagram generated based on the ATT&CK framework. The test case label can be directly named according to the attack objective corresponding to the test case script stored in each storage node, which can more clearly show the function of the test case script corresponding to each test case node, making it easier for users to select.
[0055] The above preferred solution provides a method for generating a test case framework diagram, wherein the acquisition of penetration test case scripts includes network acquisition, manual input, etc., so that a rich and complete test case script can be integrated into the test case framework diagram to fully support the penetration test task. The acquired test case scripts may have the same attributes, that is, there are several groups of test case scripts with the same attack attributes. In this case, there are multiple test case scripts stored in several storage nodes. At this time, when the user triggers and selects the corresponding test case node, it can be assumed that the user has selected all the test case scripts corresponding to the corresponding test case node. In this way, when executing the penetration test task, the specific attack can be fully tested and the weak points to deal with the attack can be found more accurately. The secondary interface of the test case framework diagram can also be further expanded for the user to select a specific test case script, so that a penetration test can be performed on a specific test case script, making the test results more targeted.
[0056] Preferably, the framework diagram further includes several scenario use case nodes. After storing the classified test case scripts in the structure of the ATT&CK framework, the method further includes:
[0057] Determine each initial test case script according to the storage structure. The initial test case script is the test case script in the first column of the storage matrix.
[0058] Input corresponding parameters into each initial test case script to obtain the execution result corresponding to each initial test case script.
[0059] Each execution result is used as a set of input parameters to traverse the test case scripts in the immediately subsequent storage column in the storage structure to obtain a test case script that can receive the input parameters and execute, and the corresponding test case script is used as the immediately subsequent test case script of the initial test case script corresponding to the corresponding input parameter, and then the execution result of the immediately subsequent test case script is used as the input parameter to traverse the test case scripts in the next storage column until the traversal of the test case scripts in the storage structure is completed, thereby obtaining several groups of test case script sets with immediately preceding and immediately succeeding correlations that include each initial test case script.
[0060] The test case scripts in each test case script set are integrated to obtain the scenario case script corresponding to each test case script set.
[0061] Determine the attack chain corresponding to each scenario use case script, generate a scenario use case label corresponding to each scenario use case script, and use each scenario use case label as the scenario use case node.
[0062] The above preferred solution provides a method for generating scenario use case nodes in a test case framework diagram, and each scenario use case node corresponds to a scenario use case script. Adding scenario use case nodes can facilitate users to select test case scripts required for specific test scenarios without having to select each test node involved in the scenario. This facilitates user operation while also avoiding misoperation, improving work efficiency, and ensuring the accuracy of test results. This preferred solution uses a one-by-one traversal method to obtain scenario use case scripts corresponding to different attack chains. When attackers carry out attacks, in order to bypass monitoring, they sometimes do not attack in the order of attack tactics recorded by the ATT&CK framework, or skip several attack tactics to attack. Therefore, this preferred solution can also be implemented in other ways, such as obtaining attack chain information, determining the attack tactic sequence contained in each attack chain, determining the initial test case script corresponding to each attack chain in the storage structure based on the initial attack tactic of each attack chain, inputting corresponding parameters into each initial test case script, obtaining the execution result corresponding to each initial test case script, using each execution result as a set of input parameters, and executing the test case scripts in the storage structure with parameters according to the attack tactic sequence of the corresponding attack chain to obtain the test case scripts corresponding to each attack chain, combining the test case scripts in each test case script set according to the corresponding tactic sequence, obtaining the scenario case script corresponding to each attack chain, and generating a scenario case label corresponding to each scenario case script, and using each scenario case label as the scenario case node. For another example, a technical manager with higher authority can manually operate and integrate the test case scripts with corresponding correlations in the test case framework diagram according to various business scenario requirements to generate various scenario case scripts, and set a scenario case label for each scenario case script, and store each scenario case label as the scenario case node in the test case architecture diagram for user selection. Just like the situation mentioned above where there are several groups of test case scripts with the same attack attributes, corresponding to the situation where there are multiple test case scripts stored in several storage nodes, there will also be several attack chains corresponding to multiple scenario case scripts, that is, there will be several scenario case nodes corresponding to multiple scenario case scripts. On the scenario case node corresponding to the test case framework diagram, a secondary interface can also be set for users to select specific scenario case scripts to adapt to the scenario-specific and customized requirements of penetration testing.
[0063] Preferably, the method further comprises:
[0064] Monitor the execution process of each test case script on the host device selected by the user, determine the host devices passed by the execution process, and generate a penetration test attack topology map.
[0065] The above preferred solution draws the topology of the host devices passed through by the entire penetration test process to form an overall penetration test attack topology map, which can enable users to understand the penetration test process and penetration test network structure more clearly and specifically, and help users understand the network security status of the current business environment.
[0066] Preferably, the monitoring of the execution process of each retrieved test case script on the host device selected by the user further includes:
[0067] Obtain the execution result, parse the execution result, and convert the execution result into a text format that can be expressed in a recognizable language for the user to view.
[0068] The preferred solution above can obtain the execution results through Python and parse the results into a text format that can be expressed in a recognizable language, including host device information, test application use cases, network and host device security risk status, etc., and output them in formats such as PDF, Word, and Excel. Compared with directly outputting the execution results, this preferred solution parses the obscure execution results into a text format that can be expressed in a recognizable language, making it easier for users to understand, allowing them to clearly understand the penetration test situation and identify current security risks.
[0069] Preferably, the method further comprises:
[0070] Based on the execution results, the security risks existing in the current network environment and the security vulnerabilities of each host device are determined, the corresponding security tools are matched in the preset tool library, and each security tool is sent to the corresponding host device for installation to strengthen the security of the current network environment and host device.
[0071] Preferably, the Metasploit penetration testing framework is used as the execution framework for test case scripts and scenario case scripts. The Metasploit penetration testing framework under the Linux system has a simpler structure, supports multiple programming languages and network environments, and supports the writing and input of user-defined scripts, which can better support penetration testing work in various requirements and various network environments.
[0072] To further illustrate the present invention, another embodiment of a penetration testing method is provided in combination with the above preferred embodiment. Figure 2 Shown, including:
[0073] S21: Displaying a network topology diagram including the current host to the user; the network topology diagram includes a plurality of nodes, each node corresponding to a host device in the current network environment.
[0074] S22: Acquire the user's triggering operation on the node in the network topology diagram, and determine the host device selected by the user.
[0075] S23: Show the user a test case framework diagram generated based on the ATT&CK framework; the framework diagram includes several test case nodes and scenario case nodes, and each node corresponds to a corresponding script.
[0076] S24: Obtain the user's triggering operation on the test case node and the scenario case node in the framework diagram, and determine at least one node selected by the user.
[0077] S25: Determine whether there is a node corresponding to multiple scripts in the node selected by the user. If so, proceed to S26; otherwise, proceed to S27;
[0078] S26: Display the secondary interface of the corresponding node to the user, obtain the user's trigger operation on the use case node in the secondary interface, and determine the specific use case node selected by the user; the secondary interface includes several use case nodes, and each use case node corresponds to a unique script.
[0079] S27: Retrieve the scripts corresponding to the nodes selected by the user, and send the retrieved scripts to the host device selected by the user.
[0080] S28: Use the Metasploit penetration testing framework to execute the retrieved scripts.
[0081] S29: Monitor the script execution process, determine the host devices passed by the execution process, and generate a penetration test attack topology map.
[0082] S210: Obtain the execution result, parse the execution result, and convert the execution result into a text format that can be expressed in a recognizable language for the user to review.
[0083] Figure 2 The embodiment provides a visual penetration testing method. Users do not need to write scripts or command lines related to executing the test. They only need to select the host device used to execute the penetration testing task through the network topology diagram, and then select the use case script for the penetration testing through the test case framework diagram, and finally execute the penetration testing task. Figure 2 The embodiments described can simplify the user-side penetration testing operation process, making penetration testing simple, intuitive, and easy to operate, avoiding operational errors caused by insufficient experience or professional knowledge, ensuring the accuracy of test results, and better guiding network security work. The test case framework diagram generated based on the ATT&CK framework contains rich and complete test case scripts, and can more intuitively provide test case scripts for various attack types and attack stages, making it convenient for users to select test case scripts as needed, helping users complete penetration testing more accurately and fully while improving the user experience. Figure 2The scenario use case node of the described embodiment allows users to easily select the test case script required for a specific test scenario without having to select each test case node involved in the scenario. This facilitates user operation while also avoiding misoperation, improving work efficiency, and ensuring the accuracy of test results. When a node selected by the user corresponds to multiple scripts, a corresponding secondary interface is displayed for the user to select a specific test case script. Penetration testing can be performed on that specific script, making the test results more targeted and better meeting the needs of test customization.
[0084] In order to illustrate the test case framework diagram generation method involved in the present invention, a test case architecture diagram generation method embodiment is given, such as Figure 3 Shown, including:
[0085] S31: Obtain test case scripts and determine attack attributes corresponding to each test case script.
[0086] S32: Based on the attack attributes, each test case script is classified using the classification method of the ATT&CK framework, and each classified test case script is stored using the structure of the ATT&CK framework.
[0087] S33: Generate a test case label corresponding to each storage node according to the attack attribute corresponding to the test case script stored in each storage node.
[0088] S34: Use each test case label as a test case node, and obtain a test case framework diagram generated based on the ATT&CK framework based on the storage structure of each test case script.
[0089] S35: Determine each initial test case script according to the storage structure.
[0090] S36: Input corresponding parameters into each initial test case script to obtain the execution result corresponding to each initial test case script.
[0091] S37: Take each execution result as a set of input parameters, traverse the test case scripts in the immediately subsequent storage column in the storage structure, obtain a test case script that can receive the input parameters and execute, and use the corresponding test case script as the immediately subsequent test case script of the initial test case script corresponding to the corresponding input parameters.
[0092] S38: Then use the execution result of the immediately subsequent test case script as an input parameter to traverse the test case scripts in the next storage column until the traversal of the test case scripts in the storage structure is completed, and obtain several groups of test case script sets with immediately preceding and immediately succeeding correlations that include each initial test case script.
[0093] S39: Integrate the test case scripts in each test case script set to obtain a scenario case script corresponding to each test case script set.
[0094] S310: Determine the attack chain corresponding to each scenario use case script, and generate a scenario use case label corresponding to each scenario use case script.
[0095] S311: Write each scenario use case label as a scenario use case node into the test case framework diagram.
[0096] Figure 3 The test case framework diagram of the embodiment can integrate a rich and complete test case script, fully supporting penetration testing tasks. The addition of scenario use case nodes allows users to easily select the test case script required by a specific test scenario without having to select each test case node involved in the scenario. This facilitates user operation while avoiding misoperation, improving work efficiency and ensuring the accuracy of test results.
[0097] The present invention also provides a visual penetration testing platform embodiment, such as Figure 4 Shown, including:
[0098] The host selection module 41 is used to display a network topology diagram including the current host to the user; the network topology diagram includes several nodes, each node corresponds to a host device in the current network environment; obtain the user's trigger operation on the node in the network topology diagram, and determine the host device selected by the user.
[0099] The use case selection module 42 is used to display a test case framework diagram generated based on the ATT&CK framework to the user; the framework diagram includes several test case nodes, and each test case node corresponds to a corresponding test case script; obtain the user's trigger operation on the test case node in the framework diagram, and determine at least one test case node selected by the user.
[0100] The penetration testing module 43 is used to retrieve the test case scripts corresponding to the test case nodes selected by the user, and send the retrieved test case scripts to the host device selected by the user to perform the penetration testing task.
[0101] Figure 4 The embodiment provides a visual penetration testing platform. Users do not need to write scripts or command lines related to executing the test. They only need to select the host device used to execute the penetration testing task through the network topology diagram, and then select the use case script for the penetration test through the test case framework diagram, and finally execute the penetration testing task. Figure 4The embodiments described can simplify the user-side penetration testing operation process, making penetration testing simple, intuitive, and easy to operate, avoiding operational errors caused by insufficient experience or professional knowledge, ensuring the accuracy of test results, and better guiding network security work. The test case framework diagram generated based on the ATT&CK framework contains rich and complete test case scripts, and can more intuitively provide test case scripts for various attack types and attack stages, making it convenient for users to select test case scripts as needed, helping users complete penetration testing more accurately and fully while improving the user experience.
[0102] Preferably, the system further includes a test case architecture diagram generation module for:
[0103] Obtain test case scripts and determine the attack attributes corresponding to each test case script.
[0104] According to the attack attributes, each test case script is classified using the classification method of the ATT&CK framework, and the classified test case scripts are stored using the structure of the ATT&CK framework.
[0105] According to the attack attributes corresponding to the test case scripts stored in each storage node, a test case label corresponding to each storage node is generated, and each test case label is used as the test case node to obtain the test case framework diagram generated based on the ATT&CK framework.
[0106] Preferably, the framework diagram further includes several scenario use case nodes. After storing the classified test case scripts in the structure of the ATT&CK framework, the test case architecture diagram generation module is further used to:
[0107] Determine each initial test case script based on the storage structure.
[0108] Input corresponding parameters into each initial test case script to obtain the execution result corresponding to each initial test case script.
[0109] Each execution result is used as a set of input parameters to traverse the test case scripts in the immediately subsequent storage column in the storage structure to obtain a test case script that can receive the input parameters and execute, and the corresponding test case script is used as the immediately subsequent test case script of the initial test case script corresponding to the corresponding input parameter, and then the execution result of the immediately subsequent test case script is used as the input parameter to traverse the test case scripts in the next storage column until the traversal of the test case scripts in the storage structure is completed, thereby obtaining several groups of test case script sets with immediately preceding and immediately succeeding correlations that include each initial test case script.
[0110] The test case scripts in each test case script set are integrated to obtain the scenario case script corresponding to each test case script set.
[0111] Determine the attack chain corresponding to each scenario use case script, generate a scenario use case label corresponding to each scenario use case script, and use each scenario use case label as the scenario use case node.
[0112] Preferably, the penetration testing module 43 is further used to:
[0113] Monitor the execution process of each test case script on the host device selected by the user, determine the host devices passed by the execution process, and generate a penetration test attack topology map.
[0114] Preferably, the penetration testing module 43 is further used to:
[0115] Obtain the execution result, parse the execution result, and convert the execution result into a text format that can be expressed in a recognizable language for the user to view.
[0116] Preferably, a security reinforcement module is also included, which is used to:
[0117] Based on the execution results, the security risks existing in the current network environment and the security vulnerabilities of each host device are determined, the corresponding security tools are matched in the preset tool library, and each security tool is sent to the corresponding host device for installation to strengthen the security of the current network environment and host device.
[0118] Preferably, the Metasploit penetration testing framework is used as the execution framework for the test case scripts and scenario case scripts.
[0119] Figure 4 The embodiment is Figure 1-3 The visual penetration testing platform embodiment corresponding to the method embodiment, Figure 4 Part of the implementation process of the embodiment is Figure 1-3 The method embodiments are similar, so Figure 4 The description of the embodiment is relatively simple. Please refer to Figure 1-3 Embodiments of the method.
[0120] The present invention also provides an embodiment of a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the penetration testing method described in the aforementioned embodiment when executing the computer program.
[0121] The present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the penetration testing method described in the above embodiment.
[0122] By using the present invention to perform penetration testing, users do not need to write scripts or command lines related to executing the test. Instead, they only need to select the host device used to perform the penetration test task through the network topology diagram, then select the use case script for the penetration test through the test case framework diagram, and finally execute the penetration test task. The present invention can simplify the user-side penetration testing operation process, making the penetration test work simple, intuitive, and easy to operate, avoiding operational errors caused by insufficient experience or professional knowledge, ensuring the accuracy of test results, and better guiding network security work.
[0123] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.
Claims
1. A penetration testing method, characterized in that: include: Show the user the network topology diagram including the current host; The network topology diagram includes a plurality of nodes, each node corresponding to a host device in the current network environment; Obtaining a user's triggering operation on a node in the network topology diagram, and determining a host device selected by the user; Show the user a test case framework diagram generated based on the ATT&CK framework; the framework diagram contains several test case nodes, each of which corresponds to a corresponding test case script; Obtaining a user's triggering operation on a test case node in the framework diagram, and determining at least one test case node selected by the user; Retrieve the test case scripts corresponding to each test case node selected by the user, and send the retrieved test case scripts to the host device selected by the user to perform the penetration test task; The test case framework diagram is obtained in the following way: Obtain test case scripts and determine the attack attributes corresponding to each test case script; According to the attack attributes, each test case script is classified using the classification method of the ATT&CK framework, and each classified test case script is stored in the structure of the ATT&CK framework; according to the attack attributes corresponding to the test case script stored in each storage node, a test case label corresponding to each storage node is generated, and each test case label is used as the test case node to obtain the test case framework diagram generated based on the ATT&CK framework; The framework diagram also includes several scenario use case nodes. After storing the classified test case scripts in the structure of the ATT&CK framework, it also includes: According to the storage structure, each initial test case script is determined; corresponding parameters are input into each initial test case script to obtain the execution result corresponding to each initial test case script; each execution result is used as a group of input parameters to traverse the test case scripts in the immediately subsequent storage column in the storage structure to obtain a test case script that can receive the input parameters and execute, and the corresponding test case script is used as the immediately subsequent test case script of the initial test case script corresponding to the corresponding input parameter, and then the execution result of the immediately subsequent test case script is used as the input parameter to traverse the test case scripts in the next storage column until the traversal of the test case scripts in the storage structure is completed, to obtain several groups of test case script sets with immediately preceding and immediately succeeding correlations containing each initial test case script; the test case scripts in each test case script set are integrated to obtain the scenario case script corresponding to each test case script set; the attack chain corresponding to each scenario case script is determined, and a scenario case label corresponding to each scenario case script is generated, and each scenario case label is used as the scenario case node.
2. The method according to claim 1, characterized in that The method further comprises: Monitor the execution process of each test case script on the host device selected by the user, determine the host devices passed by the execution process, and generate a penetration test attack topology map.
3. The method according to claim 2, characterized in that The monitoring of the execution process of each retrieved test case script on the host device selected by the user also includes: Obtain the execution result, parse the execution result, and convert the execution result into a text format that can be expressed in a recognizable language for the user to view.
4. The method according to claim 3, characterized in that The method further comprises: Based on the execution results, the security risks existing in the current network environment and the security vulnerabilities of each host device are determined, the corresponding security tools are matched in the preset tool library, and each security tool is sent to the corresponding host device for installation to strengthen the security of the current network environment and host device.
5. The method according to claim 4, characterized in that The Metasploit penetration testing framework is used as the execution framework for test case scripts and scenario case scripts.
6. A visual penetration testing platform, characterized in that: include: The host selection module is used to show the user the network topology diagram including the current host; The network topology diagram includes a plurality of nodes, each node corresponding to a host device in the current network environment; obtaining a user's triggering operation on a node in the network topology diagram, and determining the host device selected by the user; A use case selection module is used to display a test case framework diagram generated based on the ATT&CK framework to the user; the framework diagram includes several test case nodes, each of which corresponds to a corresponding test case script; obtain the user's trigger operation on the test case node in the framework diagram, and determine at least one test case node selected by the user; The penetration testing module is used to retrieve the test case scripts corresponding to each test case node selected by the user and send the retrieved test case scripts to the host device selected by the user to perform the penetration testing task; The test case framework diagram is obtained in the following way: Obtain test case scripts and determine the attack attributes corresponding to each test case script; According to the attack attributes, each test case script is classified using the classification method of the ATT&CK framework, and each classified test case script is stored in the structure of the ATT&CK framework; according to the attack attributes corresponding to the test case script stored in each storage node, a test case label corresponding to each storage node is generated, and each test case label is used as the test case node to obtain the test case framework diagram generated based on the ATT&CK framework; The framework diagram also includes several scenario use case nodes. After storing the classified test case scripts in the structure of the ATT&CK framework, it also includes: According to the storage structure, each initial test case script is determined; corresponding parameters are input into each initial test case script to obtain the execution result corresponding to each initial test case script; each execution result is used as a group of input parameters to traverse the test case scripts in the immediately subsequent storage column in the storage structure to obtain a test case script that can receive the input parameters and execute, and the corresponding test case script is used as the immediately subsequent test case script of the initial test case script corresponding to the corresponding input parameter, and then the execution result of the immediately subsequent test case script is used as the input parameter to traverse the test case scripts in the next storage column until the traversal of the test case scripts in the storage structure is completed, to obtain several groups of test case script sets with immediately preceding and immediately succeeding correlations containing each initial test case script; the test case scripts in each test case script set are integrated to obtain the scenario case script corresponding to each test case script set; the attack chain corresponding to each scenario case script is determined, and a scenario case label corresponding to each scenario case script is generated, and each scenario case label is used as the scenario case node.
7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the penetration testing method according to any one of claims 1 to 5 is implemented.
8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the penetration testing method according to any one of claims 1 to 5.