Penetration testing method, device and testing equipment

Abstract

The present application provides a penetration testing method, apparatus, and testing equipment for ensuring that the penetration test of the target server to be tested can be completed normally based on a webshell, and ensuring a stable penetration testing effect. The method includes: the testing device configures a configuration file related to the webshell on the target server to be tested, and the configuration file is an execution file with a deserialization feature; the testing device obtains the initial control instruction related to the current penetration testing task; the testing device converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation; the testing device sends the target control instruction to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through the webshell, so as to execute the initial control instruction to promote the execution of the penetration testing task; the testing device generates a penetration testing result of the penetration testing task based on the response of the target server to be tested.

Description

Technical Field

[0001] The present invention relates to the field of testing, and in particular to a penetration testing method, device and testing equipment. Background Art

[0002] For those skilled in the art, a webshell is a code execution environment in the form of webpage files such as ASP, PHP, JSP, or CGI. In some cases, it is used as a means to launch network attacks on target servers. In this case, server penetration testing can also be achieved through a webshell.

[0003] However, since webshell is a familiar way to conduct network attacks, corresponding webshell anomaly analysis solutions have also been developed in the prior art to identify situations where attempts are made to conduct network attacks through webshell.

[0004] Therefore, in the work of penetration testing based on webshell, it is difficult to carry out specific penetration work due to the webshell abnormal analysis strategy configured on the server, resulting in the problem of poor penetration testing effect. Summary of the Invention

[0005] The present application provides a penetration testing method, apparatus, and testing equipment for ensuring that penetration testing of a target server to be tested can be completed normally based on a webshell, thereby ensuring stable penetration testing results.

[0006] In a first aspect, the present application provides a penetration testing method, the method comprising:

[0007] The test device configures a Webshell-related configuration file on the target server to be tested. The target server to be tested is the server object to be subjected to penetration testing in a future time period. The configuration file is an executable file with deserialization features.

[0008] The test device obtains initial control instructions related to the current penetration test task, wherein the initial control instructions are instructions related to the penetration test behavior;

[0009] The test equipment converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation;

[0010] The test device sends the target control instructions to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instructions through the Webshell to execute the initial control instructions to advance the execution of the penetration test task;

[0011] The test device generates a penetration test result of the penetration test task based on the response of the target server to be tested.

[0012] In conjunction with the first aspect of the present application, in a first possible implementation of the first aspect of the present application, the configuration file is specifically a Webshell file, and the test device configures a Webshell-related configuration file on the target server to be tested, including:

[0013] The test device places a Webshell file in the Web root directory of the target server to be tested. The Webshell file is constructed based on the magic function corresponding to the development language. The Webshell file is used to obtain preset parameters in the request, decode them, and perform deserialization.

[0014] In combination with the first possible implementation method of the first aspect of the present application, in the second possible implementation method of the first aspect of the present application, the Webshell file is specifically used to obtain the preset parameters in the POST request, GET request or PUT request and decode and deserialize them.

[0015] In combination with the first aspect of the present application, in a third possible implementation of the first aspect of the present application, the test device converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation, including:

[0016] The test equipment integrates the initial control instructions to obtain the target control instructions.

[0017] In combination with the third possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, the test device integrates the initial control instructions to obtain the target control instructions, including:

[0018] After the test equipment integrates the initial control instructions, it obtains the target control instructions through encryption and coding processing, wherein the target server to be tested is configured with a decoding process corresponding to the encryption and coding process.

[0019] In combination with the first aspect of the present application, in the fifth possible implementation method of the first aspect of the present application, the encryption coding processing specifically adopts the encryption method of base64, HEX, AES or DES.

[0020] In combination with the first aspect of the present application, in a sixth possible implementation manner of the first aspect of the present application, the method further includes:

[0021] The test device configures an interactive Webshell management terminal on the target server to be tested.

[0022] In a second aspect, the present application provides a penetration testing device, comprising:

[0023] A configuration unit is used to configure a Webshell-related configuration file on a target server to be tested, where the target server to be tested refers to a server object to be subjected to penetration testing in a future time period, and the configuration file is an executable file with a deserialization feature;

[0024] An acquisition unit, configured to acquire initial control instructions related to the current penetration test task, wherein the initial control instructions are instructions related to the penetration test behavior;

[0025] A conversion unit, configured to convert an initial control instruction into a target control instruction that can trigger a configuration file to perform a deserialization operation;

[0026] An execution unit is used to send the target control instruction to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through a Webshell to execute the initial control instruction to advance the execution of the penetration test task;

[0027] The generating unit is used to generate a penetration test result of the penetration test task according to the response of the target server to be tested.

[0028] In conjunction with the second aspect of the present application, in a first possible implementation of the second aspect of the present application, the configuration file is specifically a Webshell file, and the configuration unit is specifically used to:

[0029] Place a Webshell file in the Web root directory of the target server to be tested. The Webshell file is constructed based on the magic function corresponding to the development language. The Webshell file is used to obtain the preset parameters in the request, decode them, and deserialize them.

[0030] In combination with the first possible implementation method of the second aspect of the present application, in the second possible implementation method of the second aspect of the present application, the Webshell file is specifically used to obtain the preset parameters in the POST request, GET request or PUT request and decode and deserialize them.

[0031] In conjunction with the second aspect of the present application, in a third possible implementation of the second aspect of the present application, the conversion unit is specifically configured to:

[0032] The initial control instructions are integrated to obtain the target control instructions.

[0033] In combination with the third possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the conversion unit is specifically configured to:

[0034] After the initial control instructions are sentence-integrated, target control instructions are obtained through encryption and coding processing, wherein the target server to be tested is configured with a decoding process corresponding to the encryption and coding process.

[0035] In combination with the second aspect of the present application, in the fifth possible implementation method of the second aspect of the present application, the encryption coding processing specifically adopts the encryption method of base64, HEX, AES or DES.

[0036] In conjunction with the second aspect of the present application, in a sixth possible implementation of the second aspect of the present application, the configuration unit is further configured to:

[0037] Configure the interactive Webshell management terminal on the target server to be tested.

[0038] In a third aspect, the present application provides a testing device comprising a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application is executed.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided in the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0040] From the above content, it can be concluded that this application has the following beneficial effects:

[0041] In response to the penetration testing requirements of the target server to be tested, this application first configures a Webshell-related configuration file on the target server to be tested by the testing device. The configuration file is specifically an execution file with a deserialization feature. After obtaining the initial control instruction related to the current penetration testing task, the initial control instruction is converted into a target control instruction that can trigger the configuration file to perform a deserialization operation, and sent to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through the Webshell to execute the initial control instruction to promote the execution of the penetration testing task. At this time, the testing device can generate a penetration testing result of the penetration testing task according to the response of the target server to be tested. In this process, by introducing the application of the deserialization operation, the target server to be tested can actively execute the initial control instruction, thereby ensuring that the penetration test of the target server to be tested can be completed normally based on the webshell, and ensuring a stable penetration testing effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 A flowchart of the penetration testing method of this application;

[0044] Figure 2 A schematic diagram of an interface for parsing POST requests for this application;

[0045] Figure 3 A schematic diagram of an interface for displaying plain text data in this application;

[0046] Figure 4 A schematic diagram of an interface for executing the dir command for this application;

[0047] Figure 5 A schematic diagram of an interface for executing the ipconfig command for this application;

[0048] Figure 6 A schematic diagram of the structure of the penetration testing device of this application;

[0049] Figure 7 This is a structural diagram of the test equipment for this application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0051] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or that are inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can be changed in the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0052] The division of modules in this application is a logical division. In actual application, there may be other division methods. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. Moreover, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed into multiple circuit modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this application.

[0053] Before introducing the penetration testing method provided by this application, the background content involved in this application is first introduced.

[0054] The penetration testing method, device, and computer-readable storage medium provided in this application can be applied to testing equipment to ensure that the penetration test of the target server to be tested can be completed normally based on webshell, thereby ensuring stable penetration testing results.

[0055] The penetration testing method mentioned in this application can be performed by a penetration testing device, or a server, physical host, or user equipment (UE) of different types integrated with the penetration testing device. The penetration testing device can be implemented in hardware or software, and the UE can be a terminal device such as a smartphone, tablet computer, laptop computer, desktop computer, or personal digital assistant (PDA). The testing equipment can be set up in a device cluster.

[0056] Specifically, it is easy to understand that the testing equipment involved in this application is equipment specifically used by staff to perform penetration testing of servers. Obviously, its specific equipment form can be flexibly configured according to different actual software and hardware conditions and different testing needs, so there is no need to make specific limitations.

[0057] Next, we will introduce the penetration testing method provided by this application.

[0058] First, see Figure 1 , Figure 1 A schematic diagram of a penetration testing method of the present application is shown. The penetration testing method provided by the present application may specifically include the following steps S101 to S105:

[0059] Step S101: The test device configures a Webshell-related configuration file on the target server to be tested, where the target server to be tested refers to a server object that will undergo penetration testing in a future time period, and the configuration file is an executable file with a deserialization feature;

[0060] It can be understood that Webshell is a code execution environment in the form of web page files such as asp, php, jsp or cgi. It can be used for website management, server management, permission management and other operations. The usage is relatively simple. You only need to upload a code file and access it through the URL to perform many daily operations, which greatly facilitates the user's management of websites and servers. For this reason, a small number of people modify the code and use it as a backdoor program to achieve the purpose of controlling the website server.

[0061] In contrast, Webshell can also be used as one of the ways to perform server penetration testing (internal testing, or testing conducted with the cooperation and consent of the server operator). Traditionally, a command execution interface is left to receive relevant control instructions for penetration testing, but it is easy to be detected.

[0062] In order to bypass the Webshell anomaly identification strategy deployed in the existing technology for Webshell as a network attack path to achieve stable server penetration testing, this application introduces deserialization operations when applying Webshell, so that the target server to be tested actively executes corresponding control instructions, thereby promoting the advancement of penetration testing.

[0063] In this regard, before sending relevant control instructions to the target server to be tested, this application needs to complete the environment configuration on the target server to be tested, that is, the configuration file involved here, which is the execution file of the deserialization feature, used to implement the deserialization operation.

[0064] The target server to be tested may be any type of server, or in other words, the object of the penetration test can be flexibly adjusted according to actual needs in practical applications, so there is no need to make specific limitations.

[0065] In addition, the number of the target server to be tested is usually one, thus implementing a one-to-one penetration test. Of course, in specific applications, it is also possible to perform penetration tests on two or more servers at the same time.

[0066] Step S102: The testing device obtains initial control instructions related to the current penetration testing task, wherein the initial control instructions are instructions related to the penetration testing behavior;

[0067] After the environment configuration is completed on the target server to be tested, the test device can obtain the initial control instructions related to this penetration test task. It can be understood that the initial control instructions mainly describe the relevant penetration test behaviors involved in this penetration test task. If it is sent directly to the target server to be tested at this time, it will respond through network attack behavior identification strategies such as Webshell anomaly identification strategies, thereby causing the penetration test to fail. Therefore, it is also necessary to use the following instruction conversion processing to adapt it to the environment configuration completed in advance on the target server to be tested, so that the relevant penetration test behaviors it wants to achieve can be smoothly executed.

[0068] Step S103: The test device converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation;

[0069] It can be understood that what is involved here is the conversion of the form (also understood as format) of the instructions, so that the form of the control instructions adapts to the environment configuration pre-completed on the target server side to be tested, so that the configuration file can recognize the converted target control instructions.

[0070] Step S104: The test device sends the target control instruction to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through the Webshell to execute the initial control instruction to advance the execution of the penetration test task;

[0071] It should be understood that as a control instruction with a nature similar to that of a network attack, it is expected to be identified by the abnormal identification strategy of the regular configuration on the server, so as to protect against abnormal behaviors of network attacks or similar network attacks. In the Webshell environment, it also deploys a Webshell abnormal identification strategy to identify abnormal behaviors of network attacks or similar network attacks against Webshell.

[0072] In this case, since the initial control instruction is converted into a target control instruction that is compatible with the environment configuration pre-built by the Webshell, the target control instruction does not have the nature of a network attack and will not cause any impact on the server, so it can be sent normally to the target server to be tested.

[0073] Since the target control instruction is compatible with the environment configuration pre-built by the Webshell, its configuration file can effectively identify it and trigger the target server to be tested to perform deserialization operations on it, so that the original initial control instruction can be restored and executed.

[0074] At this point, the target server to be tested can be effectively prompted to execute the initial control instructions, and in an active manner, which obviously effectively bypasses the recognition mechanism of the original abnormal recognition strategy on the server, thereby effectively advancing the process of penetration testing.

[0075] As for the core of this solution, deserialization and serialization before deserialization can be understood through the following:

[0076] Serialization is the process of converting the state information of an object into a form that can be stored or transmitted. During serialization, the object writes its current state to a temporary or persistent storage area, and the object can be recreated later by reading or deserializing the state of the object from the storage area.

[0077] Deserialization can be understood as the process of restoring a byte sequence into an object.

[0078] To put it more simply, serialization refers to the process of converting objects in the development language into binary strings through a certain algorithm, while deserialization is the reverse process, which restores the binary string into the object in the development language.

[0079] Step S105: The testing device generates a penetration test result of the penetration test task according to the response of the target server to be tested.

[0080] In this way, since the target server to be tested has normally completed the relevant penetration test behaviors of the initial control instructions, the response of the target server to be tested to these penetration test behaviors can be obtained normally, and the penetration test results of this penetration test task can be generated based on the response results.

[0081] Among them, the acquisition of response results can be actively reported by the target server to be tested, or obtained by observation outside the target server to be tested, or obtained by monitoring through a monitoring program configured inside the target server to be tested. The specific details can be adjusted according to actual conditions without affecting the normal execution of penetration testing operations and other operations by the target server to be tested.

[0082] The process of generating penetration test results may involve different types of data processing such as data preprocessing and format conversion, and ultimately be presented in different types of data formats such as documents, tables, pictures or videos.

[0083] from Figure 1 It can be seen from the shown embodiment that, in response to the penetration testing requirements of the target server to be tested, the present application configures a Webshell-related configuration file on the target server to be tested by the testing device first. The configuration file is specifically an execution file with a deserialization feature. After obtaining the initial control instruction related to the current penetration testing task, the initial control instruction is converted into a target control instruction that can trigger the configuration file to perform a deserialization operation, and sent to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through the Webshell to execute the initial control instruction to promote the execution of the penetration testing task. At this time, the testing device can generate a penetration testing result of the penetration testing task according to the response of the target server to be tested. In this process, by introducing the application of the deserialization operation, the target server to be tested can actively execute the initial control instruction, thereby ensuring that the penetration test of the target server to be tested can be completed normally based on the webshell, and ensuring a stable penetration testing effect.

[0084] Continue to the above Figure 1 Each step of the illustrated embodiment and its possible implementation in practical applications are described in detail.

[0085] It can be understood that the penetration test performed by this application is deployed for the purpose of testing the relevant performance of the target server to be tested. In order to ensure the effective and normal execution of the control instructions related to the penetration test, this application has been mentioned in the above content. It is completed by bypassing the abnormal identification strategy deployed by the target server to be tested.

[0086] In this case, when this application pre-builds the required environment configuration on the target server to be tested, it may also involve the cooperation or communication of relevant staff on the target server to be tested. This can not only ensure the normal construction of the environment configuration, but also avoid the situation where manual troubleshooting of anomalies may occur in actual applications and cause the environment configuration to fail.

[0087] Furthermore, for the specific contents of the configuration files and control instructions, this application also provides specific exemplary implementation solutions in combination with specific applications.

[0088] As another practical implementation method, the configuration file corresponding to the environment configuration may be a Webshell file. Correspondingly, the test device configures the Webshell-related configuration file on the target server to be tested, which may specifically include the following contents:

[0089] The test device places a Webshell file in the Web root directory of the target server to be tested. The Webshell file is constructed based on the magic function corresponding to the development language. The Webshell file is used to obtain preset parameters in the request, decode them, and perform deserialization.

[0090] It is understandable that magic functions such as the unserialize() function in PHP will check whether there is a function with the magic name __wakeup. If it exists, the function will be executed when the object is rebuilt.

[0091] Specifically, the magic function corresponding to the development language involved here can be a function such as PHP's __destruct function, __wakeup function or __construct function, or a magic function based on a different development language such as Java or Python, which can perform the deserialization operation.

[0092] In a specific application, the present application can be illustrated by applying the magic function __destruct based on PHP (PHP language), and the specific content of its configuration file can be set as follows:

[0093]

[0094]

[0095] When the above c.php file is placed in the web root directory of the target server to be tested, the deployment of the Webshell is completed. At this time, this file can be accessed through http: / / target_ip / c.php. By using the exemplary preset parameter test919 as the location and submitting a POST request, the serialized code (control instructions) can be effectively transmitted to the target server to be tested, thereby promoting the execution of the penetration test.

[0096] In addition to POST requests, other types of requests such as GET requests or PUT requests can also be used.

[0097] Similarly, in addition to being a c.php file, a Webshell file may also be an a.php file, a b.asp file, a d.jsp file, or other types of files used to form a Webshell on a server in actual applications.

[0098] As another specific implementation, the process in which the test device converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation may specifically include the following:

[0099] The test equipment integrates the initial control instructions to obtain the target control instructions.

[0100] It can be understood that the configuration file corresponding to the target server side to be tested is based on the exemplary content of the magic function __destruct shown above. It needs to deserialize the PEOPLE object, and then when this object is destroyed, the magic function __destruct will be executed. Then, it is necessary to integrate the editing statements to obtain the target control instructions that it can recognize.

[0101] Specifically, the specific processing of its control instructions can be set as follows:

[0102] The initial control instructions are:

[0103] test919=O:6:"PEOPLE":2:{s:4:"name";s:4:"exec";s:4:"male";s:3:"dir";}

[0104] Among them, the first 0 means deserialization into an object, 6 is the length of PEOPLE, and 2 means that there are two groups of key values ​​in the object (it can also be 3, 4, 5... groups).

[0105] s:4:"name"; s:4:"exec" means the variable name is name, the length is 4, the variable value is exec, the length is 4;

[0106] s:4:"male"; s:3:"dir" means the variable name is male, the length is 4, the variable value is dir, the length is 3.

[0107] Look at the webshell statement unserialize(base64_decode($_POST["test919"])), there is a base64 decoding function, so the above data field value needs to be base64 encoded, and the execution is as follows:

[0108] base64_encode("O:6:"PEOPLE":2:{s:4:"name";s:4:"exec";s:4:"male";s:3:"dir";}")=>Tzo2OiJQRU9QTEUiOjI6e3M6NDoibmFtZSI7czo0OiJleGVjIjtzOjQ6Im1hbGUiO3M6MzoiZGlyIjt9. This base64-encoded string is the data field of the POST request.

[0109] The data field of this POST request is integrated into a complete request as follows: POST / c.php HTTP / 1.1

[0110] Host:127.0.0.1

[0111] Origin:http: / / 127.0.0.1

[0112] User-Agent:Mozilla / 5.0(Windows NT 10.0;Win64;x64)AppleWebKit / 537.36(KHTML,like Gecko)Chrome / 107.0.0.0Safari / 537.36

[0113] sec-ch-ua-platform:"Windows"

[0114] test919=Tzo2OiJQRU9QTEUiOjI6e3M6NDoibmFtZSI7czo0OiJleGVjIjtzOjQ6Im1hbGUiO3M6Mzo iZGlyIjt9

[0115] Sending this POST request to the c.php file of the target server to be tested can trigger the Webshell to execute the delivered dir instruction using exec.

[0116] Among them, it can be understood that the above content is introduced using the initial control instruction as the dir instruction as an example. In specific applications, it can be any type of instruction, which can be used to serve as a penetration test instruction or an attack instruction. Therefore, the initial control instruction can also be called a penetration test instruction or an attack instruction.

[0117] In addition, it can be seen from the above content that the encryption application of base64 encoding is involved. It is understandable that after the code is deserialized, the program ends, triggering the destruction of the PEOPLE object. The __destruct function will execute the command brought in by the name parameter, and use male as the first parameter, and $b as the execution echo. In the request configured by this application, name is the exec function, which is the function for executing system commands in PHP, and male is the dir command, which is the command used to view the directory. That is to say, this request will make the Webshell execute the exec(dir,$b) command, and the $b variable stores the echo content. In order to prevent detection during transmission, all elements in $b can be decoded and encrypted and transmitted as a whole. The encoding can be based not only on base64, but also on different types of encryption methods such as HEX, AES or DES, thereby having a high degree of data security. After encoding, it is echoed to the page, thus achieving reliable return of the execution result.

[0118] Correspondingly, as another practical implementation, the process of the test device integrating the initial control instructions to obtain the target control instructions may further include:

[0119] After the test equipment integrates the initial control instructions, it obtains the target control instructions through encryption and coding processing, wherein the target server to be tested is configured with a decoding process corresponding to the encryption and coding process.

[0120] On the target server side, it can execute the initial control instructions through deserialization.

[0121] As another example, the target server under test can execute the following statement:

[0122] unserialize(base64_decode($_POST["test919"]))

[0123] Specifically, the target server to be tested will first obtain the test919 parameter in the POST request, then perform base64 decoding, and deserialize the decoded string. The data changes are as follows:

[0124] The test919 parameter in the POST request:

[0125] Tzo2OiJQRU9QTEUiOjI6e3M6NDoibmFtZSI7czo0OiJleGVjIjtzOjQ6Im1hbGUiO3M6MzoiZ GlyIjt9

[0126] For details, you can also refer to Figure 2 A schematic diagram of an interface for parsing a POST request is shown.

[0127] After base64 decoding, we get:

[0128] O:6:"PEOPLE":2:{s:4:"name";s:4:"exec";s:4:"male";s:3:"dir";}

[0129] Deserialization is done with:

[0130] O:6:"PEOPLE":2:{s:4:"name";s:4:"exec";s:4:"male";s:3:"dir";}=>PEOPLE object in PHP

[0131] For details, you can also refer to Figure 3 A schematic diagram of an interface for plain text echo data of the present application is shown.

[0132] In addition, on the target server side to be tested, this application involves the application of deserialization. Due to the deserialized data structure, modifying the command length requires modifying the values ​​of multiple positions. Therefore, it is also possible to develop a deserialized Webshell management terminal (adaptive, specialized application) to achieve high interactivity to assist the penetration testing work of this application.

[0133] Correspondingly, the present application method may further include:

[0134] The test device configures an interactive Webshell management terminal (deserialized Webshell management terminal) on the target server to be tested.

[0135] Taking Python-based programming as an example, the relevant code may include the following:

[0136]

[0137]

[0138] Through the above code, you can realize the interactive webshell application. For details, you can also refer to Figure 4 The following is a schematic diagram of an interface for executing the dir command in this application. Figure 5A schematic diagram of an interface for executing the ipconfig command in this application is shown.

[0139] In general, the above content of this application can be summarized into the following features:

[0140] (1) Anti-killing: Since the configuration file (such as c.php file) itself is not offensive and does not contain any attack code, the real attack code is serialized and passed to the server during the subsequent penetration process, so it will not be perceived by the machine;

[0141] (2) Deceptiveness: the configuration file (such as c.php file) itself can be similar to normal business code, which is invisible to the staff on the server side;

[0142] (3) Security: the communication process can implement various types of encrypted transmission, such as base64, HEX, AES or DES encryption methods;

[0143] (4) Interactivity: it can realize interactive Webshell management terminal, which is more convenient for management.

[0144] The above is an introduction to the penetration testing method provided by this application. In order to facilitate better implementation of the penetration testing method provided by this application, this application also provides a penetration testing device from the perspective of functional modules.

[0145] See Figure 6 , Figure 6 This is a schematic diagram of the structure of the penetration testing device of the present application. In the present application, the penetration testing device 600 may specifically include the following structure:

[0146] Configuration unit 601 is used to configure a Webshell-related configuration file on the target server to be tested, wherein the target server to be tested refers to a server object to be subjected to penetration testing in a future time period, and the configuration file is an executable file with a deserialization feature;

[0147] An acquiring unit 602 is configured to acquire initial control instructions related to the current penetration test task, wherein the initial control instructions are instructions related to the penetration test behavior;

[0148] A conversion unit 603 is configured to convert the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation;

[0149] The execution unit 604 is configured to send the target control instruction to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through the Webshell to execute the initial control instruction to advance the execution of the penetration test task;

[0150] The generating unit 605 is configured to generate a penetration test result of the penetration test task according to a response of the target server to be tested.

[0151] In an exemplary implementation, the configuration file is specifically a Webshell file, and the configuration unit 601 is specifically used to:

[0152] Place a Webshell file in the Web root directory of the target server to be tested. The Webshell file is constructed based on the magic function corresponding to the development language. The Webshell file is used to obtain the preset parameters in the request, decode them, and deserialize them.

[0153] In another exemplary implementation, the Webshell file is specifically used to obtain preset parameters in a POST request, a GET request, or a PUT request, decode them, and perform deserialization.

[0154] In another exemplary implementation, the conversion unit 603 is specifically configured to:

[0155] The initial control instructions are integrated to obtain the target control instructions.

[0156] In another exemplary implementation, the conversion unit 603 is specifically configured to:

[0157] After the test equipment integrates the initial control instructions, it obtains the target control instructions through encryption and coding processing, wherein the target server to be tested is configured with a decoding process corresponding to the encryption and coding process.

[0158] In another exemplary implementation, the encryption encoding process specifically adopts base64, HEX, AES or DES encryption.

[0159] In another exemplary implementation, the configuration unit 601 is further configured to:

[0160] Configure the interactive Webshell management terminal on the target server to be tested.

[0161] This application also provides a test device from the perspective of hardware structure, see Figure 7 , Figure 7 The present invention shows a schematic diagram of a test device. Specifically, the present invention may include a processor 701, a memory 702, and an input / output device 703. The processor 701 is used to execute the computer program stored in the memory 702. Figure 1 Each step of the penetration testing method in the corresponding embodiment; or, when the processor 701 is used to execute the computer program stored in the memory 702, the following is implemented Figure 6The memory 702 is used to store the functions of each unit in the corresponding embodiment. Figure 1 The computer program required for the penetration testing method in the corresponding embodiment.

[0162] For example, the computer program may be divided into one or more modules / units, one or more of which are stored in the memory 702 and executed by the processor 701 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in a computer device.

[0163] The test equipment may include, but is not limited to, a processor 701, a memory 702, and an input / output device 703. Those skilled in the art will appreciate that the illustration is merely an example of the test equipment and does not limit the test equipment. The test equipment may include more or fewer components than shown, or a combination of certain components, or different components. For example, the test equipment may also include a network access device, a bus, etc., and the processor 701, the memory 702, the input / output device 703, etc. are connected via the bus.

[0164] The processor 701 may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the test equipment and connects various parts of the entire equipment using various interfaces and lines.

[0165] The memory 702 can be used to store computer programs and / or modules. The processor 701 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 702 and accessing the data stored in the memory 702. The memory 702 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, at least one application required for a function, etc.; the data storage area may store data generated based on the use of the test equipment, etc. In addition, the memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0166] When the processor 701 is used to execute the computer program stored in the memory 702, it can specifically implement the following functions:

[0167] Configure the Webshell-related configuration file on the target server to be tested. The target server to be tested is the server object that will undergo penetration testing in the future. The configuration file is an executable file with the deserialization feature.

[0168] Obtaining initial control instructions related to the current penetration test task, wherein the initial control instructions are instructions related to the penetration test behavior;

[0169] Convert the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation;

[0170] Send the target control instructions to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instructions through the Webshell to execute the initial control instructions to advance the execution of the penetration test task;

[0171] Generates the penetration test results of the penetration test task based on the response of the target server to be tested.

[0172] Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the penetration testing device, testing equipment and its corresponding units described above can refer to the following: Figure 1 The description of the penetration testing method in the corresponding embodiment will not be repeated here.

[0173] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0174] To this end, the present application provides a computer-readable storage medium, which stores a plurality of instructions, which can be loaded by a processor to execute the present application as follows: Figure 1 For the steps of the penetration testing method in the corresponding embodiment, please refer to the following for specific operations: Figure 1 The description of the penetration testing method in the corresponding embodiment will not be repeated here.

[0175] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0176] Due to the instructions stored in the computer readable storage medium, the present application can be executed as follows: Figure 1 The steps of the penetration testing method in the corresponding embodiment can thus be implemented as follows: Figure 1 The beneficial effects that can be achieved by the penetration testing method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0177] The above is a detailed introduction to the penetration testing method, device, testing equipment and computer-readable storage medium provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A penetration testing method, characterized in that: The method comprises: The testing device configures a Webshell-related configuration file on the target server to be tested, wherein the target server to be tested refers to a server object to be subjected to penetration testing in a future time period, and the configuration file is an executable file with a deserialization feature; The testing device obtains an initial control instruction related to a current penetration testing task, wherein the initial control instruction is an instruction related to a penetration testing behavior; The test device converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation; The testing device sends the target control instruction to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through a Webshell to execute the initial control instruction to advance the execution of the penetration testing task; The testing device generates a penetration test result of the penetration test task according to the response of the target server to be tested.

2. The method according to claim 1, characterized in that The configuration file is specifically a Webshell file. The test device configures a Webshell-related configuration file on the target server to be tested, including: The test device places the Webshell file in the Web root directory of the target server to be tested, wherein the Webshell file is constructed based on the magic function corresponding to the development language, and the Webshell file is used to obtain preset parameters in the request and decode and deserialize them.

3. The method according to claim 2, characterized in that The Webshell file is specifically used to obtain preset parameters in a POST request, a GET request, or a PUT request, decode them, and perform deserialization.

4. The method according to claim 1, wherein The test device converts the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation, including: The test device performs statement integration on the initial control instruction to obtain the target control instruction.

5. The method according to claim 4, characterized in that The test device integrates the initial control instruction to obtain the target control instruction, including: After the test device performs statement integration on the initial control instruction, the target control instruction is obtained through encryption coding, wherein the target server to be tested is configured with a decoding process corresponding to the encryption coding process.

6. The method according to claim 5, characterized in that The encryption coding process specifically adopts the encryption method of base64, HEX, AES or DES.

7. The method according to claim 1, characterized in that The method further comprises: The testing device configures an interactive Webshell management terminal on the target server to be tested.

8. A penetration testing device, characterized in that: The device comprises: A configuration unit is used to configure a Webshell-related configuration file on a target server to be tested, wherein the target server to be tested refers to a server object to be subjected to penetration testing in a future time period, and the configuration file is an executable file with a deserialization feature; An acquiring unit, configured to acquire an initial control instruction related to a current penetration test task, wherein the initial control instruction is an instruction related to a penetration test behavior; A conversion unit, configured to convert the initial control instruction into a target control instruction that can trigger the configuration file to perform a deserialization operation; An execution unit, configured to send the target control instruction to the configuration file, so that the target server to be tested performs a deserialization operation on the target control instruction through a Webshell to execute the initial control instruction to advance the execution of the penetration testing task; A generating unit is used to generate a penetration test result of the penetration test task according to the response of the target server to be tested.

9. A testing device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method according to any one of claims 1 to 7 is executed.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images