A network penetration result verification method, system and device based on a data hidden transmission algorithm and a storage medium

Abstract

A method, system, device, and storage medium for verifying network penetration results based on a data escaping algorithm, belonging to the field of network security technology, solves the problem that existing verification methods are easily intercepted by mainstream security devices and are difficult to achieve data transmission and vulnerability verification under the current mainstream network security architecture. The method includes the following steps: establishing a vulnerability verification system; establishing a vulnerability scanning system; establishing a detection script template library; a verification ID application module applying for IDs from the vulnerability verification system; after generating IDs, the vulnerability verification system assigns IDs to the vulnerability scanning system; a data monitoring and ID decoding module monitors all incoming data and decodes the ID information in the received data; the vulnerability scanning system merges the ID with the detection payload and sends it to the target being monitored; the target being monitored executes the detection payload and initiates a ping command to the vulnerability verification system; a verification query module checks the ID monitoring results with the verification service system to complete the attack result verification.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, system, device, and storage medium for verifying network penetration results based on a data stealth algorithm. Background Technology

[0002] Currently, vulnerability scanning results verification methods in the cybersecurity field are mostly based on attack echo, DNS log, HTTP log, TCP log, UDP log, and modified IMC packets.

[0003] However, these verification methods have drawbacks: they are easily intercepted by mainstream security devices and are difficult to achieve data transmission and vulnerability verification under the existing mainstream network security architecture. Summary of the Invention

[0004] This invention solves the problem that existing verification methods are easily intercepted by mainstream security devices and are difficult to achieve data transmission and vulnerability verification under the existing mainstream network security architecture.

[0005] The present invention discloses a network penetration test result verification system based on a data stealth algorithm, the system comprising a vulnerability verification system and a vulnerability scanning system;

[0006] After generating an ID, the vulnerability verification system assigns the ID to the vulnerability scanning system. The vulnerability verification system listens for this ID and receives the ping command initiated by the target being detected when it executes the detection payload.

[0007] The vulnerability scanning system requests an ID from the vulnerability verification system, merges the ID with the detection payload, and sends it to the target being detected. The vulnerability scanning system then checks the ID monitoring result with the vulnerability verification system.

[0008] The vulnerability verification system includes an ID generation module, an ID lifecycle management module, and a data monitoring and ID decoding module.

[0009] The vulnerability scanning system includes a detection script synthesis module, a detection script execution module, a verification ID application module, and a verification query module;

[0010] Upon receiving an ID request, the ID generation module first locks the generation code, then reads the system time V1 in milliseconds, generates a UUID string V2, performs a CRC32 digest calculation on the concatenated array of V1 and V2 to obtain a 32-bit ID, stores the ID in the database, and unlocks it. The validity period of the ID is 10 minutes.

[0011] The ID lifecycle management module provides WebService ID application API and WebService ID query API, and is responsible for managing ID generation and storage actions;

[0012] The data monitoring and ID decoding module is based on libpcap and uses a standard ping listener to perform ID decoding.

[0013] Upon receiving the ID, the detection script synthesis module reads the detection script template using the ID standard ping command encoder. Based on predetermined rules, it modifies the attack target, loop ping count, and delay information in the payload of the template to obtain the script to be executed.

[0014] The detection script execution module reads the script to be executed into memory, uses PyRun_String and the script string to be executed in memory to dynamically execute the script, and checks whether there are any errors in the execution;

[0015] The verification ID application module initiates an ID application to the vulnerability verification system via WebService;

[0016] The verification query module uses a WebService to check the ID monitoring results with the vulnerability verification system.

[0017] Furthermore, in one embodiment of the present invention, the predetermined rule is the decimal value of each byte of the hexadecimal ID plus 1, and a 5-second delay after each byte's ping ends.

[0018] Furthermore, in one embodiment of the present invention, the data monitoring and ID decoding module builds a standard ping listener based on libpcap to complete ID decoding, specifically as follows:

[0019] After the ID is generated, a fixed time period is used as a large cycle, with the source IP address as the unit. When the first ping packet is received, the number of received ping packets is continuously counted until the condition is met. Then, the reception of the first byte value ends, and the value is decremented by 1 to obtain the last value of the byte. The second byte is received in the same way.

[0020] Furthermore, in one embodiment of the present invention, the large cycle receives a maximum of 4 bytes of data.

[0021] Furthermore, in one embodiment of the present invention, the condition is that the number of received ping packets is greater than 17 or the time interval between two ping packets is greater than 5 seconds.

[0022] The present invention discloses a network penetration test result verification method based on a data covert transmission algorithm. This method is implemented using a network penetration test result verification system based on a data covert transmission algorithm as described in any of the above methods, and includes the following steps:

[0023] Step S1, establish a vulnerability verification system: establish an ID generator module, establish an ID lifecycle management module, establish a Web Service to establish interactive I / O, and establish an ICMP listener to receive verification data;

[0024] Step S2, establish a vulnerability scanning system: establish a detection script template library, establish a script parser, establish a detection script synthesis module, establish a detection script execution module, and establish a Web Client interaction component;

[0025] Step S3: The ID application module requests an ID from the vulnerability verification system.

[0026] Step S4: After the vulnerability verification system generates an ID, it assigns the ID to the vulnerability scanning system. The data monitoring and ID decoding module monitors all incoming data and decodes the ID information in the received data.

[0027] Step S5: The vulnerability scanning system merges the ID with the detection payload and sends it to the target being detected;

[0028] Step S6: The target being detected executes the detection payload and sends a ping command to the vulnerability verification system;

[0029] Step S7: The verification query module checks the ID monitoring results with the verification service system to complete the attack result verification.

[0030] The electronic device of the present invention includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus.

[0031] Memory, used to store computer programs;

[0032] When a processor executes a program stored in memory, it implements the steps described in the above method.

[0033] The present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described above.

[0034] This invention addresses the problem that existing verification methods are easily intercepted by mainstream security devices, making it difficult to achieve data transmission and vulnerability verification under current mainstream network security architectures. Specific beneficial effects include:

[0035] The present invention discloses a network penetration test result verification method based on a data covert transmission algorithm. In an extreme network environment where TCP and UDP protocols, non-ping ICMP packets, and ping irregular packets are disabled on the host or network security equipment, the standard ping command is used to bypass the security equipment block and covertly send vulnerability verification information to the vulnerability verification server to achieve the purpose of vulnerability verification and realize the function of vulnerability discovery in extreme network environments. Attached Figure Description

[0036] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0037] Figure 1 This is a flowchart of a network penetration result verification method based on a data escaping algorithm, as described in the specific implementation.

[0038] Figure 2 This is a diagram of a network penetration result verification system based on a data stealth algorithm, as described in the specific implementation method.

[0039] Figure 3 This is a diagram of a network penetration result verification system based on a data stealth algorithm, as described in the specific implementation method.

[0040] Figure 4 This is a diagram of a network penetration result verification system based on a data escaping algorithm, as described in the specific implementation. Detailed Implementation

[0041] Various embodiments of the present invention will now be clearly and completely described with reference to the accompanying drawings. The embodiments described with reference to the drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0042] This embodiment describes a network penetration test result verification system based on a data stealth algorithm, the system comprising a vulnerability verification system and a vulnerability scanning system;

[0043] After generating an ID, the vulnerability verification system assigns the ID to the vulnerability scanning system. The vulnerability verification system listens for this ID and receives the ping command initiated by the target being detected when it executes the detection payload.

[0044] The vulnerability scanning system requests an ID from the vulnerability verification system, merges the ID with the detection payload, and sends it to the target being detected. The vulnerability scanning system then checks the ID monitoring result with the vulnerability verification system.

[0045] The vulnerability verification system includes an ID generation module, an ID lifecycle management module, and a data monitoring and ID decoding module.

[0046] The vulnerability scanning system includes a detection script synthesis module, a detection script execution module, a verification ID application module, and a verification query module;

[0047] Upon receiving an ID request, the ID generation module first locks the generation code, then reads the system time V1 in milliseconds, generates a UUID string V2, performs a CRC32 digest calculation on the concatenated array of V1 and V2 to obtain a 32-bit ID, stores the ID in the database, and unlocks it. The validity period of the ID is 10 minutes.

[0048] The ID lifecycle management module provides WebService ID application API and WebService ID query API, and is responsible for managing ID generation and storage actions;

[0049] The data monitoring and ID decoding module is based on libpcap and uses a standard ping listener to perform ID decoding.

[0050] Upon receiving the ID, the detection script synthesis module reads the detection script template using the ID standard ping command encoder. Based on predetermined rules, it modifies the attack target, loop ping count, and delay information in the payload of the template to obtain the script to be executed.

[0051] The detection script execution module reads the script to be executed into memory, uses PyRun_String and the script string to be executed in memory to dynamically execute the script, and checks whether there are any errors in the execution;

[0052] The verification ID application module initiates an ID application to the vulnerability verification system via WebService;

[0053] The verification query module uses a WebService to check the ID monitoring results with the vulnerability verification system.

[0054] In this embodiment, the predetermined rule is the decimal value of each byte of the hexadecimal ID plus 1, and a 5-second delay after each byte's ping ends.

[0055] In this embodiment, the data monitoring and ID decoding module is based on libpcap to build a standard ping listener and complete ID decoding, specifically as follows:

[0056] After the ID is generated, a fixed time period is used as a large cycle, with the source IP address as the unit. When the first ping packet is received, the number of received ping packets is continuously counted until the condition is met. Then, the reception of the first byte value ends, and the value is decremented by 1 to obtain the last value of the byte. The second byte is received in the same way.

[0057] In this embodiment, a large cycle can receive a maximum of 4 bytes of data.

[0058] In this embodiment, the condition is that the number of received ping packets is greater than 17 or the time interval between two ping packets is greater than 5 seconds.

[0059] This embodiment is based on the network penetration result verification system based on the data stealth algorithm described in this invention, combined with... Figure 2 To better understand this implementation method, a practical implementation method is provided:

[0060] like Figure 3 As shown, the ID lifecycle management module provides WebService ID application API and WebService ID query API, and is responsible for managing ID generation and storage actions.

[0061] Upon receiving an ID request, the ID generation module first locks the generation code, then reads the system time V1 in milliseconds, generates a UUID string V2 using the Snowflake algorithm, performs a CRC32 digest calculation on the concatenated array of V1 and V2 to obtain a 32-bit ID, stores the ID in the database, and then unlocks it. Each ID is valid for 10 minutes.

[0062] The data monitoring and ID decoding module is built on libpcap to create a standard ping listener. After the ID is generated, it uses a fixed time interval as a large cycle and the source IP address as the unit. When the first ping packet is received, it starts to continuously count the number of received ping packets until the number of received ping packets is greater than 17 or the time interval between two ping packets is greater than 5 seconds. At this point, it stops receiving the value of the first byte, decrements the value by 1, and obtains the last value of the byte. The same method is used to receive the second byte. A maximum of 4 bytes of data can be received in one large cycle to complete the ID decoding.

[0063] like Figure 4 As shown, the ID verification module initiates an ID request to the vulnerability verification system via WebService.

[0064] The verification query module uses a WebService to send a result check to the vulnerability verification system to see if the ID has been received.

[0065] After obtaining the ID, the detection script synthesis module reads the detection script template using the ID standard ping command encoder. Based on the rule of adding 1 to the decimal value of each byte of the hexadecimal ID and delaying for 5 seconds after each byte of ping ends, it modifies the attack target, number of loop pings, delay, and other information in the payload of the template to obtain the script to be executed.

[0066] The script execution detection module reads the script to be executed into memory, uses PyRun_String and the script string in memory to dynamically execute the script, and checks for execution errors.

[0067] This embodiment describes a network penetration test result verification method based on a data stealth algorithm. The method is implemented using a network penetration test result verification system based on a data stealth algorithm as described in any of the above embodiments, and includes the following steps:

[0068] Step S1, establish a vulnerability verification system: establish an ID generator module, establish an ID lifecycle management module, establish a Web Service to establish interactive I / O, and establish an ICMP listener to receive verification data;

[0069] Step S2, establish a vulnerability scanning system: establish a detection script template library, establish a script parser, establish a detection script synthesis module, establish a detection script execution module, and establish a Web Client interaction component;

[0070] Step S3: The ID application module requests an ID from the vulnerability verification system.

[0071] Step S4: After the vulnerability verification system generates an ID, it assigns the ID to the vulnerability scanning system. The data monitoring and ID decoding module monitors all incoming data and decodes the ID information in the received data.

[0072] Step S5: The vulnerability scanning system merges the ID with the detection payload and sends it to the target being detected;

[0073] Step S6: The target being detected executes the detection payload and sends a ping command to the vulnerability verification system;

[0074] Step S7: The verification query module checks the ID monitoring results with the verification service system to complete the attack result verification.

[0075] This embodiment is based on the network penetration result verification method based on the data escaping algorithm described in this invention, combined with... Figure 1 To better understand this implementation method, a practical implementation method is provided:

[0076] Step S1: Establish a vulnerability verification system: Establish an ID generator module, establish an ID lifecycle management module, establish a Web Service to establish interactive I / O, and establish an ICMP listener to receive verification data;

[0077] Step S2: Establish a vulnerability scanning system: establish a detection script template library, establish a script parser, establish a detection script synthesis module, establish a detection script execution module, and establish a Web Client interaction component;

[0078] Step S3: Before each verification of the target being detected, the verification ID application module requests an ID from the vulnerability verification system, encodes the ID by value, and synthesizes an effective detection payload using the detection script template and the encoded content.

[0079] Step S4: The vulnerability verification system generates a compressed unique ID and assigns the ID to the vulnerability scanning system. The data monitoring and ID decoding module monitors all incoming data and decodes the ID information in the received data.

[0080] Step S5: After the vulnerability scanning system sends the detection payload, the verification queryer queries the vulnerability verification system for the ID information contained in this payload to complete the attack result verification.

[0081] An electronic device according to this embodiment includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus.

[0082] Memory, used to store computer programs;

[0083] When a processor executes a program stored in memory, it implements the steps of the method described in the above embodiments.

[0084] This embodiment provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in the above embodiment.

[0085] The memory in this application embodiment can be volatile memory or non-volatile memory, or it can include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory used in the methods described in this invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0086] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0087] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0088] It should be noted that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiments can be completed by the integrated logic circuitry in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0089] The foregoing has provided a detailed description of the network penetration result verification method, system, device, and storage medium based on the data covert transmission algorithm proposed in this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A network penetration test result verification system based on a data escaping algorithm, characterized in that, The system includes a vulnerability verification system and a vulnerability scanning system; After generating an ID, the vulnerability verification system assigns the ID to the vulnerability scanning system. The vulnerability verification system listens for this ID and receives the ping command initiated by the target being detected when it executes the detection payload. The vulnerability scanning system requests an ID from the vulnerability verification system, merges the ID with the detection payload, and sends it to the target being detected. The vulnerability scanning system then checks the ID monitoring result with the vulnerability verification system. The vulnerability verification system includes an ID generation module, an ID lifecycle management module, and a data monitoring and ID decoding module. The vulnerability scanning system includes a detection script synthesis module, a detection script execution module, a verification ID application module, and a verification query module; Upon receiving an ID request, the ID generation module first locks the generation code, then reads the system time V1 in milliseconds, generates a UUID string V2, performs a CRC32 digest calculation on the concatenated array of V1 and V2 to obtain a 32-bit ID, stores the ID in the database, and unlocks it. The validity period of the ID is 10 minutes. The ID lifecycle management module provides WebService ID application API and WebService ID query API, and is responsible for managing ID generation and storage actions; The data monitoring and ID decoding module is based on libpcap and uses a standard ping listener to perform ID decoding. Upon receiving the ID, the detection script synthesis module uses the ID standard ping command encoder to read the detection script template and, according to predetermined rules, modifies the attack target, loop ping count, and delay information in the payload of the template to obtain the script to be executed. The detection script execution module reads the script to be executed into memory, uses PyRun_String and the script string to be executed in memory to dynamically execute the script, and checks whether there are any errors in the execution; The verification ID application module initiates an ID application to the vulnerability verification system via WebService; The verification query module uses a WebService to check the ID monitoring results with the vulnerability verification system.

2. The network penetration test result verification system based on the data escaping algorithm according to claim 1, characterized in that, The predetermined rule is to add 1 to the decimal value of each byte of the hexadecimal ID, and to delay for 5 seconds after each byte's ping ends.

3. The network penetration test result verification system based on the data escaping algorithm according to claim 1, characterized in that, The data monitoring and ID decoding module is based on libpcap to build a standard ping listener and completes ID decoding, specifically as follows: After the ID is generated, a fixed time period is used as a large cycle, with the source IP address as the unit. When the first ping packet is received, the number of received ping packets is continuously counted until the condition is met. Then, the reception of the first byte value ends, and the value is decremented by 1 to obtain the last value of the byte. The second byte is received in the same way.

4. The network penetration test result verification system based on the data escaping algorithm according to claim 3, characterized in that, The maximum number of bytes of data that can be received in a single cycle is 4 bytes.

5. A network penetration test result verification system based on a data escaping algorithm according to claim 3, characterized in that, The condition is that the number of received ping packets is greater than 17 or the time interval between two ping packets is greater than 5 seconds.

6. A method for verifying network penetration results based on a data escaping algorithm, wherein the method is implemented using a network penetration result verification system based on a data escaping algorithm as described in any one of claims 1-5, characterized in that... Includes the following steps: Step S1, establish a vulnerability verification system: establish an ID generation module, establish an ID lifecycle management module, establish a WebService service to establish interactive IO, and establish an ICMP listener to receive verification data; Step S2, establish a vulnerability scanning system: establish a detection script template library, establish a script parser, establish a detection script synthesis module, establish a detection script execution module, and establish a Web Client interaction component; Step S3: The ID application module requests an ID from the vulnerability verification system. Step S4: After the vulnerability verification system generates an ID, it assigns the ID to the vulnerability scanning system. The data monitoring and ID decoding module monitors all incoming data and decodes the ID information in the received data. Step S5: The vulnerability scanning system merges the ID with the detection payload and sends it to the target being detected; Step S6: The target being detected executes the detection payload and sends a ping command to the vulnerability verification system; Step S7: The verification query module checks the ID monitoring results with the verification service system to complete the attack result verification.

7. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in memory, it implements the steps of the method described in claim 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in claim 6.

Images