A penetration testing attack optimization method, system, and storage medium

Abstract

This application discloses a penetration testing attack optimization method, system, and storage medium, relating to the field of smart home / intelligent home technology. The penetration testing attack optimization method includes: collecting relevant information data of a target website; performing vulnerability detection on the relevant information data of the target website to obtain the vulnerability types of exploitable vulnerabilities and their corresponding vulnerability environments; performing penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in a training set, and recording the attack payloads that successfully penetrate the target website; and updating the training set after matching the attack payloads that successfully penetrate the target website with the corresponding vulnerability environments.

Description

Technical Field

[0001] This application relates to the field of network data security technology, and more specifically, to an optimized method, system, and storage medium for penetration testing attacks. Background Technology

[0002] Faced with an increasingly severe cybersecurity situation, routine live-fire attack and defense exercises have become the best practice for testing cybersecurity protection levels and improving the security awareness and practical skills of practitioners. With the large-scale implementation of these exercises, many companies face difficulties in understanding both their own capabilities and the challenges of penetration testing.

[0003] In terms of understanding the enemy, companies typically organize red team / blue team exercises to conduct real-world cyber attack and defense drills, hoping to discover hackers' attack methods and potential vulnerabilities in advance. However, difficulties such as organizing these activities, coordinating attack teams, and varying skill levels among participants often make it hard to quantify and demonstrate the results and value of the work.

[0004] In terms of self-awareness, enterprises can use methods such as risk assessment and code auditing to understand the vulnerabilities and residual risks of their own application systems. However, in practice, there are still many problems regarding whether their own security defense system can effectively detect and respond to attacks and exploitation behaviors that use social engineering, close-range attacks, or even zero-day vulnerabilities. Summary of the Invention

[0005] To overcome the above-mentioned shortcomings, this invention is proposed to provide a penetration testing attack optimization method, system, and storage medium that solves or at least partially solves the problem of low success rate of penetration testing attacks.

[0006] In a first aspect, the present invention provides an optimized method for penetration testing attacks, characterized in that it includes:

[0007] Collect relevant information and data from the target website;

[0008] Vulnerability detection is performed on the relevant information data of the target website to obtain the types of exploitable vulnerabilities and their corresponding vulnerability environments;

[0009] Penetration attacks were performed using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and the attack payloads that successfully penetrated the vulnerabilities were recorded.

[0010] After the successful penetration attack payload is matched with the corresponding vulnerability environment, the training set is updated.

[0011] In one specific embodiment, the collection of relevant information data from the target website includes:

[0012] Collect information on the target device type, open ports, services, development frameworks, and components for penetration testing.

[0013] In one specific embodiment, the step of performing vulnerability detection on the relevant information data of the target website to obtain the vulnerability types of exploitable vulnerabilities and their corresponding vulnerability environments includes:

[0014] The detection script is used to scan the relevant information data of the target website, discover all vulnerabilities, and obtain the vulnerability types and corresponding vulnerability environments;

[0015] Based on the vulnerability type, determine whether there is an exploitable vulnerability among all the vulnerabilities;

[0016] If an exploitable vulnerability exists, the vulnerability type and its corresponding vulnerability environment are obtained.

[0017] In one specific embodiment, the step of performing a penetration attack using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and recording the attack payloads of successful penetration attacks, includes:

[0018] The exploitable vulnerabilities are then exploited sequentially using attack payloads corresponding to the vulnerability types in the training set.

[0019] Determine whether a penetration attack was successful;

[0020] If the penetration attack is successful, the attack payload of the successful penetration attack is recorded.

[0021] In one specific embodiment, the feature is that if the penetration attack is unsuccessful, the attack payload corresponding to the training set is decomposed into the smallest fragments and then a second penetration attack is performed on the vulnerability type, and the training set is selectively updated according to the result of the second penetration attack.

[0022] In one specific embodiment, the step of decomposing the attack payload corresponding to the training set into the smallest fragments and then performing another penetration attack on the vulnerability type, and selectively updating the training set based on the results of the second penetration attack, includes:

[0023] The attack payloads corresponding to the training set are decomposed into the smallest fragments;

[0024] Use attack payloads broken down into the smallest fragments to perform a re-penetration attack on the vulnerability type;

[0025] Determine whether a penetration attack was successful;

[0026] If the penetration attack is successful, record the attack payload broken down into its smallest fragments; and / or

[0027] If the penetration attack is unsuccessful, the penetration test will end.

[0028] In one specific embodiment, the determination of whether the penetration attack was successful includes:

[0029] Check whether the target website's server returns the specified information;

[0030] If the specified information is returned, the penetration attack is successful; and / or

[0031] If the specified information is not returned, the penetration attack fails.

[0032] In one specific embodiment, the method further includes:

[0033] The results of penetration testing and related vulnerability information are compiled into a report and displayed on the front-end user interface.

[0034] In a second aspect, the present invention provides a penetration testing attack optimization system, characterized in that it comprises:

[0035] Information collection module: Used to collect relevant information and data from the target website;

[0036] Vulnerability detection module: performs vulnerability detection on the relevant information and data of the target website to obtain the types of exploitable vulnerabilities and their corresponding vulnerability environments;

[0037] Penetration attack module: Performs penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and records the attack payloads of successful penetration attacks;

[0038] Machine learning module: After matching the successful attack payload of the penetration attack with the corresponding vulnerability environment, it updates the training set.

[0039] In a third aspect, the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored program, wherein the program executes the above-described penetration testing attack optimization method when it runs.

[0040] The above-described technical solutions of the present invention have at least one or more of the following beneficial effects:

[0041] By implementing the technical solution of this invention, the problem of low success rate of penetration testing attacks can be solved or at least partially solved. Attached Figure Description

[0042] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic flowchart of the main steps of a penetration testing attack optimization method according to an embodiment of the present invention;

[0045] Figure 2 This is a flowchart illustrating the main steps of obtaining the exploitable vulnerability type and its corresponding vulnerability environment from relevant information data of the target website according to an embodiment of the present invention.

[0046] Figure 3 This is a schematic diagram of the main steps of performing a penetration attack using the corresponding attack payload in the training set and recording the attack payload that successfully penetrates the target, according to an embodiment of the present invention.

[0047] Figure 4 This is a schematic diagram of the main steps of decomposing the attack payload into the smallest fragments and then performing a penetration attack and updating the training set according to an embodiment of the present invention.

[0048] Figure 5 This is a schematic diagram of a penetration testing attack optimization system according to an embodiment of the present invention. Detailed Implementation

[0049] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0050] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0051] To address the aforementioned technical problems, particularly the low success rate of penetration testing attacks, this invention proposes an optimized penetration testing attack method, system, and storage medium.

[0052] In embodiments of the present invention, see appendix. Figure 1 , Figure 1 This is a schematic flowchart of the main steps of a penetration testing attack optimization method according to an embodiment of the present invention, as follows: Figure 1 As shown, it includes the following steps S1-S5:

[0053] S1. Collect relevant information and data from the target website.

[0054] In one specific embodiment, the collection of relevant information data from the target website includes:

[0055] Collect information on the target device type, open ports, services, development frameworks, and components for penetration testing.

[0056] For example, before conducting a penetration test attack, the system can fill in the target website's characteristic information, such as the company name and top-level domain name, in the information collection menu. The penetration test attack system can then automatically start the crawler script to collect relevant information data about the target website across the Internet and generate a list containing device type, open ports, services, development frameworks and components, so as to conduct further vulnerability detection based on this relevant information data.

[0057] Furthermore, after collecting relevant information and data about the target website, it is easier to conduct more targeted vulnerability detection. For example, if it is found that the target website uses the MySQL database type, then MySQL-related CVEs and tools can be used for vulnerability detection. Or, if the collected relevant information and data find that the target website has opened port 22, then weak password brute-force attacks can be used for further vulnerability exploitation.

[0058] S2. Perform vulnerability detection on the relevant information data of the target website to obtain the types of exploitable vulnerabilities and their corresponding vulnerability environments.

[0059] For example, the most effective attack payload will differ depending on the vulnerability environment. Take SQL injection vulnerabilities, for instance. By default, there are 100 attack payloads corresponding to SQL injection vulnerabilities. However, vulnerability detection reveals that this vulnerability is exploited in the URL: www.xxx.com / user?=1 'and 1=1'. In this specific vulnerability environment, the attack command '1'and 1=1' is the most effective.

[0060] In one specific embodiment, see Appendix Figure 2 The step of performing vulnerability detection on the relevant information data of the target website to obtain the vulnerability types and corresponding vulnerability environments of exploitable vulnerabilities includes steps S21-S22:

[0061] S21. Use a detection script to scan the relevant information data of the target website, discover all vulnerabilities, and obtain the vulnerability types and corresponding vulnerability environments.

[0062] S22. Based on the vulnerability type, determine whether there is an exploitable vulnerability among all the vulnerabilities.

[0063] In one example, not all vulnerabilities can be exploited for penetration attacks. For instance, simple information discovery vulnerabilities are unusable. Although such vulnerabilities may leak some insignificant information, they cannot be used to attack the server. Therefore, further assessment of the detected vulnerabilities is required.

[0064] For example, vulnerabilities such as misconfiguration / errors, logical / involvement errors, unauthorized access / permission bypass, keylogging, protocol anomalies, and browser hijacking cannot be used to continue exploiting attacks on the target website's server.

[0065] S23. If there is an exploitable vulnerability, obtain the vulnerability type of the exploitable vulnerability and its corresponding vulnerability environment.

[0066] Furthermore, if none of the vulnerabilities discovered by the vulnerability probe are exploitable, the penetration test attack ends.

[0067] S3. Perform penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and record the attack payloads that successfully penetrate the vulnerabilities.

[0068] In one specific embodiment, see Appendix Figure 3The step of performing penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and recording the attack payloads of successful penetration attacks, includes:

[0069] S31. Using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, perform penetration attacks on the exploitable vulnerabilities in sequence.

[0070] S32. Determine whether the penetration attack was successful;

[0071] S33. If the penetration attack is successful, record the attack payload of the successful penetration attack.

[0072] In one example, such as an SQL injection vulnerability, there are 100 attack payloads corresponding to the SQL injection vulnerability by default. However, in this penetration test, only the attack payload "1'and 1=1" was successfully penetrated. Therefore, "1'and 1=1" is recorded and added to the training set for future use.

[0073] In one specific embodiment, the feature is that if the penetration attack is unsuccessful, the attack payload corresponding to the training set is decomposed into the smallest fragments and then a second penetration attack is performed on the vulnerability type, and the training set is selectively updated according to the result of the second penetration attack.

[0074] Furthermore, by using machine learning to decompose the attack payload corresponding to the training set into the smallest fragments, a second penetration attack is performed on the vulnerability type, and the training set is selectively updated based on the results of the second penetration attack.

[0075] In one example, the attack payload might fail to penetrate a vulnerability because the target website has security devices (such as a web firewall). These devices can identify the penetration test statements in the attack payload and block the attack. Therefore, machine learning is needed to decompose the corresponding attack payloads in the training set into their smallest fragments to bypass the security devices' detection of these statements. Furthermore, decomposing the attack payload into its smallest fragments and attacking the vulnerability again can significantly improve the success rate of the penetration attack, thereby verifying the security level and reliability of the target website.

[0076] In one specific embodiment, see Appendix Figure 4 The feature is that, after decomposing the attack payload corresponding to the training set into the smallest fragments, a new penetration attack is performed on the vulnerability type, and the training set is selectively updated based on the results of the new penetration attack, including:

[0077] The attack payloads corresponding to the training set are decomposed into the smallest fragments;

[0078] Use attack payloads broken down into the smallest fragments to perform a re-penetration attack on the vulnerability type;

[0079] Determine whether a penetration attack was successful;

[0080] If the penetration attack is successful, record the attack payload broken down into its smallest fragments; and / or

[0081] If the penetration attack is unsuccessful, the penetration test will end.

[0082] For example, the penetration test attack statement POC (and 1=1) can be broken down into "and""1""=""1" and then the penetration attack can be performed again. If the attack is successful, "and""1""=""1" is recorded and added to the training set for future use.

[0083] For example, the penetration test attack statement POC (and 1=1) can be broken down into "and""1""=""1" and then the penetration test can be performed again. If the attack is unsuccessful, it means that the target website has a high level of security and strong reliability, and the penetration test attack can be terminated.

[0084] S4. After matching the successful attack payload of the penetration attack with the corresponding vulnerability environment, update the training set.

[0085] In one example, the most effective attack payload will be different in different vulnerability environments. After obtaining the vulnerability environment and the most effective attack payload corresponding to the vulnerability, by matching and updating in the training set, it can be directly invoked when the next penetration attack is in the same vulnerability environment and the same vulnerability, which improves the penetration attack rate and shortens the time of penetration testing.

[0086] For example, after recording the successful attack payload 1'and 1=1 from the above penetration attack, it is matched with its corresponding vulnerability environment, and the training set is updated after the matching is completed.

[0087] For example, after recording the attack payload "and""1""=""1" from the successful penetration attack mentioned above, it is matched with its corresponding vulnerability environment, and the training set is updated after the matching is completed.

[0088] In one specific embodiment, the determination of whether the penetration attack was successful includes:

[0089] Check whether the target website's server returns the specified information;

[0090] If the specified information is returned, the penetration attack is successful; and / or

[0091] If the specified information is not returned, the penetration attack fails.

[0092] In one example, vulnerability detection is performed by collecting relevant information data from the target website, and then a penetration attack is launched. The fundamental purpose is to obtain relevant data from the target website's server. In other words, if the penetration attack is successful, the target website's server will return specified information.

[0093] In another example, if the target website's server does not return the specified information, it indicates that the target website has a high level of security and strong reliability, and the penetration test attack will end.

[0094] In one specific embodiment, the method further includes:

[0095] The results of penetration testing and related vulnerability information are compiled into a report and displayed on the front-end user interface.

[0096] In one example, the front-end user interface is developed using a JavaScript framework and includes modules for project management, plugin management, fingerprint management, penetration strategies, and system management to facilitate users in performing various penetration testing attacks. After a penetration attack is completed, regardless of its success or failure, the results and related vulnerability information are displayed in a report on the front-end user interface. The report summarizes the security and reliability of the target website from multiple dimensions, including vulnerability type, server type, and remediation status.

[0097] Based on steps S1-S4 above, the attack payload of a successful penetration attack is matched with the corresponding vulnerability environment and then updated in the training set so that it can be directly invoked when the next penetration attack is in the same vulnerability environment with the same vulnerability. This not only improves the penetration attack rate, but also greatly shortens the time spent on penetration testing attacks.

[0098] It should be noted that although the steps in the above embodiments are described in a specific order, those skilled in the art will understand that in order to achieve the effects of the present invention, different steps do not necessarily have to be executed in such an order. They can be executed simultaneously (in parallel) or in other orders, and these variations are all within the scope of protection of the present invention.

[0099] Furthermore, this invention also provides a penetration testing attack optimization system, see appendix. Figure 5 Its features include:

[0100] Information collection module (100): Used to collect relevant information and data from the target website;

[0101] Vulnerability detection module (200): performs vulnerability detection on the relevant information data of the target website to obtain the vulnerability types of exploitable vulnerabilities and their corresponding vulnerability environments;

[0102] Penetration attack module (300): Performs penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and records the attack payloads that successfully penetrate the vulnerabilities.

[0103] Machine learning module (400): After matching the successful attack payload of the penetration attack with the corresponding vulnerability environment, update the training set.

[0104] In one example, the penetration testing attack optimization system is built using the open-source Metasploit penetration testing framework, which provides a large number of exploit codes for components, operating systems, network and security devices, and applications.

[0105] The above-mentioned penetration testing attack optimization system is used for execution Figure 1 The penetration testing attack optimization method embodiments shown are similar in technical principle, the technical problems they solve, and the technical effects they produce. Those skilled in the art can clearly understand this. For the sake of convenience and brevity, the specific working process and related descriptions of the penetration testing attack optimization system can be found in the embodiments of the penetration testing attack optimization method, and will not be repeated here.

[0106] Furthermore, the present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored program, wherein the program executes the above-described penetration testing attack optimization method when it runs.

[0107] Those skilled in the art will understand that all or part of the processes in the method of the above embodiment of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable storage medium can include any entity or device capable of carrying the computer program code, a medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory, a random access memory, an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0108] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will all fall within the scope of protection of the present invention.

[0109] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An optimized method for penetration testing attacks, characterized in that, include: Collect relevant information and data from the target website; Vulnerability detection is performed on the relevant information data of the target website to obtain the types of exploitable vulnerabilities and their corresponding vulnerability environments; Penetration attacks were performed using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and the attack payloads that successfully penetrated the vulnerabilities were recorded. After matching the successful attack payload of the penetration attack with the corresponding vulnerability environment, the training set is updated. If the penetration attack is unsuccessful, the attack payload corresponding to the training set is decomposed into the smallest fragments and then the exploitable vulnerability is attacked again. The training set is then selectively updated based on the results of the second penetration attack.

2. The method according to claim 1, characterized in that, The relevant information and data collected from the target website include: Collect information on the target device type, open ports, services, development frameworks, and components for penetration testing.

3. The method according to claim 1, characterized in that, The process of performing vulnerability detection on the relevant information data of the target website to obtain the types of exploitable vulnerabilities and their corresponding vulnerability environments includes: The detection script is used to scan the relevant information data of the target website, discover all vulnerabilities, and obtain the vulnerability types and corresponding vulnerability environments; Based on the vulnerability type, determine whether there is an exploitable vulnerability among all the vulnerabilities; If an exploitable vulnerability exists, the vulnerability type and its corresponding vulnerability environment are obtained.

4. The method according to claim 1, characterized in that, The process involves performing penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and recording the attack payloads of successful penetration attacks, including: The exploitable vulnerabilities are then exploited sequentially using attack payloads corresponding to the vulnerability types in the training set. Determine whether a penetration attack was successful; If the penetration attack is successful, the attack payload of the successful penetration attack is recorded.

5. The method according to claim 1, characterized in that, The step of decomposing the attack payload corresponding to the training set into the smallest fragments and then performing another penetration attack on the vulnerability type, and selectively updating the training set based on the results of the second penetration attack, includes: The attack payloads corresponding to the training set are decomposed into the smallest fragments; Use attack payloads broken down into the smallest fragments to perform a re-penetration attack on the vulnerability type; Determine whether a penetration attack was successful; If the penetration attack is successful, record the attack payload broken down into its smallest fragments; and / or If the penetration attack is unsuccessful, the penetration test will end.

6. The method according to claim 4 or 5, characterized in that, The determination of whether a penetration attack is successful includes: Check whether the target website's server returns the specified information; If the specified information is returned, the penetration attack is successful; and / or If the specified information is not returned, the penetration attack fails.

7. The method according to claim 1, characterized in that, The method further includes: The results of penetration testing and related vulnerability information are compiled into a report and displayed on the front-end user interface.

8. A penetration testing attack optimization system, characterized in that, include: Information collection module: Used to collect relevant information and data from the target website; Vulnerability detection module: performs vulnerability detection on the relevant information and data of the target website to obtain the types of exploitable vulnerabilities and their corresponding vulnerability environments; Penetration attack module: Performs penetration attacks using attack payloads corresponding to the vulnerability types of the exploitable vulnerabilities in the training set, and records the attack payloads that succeed in the penetration attack; if the penetration attack fails, the attack payloads corresponding to the training set are decomposed into the smallest fragments and then used to perform another penetration attack on the exploitable vulnerability. Machine learning module: After matching the successful attack payload of the penetration attack with the corresponding vulnerability environment, update the training set; selectively update the training set based on the results of the subsequent penetration attack.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method of any one of claims 1 to 7.

Images