A security testing method and system for real-time processing of TCP data

Abstract

The application discloses a kind of for TCP data real-time processing safety testing method and system, belong to TCP protocol on the safety testing field of application layer, a kind of for TCP data real-time processing safety testing method includes the following steps: setting test tool between TCP client and TCP server, and setting proxy tool and secondary proxy tool in TCP client;When TCP client sends data to TCP server, by TCP client proxy tool, the flow direction of sending data is changed, and the sent tcp data is converted into http data and is forwarded to test tool, test tool is modified to the operation received http data and is forwarded to the secondary proxy tool of TCP client, and the secondary proxy tool converts http data into tcp data and is forwarded to TCP server;Modification operation at least includes replay data.Solve the problem that receiving end transmitted by TCP transmission protocol cannot receive application layer replay class data, leading to the problem that the security capability of the receiving end cannot be tested.

Description

Technical Field

[0001] This invention belongs to the field of security testing of the TCP protocol at the application layer, and in particular relates to a security testing method and system for real-time TCP data processing. Background Technology

[0002] Each end of a TCP session sends data containing a 32-bit sequence number, which is used to track the amount of data sent. Every packet contains this sequence number, and the receiving end uses an acknowledgment number to notify the sender of successful data reception. TCP uses sequence numbers to detect duplicates during retransmissions, preventing replay attacks. However, in general security testing, it's often necessary to simulate a replay of application-layer data to test the application's replay resistance, especially in core business logic such as user login, password modification, and control operations.

[0003] Due to the inherent replay resistance of the TCP protocol, existing academic materials rarely focus on application-layer data processing, such as interception, tampering, and replay. There are two main methods for TCP security testing: one involves adding hardware testing equipment to normal communication, such as a damage tester, to intercept, discard, or tamper with specific TCP data; the other is based on the NDIS intermediate layer driver, as disclosed in Xie Mei's paper "Design and Implementation of Packet Filtering and Traffic Monitoring Based on NDIS Intermediate Layer Driver," which uses software programming to call the system kernel driver at the lower level to intercept and tamper with the entire TCP data. As can be seen from these two approaches, there are no specific methods for processing TCP application-layer data. Both hardware testing equipment and kernel driver-level testing target the entire TCP protocol, rather than providing application-layer-specific testing. This is due to TCP's unique sequence number mechanism; TCP does not allow replayed data to reach the receiving end, thus preventing testing of the application-layer receiver's security capabilities. Summary of the Invention

[0004] The purpose of this invention is to provide a security testing method and system for real-time TCP data processing, in order to solve the technical problem in the prior art that the receiving end of TCP transmission protocol cannot receive replay data, thus making it impossible to test the anti-replay capability of the receiving end.

[0005] To achieve the above objectives, the technical solution provided by this invention for a security testing method and system for real-time TCP data processing is as follows:

[0006] A security testing method for real-time TCP data processing includes the following steps: A testing tool is set up between a TCP client and a TCP server, and a proxy tool and a secondary proxy tool are set up on the TCP client; when the TCP client sends data to the TCP server, the TCP client proxy tool changes the flow of the sent data and converts the sent TCP data into HTTP data before forwarding it to the testing tool. The testing tool modifies the received HTTP data and forwards it to the secondary proxy tool on the TCP client. The secondary proxy tool converts the HTTP data back into TCP data and forwards it to the TCP server; when the TCP server receives the TCP data, it returns a packet to the TCP client. The secondary proxy tool on the TCP client changes the flow of the packet and converts the sent TCP data into HTTP data before forwarding it to the testing tool. The testing tool modifies the received HTTP data and forwards it to the proxy tool on the TCP client. The proxy tool converts the HTTP data back into TCP data and forwards it to the TCP client; the modification operation includes at least data replay.

[0007] The beneficial effects are as follows: By changing the data flow to transmit data to the testing tool, and then modifying the data type to one that the testing tool can recognize, the modified TCP data is sent to the TCP server. This allows the TCP server to receive the modified TCP data, and the server's response to the modified data can be observed and analyzed to test its security level. Similarly, the TCP server returns packets to the TCP client, and the client's response to the modified TCP packets can be observed and analyzed to test its security level. This solves the problem that the receiving end of a TCP transmission protocol cannot receive replay-type data, thus preventing the testing of the receiver's anti-replay capabilities.

[0008] As a further improvement, the modification operations include: intercepting data and / or tampering with data.

[0009] The beneficial effect is that the ability of TCP servers and TCP clients to identify or detect data interception and tampering is a fundamental modification in security testing. Therefore, various modifications to the sent data are needed to test the capabilities of TCP servers and TCP clients.

[0010] As a further improvement, a method to change the direction of data transmission is to modify the original destination address of the receiving end of the transmitted data to the address of the testing tool, thereby changing the direction of data transmission.

[0011] The beneficial effect is that after the destination address of the data is modified, the data is transmitted according to the modified destination address, thus achieving the purpose of changing the direction of data flow.

[0012] As a further improvement, the proxy tool retains the original destination address of the receiving end when modifying the destination address of the sent data.

[0013] The beneficial effect is that preserving the original destination address allows the modified data to reach its original destination, achieving the desired testing effect.

[0014] As a further improvement, the testing tool is Burp Suite.

[0015] The beneficial effects are: the Burp Suite testing tool is technically mature, and using it can ensure the accuracy of security testing.

[0016] As a further improvement, the proxy tool is Proxifier, and the secondary proxy tool is Squid.

[0017] The beneficial effect is that this proxy tool is widely used in the field of transparent proxies, so choosing this proxy tool makes this method easier to implement.

[0018] This invention also discloses a security testing system for real-time TCP data processing. The system includes a proxy tool, a secondary proxy tool, and a testing tool. The testing tool is positioned between the TCP client and the TCP server, while the proxy tool and the secondary proxy tool are positioned on the TCP client. The TCP client proxy tool changes the flow of transmitted data and converts the transmitted TCP data into HTTP data before forwarding it to the testing tool. The testing tool modifies the received HTTP data and forwards it to the TCP client proxy tool or the secondary proxy tool on the TCP client. The TCP client secondary proxy tool converts the HTTP data into TCP data and forwards it to the TCP server or the TCP client. The modification operation includes at least data replay.

[0019] The beneficial effects are as follows: The proxy tool functions to change the data flow and forward data, ensuring that the modified data reaches the TCP server or TCP client. The testing tool tests the security performance of the TCP server or TCP client by modifying the data, observing and analyzing the TCP server's or TCP client's response to the modified data, and thus testing the security level of the TCP server or TCP client. This solves the problem that the receiving end using the TCP transport protocol cannot receive replay-type data, thus preventing the testing of the receiving end's anti-replay capabilities.

[0020] As a further improvement, the modification operations include: intercepting data and / or tampering with data.

[0021] The beneficial effect is that the ability of TCP servers and TCP clients to identify or detect data interception or tampering is a fundamental modification in security testing. Therefore, various modifications to the sent data are needed to test the capabilities of TCP servers and TCP clients.

[0022] As a further improvement, a method to change the direction of data transmission is to modify the original destination address of the receiving end of the transmitted data to the address of the testing tool, thereby changing the direction of data transmission.

[0023] The beneficial effect is that after the destination address of the data is modified, the data is transmitted according to the modified destination address, thus achieving the purpose of changing the direction of data flow.

[0024] As a further improvement, the proxy tool retains the original destination address of the receiving end when modifying the destination address of the sent data.

[0025] The beneficial effect is that preserving the original destination address allows the modified data to reach its original destination, achieving the desired testing effect. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the security testing method for real-time TCP data processing in this invention;

[0027] Figure 2 This is a schematic diagram of the security testing system for real-time TCP data processing in this invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention; that is, the described embodiments are merely some embodiments of the invention, not all embodiments. The components of the embodiments of the invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0029] Example of a security testing method for real-time TCP data processing:

[0030] like Figure 1 As shown, a security testing method for real-time TCP data processing is described, which includes the following steps:

[0031] Taking Burp Suite as the testing tool, Proxifier as the proxy tool, and Squid as the secondary proxy tool as the secondary proxy tool, we can illustrate this with an example. Proxifier is used to change the direction of data flow and change the format of data. This testing tool is set between the TCP client and the TCP server. The proxy tool and the secondary proxy tool are set on the TCP client.

[0032] 1) When a TCP client sends data to a TCP server.

[0033] The proxy tool Procifie changes the destination address of the sent data, thereby altering the data flow and converting the TCP data into HTTP data, which is then forwarded to the testing tool Burpsuite via the HTTP Tunnel. The testing tool modifies the HTTP data; this modification can be any combination of intercepting, tampering with, and / or replaying the data.

[0034] The modified HTTP data forwarding proxy tool, Proxifier, converts HTTP data into TCP data and forwards it to the corresponding TCP server based on the original destination address.

[0035] The security level of a TCP server can be determined by observing its response to modified data.

[0036] 2) When the TCP server receives TCP data, it needs to return a message to the TCP client.

[0037] The secondary proxy tool Squid converts TCP packets into HTTP packets and forwards them to the testing tool through an HTTP tunnel. The testing tool modifies the HTTP packets and forwards them to the proxy tool Proxifier. The proxy tool converts the HTTP packets back into TCP packets and forwards them to the TCP client.

[0038] Based on the data received by the TCP client and the corresponding modifications to the testing tools, analyze the security performance of the TCP client.

[0039] By altering the data flow to transmit data to a testing tool, and then changing the data type to one that the tool can recognize, the modified TCP data is sent to a TCP server. This allows the TCP server to receive the modified data, and the server's response is observed and analyzed to test its security level. Similarly, the TCP server returns packets to the TCP client, and the client's response to these modified packets is observed and analyzed to test its security level. This solves the problem that the receiving end of a TCP transmission protocol cannot receive replay-type data, thus preventing the testing of the receiver's security performance.

[0040] Example of a security testing system for real-time TCP data processing:

[0041] like Figure 2 As shown, a security testing system for real-time TCP data processing includes a proxy tool, a secondary proxy tool, and a testing tool. The testing tool is positioned between the TCP client and the TCP server, while the proxy tool and the secondary proxy tool are positioned on the TCP client. The TCP client proxy tool changes the flow of transmitted data and converts the transmitted TCP data into HTTP data before forwarding it to the testing tool. The testing tool modifies the received HTTP data and forwards it to the TCP client proxy tool or the secondary proxy tool on the TCP client. The TCP client secondary proxy tool converts the HTTP data back into TCP data and forwards it to the TCP server or to the testing tool. The modification operation includes at least data replay. This embodiment refers to an embodiment of a security testing method for real-time TCP data processing, which will not be repeated here.

[0042] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still make modifications to the technical solutions described in the foregoing embodiments without creative effort, or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A security testing method for real-time TCP data processing, characterized in that, The method includes the following steps: Set up testing tools between the TCP client and TCP server, and set up proxy tools and secondary proxy tools on the TCP client; When a TCP client sends data to a TCP server, the TCP client proxy tool changes the direction of the data flow and converts the sent TCP data into HTTP data before forwarding it to the testing tool. The testing tool modifies the received HTTP data and forwards it to the secondary proxy tool of the TCP client. The secondary proxy tool converts the HTTP data back into TCP data and forwards it to the TCP server. When the TCP server receives TCP data, it returns a packet to the TCP client. The TCP client's secondary proxy tool converts the sent TCP data into HTTP data and forwards it to the testing tool. The testing tool modifies the received HTTP data and forwards it to the TCP client's proxy tool. The proxy tool converts the HTTP data into TCP data and forwards it to the TCP client. The modification operation includes at least replaying the data.

2. The security testing method for real-time TCP data processing according to claim 1, characterized in that, The modification operations also include: tampering with data and / or intercepting data.

3. The security testing method for real-time TCP data processing according to claim 1, characterized in that, Method to change the direction of data transmission: Modify the original destination address of the receiving end of the transmitted data to the address of the test tool, thereby changing the direction of data transmission.

4. The security testing method for real-time TCP data processing according to claim 3, characterized in that, When the proxy tool modifies the destination address of the sent data, it retains the original destination address of the receiving end.

5. The security testing method for real-time TCP data processing according to any one of claims 1-4, characterized in that, The testing tool used is Burp Suite.

6. The security testing method for real-time TCP data processing according to any one of claims 1-4, characterized in that, The proxy tool is Proxifier, and the secondary proxy tool is Squid.

7. A security testing system for real-time TCP data processing, characterized in that, The system includes a proxy tool, a secondary proxy tool, and a testing tool; the testing tool is used to be set between the TCP client and the TCP server, and the proxy tool and the secondary proxy tool are used to be set on the TCP client. TCP client proxy tools are used to change the direction of data transmission and convert the sent TCP data into HTTP data for forwarding to the testing tool; Testing tools are proxy tools used to modify received HTTP data and forward it to TCP clients, or secondary proxy tools that send data to TCP clients. TCP client secondary proxy tools are used to convert HTTP data into TCP data and forward it to the TCP server or send it to testing tools. The modification operation includes at least replaying the data.

8. The security testing system for real-time TCP data processing according to claim 7, characterized in that, Modification operations also include: intercepting data and / or tampering with data.

9. The security testing system for real-time TCP data processing according to claim 7 or 8, characterized in that, The method to change the direction of data transmission is to modify the original destination address of the receiving end of the data transmission to the address of the test tool, thereby changing the direction of data transmission.

10. The security testing system for real-time TCP data processing according to claim 9, characterized in that, When the proxy tool modifies the destination address of the sent data, it retains the original destination address of the receiving end of the sent data.

Images