A method to bypass weak password scanning protection mechanism based on directed graph representation

Abstract

The present invention relates to a method for bypassing a weak password scanning protection mechanism based on a directed graph representation, and belongs to the field of network security. For a specified tested protocol, the present invention uses nodes to represent the four elements of a scanner source IP, a target IP, a user name, and a password, and uses edges to represent the weak password scanning process. The number of scans is represented by the path value or weight corresponding to the edge, and the S and D nodes are used as nodes for task start and task end to obtain a directed graph model. The present invention establishes a directed graph model, and effectively schedules the scanning process by using a path flow minimum algorithm. The present invention can effectively bypass the two major protection mechanisms of weak passwords-IP interception and account authentication locking, thereby improving the detection efficiency of weak password scanning.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to a method for bypassing a weak password scanning protection mechanism based on directed graph representation. Background Art

[0002] Weak passwords refer to situations where security is reduced due to the use of simple, easy-to-guess or common passwords, or lax password policies. Common weak passwords include the use of common dictionary words, simple number sequences or repeated characters. In addition, some users may choose passwords related to their personal information, such as birthdays, phone numbers, etc., which may also become the source of weak passwords.

[0003] Weak passwords pose a great threat and harm to network security. Attackers can obtain unauthorized access by guessing or cracking weak passwords, and then exploit system vulnerabilities to further attack the system and steal sensitive data or perform malicious acts such as identity forgery. Especially in Internet applications such as email, social networks, and online banking, weak password vulnerabilities can allow attackers to easily obtain users' accounts and personal information, causing great losses to users.

[0004] In order to reduce the threat posed by weak passwords, weak password scanning is an effective testing method. Weak password scanning is used to detect weak password vulnerabilities in systems or applications. Through automated tools or scripts, weak password scanners can try to use a series of common username and password combinations to log in to the target system to determine whether there are weak passwords.

[0005] Weak password scanning usually includes the following steps: (1) Build a username and password dictionary: The scanner needs to use a dictionary file that contains various common username and password combinations. These combinations may be based on common dictionary words, number sequences, common weak passwords, or known leaked passwords. (2) Connect to the target system: The scanner will try to connect to the target system through the network, usually using protocols such as SSH (Secure Shell), FTP (File Transfer Protocol), or HTTP (Hypertext Transfer Protocol). (3) Perform authentication attempts: The scanner uses the username and password combinations in the dictionary to attempt login authentication. For each combination, the scanner sends a login request to the target system and determines whether the authentication is successful based on the returned response. (4) Analyze the scan results: The scanner records the results of each attempt, including successful authentication combinations and unsuccessful authentication combinations. After the scan is completed, the scanner will generate a report that lists the weak passwords found and recommended remediation measures.

[0006] In order to prevent malicious weak password scanning, the scanning protection mechanism limits the weak password scanner. The two most common mechanisms are: one is IP interception, which prevents scanning by intercepting IPs that access too many times in a short period of time; the other is the account authentication lock mechanism. After a certain number of failed login attempts, the same account will be locked to prevent brute force cracking.

[0007] The existing weak password scanner mainly consists of three modules: port detection, feature recognition, and weak password detection. Their functions are:

[0008] The port detection module detects the live IPs and open ports in the scan target range;

[0009] The feature recognition module identifies the protocols, services and interfaces used by the target under the OSI model framework by matching the feature library;

[0010] The weak password detection module conducts password cracking on the protocols, services and interfaces that are easily identifiable by the corresponding targets.

[0011] The above technology builds a feasible weak password scanning system for efficient and parallel password detection, but ignores the existing password protection mechanism: such as the IP interception mechanism. When the scanner performs a large number of tests on the same IP (the username and password database will generate a large number of combinations), the tested object will blacklist the scanner IP, and the subsequent test packages sent by the scanner will not be sent to the tested target; such as the user authentication lock mechanism, the account will be locked after the number of failed blasting attempts on the same account exceeds a certain number, and the scanner will also be unable to continue effective testing. This will lead to a large waste of resources. Summary of the invention

[0012] 1. Technical issues to be resolved

[0013] The technical problem to be solved by the present invention is how to provide a method for bypassing a weak password scanning protection mechanism based on a directed graph representation, so as to solve the problem that the existing weak password scanning system ignores the existing password protection mechanism.

[0014] (II) Technical solution

[0015] In order to solve the above technical problems, the present invention proposes a method for bypassing a weak password scanning protection mechanism based on a directed graph representation. The method uses a path flow minimum algorithm to perform scanning scheduling in a weak password scanning system based on a constructed directed graph model, and includes the following steps:

[0016] S1, Initialization: The path value from the starting point S to all nodes P in the password library is initially 0. x The path value to all nodes U in the user name database is initially 0. xThe path value to all nodes DstIP of the destination IP is 0. The path value to any node DstIP of the destination IP is 0. x The path value to all nodes SrcIP of the source IP is 0, and the path value to any node SrcIP of the source IP is 0. x The path value to the end point D is 0; at the same time, the queue Q is initialized;

[0017] S2. Find the path with the minimum traffic: For S to D, select a path with the minimum path value Path =<S,P,U,DstIP,SrcIP,D> ;

[0018] S3. If Path is not in queue Q, add Path to Q, add 1 to all edge weights of Path, and perform a scan, that is, use SrcIP's scanner to send a test packet with username U and password P to DstIP's target; if Path is in queue Q, end this scan;

[0019] S4. If the test fails, execute S5; if the test succeeds, remove the edge E from the current user name to the destination IP.<U,DstIP> , then execute S5;

[0020] S5. Jump to S2 and continue to find the path with the least traffic to perform the test.

[0021] (III) Beneficial effects

[0022] The present invention proposes a method for bypassing a weak password scanning protection mechanism based on a directed graph representation. The present invention designs a method for bypassing a weak password scanning protection mechanism with minimal directed graph path traffic. A directed graph model is constructed for the four elements of scanner IP, target IP, user name, and password. The method of minimizing path traffic is used to schedule the test process of the scanner, reduce frequent tests on the same destination IP and the same user name, effectively bypass the IP interception mechanism and the user name authentication locking mechanism, and improve the efficiency of weak password testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a schematic diagram of the weak password scanning system;

[0024] Figure 2 It is a schematic diagram of a directed graph model of the present invention;

[0025] Figure 3 Flowchart of the path flow minimization algorithm based on directed graph. DETAILED DESCRIPTION

[0026] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0027] OSI: Open System Interconnect, open system interconnection.

[0028] Shadon: An open source information search engine for the Internet.

[0029] Based on the actual needs of weak password scanning, the present invention establishes a directed graph model and effectively schedules the scanning process by using the path flow minimum algorithm. Through this method, the two major protection mechanisms of weak passwords - IP interception and account authentication lock - can be effectively bypassed, thereby improving the detection efficiency of weak password scanning.

[0030] The present invention is based on Figure 1 After detecting the target asset range, the weak password scanning system will use a proxy scanner to scan and detect the object under test for efficient parallel scanning. The detected assets are classified according to open services. For each service (such as SSH), the scanning system will schedule the proxy scanner to exhaustively search the combination of the user name library and password library of the service to send a test package to the object under test, and determine whether the test is successful based on the response package.

[0031] For a specified protocol under test, the present invention uses nodes to represent the four elements of the scanner source IP, target IP, user name, and password. The weak password scanning process is represented by edges. The number of scans is represented by the path value or weight corresponding to the edge. The S and D nodes are used as the nodes for task start and task end. Figure 2 The directed graph model shown in FIG. Among them, the IPs of the s proxy scanners are SrcIP1, SrcIP2, SrcIP3...SrcIP s-1 、SrcIP s , the IP addresses of the m targets under test are DstIP1, DstIP2, DstIP3...DstIP m-1 、DstIP m , the k user names in the user name database are U1, U2, U3...U k-1 , U k , and the n passwords in the password library are P1, P2, P3...P n-1 , P n A scanning task can be expressed as<S,P,U,DstIP,SrcIP,D> , that is, use the SrcIP scanner to test the DstIP target with username U and password P.

[0032] The method for bypassing the weak password scanning protection mechanism based on directed graph representation of the present invention uses a path flow minimum algorithm to perform scanning scheduling in the weak password scanning system based on the constructed directed graph model. The specific steps are as follows:

[0033] S1, Initialization: The path value from the starting point S to all nodes P in the password library is initially 0. x The path value to all nodes U in the user name database is initially 0. x The path value to all nodes DstIP of the destination IP is 0. The path value to any node DstIP of the destination IP is 0. x The path value to all nodes SrcIP of the source IP is 0, and the path value to any node SrcIP of the source IP is 0. x The path value to the end point D is 0. At the same time, the queue Q is initialized;

[0034] S2. Find the path with the minimum traffic: For S to D, select a path with the minimum path value Path =<S,P,U,DstIP,SrcIP,D> ;

[0035] like Figure 2 As shown, the minimum path value means that the sum of the path values ​​of all edges on the path is the smallest.

[0036] S3. If Path is not in queue Q, add Path to Q, add 1 to all edge weights of Path, and perform a scan, that is, use SrcIP's scanner to send a test packet with username U and password P to DstIP's target; if Path is in queue Q, end this scan;

[0037] S4. If the test fails, execute S5; if the test succeeds, remove the edge E from the current user name to the destination IP.<U,DstIP> , then execute S5;

[0038] S5. Jump to S2 and continue to find the path with the least traffic to perform the test.

[0039] In a certain embodiment, after the S5 jump, the user name node and the source IP node remain unchanged, and the password node and the destination IP node are changed first.

[0040] In a certain embodiment, after the S5 jump, the password node and the destination IP node remain unchanged, and the username node and the source IP node are changed first.

[0041] In a certain embodiment, the polling rules of the four elements of source IP, target IP, user name and password can be designed according to the concept of the present invention, but the path with the minimum traffic needs to be found each time.

[0042] The pseudo code of the method for bypassing the weak password scanning protection mechanism based on directed graph representation of the present invention is as follows:

[0043] E1,E2,E3,E4,E5={}

[0044] Q=[]

[0045] U=[U1、U2、、U3...U k-1 、U k ]

[0046] P=[P1、P2、、P3...P n-1 、P n ]

[0047] SrcIP=[SrcIP1、SrcIP2、、SrcIP3...SrcIP s-1 、SrcIP s ]

[0048] DstIP=[DstIP1、DstIP2、、DstIP3...DstIP m-1 、DstIP m ]

[0049] / / Initialization

[0050] for i in n:

[0051] E<S,P i >=0,

[0052] push E<S,P i >in E1,

[0053] for i,j in n,k:

[0054] E<P n ,U k >=0

[0055] push E<P n ,U k >in E2,

[0056] for i,j in k,m:

[0057] E<U k ,DstIP m >=0

[0058] push E<U k ,DstIP m >in E3,

[0059] for i,j in m,s:

[0060] E<DstIS m ,SrcIP s >=0

[0061] pushE<DstIS m,SrcIP s >inE4,

[0062] foriin s:

[0063] E <SrcIP s ,D>=0

[0064] pushE <SrcIP s ,D>inE5,

[0065] / / Task

[0066] while findr<e1,e2,e3,e4,e5> from S toD andrnotin Q:

[0067] r=min(e1+e2+e3+e4+e5,e1∈E1,e2∈E2,e3∈E3,e4∈E4,e5∈E5),

[0068] pushrin Q,

[0069] e1+=1,

[0070] e2+=1,

[0071] e3+=1,

[0072] e4+=1,

[0073] e5+=1,

[0074] result=execute(r),

[0075] ifresult == true:

[0076] pop e3 in E3,

[0077] Log(r),

[0078] continue,

[0079] Embodiment 1:

[0080] When 10 proxy scanners are used to perform a weak password scanning test on 10,000 targets with open SSH services, and the sizes of the username database and password database are 100 and 100 respectively, the parameters of the directed graph model are n=100, k=100, m=10000, and s=10.

[0081] In the scheduling process, the minimum path r is first selected<S,P1,U1,DstIP1,srcIP1,D> , using the proxy scanner of SrcIP1, send a test packet with username U1 and password P1 to the target of DstIP1, and the traversed path value is e1<S,P1> 、e2<P1,U1> 、e3<U1,DstIP1> 、e4<DstIP1,srcIP1> 、e5<srcIP1,D> If the test fails, the second choice will try to use P2.<P2,U1> is 0, but<U1,DstIP1> is 1, so select the path with a value of 0<U1,DstIP2> ,at the same time,<DstIP2,srcIP1> is also 0, that is, the second time will select<S,P2,U1,DstIP2,srcIP1,D> Execute the test, the third time will select<S,P3,U1,DstIP3,srcIP1,D> Execute the test, the fourth time will select

[0082] <S,P4,U1,DstIP4,srcIP1,D> And so on; if the kth test succeeds, edge e will be deleted <U1,DstIP k >, that is, no longer use DstIP k The user U1 is tested. In the prior art,

[0083] <S,P1,U1,DstIP1,srcIP1,D> When a test fails, it usually fails by path

[0084] <S,P2,U1,DstIP1,srcIP1,D> This will result in a large number of tests on the same IP, and the tested IP will blacklist the scanner IP.

[0085] The scanning of the present invention keeps searching for the path with the shortest traffic flow for scheduling until no path that meets the conditions is found. During the execution process, the scanning of the same IP in a short period of time is effectively reduced to circumvent the IP interception mechanism, and multiple tests of the same target account to bypass the account authentication locking mechanism are also avoided.

[0086] The present invention designs a method to bypass the weak password scanning protection mechanism with the minimum directed graph path flow. By constructing a directed graph model for the four elements of scanner IP, target IP, username, and password, the scanner test process is scheduled using a method with the minimum path flow, reducing frequent tests on the same target IP and the same username, effectively bypassing the IP interception mechanism and username authentication locking mechanism, and improving the efficiency of weak password testing.

[0087] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for bypassing a weak password scanning protection mechanism based on directed graph representation, characterized in that: This method is based on the constructed directed graph model and uses the path flow minimum algorithm to perform scanning scheduling in the weak password scanning system, including the following steps: S1, Initialization: The path value from the starting point S to all nodes in the password library is initially 0. x The path value to all nodes in the user name database is initially 0. x The path value to all nodes of the destination IP is 0, and the DstIP of any node of the destination IP x The path value to all nodes of the source IP is 0, and the source IP any node SrcIP x The path value to the end point D is 0; at the same time, the queue Q is initialized; S2. Find the path with the minimum traffic: For S to D, select a path with the minimum path value Path =<S,P,U,DstIP,SrcIP,D> ; S3. If Path is not in the queue Q, add Path to Q, add 1 to all edge weights of Path, and perform a scan, that is, use the SrcIP scanner to send a test packet with username U and password P to the DstIP target; If the path is in the queue Q, end the scan; S4. If the test fails, execute S5; if the test succeeds, remove the edge E from the current user name to the destination IP.<U,DstIP> , then execute S5; S5, jump to S2 and continue to find the path with the least traffic to perform the test; in, For the specified tested protocol, the four elements of the scanner source IP, target IP, user name, and password are represented by nodes, the weak password scanning process is represented by edges, the number of scans is represented by the path value corresponding to the edge, and the S and D nodes are used as the nodes for task start and task end to obtain a directed graph model; among them, the IPs of the s proxy scanners are SrcIP1, SrcIP 2、 、SrcIP3...SrcIP s-1 、SrcIP s , the IP addresses of the m targets under test are DstIP1, DstIP 2、 , DstIP3...DstIP m-1 、DstIP m , the k user names in the user name database are U1, U 2、 、U3...U k-1 , U k , and the n passwords in the password library are P1, P 2、 、P3...P n-1 , P n ; A scanning task can be expressed as<S,P,U,DstIP,SrcIP,D> , that is, use the SrcIP scanner to test the DstIP target with username U and password P.

2. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 1, characterized in that: In S1, the queue Q is initialized to be empty.

3. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 1, characterized in that: In S2, the minimum path value means that the sum of the path values ​​of the edges on the path is the minimum.

4. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 1, characterized in that: After detecting the target asset range, the weak password scanning system uses a proxy scanner to scan and detect the object being tested.

5. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 4, characterized in that: The detected assets are classified according to open services. For each service, the scanning system will dispatch the proxy scanner to exhaustively enumerate the combination of the user name library and password library of the service to send a test package to the object under test, and determine whether the test is successful based on the response package.

6. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 4, characterized in that: Services include: SSH.

7. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 1, characterized in that: After the S5 jump, the user name node and the source IP node remain unchanged, and the password node and the destination IP node are changed first.

8. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 1, characterized in that: After the S5 jump, the password node and the destination IP node remain unchanged, and the user name node and the source IP node are changed first.

9. The method for bypassing a weak password scanning protection mechanism based on directed graph representation as claimed in claim 1, characterized in that: In the scheduling process, the minimum path r is first selected<S,P1,U1,DstIP1,srcIP1,D> , using the proxy scanner of SrcIP1, send a test packet with username U1 and password P1 to the target of DstIP1, and the traversed path value is e1<S,P1> 、e2<P1,U1> 、e3<U1,DstIP1> 、e4<DstIP1,srcIP1> 、e5<srcIP1,D> If the test fails, the second time will select<S,P2,U1,DstIP2,srcIP1,D> Execute the test, the third time will select<S,P3,U1,DstIP3,srcIP1,D> Execute the test, the fourth time will select<S,P4,U1,DstIP4,srcIP1,D> ; And so on; if the kth test succeeds, edge e will be deleted <U1,DstIP k >, that is, no longer use DstIP k The user U1 is tested.

Images