A method of penetration testing and related apparatus

Abstract

The application provides a penetration testing method and related device. The method comprises: determining a penetration testing strategy for a to-be-tested system according to testing information of the to-be-tested system, wherein the penetration testing strategy is composed of at least one type of attack strategy, and the attack strategy comprises information for performing an attack and information for processing an attack result; performing penetration testing on the to-be-tested system according to the information for performing an attack in the at least one type of attack strategy; obtaining key log information of the to-be-tested system in the penetration testing process; and analyzing the key log information according to the information for processing an attack result in the at least one type of attack strategy to generate a penetration testing result of the to-be-tested system. The method can realize a full-automatic testing process from determining a penetration testing strategy, performing penetration testing and generating a penetration testing result, and improves the efficiency of penetration testing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to a penetration testing method and device, an electronic device, a computer readable storage medium, and a computer program product. BACKGROUND

[0002] With the rapid development of computer technology, network security is increasingly important. For a system related to a network, such as a network system composed of hardware, software, and a network, or an operating system connected to the Internet and an application program running on the operating system, penetration testing can timely find potential network security risks in the system.

[0003] In a specific implementation, a tester needs to select different attack means for penetration testing according to testing experience for different systems, and penetration testing data under different attack means need to be analyzed by using different analysis tools, so the efficiency of penetration testing is low. SUMMARY

[0004] The present application provides a penetration testing method that can improve the efficiency of penetration testing. The present application also provides a device, an electronic device, a computer readable storage medium, and a computer program product corresponding to the above method.

[0005] In a first aspect, the present application provides a penetration testing method. The method comprises:

[0006] According to the test information of the system to be tested, a penetration testing strategy for the system to be tested is determined, the penetration testing strategy is composed of at least one type of attack strategy, and the attack strategy includes information for executing an attack and information for processing an attack result;

[0007] According to the information for executing an attack in the at least one type of attack strategy, the system to be tested is subjected to penetration testing;

[0008] Key log information of the system to be tested in the penetration testing process is obtained;

[0009] According to the information for processing an attack result in the at least one type of attack strategy, the key log information is analyzed to generate a penetration testing result of the system to be tested.

[0010] In some possible implementation manners, the penetration testing of the system to be tested according to the information for executing an attack in the at least one type of attack strategy comprises:

[0011] According to the at least one type of attack strategy, at least one attack type and attack resources required for executing the at least one attack type are determined;

[0012] performing penetration testing of the at least one attack type on the to-be-tested system by using the attack resources.

[0013] In some possible implementation manners, the obtaining the key log information of the to-be-tested system in the penetration testing process includes:

[0014] collecting log information generated by the to-be-tested system in the penetration testing process;

[0015] determining a log keyword according to information used for performing attacks in the at least one type of attack strategy;

[0016] determining key log information from the log information according to the log keyword.

[0017] In some possible implementation manners, the analyzing the key log information according to information used for processing attack results in the at least one type of attack strategy to generate a penetration testing result of the to-be-tested system includes:

[0018] determining data format information corresponding to at least one attack type according to the at least one type of attack strategy;

[0019] analyzing the key log information according to the data format information corresponding to at least one attack type to generate a penetration testing result of the to-be-tested system.

[0020] In some possible implementation manners, the at least one type of attack strategy is generated by the following steps:

[0021] receiving information used for performing attacks and information used for processing attack results input by a user for a target system;

[0022] adding at least one probe in program code of the target system according to the information used for performing attacks and the information used for processing attack results, the at least one probe being used to obtain execution information in a process in which the program code of the target system is executed.

[0023] In some possible implementation manners, the method further includes:

[0024] extracting content of at least one result field according to the penetration testing result of the to-be-tested system;

[0025] generating a penetration testing report according to the content of the at least one result field;

[0026] presenting the penetration testing report.

[0027] In a second aspect, the present application provides a penetration testing device. The device comprises:

[0028] a determination module configured to determine a penetration testing strategy for a to-be-tested system according to testing information of the to-be-tested system, the penetration testing strategy being composed of at least one type of attack strategy, the attack strategy including information for performing an attack and information for processing an attack result;

[0029] a testing module configured to perform a penetration test on the to-be-tested system according to the information for performing an attack in the at least one type of attack strategy;

[0030] an acquisition module configured to acquire key log information of the to-be-tested system in the penetration test;

[0031] an analysis module configured to analyze the key log information according to the information for processing an attack result in the at least one type of attack strategy, and generate a penetration test result of the to-be-tested system.

[0032] In some possible implementation manners, the testing module is specifically configured to:

[0033] determine at least one attack type and attack resources required for performing the at least one attack type according to the at least one type of attack strategy;

[0034] perform a penetration test of the at least one attack type on the to-be-tested system by using the attack resources.

[0035] In some possible implementation manners, the acquisition module is specifically configured to:

[0036] collect log information generated by the to-be-tested system in the penetration test;

[0037] determine a log keyword according to the information for performing an attack in the at least one type of attack strategy;

[0038] determine key log information from the log information according to the log keyword.

[0039] In some possible implementation manners, the analysis module is specifically configured to:

[0040] determine data format information corresponding to at least one attack type according to the at least one type of attack strategy;

[0041] analyze the key log information according to the data format information corresponding to the at least one attack type, and generate a penetration test result of the to-be-tested system.

[0042] In some possible implementation manners, the at least one type of attack strategy is generated through the following steps:

[0043] receiving information input by a user for performing an attack on a target system and information for processing an attack result;

[0044] adding at least one probe in program code of the target system according to the information for performing an attack and the information for processing an attack result, the at least one probe being used to acquire execution information during execution of the program code of the target system.

[0045] In some possible implementation manners, the apparatus further includes a presentation module, configured to:

[0046] extracting content of at least one result field according to the penetration test result of the system to be tested;

[0047] generating a penetration test report according to the content of the at least one result field;

[0048] presenting the penetration test report.

[0049] In a third aspect, the present application provides an electronic device. The electronic device includes a processor and a memory, the memory stores instructions, and the processor executes the instructions, so that the electronic device platform executes the method in the first aspect of the present application or any implementation manner of the first aspect.

[0050] In a fourth aspect, the present application provides a computer-readable storage medium. The computer-readable storage medium stores instructions, and when the instructions are executed on an electronic device, the electronic device executes the method in the first aspect or any implementation manner of the first aspect.

[0051] In a fifth aspect, the present application provides a computer program product. The computer program product includes computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device executes the method in the first aspect or any implementation manner of the first aspect.

[0052] On the basis of the implementation manners of the aspects described above, the present application can be further combined to provide more implementation manners.

[0053] Based on the above description, it can be known that the technical scheme of the present application has the following beneficial effects:

[0054] Specifically, the method first determines a penetration test strategy for the to-be-tested system according to test information of the to-be-tested system. The penetration test strategy is composed of at least one type of attack strategy, and the attack strategy includes information for performing an attack and information for processing an attack result. Then, the to-be-tested system is subjected to penetration testing according to the information for performing an attack in the at least one type of attack strategy, key log information of the to-be-tested system in the penetration testing process is obtained, the key log information is analyzed according to the information for processing an attack result in the at least one type of attack strategy, and a penetration test result of the to-be-tested system is generated.

[0055] In the method, by pre-configuring different types of attack strategies, penetration testing can be automatically performed on the to-be-tested system by using the information for performing an attack in the attack strategy, and analysis can be automatically performed on the key log information of the to-be-tested system by using the information for processing an attack result in the attack strategy, thereby realizing a full-automatic test flow from determining a penetration test strategy, performing penetration testing, and generating a penetration test result, and improving the efficiency of penetration testing. BRIEF DESCRIPTION OF DRAWINGS

[0056] The above and other features, advantages, and aspects of the present embodiments will become more apparent by thoroughly examining the following detailed description, the accompanying drawings, and the appended claims. Identical or similar components shown throughout the figures are identified with the same or similar reference numerals. It should be understood that the drawings are schematic and that the sizes and elements are not necessarily drawn to scale.

[0057] Figure 1 A flowchart of a penetration test method provided by an embodiment of the present application;

[0058] Figure 2 An architecture diagram of a penetration test system provided by an embodiment of the present application;

[0059] Figure 3 A flowchart of an information collection unit provided by an embodiment of the present application;

[0060] Figure 4 A flowchart of a knowledge base strategy unit provided by an embodiment of the present application;

[0061] Figure 5 An interaction diagram of a to-be-tested system and a penetration test system provided by an embodiment of the present application;

[0062] Figure 6 A structural diagram of a penetration test device provided by an embodiment of the present application;

[0063] Figure 7 A structural diagram of an electronic device for implementing penetration testing provided by an embodiment of the present application. DETAILED DESCRIPTION

[0064] Embodiments of the present application will be described in more detail with reference to the drawings. Although some embodiments of the present application are shown in the drawings, it is understood that the present application can be embodied in various forms and should not be interpreted as being limited to the embodiments set forth herein, but rather the embodiments are provided so that the present application can be more thoroughly and completely understood. It should be understood that the drawings and embodiments of the present application are only for illustrative purposes and are not intended to limit the scope of protection of the present application.

[0065] The term "comprising" and variations thereof as used herein are used inclusively, i.e., "comprising, but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Related definitions are given throughout the description.

[0066] It should be noted that the terms "first", "second", and the like in the present application are only used to distinguish different devices, modules or units, and are not intended to limit the functions of these devices, modules or units.

[0067] It should be noted that the terms "one", "multiple" in the present application are illustrative and not restrictive, and those skilled in the art should understand that unless otherwise explicitly stated in the context, it should be understood as "one or more".

[0068] In order to facilitate understanding of the technical solutions of the present application, the specific technical terms and application scenarios in the present application are described below.

[0069] Network security: Network security is used to ensure the security of data and communication on the network. Among them, data security is used to prevent unauthorized disclosure, transfer, modification and destruction of data, and communication security requires the use of confidentiality security, transmission security, radiation security measures in the communication process.

[0070] Penetration testing: penetration testing is to simulate the technical attack means and vulnerability discovery technology that attackers may use to deeply probe the security of the target system and find the weak links in the system.

[0071] Probe testing: probe testing is to insert some probes into the program being tested on the basis of ensuring the integrity of the original logic of the program being tested. Through the execution of the probes, the characteristic data in the running process of the program being tested is thrown out. Through the analysis of these characteristic data, the control flow and data flow information of the program being tested can be obtained, and the testing purpose can be achieved.

[0072] In the system development process, developers usually pay more attention to the development of business logic, and easily ignore the security problems that may exist in the development process, which may lead to security vulnerabilities in the system and make the system in an unsafe state.

[0073] With the rapid development of computer technology, network security is increasingly important. Penetration testing of network-related systems can help identify potential network security risks in the system. In related technologies, penetration testing is usually performed manually by human operators. Testers select different attack methods for different systems based on their testing experience.

[0074] However, since penetration testing needs to cover many network security issues, including common web vulnerabilities (such as SQL injection, XSS cross-site scripting, CSRF cross-site request forgery), XXE vulnerabilities, SSRF server request forgery vulnerabilities, file inclusion vulnerabilities, file upload vulnerabilities, and file parsing vulnerabilities, the above manual selection of attack methods for penetration testing is often inefficient.

[0075] Moreover, testers also need to use different analysis tools for analysis according to different attack methods, further reducing the efficiency of penetration testing.

[0076] Therefore, the present application provides a penetration testing method. Specifically, the method first determines a penetration testing strategy for the system to be tested according to the test information of the system to be tested. The penetration testing strategy is composed of at least one type of attack strategy, and the attack strategy includes information for executing attacks and information for processing attack results. Then, according to the information for executing attacks in at least one type of attack strategy, the system to be tested is subjected to penetration testing, the key log information of the system to be tested during the penetration testing process is obtained, the key log information is analyzed according to the information for processing attack results in at least one type of attack strategy, and the penetration testing result of the system to be tested is generated.

[0077] In this method, by pre-configuring different types of attack strategies, the system to be tested can automatically perform penetration testing using the information for executing attacks in the attack strategy, and the key log information of the system to be tested can automatically be analyzed using the information for processing attack results in the attack strategy. The full-automatic testing process from determining the penetration testing strategy, performing the penetration testing, and generating the penetration testing result is realized, and the efficiency of the penetration testing is improved.

[0078] Next, the penetration testing method provided by the present application will be described in detail in conjunction with the accompanying drawings.

[0079] Referring to Figure 1A flowchart of a penetration testing method is shown, which specifically comprises the following steps:

[0080] S101: According to the test information of the to-be-tested system, determine a penetration testing strategy for the to-be-tested system.

[0081] In the embodiments of the present application, the to-be-tested system can be a system related to a network. In some embodiments, the to-be-tested system can be a network system composed of hardware, software and network, for example, a business system located in a local area network node. In other embodiments, the to-be-tested system can also be an operating system connected to the Internet and an application program running on the operating system.

[0082] The test information of the to-be-tested system can refer to information related to the network characteristics of the to-be-tested system. For example, the test information can include the domain name, the internet protocol (IP) address, the port number and the like of the to-be-tested system.

[0083] In some possible implementation manners, the test information of the to-be-tested system can be input by a tester. For example, the tester can input the test information of the to-be-tested system in a test page.

[0084] After obtaining the test information of the to-be-tested system, the penetration testing strategy for the to-be-tested system can be determined. In the embodiments of the present application, the penetration testing strategy can be composed of at least one type of attack strategy.

[0085] That is, through the test information of the to-be-tested system, at least one type of attack strategy close to the actual running environment of the to-be-tested system and capable of simulating real attacks on the to-be-tested system can be selected from a plurality of types of attack strategies to form the penetration testing strategy for the to-be-tested system.

[0086] Among them, the attack strategy can include information for executing an attack and information for processing an attack result, the information for executing an attack can refer to a vulnerability type attack mode, an attack program code, and the information for processing an attack result can refer to an attack result analysis mode, a recommended solution for a corresponding vulnerability and the like.

[0087] In other words, through the test information of the to-be-tested system and the pre-configured different types of attack strategies, at least one type of attack strategy that needs to attack the to-be-tested system can be determined, and automatic determination of the attack strategy is realized.

[0088] The embodiment of the present application supports user-defined attack strategy. In the implementation, information for performing attack and information for processing attack result input by the user for the target system can be received, and then at least one probe can be added in the program code of the target system according to the information for performing attack and the information for processing attack result, wherein the at least one probe can be used to acquire execution information during execution of the program code of the target system.

[0089] That is, since the user (for example, a developer) is more familiar with the processing logic of the target system, the user can configure the attack strategy according to the processing logic of the target system for the program code that may have network security vulnerabilities, and realize personalized attack strategy configuration for the target system.

[0090] In order to ensure the accuracy of the attack strategy, the probe can be written into the program code of the target system by means of a method such as source or binary instrumentation, and then the execution information of the program code can be acquired through the probe during execution of the attack, so as to analyze the result of the penetration test.

[0091] Further, when determining the penetration test strategy for the system to be tested, the user-defined attack strategy can be given a higher priority, and the penetration test for the system to be tested can be realized.

[0092] S102: performing penetration test on the system to be tested according to the information for performing attack in at least one type of attack strategy.

[0093] In the implementation, at least one attack type and attack resources required for performing the at least one attack type can be determined according to the at least one type of attack strategy, and the system to be tested can be subjected to penetration test of the at least one attack type by using the attack resources.

[0094] That is, the information for performing attack can include attack type and attack resources (for example, attack code), and penetration test of a certain attack type can be automatically performed by using the attack resources (for example, executing attack code).

[0095] S103: acquiring key log information of the system to be tested in the process of penetration test.

[0096] It can be understood that in the process of penetration test, the system to be tested can generate corresponding log information due to being subjected to at least one type of attack. In the embodiment of the present application, the key log information can be log information required when processing attack result.

[0097] In a specific implementation, log information generated by the to-be-tested system during the penetration testing process can be collected, log keywords can be determined according to information used for performing attacks in at least one type of attack strategy, and key log information can be determined from the log information according to the log keywords.

[0098] That is, the information used for performing attacks can include log keywords needed for processing attack results of a certain attack strategy. Through the log keywords, log information generated by the to-be-tested system can be filtered, redundant log information can be filtered out, and key log information needed can be left, thereby reducing bandwidth consumption and improving testing efficiency.

[0099] S104: Analyzing the key log information according to information used for processing attack results in at least one type of attack strategy, and generating a penetration testing result of the to-be-tested system.

[0100] In a specific implementation, data format information corresponding to at least one type of attack can be determined according to at least one type of attack strategy, and then the key log information can be analyzed according to the data format information corresponding to at least one type of attack, and a penetration testing result of the to-be-tested system can be generated.

[0101] That is, the information used for processing attack results can include data format information of attack results of a certain attack strategy. Through the data format information, the key log information can be parsed, the meanings of different fields in the key log information can be obtained, and then a penetration testing result of the to-be-tested system can be generated.

[0102] Further, content of at least one result field can be extracted according to the penetration testing result of the to-be-tested system, a penetration testing report can be generated according to the content of the at least one result field, and the penetration testing report can be presented.

[0103] In other words, a penetration testing report can be derived according to the penetration testing result. Through a pre-configured result field, content of the result field is extracted from the penetration testing result and filled into the result field, and then a penetration testing report including different content of the result field, such as content of a result field including a vulnerability type, an attack code, original data generated by penetration testing, log information, a processing manner for the vulnerability, a repair suggestion, and the like, is generated. Moreover, by presenting the penetration testing report to a user, the user can efficiently locate and repair vulnerabilities through the penetration testing report.

[0104] Based on the above description, in the penetration testing method provided in the application, first, according to the test information of the to-be-tested system, a penetration testing strategy for the to-be-tested system is determined. The penetration testing strategy is composed of at least one type of attack strategy, and the attack strategy includes information for executing an attack and information for processing an attack result. Then, according to the information for executing an attack in the at least one type of attack strategy, the to-be-tested system is subjected to penetration testing, key log information of the to-be-tested system in the penetration testing process is obtained, the key log information is analyzed according to the information for processing an attack result in the at least one type of attack strategy, and a penetration testing result of the to-be-tested system is generated.

[0105] In the method, by pre-configuring different types of attack strategies, penetration testing can be automatically performed on the to-be-tested system by using the information for executing an attack in the attack strategy, and analysis can be automatically performed on the key log information of the to-be-tested system by using the information for processing an attack result in the attack strategy, realizing a full-automatic testing process from determining a penetration testing strategy, performing penetration testing, and generating a penetration testing result, and improving the efficiency of penetration testing.

[0106] The foregoing describes the penetration testing method provided in the application, and the following further describes the execution of the penetration testing method by the penetration testing system.

[0107] Referring to Figure 2 The penetration testing system includes a display operation unit, a knowledge base strategy unit, a collection and analysis unit, and an information collection unit. The following will be described respectively.

[0108] The display operation unit can be presented in the form of a web page. The display operation unit includes a basic information input area and an analysis report display area. The basic information input area is used to input test information, and the analysis report display area is used to present a penetration testing report. The user can also export the penetration testing report in the analysis report display area.

[0109] The information collection unit includes a collector, a transmitter, and a filter. The information collection unit is deployed in the to-be-tested system, for example, the information collection unit can be deployed in the to-be-tested system by modifying a dependency configuration file.

[0110] The following will be described in combination with Figure 3The workflow of the information collection unit is described. Specifically, the sender can establish a long connection with the server, the collector can be understood as a buffer area, the collector can obtain the log information of the to-be-tested system and store it in the form of a queue, when the log information in the queue reaches the default threshold, the collector can send the log information to the filter. Since the collector adopts the queue form, the log information can realize "first in, first out", and the order in time sequence is guaranteed, which improves the readability of the log information.

[0111] The filter stores log keywords corresponding to the attack strategy, filters the log information through the log keywords, determines the key log information, and reduces the sending of redundant information. Further, the sender can be able to send the key log information and return the key log information to the server.

[0112] The knowledge base strategy unit includes a memory and a strategy parser. The memory stores at least one type of attack strategy, the attack strategy includes information for executing attacks and information for processing attack results, and the attack strategy stored in the memory can also be updated through networking to realize the storage of emerging attack strategies. As described above, the attack strategy in the memory can also be customized by the user.

[0113] The strategy parser is used to determine a penetration testing strategy for the to-be-tested system, and combines at least one type of attack strategy stored in the memory to determine a penetration testing strategy that is close to reality and can simulate a real and complex attack environment. And the strategy parser can also determine the attack resources required to execute at least one attack type according to at least one type of attack strategy in the penetration testing strategy. In this way, the to-be-tested system can be subjected to penetration testing.

[0114] The following will be described in combination Figure 4 The workflow of the knowledge base strategy unit is described. Specifically, the strategy parser can obtain the test information of the to-be-tested system and determine at least one type of attack strategy from the memory, then the strategy parser can combine at least one type of attack strategy into a penetration testing strategy for the to-be-tested system, and determine the attack resources required to execute at least one attack type, and send log keywords to the information collection unit so that the information collection unit collects key log information. Then, the strategy parser can use the attack resources to perform penetration testing on the to-be-tested system, and send the key log information and the information for processing attack results in the attack strategy to the collection and analysis unit for subsequent analysis of the key log information by the collection and analysis unit.

[0115] The collection and analysis unit comprises a receiver, a computing processor and a document generator. The receiver is configured to receive the key log information sent by the information collection unit and the information for processing the attack result in the attack strategy sent by the knowledge base strategy unit.

[0116] The computing processor is configured to analyze the key log information according to the information for processing the attack result. In this way, the computing processor can replace the manual penetration testing analysis process in the related art, realize rapid computing processing of the key log information, and improve the generation efficiency of the penetration testing result.

[0117] The document generator is configured to generate a penetration testing report. Specifically, the document generator can extract the content of the result field according to the penetration testing result of the to-be-tested system, and then generate a penetration testing report comprising different result fields. In this way, the penetration testing report generated by the document generator can be presented to the user in the analysis report display area of the display operation unit. Since the penetration testing report covers the content of different result fields, the user can efficiently complete vulnerability positioning and vulnerability repair by using the penetration testing report.

[0118] The following will be described in combination with Figure 5 The interaction process between the to-be-tested system and the penetration testing system will be described. The penetration testing system (for example, the display operation unit) obtains the test information of the to-be-tested system. In the to-be-tested system, the information collection unit of the penetration testing system is deployed. The knowledge base strategy unit of the penetration testing system determines the penetration testing strategy for the to-be-tested system. The information collection unit deployed in the to-be-tested system can collect log information. The penetration testing system (for example, the knowledge base strategy unit) determines the attack resources required for executing at least one attack type, performs penetration testing on the to-be-tested system, and determines the key log information according to the log keywords. The penetration testing system (for example, the collection and analysis unit) analyzes the key log information, generates the penetration testing result of the to-be-tested system, and then generates a penetration testing report comprising the content of at least one result field, thereby completing the penetration testing and analysis on the to-be-tested system.

[0119] Based on the above method provided by the embodiments of the present application, the embodiments of the present application also provide a penetration testing device corresponding to the above method. The units / modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the unit / module does not constitute a limitation on the unit / module itself.

[0120] Referring to Figure 6 The structure diagram of the penetration testing device is shown in FIG. 6. The device 600 comprises:

[0121] The determining module 601 is configured to determine a penetration test strategy for the to-be-tested system according to test information of the to-be-tested system, wherein the penetration test strategy is composed of at least one type of attack strategy, and the attack strategy includes information for performing an attack and information for processing an attack result.

[0122] The test module 602 is configured to perform a penetration test on the to-be-tested system according to the information for performing an attack in the at least one type of attack strategy.

[0123] The acquisition module 603 is configured to acquire key log information of the to-be-tested system in the penetration test process.

[0124] The analysis module 604 is configured to analyze the key log information according to the information for processing an attack result in the at least one type of attack strategy, and generate a penetration test result of the to-be-tested system.

[0125] In some possible implementation manners, the test module 602 is specifically configured to:

[0126] determine at least one attack type and attack resources required for performing the at least one attack type according to the at least one type of attack strategy; and

[0127] perform a penetration test of the at least one attack type on the to-be-tested system by using the attack resources.

[0128] In some possible implementation manners, the acquisition module 603 is specifically configured to:

[0129] collect log information generated by the to-be-tested system in the penetration test process;

[0130] determine a log keyword according to the information for performing an attack in the at least one type of attack strategy; and

[0131] determine key log information from the log information according to the log keyword.

[0132] In some possible implementation manners, the analysis module 604 is specifically configured to:

[0133] determine data format information corresponding to at least one attack type according to the at least one type of attack strategy; and

[0134] analyze the key log information according to the data format information corresponding to the at least one attack type, and generate a penetration test result of the to-be-tested system.

[0135] In some possible implementation manners, the at least one type of attack strategy is generated by the following steps:

[0136] Receive information from the user regarding the target system for executing attacks and for processing attack results;

[0137] Based on the information used to execute the attack and the information used to process the attack results, at least one probe is added to the program code of the target system. The at least one probe is used to obtain execution information during the execution of the program code of the target system.

[0138] In some possible implementations, the apparatus further includes a rendering module, the rendering module being used for:

[0139] Based on the penetration test results of the system under test, extract the content of at least one result field;

[0140] Generate a penetration test report based on the content of at least one of the result fields;

[0141] Present the penetration test report.

[0142] The penetration testing apparatus 600 according to the embodiments of this application can correspondingly execute the methods described in the embodiments of this application, and the above and other operations and / or functions of each module / unit of the penetration testing apparatus 600 are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0143] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. See also Figure 7 The schematic diagram shown illustrates the structure of the electronic device 700 used for penetration testing. It should be noted that... Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0144] like Figure 7 As shown, the electronic device 700 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0145] In general, the following devices can be connected to the I / O interface 705: input device(s) 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, and so on; output device(s) 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and so on; storage device(s) 708 including, for example, a magnetic tape, a hard disk, and so on; and communication device(s) 709. The communication device(s) 709 can allow the electronic device 700 to exchange data with other devices via a wired or wireless connection. Although Figure 7 The electronic device 700 is illustrated with various devices, but it is understood that all of the illustrated devices are not required to implement or have the electronic device 700. More or less devices can alternatively be implemented.

[0146] The present application also provides a computer readable storage medium, also referred to as a machine readable medium. In the context of this application, a machine readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine readable medium can be a machine readable signal medium or a machine readable storage medium. The machine readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine readable storage medium will include one or more lines of electrical connections, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0147] It should be noted that the computer readable medium in the foregoing of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer readable program code. Such a propagated data signal can take many forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or apparatus. The program code contained in the computer readable medium can be transmitted by any suitable medium, including but not limited to a wire, a cable, a RF (radio frequency) or the like, or any suitable combination of the above.

[0148] The computer readable medium described above carries one or more programs, when the one or more programs are executed by the electronic device, the electronic device is caused to: determine a penetration test strategy for a to-be-tested system according to test information of the to-be-tested system; perform penetration testing on the to-be-tested system according to information for performing attacks in the at least one type of attack strategy; obtain key log information of the to-be-tested system in the penetration testing process; analyze the key log information according to information for processing attack results in the at least one type of attack strategy, and generate a penetration test result of the to-be-tested system.

[0149] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments of this application.

[0150] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

[0151] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0152] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method of permeation testing, characterized by, The method comprises: determining a penetration test strategy for a to-be-tested system according to test information of the to-be-tested system, the penetration test strategy being composed of at least one type of attack strategy, the attack strategy including information for performing an attack and information for processing an attack result; performing penetration testing on the to-be-tested system according to the information for performing an attack in the at least one type of attack strategy; collecting log information generated by the to-be-tested system during the penetration testing; determining a log keyword according to the information for performing an attack in the at least one type of attack strategy; determining key log information from the log information according to the log keyword; determining data format information corresponding to at least one attack type according to the at least one type of attack strategy; analyzing the key log information according to the data format information corresponding to the at least one attack type to generate a penetration test result of the to-be-tested system.

2. The method of claim 1, wherein, The penetration testing on the to-be-tested system according to the information for performing an attack in the at least one type of attack strategy comprises: determining at least one attack type and attack resources required for performing the at least one attack type according to the at least one type of attack strategy; performing penetration testing of the at least one attack type on the to-be-tested system by using the attack resources.

3. The method of claim 1, wherein, The at least one type of attack strategy is generated by the following steps: receiving information for performing an attack and information for processing an attack result input by a user for a target system; adding at least one probe in program code of the target system according to the information for performing an attack and the information for processing an attack result, the at least one probe being used to acquire execution information during execution of the program code of the target system.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: extracting content of at least one result field according to the penetration test result of the to-be-tested system; generating a penetration test report according to the content of the at least one result field; presenting the penetration test report.

5. A permeation test device characterized by, The device comprises: a determination module configured to determine a penetration test strategy for a to-be-tested system according to test information of the to-be-tested system, the penetration test strategy being composed of at least one type of attack strategy, the attack strategy including information for performing an attack and information for processing an attack result; a test module configured to perform penetration testing on the to-be-tested system according to the information for performing an attack in the at least one type of attack strategy; an acquisition module configured to collect log information generated by the to-be-tested system during the penetration testing, determine a log keyword according to the information for performing an attack in the at least one type of attack strategy, and determine key log information from the log information according to the log keyword; an analysis module configured to determine data format information corresponding to at least one attack type according to the at least one type of attack strategy, and analyze the key log information according to the data format information corresponding to the at least one attack type to generate a penetration test result of the to-be-tested system.

6. An electronic device, comprising: The electronic device includes a processor and a memory having instructions stored therein, the processor executes the instructions to cause the electronic device to perform the method of any one of claims 1-4.

7. A computer readable storage medium characterized by A computer program product including computer readable instructions to cause an electronic device to perform the method of any one of claims 1-4 when the computer readable instructions are run on the electronic device.

8. A computer program product, characterised in that, A computer program product including computer readable instructions to cause an electronic device to perform the method of any one of claims 1-4 when the computer program product is run on the electronic device.

Images