Attack payload generation method, attack payload generation device and storage medium

Abstract

The present invention discloses a method for generating an attack load, an attack load generating device and a storage medium, wherein the method comprises the following steps: determining a target network corresponding to a received security assessment instruction and / or vulnerability update instruction, and obtaining server information of the target network based on a preset detection tool; using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the target network; obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by a vulnerability processing interface; and generating an attack load corresponding to the target network based on the exploit code and the security vulnerability information. When generating an attack load, first evaluate the configuration and vulnerability information of the target, then select relevant processing rules according to the vulnerability information of the target, and automatically generate an attack load, thereby avoiding the need for manual writing, improving the generation efficiency of the attack load, and further improving the efficiency of security testing.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for generating an attack payload, a device for generating an attack payload, and a storage medium. Background Art

[0002] Attack payload refers to the malicious code or instructions that network attackers send to the target system by exploiting vulnerabilities.

[0003] When conducting penetration testing and security assessments on computer networks, attacks are usually carried out on the target network based on attack payloads. During the attack process, it is necessary to have a deep understanding of the architecture and vulnerabilities of the target network in order to construct an effective attack payload.

[0004] However, the current method of generating attack payloads is to manually write them according to relevant rules. When the vulnerability information of the target network changes, the corresponding attack payload needs to be manually written according to the changes, resulting in a long cycle of penetration testing and security assessment. Therefore, the current method of conducting penetration testing and security assessment on computer networks has the defect of low testing efficiency.

[0005] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of the present invention is to provide a method for generating an attack payload, a device for generating an attack payload and a storage medium, so as to solve the problem of low testing efficiency in the prior art.

[0007] To achieve the above object, the present invention provides a method for generating an attack payload, the method comprising the following steps:

[0008] Determine a target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and obtain server information of the target network based on a preset detection tool;

[0009] Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the target network;

[0010] Obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;

[0011] Based on the exploit code and the security vulnerability information, an attack payload corresponding to the target network is generated.

[0012] Optionally, the step of generating an attack payload corresponding to the target network based on the exploit code and the security vulnerability information includes:

[0013] Generate a preset attack payload template based on the vulnerability version of the security vulnerability information;

[0014] The exploit code is added to a preset attack payload template to obtain the attack payload corresponding to the target network.

[0015] Optionally, the step of generating a preset attack payload template based on the vulnerability version of the security vulnerability information includes:

[0016] Selecting a code writing rule according to the vulnerability version, and generating the preset attack payload template based on the code writing rule; and / or

[0017] A code generation module is selected according to the vulnerability version, and the security vulnerability information is input into the code generation module to obtain the preset attack payload template.

[0018] Optionally, after the step of generating an attack payload corresponding to the target network based on the exploit code and the security vulnerability information, the step further includes:

[0019] Executing an attack action based on the attack payload, and obtaining an attack data packet fed back by the target network based on the attack action;

[0020] When the attack result corresponding to the attack data packet is an attack failure, obtaining corresponding feedback information in the attack data packet;

[0021] A target exploit code corresponding to the feedback information is selected or received based on the feedback information, and a target attack payload for re-attack is generated according to the target exploit code and the security vulnerability information.

[0022] Optionally, the step of selecting or receiving a target exploit code corresponding to the feedback information based on the feedback information, and generating a target attack payload for re-attack according to the target exploit code and the security vulnerability information includes:

[0023] Inputting the feedback information into a feedback information processing module, and selecting the target utilization code based on the processing information fed back by the feedback information processing module;

[0024] When the processing information is empty, outputting the feedback information to the vulnerability processing interface, and receiving the target exploitation code fed back by the vulnerability processing interface;

[0025] The target attack payload for re-attack is generated according to the target exploit code and the security vulnerability information.

[0026] Optionally, when the attack result corresponding to the attack data packet is an attack failure, after the step of obtaining corresponding feedback information in the attack data packet, the method further includes:

[0027] Perform secondary processing on the server information based on the vulnerability detection module to obtain target security vulnerability information;

[0028] When the target security vulnerability information is different from the security vulnerability information, the step of obtaining the exploit code associated with the security vulnerability information or obtaining the exploit code received by the vulnerability processing interface is performed based on the target security vulnerability information.

[0029] Optionally, before the step of determining the target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and acquiring the server information of the target network based on a preset detection tool, the step further includes:

[0030] Acquire historical vulnerability detection data, and analyze and process the historical vulnerability detection data based on the vulnerability analysis module to obtain vulnerability data of various categories;

[0031] Extract features of the vulnerability data to obtain detection codes and detection procedures for the vulnerability data;

[0032] The preset training module is trained based on the detection code, the detection process and the vulnerability data, and when the convergence value tends to be stable, the vulnerability detection module is generated based on the preset training module.

[0033] Optionally, before the step of obtaining the exploit code associated with the security vulnerability information or obtaining the exploit code received by the vulnerability processing interface, the step further includes:

[0034] Using the security vulnerability information as an index condition, searching for the exploit code in a local or cloud database;

[0035] The step of obtaining the exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface includes:

[0036] When the query result of querying the exploit code is not empty, using the query result as the exploit code associated with the security vulnerability information;

[0037] When the query result of querying the exploit code is empty, the security vulnerability information is sent to the vulnerability processing interface, and when responding to the operation instruction of the vulnerability processing interface, the exploit code received by the vulnerability processing interface is obtained.

[0038] In addition, to achieve the above-mentioned purpose, the present invention also provides an attack payload generation device, which includes a memory, a processor, and an attack payload generation program stored in the memory and executable on the processor, and the attack payload generation program implements the steps of the attack payload generation method described above when executed by the processor.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a program for generating an attack payload is stored. When the attack payload generation program is executed by a processor, the steps of the attack payload generation method as described above are implemented.

[0040] The embodiment of the present invention provides a method for generating an attack load, an attack load generating device and a storage medium. When receiving a security assessment instruction and / or a vulnerability update instruction, the target network corresponding to the instruction is determined, and the server information of the target network is obtained according to a preset detection tool. Then, the security vulnerability information of the target network is determined based on a vulnerability detection module, and then the exploit code corresponding to the security vulnerability information is obtained, and the attack load corresponding to the target network is generated according to the exploit code and the security vulnerability information. Based on this, when a vulnerability assessment is performed on the target network or the target network changes, and then an attack load needs to be generated, the configuration information and vulnerability information of the target network are first evaluated, and then the relevant processing rules are selected according to the vulnerability information of the target, and the attack load is automatically generated, avoiding the need for manual writing, improving the generation efficiency of the attack load, and thus improving the efficiency of security testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the description of the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor.

[0042] Figure 1 It is a flowchart of a first embodiment of a method for generating an attack payload of the present invention;

[0043] Figure 2 is a flow chart of a second embodiment of a method for generating an attack payload of the present invention;

[0044] Figure 3 It is a flowchart of a third embodiment of the method for generating an attack payload of the present invention;

[0045] Figure 4It is a schematic diagram of the terminal hardware structure of each embodiment of the attack payload generation method of the present invention.

[0046] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0048] The current method of generating attack payloads is to manually write them according to relevant rules. When the vulnerability information of the target network changes, the corresponding attack payload needs to be manually written according to the changes, resulting in a long cycle of penetration testing and security assessment. Therefore, the current method of conducting penetration testing and security assessment on computer networks has the defect of low testing efficiency.

[0049] To solve the above defects, an embodiment of the present invention proposes a method for generating an attack payload, and its main solution includes the following steps:

[0050] Determine a target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and obtain server information of the target network based on a preset detection tool;

[0051] Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the target network;

[0052] Obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;

[0053] Based on the exploit code and the security vulnerability information, an attack payload corresponding to the target network is generated.

[0054] The present invention can first evaluate the configuration information and vulnerability information of the target network when a vulnerability assessment is performed on the target network or the target network changes, and then generate an attack payload, and then select relevant processing rules according to the vulnerability information of the target, and automatically generate an attack payload, thereby avoiding the need for manual writing, improving the generation efficiency of the attack payload, and further improving the efficiency of security testing.

[0055] In order to better understand the above technical solution, exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0056] First embodiment

[0057] Please refer to Figure 1 The steps of the attack payload generation method of the present invention include:

[0058] Step S10, determining a target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and obtaining server information of the target network based on a preset detection tool;

[0059] In this embodiment, the security assessment instruction refers to the attack instruction set by the security tester for the computer network that needs to be subjected to penetration testing and security assessment, that is, the target network. During the penetration test and security assessment process, the tester will update the computer network that is being attacked based on the corresponding vulnerability. At this time, the old attack payload cannot continue to attack and a new attack payload needs to be generated. Based on this, the tester needs to send a vulnerability update instruction to the attack payload generation system to re-attack the updated computer network. The preset detection tools include web crawler scripts and port scanning tools, based on which the server information such as the operating system type, open ports, and running services corresponding to the target network for penetration testing and security assessment is obtained.

[0060] Therefore, in an optional embodiment, when the attack payload generation system receives at least one of the security assessment instructions and the vulnerability update instructions, it determines the target network corresponding to the instruction, and then obtains the server information of the target network based on the detection tool, so that it can obtain the corresponding security vulnerability information based on the server information, and then automatically generates an attack payload based on the security vulnerability information, thereby improving the attack payload generation efficiency and security testing efficiency.

[0061] Step S20, using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the target network;

[0062] In this embodiment, the vulnerability detection module is a functional module pre-trained and generated by the attack payload generation system. The module is used to detect vulnerability information existing in the current server information, and then automatically detect the vulnerability information existing in the target network so as to automatically generate an attack payload based on the vulnerability information, thereby improving the generation efficiency of the attack payload.

[0063] Exemplarily, after the server is input into the vulnerability detection model, the operating system of the output target network contains vulnerable old version web (World Wide Web, wide area network) servers such as Internet Information Services (IIS).

[0064] Step S30, obtaining the exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;

[0065] In this embodiment, the use code refers to a code written in a computer programming language that can realize a certain function or solve a certain problem. The use code can be a pre-written library, framework or module, or it can be a code written by the tester himself. By running these codes, the computer can perform specific operations, such as data processing, calculation, and control of hardware devices.

[0066] In an optional implementation, different exploit codes are pre-compiled and stored in a local or cloud database, and are stored or bound in association with the corresponding security vulnerability information. Therefore, before this, it is necessary to use the security vulnerability information as an index condition, and then query the exploit code in the local or cloud database based on the index condition. After the corresponding exploit code is queried, the database will feed the exploit code back to the attack payload generation system as a query result. Therefore, when the query result is not empty, the query result is used as the exploit code associated with the security vulnerability information. When the query result is empty, it means that there is no exploit code corresponding to the vulnerability at present. At this time, the security vulnerability information needs to be sent to the vulnerability processing interface. At this time, the tester will write a new exploit code based on the security vulnerability information and feed it back to the vulnerability processing interface. When the attack payload generation system responds to the operation instructions performed by the tester in the vulnerability processing interface, it obtains the exploit code received by the vulnerability processing interface.

[0067] By obtaining the exploit code corresponding to the security vulnerability information, the attack payload can be automatically generated through the exploit code and the security vulnerability information, thereby improving the generation efficiency and testing efficiency of the attack payload.

[0068] Step S40: generating an attack payload corresponding to the target network based on the exploit code and the security vulnerability information.

[0069] In this embodiment, the attack payload includes the exploit code corresponding to the security vulnerability information. As an optional implementation, in the process of generating the attack payload corresponding to the target network, a preset attack payload template can be generated based on the vulnerability version of the security vulnerability information, and then the exploit code is added to the preset attack payload template to obtain the attack payload corresponding to the target network. Among them, the vulnerability version refers to the version type currently corresponding to the security vulnerability information. When generating the preset attack payload template, it is necessary to select the code writing rules according to the vulnerability version, and then generate the preset attack payload template according to the code writing rules. In addition, a code generation module can be selected according to the vulnerability version, and the security vulnerability information can be input into the module, thereby automatically generating a preset attack payload template.

[0070] In an exemplary implementation scenario of generating an attack payload based on exploit code and security vulnerability information, the currently identified target network and the corresponding security vulnerability information include: the target system has SQL (Structured Query Language) injection vulnerabilities, file inclusion vulnerabilities, and cross-site scripting (XSS) vulnerabilities. At this time, the vulnerability information is used as an index condition for query or the exploit code received according to the vulnerability processing interface includes: code for executing malicious SQL queries, code for executing uploaded malicious files, and code for executing injected malicious scripts. Based on this, the attack payload generation system can create an attack payload for malicious SQL queries, and after selecting to construct a malicious SQL query such as 'OR '1'='1, use the database management system (MySQL, PostgreSQL, etc.) of the target system to submit the malicious query through an input box or other interactive components. When generating a file inclusion attack payload, construct a malicious file name, such as .. / .. / etc / passwd, and then use the file upload function of the target network system to upload the malicious file to a directory on the server. When generating an XSS attack payload, first construct a malicious script, <script>alert('XSS')< / script> , and using the target website's HTML elements,<imgsrc="x" onerror="alert('XSS')"> to attack.

[0071] Based on this, attack payloads can be constructed according to the types of security vulnerabilities detected in real time, which improves the efficiency of attack payload construction while improving the testing efficiency of security assessments.

[0072] In the technical solution disclosed in this embodiment, at least one of the security assessment instruction and the vulnerability update instruction is used to determine the corresponding target network and the server information corresponding to the target network, then the corresponding security vulnerability information is selected based on the server information, and the exploit code corresponding to the security vulnerability information is obtained. After the attack payload template is generated by the security vulnerability information, the exploit code is added to the attack payload template to obtain the attack payload. Automatic generation of the attack payload is achieved, and the test efficiency is improved.

[0073] Second embodiment

[0074] Please refer to Figure 2 , based on the first embodiment, after step S40, the method further includes:

[0075] Step S50, executing an attack action based on the attack payload, and obtaining an attack data packet fed back by the target network based on the attack action;

[0076] As an optional implementation, after executing the attack action, an attack data packet fed back by the target network may be obtained so as to view the current attack content according to the attack data packet.

[0077] Step S60, when the attack result corresponding to the attack data packet is an attack failure, obtaining corresponding feedback information in the attack data packet;

[0078] In this embodiment, when the attack result is an attack failure, it means that there is an error in the exploit code, or the target network has completed the repair of the vulnerability, resulting in the attack failure.

[0079] In another optional implementation, after obtaining feedback information, there may be a detection error during the vulnerability detection process, resulting in an error in the attack payload generated in the end. Therefore, the server information can be reprocessed based on the vulnerability detection module to obtain the target security vulnerability information, and when the target security vulnerability information is different from the security vulnerability information, step S30 can be re-executed based on the target security vulnerability information to obtain the exploit code associated with the security vulnerability information, or to obtain the exploit code received by the vulnerability processing interface. By re-detecting the security vulnerability information, the situation where the tester needs to wait for processing due to an error in the security vulnerability information is avoided, thereby improving the efficiency of the test.

[0080] Step S70, selecting or receiving a target exploit code corresponding to the feedback information based on the feedback information, and generating a target attack payload for re-attack according to the target exploit code and the security vulnerability information.

[0081] In an optional implementation method in which there is an error in the exploit code, it is necessary to obtain feedback information in the attack data packet so as to select or receive a new target exploit code based on the feedback information. Specifically, the feedback information can be input into the feedback information processing module, and the target exploit code can be selected based on the processing information fed back by the feedback information processing module. For example, when the processing information is that there is a denial of service (Dos) vulnerability in the target network, a new exploit code is selected in the local database or cloud database based on the vulnerability. When the processing information is empty, it means that the attack payload generation system cannot recognize the content of the feedback information. At this time, it is necessary to output the feedback information to the vulnerability processing interface, and receive the target exploit code fed back by the tester in the vulnerability processing interface. Finally, the target attack payload for re-attack is generated based on the target exploit code and the security vulnerability information. Reselect or receive the target exploit code through feedback information to improve the efficiency of regenerating the attack payload after the attack fails.

[0082] In addition, when the attack fails, the attack payload generation system can also try different vulnerability exploitation methods or bypass the detection mechanism to handle the attack.

[0083] In the technical solution disclosed in this embodiment, when an attack action is executed and the attack fails, the current cause of failure is determined through the return packet corresponding to the attack failure, and the exploit code, security vulnerability information, and vulnerability exploitation strategy are adjusted based on the cause of failure, thereby regenerating the attack payload. This reduces the need for testers to conduct detailed analysis of the failed return packet, rewrite the exploit code, and re-search for security vulnerability information, thereby improving the generation efficiency when regenerating the attack payload and further improving the testing efficiency of the security assessment process.

[0084] Third embodiment

[0085] Please refer to Figure 3 , based on the third embodiment, before step S10, the method further includes:

[0086] Step S80, obtaining historical vulnerability detection data, and analyzing and processing the historical vulnerability detection data based on the vulnerability analysis module to obtain vulnerability data of various categories;

[0087] Step S90, extracting features of the vulnerability data to obtain a detection code and a detection process for the vulnerability data;

[0088] Step S100, training a preset training module based on the detection code, the detection process and the vulnerability data, and generating the vulnerability detection module based on the preset training module when the convergence value tends to be stable.

[0089] In this embodiment, it is necessary to train the preset training module according to the server information corresponding to each vulnerability data in the historical vulnerability detection data, so as to generate a vulnerability detection module. Therefore, in an optional implementation, firstly, vulnerability data of each category is determined based on the vulnerability analysis module, then feature extraction is performed on the vulnerability data, and finally, the training module is trained according to the content after feature extraction to obtain a vulnerability detection module, so that the attack load generation system can quickly analyze the security vulnerability information of the target network based on the vulnerability detection module.

[0090] Reference Figure 4 , Figure 4 The figure is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiment of the present invention.

[0091] like Figure 4As shown, the terminal may include: a processor 1001, such as a main processor (Central Processing Unit, CPU), a communication bus 1002, a network interface 1003, and a memory 1004. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The network interface 1003 may optionally include a standard wired interface, a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1004 may be a high-speed RAM memory (Random Access Memory, RAM) or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1004 may also be a storage device independent of the aforementioned processor 1001.

[0092] Those skilled in the art will understand that Figure 4 The terminal structure shown in the figure does not constitute a limitation on the terminal, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0093] like Figure 4 As shown, the memory 1004 as a computer storage medium may include an operating system, a data storage module, a network communication module, and a program for generating an attack payload.

[0094] exist Figure 4 In the terminal shown, the network interface 1003 is mainly used to connect to the backend server and perform data communication with the backend server; the processor 1001 can call the attack payload generation program stored in the memory 1004 and perform the following operations:

[0095] Determine a target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and obtain server information of the target network based on a preset detection tool;

[0096] Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the target network;

[0097] Obtaining an exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface;

[0098] Based on the exploit code and the security vulnerability information, an attack payload corresponding to the target network is generated.

[0099] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0100] Generate a preset attack payload template based on the vulnerability version of the security vulnerability information;

[0101] The exploit code is added to a preset attack payload template to obtain the attack payload corresponding to the target network.

[0102] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0103] Selecting a code writing rule according to the vulnerability version, and generating the preset attack payload template based on the code writing rule; and / or

[0104] A code generation module is selected according to the vulnerability version, and the security vulnerability information is input into the code generation module to obtain the preset attack payload template.

[0105] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0106] Executing an attack action based on the attack payload, and obtaining an attack data packet fed back by the target network based on the attack action;

[0107] When the attack result corresponding to the attack data packet is an attack failure, obtaining corresponding feedback information in the attack data packet;

[0108] A target exploit code corresponding to the feedback information is selected or received based on the feedback information, and a target attack payload for re-attack is generated according to the target exploit code and the security vulnerability information.

[0109] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0110] Inputting the feedback information into a feedback information processing module, and selecting the target utilization code based on the processing information fed back by the feedback information processing module;

[0111] When the processing information is empty, outputting the feedback information to the vulnerability processing interface, and receiving the target exploitation code fed back by the vulnerability processing interface;

[0112] The target attack payload for re-attack is generated according to the target exploit code and the security vulnerability information.

[0113] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0114] Perform secondary processing on the server information based on the vulnerability detection module to obtain target security vulnerability information;

[0115] When the target security vulnerability information is different from the security vulnerability information, the step of obtaining the exploit code associated with the security vulnerability information or obtaining the exploit code received by the vulnerability processing interface is performed based on the target security vulnerability information.

[0116] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0117] Acquire historical vulnerability detection data, and analyze and process the historical vulnerability detection data based on the vulnerability analysis module to obtain vulnerability data of various categories;

[0118] Extract features of the vulnerability data to obtain detection codes and detection procedures for the vulnerability data;

[0119] The preset training module is trained based on the detection code, the detection process and the vulnerability data, and when the convergence value tends to be stable, the vulnerability detection module is generated based on the preset training module.

[0120] Further, the processor 1001 may call the attack payload generation program stored in the memory 1004, and further perform the following operations:

[0121] Using the security vulnerability information as an index condition, searching for the exploit code in a local or cloud database;

[0122] The step of obtaining the exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface includes:

[0123] When the query result of querying the exploit code is not empty, using the query result as the exploit code associated with the security vulnerability information;

[0124] When the query result of querying the exploit code is empty, the security vulnerability information is sent to the vulnerability processing interface, and when responding to the operation instruction of the vulnerability processing interface, the exploit code received by the vulnerability processing interface is obtained.

[0125] In addition, it can be understood by a person skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the control terminal to implement the process steps of the embodiment of the above method.

[0126] Therefore, the present invention also provides a computer-readable storage medium, which stores an attack payload generation program. When the attack payload generation program is executed by a processor, the various steps of the attack payload generation method described in the above embodiment are implemented.

[0127] It should be noted that since the storage medium provided in the embodiment of the present application is the storage medium used to implement the method of the embodiment of the present application, based on the method introduced in the embodiment of the present application, the person skilled in the art can understand the specific structure and deformation of the storage medium, so it is not repeated here. All storage media used in the method of the embodiment of the present application belong to the scope of protection of this application.

[0128] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0132] It should be noted that in the claims, any reference signs placed between parentheses shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claim. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0133] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0134] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0135] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for generating an attack payload, characterized in that: The attack payload generation method includes: Determine a target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and obtain server information of the target network based on a preset detection tool; Using the server information as an input parameter of a vulnerability detection module to obtain security vulnerability information of the target network; Obtaining an exploit code associated with the security vulnerability information, or obtaining an exploit code received by a vulnerability processing interface; Based on the exploit code and the security vulnerability information, generating an attack payload corresponding to the target network; Executing an attack action based on the attack payload, and obtaining an attack data packet fed back by the target network based on the attack action; When the attack result corresponding to the attack data packet is an attack failure, obtaining corresponding feedback information in the attack data packet; Inputting the feedback information into a feedback information processing module, and selecting a target exploit code based on the processing information fed back by the feedback information processing module, wherein when the processing information indicates that the target network has a denial of service vulnerability, the feedback information processing module selects the target exploit code in a local database or a cloud database based on the vulnerability; When the processing information is empty, outputting the feedback information to the vulnerability processing interface, and receiving the target exploitation code fed back by the vulnerability processing interface; A target attack payload for re-attack is generated according to the target exploit code and the security vulnerability information.

2. The method for generating an attack payload according to claim 1, wherein: The step of generating an attack payload corresponding to the target network based on the exploit code and the security vulnerability information includes: Generate a preset attack payload template based on the vulnerability version of the security vulnerability information; The exploit code is added to a preset attack payload template to obtain the attack payload corresponding to the target network.

3. The method for generating an attack payload according to claim 2, wherein: The step of generating a preset attack payload template based on the vulnerability version of the security vulnerability information comprises: Selecting a code writing rule according to the vulnerability version, and generating the preset attack payload template based on the code writing rule; and / or A code generation module is selected according to the vulnerability version, and the security vulnerability information is input into the code generation module to obtain the preset attack payload template.

4. The method for generating an attack payload according to claim 1, wherein: After the step of obtaining the corresponding feedback information in the attack data packet when the attack result corresponding to the attack data packet is an attack failure, the method further includes: Perform secondary processing on the server information based on the vulnerability detection module to obtain target security vulnerability information; When the target security vulnerability information is different from the security vulnerability information, the step of obtaining the exploit code associated with the security vulnerability information or obtaining the exploit code received by the vulnerability processing interface is performed based on the target security vulnerability information.

5. The method for generating an attack payload according to claim 1, wherein: Before the step of determining the target network corresponding to the received security assessment instruction and / or vulnerability update instruction, and obtaining the server information of the target network based on a preset detection tool, the method further includes: Acquire historical vulnerability detection data, and analyze and process the historical vulnerability detection data based on the vulnerability analysis module to obtain vulnerability data of various categories; Extract features of the vulnerability data to obtain a detection code and a detection process for the vulnerability data; The preset training module is trained based on the detection code, the detection process and the vulnerability data, and when the convergence value tends to be stable, the vulnerability detection module is generated based on the preset training module.

6. The method for generating an attack payload according to claim 1, wherein: Before the step of obtaining the exploit code associated with the security vulnerability information or obtaining the exploit code received by the vulnerability processing interface, the step further includes: Using the security vulnerability information as an index condition, searching for the exploit code in a local or cloud database; The step of obtaining the exploit code associated with the security vulnerability information, or obtaining the exploit code received by the vulnerability processing interface includes: When the query result of querying the exploit code is not empty, using the query result as the exploit code associated with the security vulnerability information; When the query result of querying the exploit code is empty, the security vulnerability information is sent to the vulnerability processing interface, and when responding to the operation instruction of the vulnerability processing interface, the exploit code received by the vulnerability processing interface is obtained.

7. A device for generating an attack payload, characterized in that: The attack payload generation device includes: a memory, a processor, and an attack payload generation program stored in the memory and executable on the processor. When the attack payload generation program is executed by the processor, the steps of the attack payload generation method as described in any one of claims 1 to 6 are implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an attack payload generation program, and when the attack payload generation program is executed by a processor, the steps of the attack payload generation method according to any one of claims 1 to 6 are implemented.

Images