A network security verification method and system compatible with application targets

Abstract

The present invention belongs to the technical field of network security verification, and specifically discloses a network security verification method and system compatible with application targets, the method comprising: configuring application targets, the application targets are associated with matching rules, the matching rules are information in response packets returned by different WAF devices; when a user creates a task, he can choose to verify the application target type, display the WAF class script, and add the target type field, matching rule object list field and application target object field in the task delivery parameters; the attacker simulator receives the task delivery parameters, extracts the target information and matching rule information for the application target type task, and sends a simulated attack to the target address corresponding to the application target; after launching the attack, the attack result is judged based on the response packet and the matching rule. The present invention is compatible with the situation where the attacked simulator cannot be correctly deployed or the attacker simulator cannot connect to the attacked simulator.

Description

Technical Field

[0001] The invention relates to a network security verification method and system compatible with application targets, belonging to the technical field of network security verification. Background Art

[0002] The network security verification system (BAS system) is mainly composed of the BAS application system and simulators (divided into attacker simulators and victim simulators). The basic process of using the BAS system for security verification mainly includes: 1. Design and install deployment plans and simulate attack plans according to customer protection strategies; 2. Install and deploy BAS system servers and simulators in designated network areas; 3. Configure simulator roles according to attack plans and the network areas where the simulators are located. The simulator roles that can be configured include: attacker, victim, asset protection detection, simulator victim network, simulated core data, email application configuration, etc. Different roles correspond to different security verification directions and functions; 4. Create tasks, select targeted scripts according to protection strategies and protection equipment, and select the simulators that need to be executed; 5. , assemble parameters, automatically assemble the parameters required to execute the script according to the selected simulator and script; 6. Task dispatch, the simulator automatically initiates a task request to the server, and the server automatically determines whether there is a task that the simulator needs to execute. If so, it returns the corresponding execution parameters; 7. Task execution, the simulator receives the execution parameter information returned by the server, and starts to execute the script task; 8. Execution is completed, and the execution result is judged. If the simulated attack is successful, it is not intercepted, otherwise it is blocked; 9. Execution ends. If the execution result reaches the server, the server determines whether the scripts under the task have been fully executed. If all are completed, the task is ended and a security verification report is automatically generated.

[0003] In actual application, some users often only have one set of Web application protection system (also known as website application-level intrusion prevention system, English: Web Application Firewall, abbreviated as: WAF) security protection equipment. These users usually only purchase one set of WAF equipment, so it will be impossible to add the victim simulator to the WAF equipment protection network. In addition, due to the high level of network security control, the victim IP and port cannot be opened, and the attacker cannot access the victim simulator. Since there is no support response from the victim simulator, our task verification process cannot be closed and the task cannot be executed, so it is impossible to test the effectiveness of these users' security equipment.

[0004] However, customers still hope that we can conduct security testing and verification on their portal website or a certain network site, and expect us to directly simulate attacks on the website specified by the user, using their real site as the victim, so as to more realistically and intuitively test the effectiveness of WAF security protection equipment.

[0005] In view of the above possible situations where the victim simulator cannot be deployed correctly or the attacker simulator cannot connect to the victim simulator, in the existing BAS system, all scripts for WAF effectiveness testing require two simulators, the attacker simulator and the victim simulator. The attacker simulator sends a simulated attack to the victim simulator, and the attack traffic passes through the security protection device. The victim receives the simulated attack and responds to a certain extent, thus forming a closed loop of execution verification. Therefore, in view of the possible problems of the correct deployment of the victim and the use of the victim channel, we need to be compatible with the situation where there is no victim simulator or the victim simulator cannot respond normally. Summary of the invention

[0006] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a network security verification method and system that is compatible with application targets, which can be applicable to situations where the attacked simulator cannot be correctly deployed or the attacker simulator cannot connect to the attacked simulator.

[0007] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0008] A network security verification method for compatible application targets comprises the following steps:

[0009] Configure the application target; the configuration information of the application target includes the system name, system URL, host IP and associated matching rules; the matching rules are the information in the response packets returned by different WAF devices, including the rule name, return status code, return Header information and return Body information;

[0010] When the user creates a script task, the user selects the target type for verification, including simulator and application target. For the application target type, WAF scripts are displayed;

[0011] When the script task is sent to the attacker simulator, the target type field, matching rule object list field, and application target object field are added to the task sending parameters;

[0012] After receiving the task delivery parameters, the attacker simulator extracts the target information and matching rule information for the task of application target type, and sends a simulated attack to the target address corresponding to the application target;

[0013] After the attacker simulator launches an attack, it first determines whether the response packet is empty. If the response packet is empty, the attack is judged to have failed and the result is blocked. If the response packet is not empty, it then determines whether there is a matching rule. If there is a matching rule, it then determines whether the return status code, return Header information, and return Body information in the response packet are consistent with the information in the matching rule. If they are consistent, it is determined that the request has been intercepted by the WAF device, the attack fails, and the result is blocked. If at least one match is inconsistent, it is determined that the request has not been detected by the WAF device, the attack is successful, and the result is not intercepted. If there is no matching rule, it is determined that the attack is successful and the result is not intercepted.

[0014] Preferably, the matching rule associated with the application target is a matching rule of a known WAF device built into the BAS system, a matching rule customized and added by a user according to his own WAF device, or an intelligent matching rule.

[0015] Preferably, when the matching rule associated with the application target is an intelligent matching rule, a WAF device detection scan is performed on the target, and it is determined whether WAF fingerprint information exists based on the response packet. If WAF fingerprint information exists, the return status code, return Header information and return Body information of the response packet and the WAF fingerprint information are extracted to generate a matching rule.

[0016] Preferably, when detecting and scanning the WAF device, first send a normal HTTP request to the target, and determine whether there is WAF fingerprint information based on the returned response packet. If there is WAF fingerprint information, extract the return status code, return Header information and return Body information of the response packet and generate a matching rule based on the WAF fingerprint information; if no WAF fingerprint information is detected, send a malicious request again, and determine whether there is WAF fingerprint information based on the response packet. If there is WAF fingerprint information, extract the return status code, return Header information and return Body information of the response packet and generate a matching rule based on the WAF fingerprint information.

[0017] Preferably, the matching rules obtained by the WAF device detection scan are automatically added to the matching rules of the BAS system server.

[0018] Preferably, after the attacker simulator receives the task delivery parameters, for tasks whose target type is an application target type, the real address of the target is intercepted according to the system URL in the application target object. If the address is a domain name address, the domain name address needs to be resolved first to intercept the real domain name address, and then it is determined whether the domain name resolution and host name query static table are configured. If not, the configuration file is modified to add the domain name resolution and host name query static table; if the address is an IP address, it is used directly.

[0019] Preferably, when executing the attack result judgment, the attacker simulator first determines whether there is a response packet. If not, the attack fails and the result is blocked. Secondly, it determines whether there is a matching rule. If there is a matching rule, the attack result judgment of the target type target is performed. If there is no matching rule, the attack is judged to be successful.

[0020] Based on the same inventive concept, the present invention provides a network security verification system compatible with application targets, comprising:

[0021] A matching rule configuration module is used to configure matching rules. The matching rules are information in the response packets returned by different WAF devices, including return status code, return Header information, and return Body information.

[0022] An application target configuration module, used to configure the application target; the configuration information of the application target includes the system name, system URL, host IP and associated matching rules;

[0023] The task creation module is used to create script tasks. When users create script tasks, they select the target type to be verified, including simulators and application targets. For application target types, WAF scripts are displayed.

[0024] The task delivery module is used to add the target type field, matching rule object list field and application target object field to the task delivery parameters when the script task is delivered to the attacker simulator;

[0025] And, the attacker simulator is used to, after receiving the task delivery parameters, for tasks with the target type of application target type, first extract the target information and matching rule information, and then send a simulated attack to the target address corresponding to the application target; and after launching the attack, first determine whether the response packet is empty. If the response packet is empty, the attack is judged to have failed, and the result is blocked; secondly, if the response packet is not empty, it is determined whether there is a matching rule. If there is a matching rule, it is determined whether the return status code, return Header information and return Body information in the response packet are consistent with the content in the matching rule. If they are consistent, it is determined that the request has been intercepted by the WAF device, the attack failed, and the result is blocked. If one of the matches is inconsistent, it is determined that the request has not been detected by the WAF device, the attack is successful, and the result is not intercepted; if there is no matching rule, the attack is judged to be successful, and the result is not intercepted.

[0026] Preferably, the system also includes an intelligent matching module, which is used to perform a WAF device detection scan on the target when the matching rule associated with the application target is an intelligent matching rule, and determine whether WAF fingerprint information exists based on the response packet. If WAF fingerprint information exists, the return status code, return Header information, return Body information and WAF fingerprint information of the response packet are extracted to generate a matching rule.

[0027] The present invention also provides a computer program product, comprising a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the steps of the network security verification method for a compatible application target are implemented.

[0028] Beneficial effects: Compared with the prior art, the present invention has the following advantages: 1. The present invention is compatible with the situation where there is no attacked simulator, and a new application target concept is added, that is, the user's real Web site. WAF-type scripts can attack application targets or attacked simulators, and can flexibly select attack targets according to customer needs. 2. The present invention adds a new matching rule concept, with built-in matching rules for WAF device response packets adapted to different manufacturers, and can also customize and add new WAF matching rules, and further supports intelligent matching rules. The matching rules associated with application targets can accurately determine the results of simulated attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Schematic diagram of a network security verification system compatible with application targets in an embodiment of the present invention.

[0030] Figure 2 The figure is a schematic diagram of the target configuration process used in the embodiment of the present invention.

[0031] Figure 3 The present invention is a schematic diagram of a network security verification process that is compatible with an attacked simulator and an application target in an embodiment of the present invention.

[0032] Figure 4 The figure is a schematic diagram of the intelligent matching rule acquisition process in an embodiment of the present invention.

[0033] Figure 5 The figure is a schematic diagram of the task execution flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0035] like Figure 1 - Figure 5As shown, the present invention aims at the possible situation that the attacked simulator cannot be correctly deployed or the attacker simulator cannot be connected to the attacked simulator, and analyzes it from the simulator WAF script execution process. After the attacker simulator receives the WAF script task, it reads the script attack request packet and sends the attack request packet to the attacked simulator. The WAF security protection device may perform security protection in a serial or bypass mode. The attack traffic will pass through the WAF protection device. If the WAF protection device detects and determines that this traffic is an attack request traffic, it will respond according to the configured protection rules. Common WAF protection rules include: protection mode (blocking attacks), observation mode (only recording without blocking), and maintenance mode (uniformly returning to the maintenance page). The protection mode will intercept malicious attack requests and return the response packets intercepted by the WAF protection device. No requests will be intercepted in the observation mode, and maintenance will uniformly return maintenance page response packets. If the attack traffic passes through the WAF protection device and reaches the attacked simulator, the attacked simulator will match the corresponding response packet according to the traffic content and return it. The returned packet passes through the WAF protection device and may also trigger the protection rules. If it is not intercepted, the response packet is returned to the attacker simulator. The attacker simulator determines whether the returned response packet content is consistent with the corresponding response packet content in the script. If they are consistent, the request is judged to be successful.

[0036] From the above WAF script execution process, the role of the attacked simulator is only to respond to the requests of the attacker simulator, so that the attacker simulator can accurately determine the attack traffic and the results. However, customers who only have one set of Web application protection system need to attack real Web sites to verify whether their WAF protection equipment is effective.

[0037] The present invention starts from the essence of BAS. The purpose of the BAS system is to verify the effectiveness of the security protection equipment, that is, whether the security protection equipment can detect our attack behavior and intercept it during the verification process. As for whether the attack is successful or whether the attack traffic reaches the attacked simulator, it can only be regarded as an auxiliary means (logical closed loop) to verify the authenticity of our simulated attack. If the security protection equipment is effective, our attack behavior or traffic can definitely be detected or intercepted, and after the protection rules of the security protection equipment are triggered, the attacked simulator will not receive any information. In this case, we can also not need the attacked simulator, and only need the security protection equipment to respond. If the security protection equipment does not respond or alarm to our attack behavior or request, then it can be considered that the attack is successful.

[0038] Based on the above analysis, if Figure 1As shown, an embodiment of the present invention discloses a network security verification system compatible with application targets, which is compatible with existing BAS systems and special requirements, and regards a Web site as an application target (victim). When executing a WAF script task, the victim can be an attacker simulator or an application target. The attacker simulator can directly launch a simulated attack on the application target. If the WAF protection device intercepts it, the result is blocking, and a closed process loop can be performed. If there is no interception, it is determined whether a response packet is received (if it is an incorrect request to access the Web site, it is normally not authorized, and a status of 404, 405, 500, etc. will be returned). If a response packet returned by the Web site is received, it is considered that the attack is successful, and the result is not intercepted. If no response packet returned by the Web site is received, it is determined that the attack failed, and the result is blocking.

[0039] Specifically, an embodiment of the present invention discloses a network security verification method compatible with application targets. Before creating a script task, the application target is first configured. The configuration information of the application target includes the system name, system URL, host IP and associated matching rules, etc.; wherein the matching rule is the information in the response packet returned by different WAF devices, including the return status code, the return Header information and the return Body information; when the user creates a script task, the user selects the target type for verification, including the simulator and the application target. For tasks whose target type is the application target type, the WAF type script is displayed; and the target type field, the matching rule object list field and the application target object field are added to the task delivery parameters; after the attacker simulator receives the task delivery parameters, for tasks whose target type is the application target type, the first First, you need to extract the application target information and matching rule information, and then send a simulated attack to the target address corresponding to the application target; after the attacker simulator launches the attack, it first determines whether the response packet is empty. If the response packet is empty, the attack is judged to have failed and the result is blocked; secondly, if the response packet is not empty, it is judged whether there is a matching rule. If there is a matching rule, it is judged whether the return status code, return Header information, and return Body information in the response packet are consistent with the information in the matching rule. If they are consistent, it is judged that the request has been intercepted by the WAF device, the attack failed, and the result is blocked. If there is at least one inconsistent match, it is judged that the request has not been detected by the WAF device, the attack is successful, and the result is not intercepted; if there is no matching rule, it is judged that the attack is successful and the result is not intercepted.

[0040] The embodiments of the present invention take into account that different WAF vendors configure different protection rules and return different contents. Each WAF vendor has its own return status code, return header information, and return body information, which are different from each other. For example, Changting Leichi WAF (hereinafter referred to as Changting WAF) and Huawei Web Application Firewall WAF (hereinafter referred to as Huawei WAF), the status code returned by Changting WAF is 403, while the status code returned by Huawei WAF is 418. The corresponding return header information and return body information are different. Therefore, it is necessary to dynamically adapt different WAF products installed by different users. Based on the response content returned by each WAF vendor, the embodiments of the present invention extract their commonalities and organize them into matching rule modules. The matching rule module includes two parts: matching rules and intelligent matching rules. The matching rules are the information in the response packets returned by different WAF vendors, including: rule name (WAF product name, version information, etc.), return status code, return Header information, return Body information, rule source, rule status (on and off), and adding time. The information returned by the encountered WAF products is collected, and the matching rules of these WAF vendors are built into the system. Users can also add matching rules based on their own WAF devices. The intelligent matching rules will first perform a WAF device detection scan on the target, and determine whether there is WAF fingerprint information based on the response packet. If there is WAF fingerprint information, the return status code, return Header information, return Body information and WAF fingerprint information of the response packet are extracted to generate matching rules for attack result judgment in the task. At the same time, the extracted information is returned to the server, and the server is automatically added to the matching rule module.

[0041] In addition, the attacker simulator's judgment on the attack result is compatible with the attacked simulator and the target of the application target type. For tasks with the target type of the application target type, when executing the attack result judgment, it first determines whether the response packet is empty. If the response packet is empty, the attack is judged to have failed and the result is blocked. Secondly, it determines whether there is a matching rule. If there is a matching rule, it determines whether the return status code, return Header information, and return Body information in the response packet are consistent with the information in the matching rule. If all are consistent, the result is directly judged to be blocked. If there is at least one inconsistency, the match fails and the result is judged to be not intercepted; if there is no matching rule, the attack is judged to be successful and the result is not intercepted.

[0042] Exemplarily, the detailed steps of a network security verification method for compatible application targets are as follows:

[0043] Step 1: Add matching rules. The BAS system will have built-in matching rules for some WAF products. Users first need to determine whether their WAF device is included in the built-in matching rules. If not, they need to add custom matching rules.

[0044] Step 2: Add application targets. The embodiment of the present invention splits the original simulator into two categories: simulator and application targets. The simulator is consistent with the original process, and the application target type is added. Users can customize the addition of application targets (the flowchart is as shown in the figure). Figure 2 As shown in the figure), it includes: application target system name, system URL (e.g. http: / / www.xxxx.com), host IP, network area, source, matching rule, and adding time. Users can add the application target (web site) to be verified. When adding, they can choose matching rule or smart matching rule. If smart matching rule is selected, when verifying the application target, it will automatically detect whether there is WAF device fingerprint information in the scan target. If there is WAF fingerprint information, the information of the response packet is extracted and added to the matching rule, which is used as the basis for the attacker to judge the attack result, and will be automatically integrated into the matching rule of our BAS server. If the selection is not a smart matching rule, the attacker simulator will make a judgment based on the selected matching rule when judging the execution result.

[0045] Step 3: Create task adjustment. First, after the user clicks Create Task, he needs to select whether the verification target is a simulator or an application target. If the application target type is selected, all WAF-type scripts will be displayed. The user can only select WAF-type scripts. If the simulator is selected, it will be consistent with the original process. Taking the application target as an example, after selecting the WAF-type script, select the application target to be verified and the corresponding attacker simulator. After selecting, fill in the task information and confirm.

[0046] Step 4: Adjust the task delivery. Add the target type field (to distinguish whether the target is a simulator or an application target), the matching rule object list field, and the application target object field to the script task delivery parameters.

[0047] Step 5: Attack process adjustment. After receiving the script parameters, the attacker simulator first determines the target type. If the target type is a simulator, it is consistent with the original process. If the target type is an application target, the target information and matching rule information are extracted, and the actual target address in the target URL is cut out (Note: Generally, the URL may be a combination of address plus reception, such as http: / / www.xxxx.com / search?=XXX. Such an address cannot be used directly, so the www.xxxx.com domain name needs to be cut out to be used as a target). If the address is an IP address, it can be used directly, but if it is a domain name, domain name resolution needs to be configured. When configuring domain name resolution, it is necessary to determine whether the host IP address is empty. If it is not empty, modify the / etc / hosts file to specify the domain name and address, as shown in Table 1. If it is empty, modify the / etc / resolv.conf file to configure the domain name resolution to 114.114.114.114, as shown in Table 2. After the address is obtained, send a simulated attack to the address.

[0048] Table 1:

[0049]

[0050] Table 2:

[0051]

[0052] Step 6: Result judgment adjustment. For tasks with application target type, extract the matching rule information. First, determine whether the matching rule is an intelligent matching rule. If it is an intelligent matching rule, you need to perform WAF detection on the target first. Combined with the Wafw00f open source tool, detect whether there is a WAF device on the target, and determine whether there is WAF fingerprint information based on the response packet. If there is WAF fingerprint information, extract the return status code, return Header information, return Body information and WAF fingerprint information of the response packet, generate matching rules, and automatically add them to the matching rules of the Web server. If the matching rules configured in the script execution parameters are used, the configured matching rules are used for result judgment.

[0053] After the attacker simulator launches an attack, for tasks whose target type is the application target type, it first determines whether the response packet is empty. If the response packet is empty, the attack is judged to have failed and the result is blocked; secondly, if the response packet is not empty, it determines whether there is a matching rule. If there is a matching rule, the return status code, return Header information, and return Body information of the response packet are matched with the matching rule. If all matches are successful, it is directly judged that the attack has been intercepted by the WAF device, the attack fails, and the result is blocked; if at least one item is not matched successfully, it is judged that the response packet is not returned by the WAF device, but by the application target site, and the attack is judged to be successful, and the result is not intercepted; if there is no matching rule, the attack is judged to be successful, and the result is not intercepted.

[0054] In summary, the network security verification process that is compatible with the attacked simulator and the application target is as follows: Figure 3 As shown, the specific process is as follows:

[0055] 1. Customize the installation and deployment plan according to the customer's security protection strategy and the security protection equipment that needs to be verified. If the victim simulator cannot be installed and deployed in the protection network or the victim simulator channel cannot be opened due to customer environment restrictions or customer requirements, you can choose to create an application target. The deployment diagram is as follows: Figure 1 As shown in the figure, with the customer's permission, an attack simulation is performed on the customer's real Web website with WAF security protection equipment, and the BAS server and attacker simulator are installed and deployed in other areas. The following process only introduces the process related to the application target.

[0056] 2. If the verification target type is an application target, you need to check whether the protection rules of the WAF protection device installed and deployed by the customer are in the matching rules of the BAS system. If there is no matching rule for the WAF device, you first need to customize the matching rules of the WAF device, and then create an application target, and select matching rules or smart matching rules for the application target. If you select matching rules, the selected matching rules will be sent to the attacker simulator when executing the task of the application target. If you select smart matching rules, the attacker simulator will automatically detect the WAF device on the target when executing the task, and determine whether there is WAF fingerprint information based on the response packet. If there is WAF fingerprint information, extract the return status code, return Header information, return Body information and WAF fingerprint information of the response packet to generate matching rules.

[0057] 3. Create a task. After clicking Create Task, you first need to select the target type (simulator and application target) to be verified. After selecting the application target type, all WAF type scripts will be displayed. After selecting the script to be executed, click Next, and then select the application target object and attacker simulator to be verified. After selection, the system will check whether the script, simulator, and application target meet the execution conditions. If not, you need to reselect the script, simulator, and application target. After verification, fill in the basic information of the task to create the task.

[0058] 4. Assemble parameters. According to the selected script, simulator and application target, automatically assemble the execution parameters required to execute the script, and add the application target object parameters and corresponding matching rules (for matching rules, refer to the matching rule type selected in step 2).

[0059] 5. Task dispatch: the attacker simulator automatically initiates a task request to the server, and the server returns the script execution parameter information that needs to be executed by the simulator to the attacker simulator.

[0060] 6. WAF device detection, determine whether the matching rule type is a smart matching rule. If it is a smart matching rule, use the Wafw00f open source WAF scanning detection tool to scan. The process is as follows: Figure 4 As shown, first, Wafw00f will send a normal HTTP request to the target, and determine whether there is WAF fingerprint information based on the returned response packet. If there is WAF information, the return status code, return Header information, return Body information and WAF fingerprint information of the response packet are extracted to generate matching rules for the result judgment in step 8, and the matching rules are returned to the server, and automatically integrated into the matching rules of the BAS server; if WAF fingerprint information is not detected, malicious requests are sent again, such as: XSS class, SQL injection class, traversal class, command execution / splicing class, XXE class, etc., and one or more malicious requests are constructed based on these five categories, and then based on the response packet, whether there is WAF fingerprint information, the processing flow is the same as above. Wafw00f has integrated the WAF detection features of 161 domestic network manufacturers, which facilitates our detection of unknown WAF devices.

[0061] 7. Task execution process Figure 5As shown in the figure, the attacker simulator receives the task delivery parameters and first needs to determine the target type to be verified. If it is a simulator, it is consistent with the original process. If the target type is an application target, it is necessary to intercept the real address of the target according to the system URL in the target object. If the address is a domain name address, it is necessary to determine whether the domain name resolution (Table 2) and the host name query static table (Table 1) are configured. If not, it is necessary to modify the / etc / resolv.conf configuration file to add domain name resolution and / etc / hosts host name query static table. If the address is an IP address, it can be used directly.

[0062] 8. After the execution is completed, for tasks with the target type of application target, first determine whether the content of the response packet is empty. If the response packet is empty, the attack is judged to have failed and the result is blocked. If the response packet is not empty, then determine whether there is a matching rule. If there is a matching rule, then determine whether the return status code, return Header information, and return Body information of the response packet are consistent with the information in the matching rule. If all are consistent, the request has been intercepted by the WAF device, the attack failed, and the result is blocked. If there is at least one inconsistent match, the request is not detected by the WAF device, the attack is successful, and the result is not intercepted; if there is no matching rule, the attack is judged to be successful and the result is not intercepted.

[0063] 9. Return the execution result to the server. The server determines whether all the scripts under the task have been executed. If they have been completed, the task is terminated and a security verification report is automatically generated.

[0064] Based on the same inventive concept, an embodiment of the present invention discloses a network security verification system compatible with application targets, including: a matching rule configuration module for configuring matching rules; an application target configuration module for configuring application targets; a task creation module for creating a script task, when a user creates a script task, the user selects the target type to be verified, and for the application target type, a WAF script is displayed; a task delivery module for adding a target type field, a matching rule object list field, and an application target object field to the task delivery parameters when the script task is delivered to the attacker simulator; and an attacker simulator for extracting target information and matching rule information for tasks of the application target type after receiving the task delivery parameters, and sending a simulated attack to the target address corresponding to the application target; and judging the attack result after launching the attack. For specific implementation details, please refer to the above method embodiment. Furthermore, the system also includes an intelligent matching module, which is used to perform a WAF device detection scan on the target when the matching rule associated with the application target is an intelligent matching rule, and determine whether there is WAF fingerprint information based on the response packet. If WAF information exists, the return status code, return Header information, return Body information and WAF fingerprint information of the response packet are extracted to generate a matching rule for attack result judgment in the task.

[0065] The embodiment of the present invention further discloses a computer program product, including a computer program / instruction, which implements the steps of the network security verification method for compatible application targets when the computer program / instruction is executed by a processor.

Claims

1. A network security verification method for compatible application targets, characterized in that: The steps include: Configure the application target; the configuration information of the application target includes the system name, system URL, host IP and associated matching rules; the matching rules are the information in the response packets returned by different WAF devices, including the return status code, return Header information and return Body information; When the user creates a script task, the user selects the target type for verification, including simulator and application target. For the application target type, WAF scripts are displayed; When the script task is sent to the attacker simulator, the target type field, matching rule object list field, and application target object field are added to the task sending parameters; After receiving the task delivery parameters, the attacker simulator first determines whether the current task is an application target type task based on the target type field. If it is an application target type task, it extracts the application target information and matching rule information, and sends a simulated attack to the target address corresponding to the application target; After the attacker simulator launches an attack, it first determines whether a response packet is received. If no response packet is received, the attack is considered to have failed and the result is blocked. Secondly, if the response packet is not empty, it determines whether there is a matching rule. If there is a matching rule, it determines whether the return status code, return Header information, and return Body information in the response packet are consistent with the information in the matching rule. If they are consistent, it is determined that the request has been intercepted by the WAF device, the attack fails, and the result is blocked. If at least one match is inconsistent, it is determined that the request has not been detected by the WAF device, the attack is successful, and the result is not intercepted. If there is no matching rule, the attack is considered successful and the result is not intercepted.

2. A network security verification method for compatible application targets according to claim 1, characterized in that: The matching rule associated with the application target is a matching rule of a known WAF device built into the BAS system, or a matching rule customized and added by a user according to his own WAF device, or an intelligent matching rule.

3. A network security verification method for compatible application targets according to claim 2, characterized in that: When the matching rule associated with the application target is an intelligent matching rule, a WAF device detection scan is performed on the target, and it is determined whether WAF fingerprint information exists based on the response packet. If WAF fingerprint information exists, the return status code, return Header information, return Body information and WAF fingerprint information of the response packet are extracted to generate a matching rule.

4. A network security verification method for compatible application targets according to claim 3, characterized in that: When detecting and scanning the WAF device, first send a normal HTTP request to the target, and determine whether there is WAF fingerprint information based on the returned response packet. If there is WAF fingerprint information, extract the return status code, return Header information, return Body information and WAF fingerprint information of the response packet to generate a matching rule; if no WAF fingerprint information is detected, send a malicious request again, and determine whether there is a WAF fingerprint based on the response packet. If there is WAF fingerprint information, extract the return status code, return Header information, return Body information and WAF fingerprint information of the response packet to generate a matching rule.

5. A network security verification method for compatible application targets according to claim 3, characterized in that: The matching rules obtained by the WAF device detection scan are automatically added to the matching rules of the BAS system server.

6. A network security verification method for compatible application targets according to claim 1, characterized in that: After the attacker simulator receives the task delivery parameters, for tasks with the target type of application target type, the real address of the target is intercepted according to the system URL in the application target object. If the address is a domain name address, the domain name address must be resolved first to intercept the real domain name address, and then determine whether the attacker simulator has configured domain name resolution and host name query static tables. If not, modify the configuration file to add domain name resolution and host name query static tables; if the address is an IP address, use it directly.

7. A network security verification system for compatible application targets, which is implemented based on the network security verification method for compatible application targets as claimed in any one of claims 1 to 6, characterized in that: include: A matching rule configuration module is used to configure matching rules. The matching rules are information in the response packets returned by different WAF devices, including return status code, return Header information, and return Body information. An application target configuration module, used to configure the application target; the configuration information of the application target includes the system name, system URL, host IP and associated matching rules; The task creation module is used to create script tasks. When users create script tasks, they select the target type to be verified, including simulators and application targets. For application target types, WAF scripts are displayed. The task delivery module is used to add the target type field, matching rule object list field and application target object field to the task delivery parameters when the script task is delivered to the attacker simulator; and, an attacker simulator, which is used to, after receiving the task delivery parameters, first extract the target information and matching rule information for the task whose target type is the application target type, and then send a simulated attack to the target address corresponding to the application target; After launching the attack, first determine whether the response packet is received. If no response packet is received, the attack is considered to have failed and the result is blocked. Secondly, if the response packet is not empty, determine whether there is a matching rule. If there is a matching rule, determine whether the return status code, return Header information, and return Body information in the response packet are consistent with the information in the matching rule. If they are consistent, it is determined that the request has been intercepted by the WAF device, the attack has failed, and the result is blocked. If at least one match is inconsistent, it is determined that the request has not been detected by the WAF device, the attack is successful, and the result is not intercepted. If there is no matching rule, the attack is considered successful and the result is not blocked.

8. A network security verification system compatible with application targets according to claim 7, characterized in that: It also includes an intelligent matching module, which is used to perform WAF device detection and scanning on the target when the matching rule associated with the application target is an intelligent matching rule, and determine whether WAF fingerprint information exists based on the response packet. If WAF fingerprint information exists, the return status code, return Header information, return Body information and WAF fingerprint information of the response packet are extracted to generate matching rules.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of a network security verification method for a compatible application target according to any one of claims 1 to 6 are implemented.

Images