Penetration testing method, device and equipment and storage medium
By acquiring and processing structured vulnerability data and generating vulnerability test cases, the problems of penetration testing accuracy and inefficiency are solved, and the cost reduction effect is achieved.
Patent Information
- Application Number
- CN202310783807.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-29
- Publication Date
- 2024-12-31
AI Technical Summary
The accuracy and efficiency of existing penetration testing technologies lead to higher costs.
By obtaining target structured vulnerability data, generating corresponding vulnerability test cases, and penetration test objects to be tested based on these use cases, using preset test requirements description language rules and static program analysis strategies for data flow and control flow analysis, generating structure Develop vulnerability data and vulnerability databases, filter and map CVE and CNNVD fields, and build test requirements models to generate vulnerability test cases.
Improves the accuracy and efficiency of penetration testing and reduces testing costs.
Smart Images
Figure CN119227068A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of automated testing technology, and in particular to a penetration testing method, device, equipment and storage medium. Background Art
[0002] With the rapid development of Internet technology, network security incidents occur frequently. Hackers use security vulnerabilities to attack clients, servers, databases and other fields, resulting in security issues such as user information loss, web page tampering and permanent data destruction, causing serious losses to users. In order to ensure the security of the system, it is necessary to conduct penetration testing on the system. The commonly used penetration testing technology currently uses penetration tools or the experience of test engineers. However, the use of penetration tools and manual testing will result in more or less deviations during the penetration testing process, resulting in low accuracy of penetration testing, low efficiency of batch penetration testing and high cost.
[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention
[0004] The main purpose of the present invention is to provide a penetration testing method, device, equipment and storage medium, aiming to solve the technical problems of low accuracy and efficiency of penetration testing in the prior art, resulting in high penetration testing costs.
[0005] To achieve the above object, the present invention provides a penetration testing method, which comprises the following steps:
[0006] Obtain target structured vulnerability data;
[0007] Generate corresponding vulnerability test cases according to the target structured vulnerability data;
[0008] Perform penetration testing on the test object according to the vulnerability test cases.
[0009] Optionally, obtaining target structured vulnerability data includes:
[0010] Obtain a current vulnerability database, traverse the current vulnerability database, and obtain each vulnerability data;
[0011] Structuring the various vulnerability data according to a preset field structuring standard to obtain structured vulnerability data;
[0012] Storing the structured vulnerability data in the current vulnerability database;
[0013] The target structured vulnerability data is obtained according to the current vulnerability database after storing the structured vulnerability data.
[0014] Optionally, obtaining the current vulnerability database includes:
[0015] During the operation of the object to be tested, obtaining current program operation data;
[0016] Performing data flow analysis on the current program running data using a preset static program analysis strategy;
[0017] Performing control flow analysis on the current program running data using a preset static program analysis strategy;
[0018] Scan the data flow analysis results and control flow analysis results according to the preset vulnerability scanning strategy;
[0019] Generate a current vulnerability database based on the scan results.
[0020] Optionally, generating a current vulnerability database according to the scanning result includes:
[0021] Obtain vulnerability data of the object to be tested based on the scanning results;
[0022] Obtain the CVE field and CNNVD field according to the preset field structure standard;
[0023] Mapping the vulnerability data of the object to be tested to at least the CVE field and the CNNVD field;
[0024] The CVE field and CNNVD field of the mapped vulnerability data are stored to generate a current vulnerability database.
[0025] Optionally, obtaining target structured vulnerability data according to the current vulnerability database after storing the structured vulnerability data includes:
[0026] Scan the test object to obtain the target open ports and target open running services;
[0027] Filtering the current vulnerability database after storing the structured vulnerability data through the target open port;
[0028] The filtered current vulnerability database is filtered again through the target open operation service;
[0029] The current vulnerability database after re-filtering is filtered according to the limiting conditions set by the user to obtain the target structured vulnerability data.
[0030] Optionally, after filtering the filtered current vulnerability database again through the target open operation service, the method further includes:
[0031] Get asset vulnerability data based on the scan results;
[0032] The asset vulnerability data is used to filter the current vulnerability database after filtering again.
[0033] Optionally, generating a corresponding vulnerability test case according to the target structured vulnerability data includes:
[0034] The target structured vulnerability data is converted according to a preset test requirement description language rule to obtain a test requirement description script;
[0035] Constructing a test requirement visual modeling environment, and building a test requirement model in the test requirement visual modeling environment;
[0036] The test requirement model is used to generate corresponding vulnerability test cases according to the target structured vulnerability data.
[0037] Optionally, performing a penetration test on the test object according to the vulnerability test case includes:
[0038] Traversing the vulnerability test cases to obtain a number of vulnerability test cases;
[0039] Obtaining a corresponding vulnerability testing process according to the plurality of vulnerability testing cases;
[0040] Execute the plurality of vulnerability test cases according to the vulnerability test process to complete the penetration test on the object to be tested.
[0041] Optionally, executing the plurality of vulnerability test cases according to the vulnerability test process includes:
[0042] Get penetration testing rules;
[0043] Sorting a number of vulnerability test cases according to the penetration test rules to obtain a target penetration test sequence;
[0044] Execute the several number of vulnerability test cases according to the target penetration test sequence and vulnerability test process.
[0045] Optionally, after performing a penetration test on the test object according to the vulnerability test case, the method further includes:
[0046] Monitor in real time whether the session shell of the object to be tested is obtained;
[0047] When the session shell of the object to be tested is not obtained, the penetration test of the object to be tested continues;
[0048] When the session shell of the object to be tested is obtained, the penetration test of the object to be tested is stopped, and the residual traces of the test process are cleared.
[0049] In addition, to achieve the above-mentioned purpose, the present invention also provides a penetration testing device, which comprises:
[0050] The acquisition module is used to obtain the target structured vulnerability data;
[0051] A generation module, used to generate corresponding vulnerability test cases according to the target structured vulnerability data;
[0052] The testing module is used to perform penetration testing on the test object according to the vulnerability test case.
[0053] Optionally, the acquisition module is also used to obtain a current vulnerability database, traverse the current vulnerability database to obtain various vulnerability data; structure the various vulnerability data according to a preset field structuring standard to obtain structured vulnerability data; store the structured vulnerability data in the current vulnerability database; and obtain target structured vulnerability data based on the current vulnerability database after storing the structured vulnerability data.
[0054] Optionally, the acquisition module is also used to obtain current program running data during the operation of the object to be tested; perform data flow analysis on the current program running data through a preset static program analysis strategy; perform control flow analysis on the current program running data through a preset static program analysis strategy; scan the data flow analysis results and the control flow analysis results according to a preset vulnerability scanning strategy; and generate a current vulnerability database based on the scanning results.
[0055] Optionally, the acquisition module is also used to obtain vulnerability data of the object to be tested based on the scanning results; obtain CVE fields and CNNVD fields according to preset field structuring standards; map the vulnerability data of the object to be tested to at least the CVE fields and CNNVD fields; and store the CVE fields and CNNVD fields of the mapped vulnerability data to generate a current vulnerability database.
[0056] Optionally, the acquisition module is also used to scan the test object to obtain the target open port and the target open running service; filter the current vulnerability database after storing the structured vulnerability data through the target open port; filter the filtered current vulnerability database again through the target open running service; filter the current vulnerability database after re-filtering according to the limiting conditions set by the user to obtain the target structured vulnerability data.
[0057] Optionally, the generation module is also used to convert the target structured vulnerability data according to preset test requirement description language rules to obtain a test requirement description script; construct a test requirement visual modeling environment, and build a test requirement model in the test requirement visual modeling environment; and generate corresponding vulnerability test cases according to the target structured vulnerability data through the test requirement model.
[0058] Optionally, the testing module is further used to traverse the vulnerability test cases to obtain a number of vulnerability test cases; obtain a corresponding vulnerability testing process based on the number of vulnerability test cases; and execute the number of vulnerability test cases according to the vulnerability testing process to complete the penetration test of the test object.
[0059] Optionally, the test module is also used to obtain penetration test rules; sort a number of vulnerability test cases according to the penetration test rules to obtain a target penetration test sequence; and execute the number of vulnerability test cases according to the target penetration test sequence and the vulnerability test process.
[0060] In addition, to achieve the above-mentioned purpose, the present invention also proposes a penetration testing device, which includes: a memory, a processor, and a penetration testing program stored in the memory and executable on the processor, wherein the penetration testing program is configured to implement the penetration testing method described above.
[0061] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a penetration testing program is stored, and when the penetration testing program is executed by a processor, the penetration testing method as described above is implemented.
[0062] The penetration testing method proposed in the present invention obtains target structured vulnerability data; generates corresponding vulnerability test cases according to the target structured vulnerability data; and performs penetration testing on the test object according to the vulnerability test cases. In the above manner, the target structured vulnerability data is used to generate corresponding vulnerability test cases, and the penetration testing is performed on the test object according to the vulnerability test cases, thereby effectively improving the accuracy and efficiency of the penetration testing and reducing the cost of the penetration testing. BRIEF DESCRIPTION OF THE DRAWINGS
[0063] Figure 1 It is a structural diagram of a penetration testing device for a hardware operating environment involved in an embodiment of the present invention;
[0064] Figure 2 It is a schematic diagram of the flow chart of the first embodiment of the penetration testing method of the present invention;
[0065] Figure 3It is a schematic diagram of the overall process of an embodiment of a penetration testing method of the present invention;
[0066] Figure 4 It is a flow chart of the second embodiment of the penetration testing method of the present invention;
[0067] Figure 5 It is a flow chart of the third embodiment of the penetration testing method of the present invention;
[0068] Figure 6 This is a schematic diagram of the functional modules of the first embodiment of the penetration testing device of the present invention.
[0069] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0070] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0071] Reference Figure 1 , Figure 1 A schematic diagram of the structure of a penetration testing device for a hardware operating environment according to an embodiment of the present invention.
[0072] like Figure 1 As shown, the penetration testing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.
[0073] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation of the penetration testing equipment, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.
[0074] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a penetration testing program.
[0075] exist Figure 1 In the penetration testing device shown, the network interface 1004 is mainly used for data communication with the network integration platform workstation; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the penetration testing device of the present invention can be set in the penetration testing device, and the penetration testing device calls the penetration testing program stored in the memory 1005 through the processor 1001, and executes the penetration testing method provided by the embodiment of the present invention.
[0076] Based on the above hardware structure, an embodiment of the penetration testing method of the present invention is proposed.
[0077] Reference Figure 2 , Figure 2 Schematic diagram of the first embodiment of the penetration testing method of the present invention.
[0078] In a first embodiment, the penetration testing method comprises the following steps:
[0079] Step S10, obtaining target structured vulnerability data.
[0080] It should be noted that the executor of this embodiment is a penetration testing device, and may also be other devices that can achieve the same or similar functions, such as a penetration testing system, etc. This embodiment does not limit this. In this embodiment, the penetration testing system is taken as an example for description.
[0081] It should be understood that the target structured vulnerability data refers to vulnerability data used for penetration testing and conforming to structured standards, and the target structured vulnerability data is obtained through structuring, filtering and other processing operations.
[0082] Step S20: Generate corresponding vulnerability test cases according to the target structured vulnerability data.
[0083] It can be understood that a vulnerability test case refers to a case used for penetration testing, which is generated based on target structured vulnerability data, and the number of vulnerability test users can be multiple.
[0084] Further, step S20 includes: converting the target structured vulnerability data according to preset test requirement description language rules to obtain a test requirement description script; constructing a test requirement visual modeling environment, and building a test requirement model in the test requirement visual modeling environment; generating corresponding vulnerability test cases according to the target structured vulnerability data through the test requirement model.
[0085] It should be understood that the preset test requirement description language rules refer to the language rules for converting the data required to generate test cases into the corresponding description scripts, and the test requirement visual modeling environment refers to the environment for constructing the test requirement model. After constructing the test requirement visual modeling environment, the test requirement model is constructed in the test requirement visual modeling environment according to the historical test requirement description scripts and the corresponding vulnerability test cases, and then the target structured vulnerability data is output to the test requirement model, and the test requirement model outputs the corresponding vulnerability test cases.
[0086] Step S30: performing a penetration test on the test object according to the vulnerability test case.
[0087] It should be understood that after obtaining the vulnerability test case, the penetration test of the object to be tested is implemented by traversing and executing the vulnerability test case, and the object to be tested may be a security system or application to be tested.
[0088] Further, step S30 includes: real-time monitoring whether the session shell of the object to be tested is obtained; when the session shell of the object to be tested is not obtained, continuing the penetration test of the object to be tested; when the session shell of the object to be tested is obtained, stopping the penetration test of the object to be tested, and clearing the residual traces in the test process.
[0089] It can be understood that the session shell refers to the condition used to determine whether it is necessary to continue the penetration test. After executing all vulnerability test cases, it is monitored in real time whether the session shell of the object to be tested is received. If not, it is necessary to continue the penetration test on the object to be tested using the above-mentioned penetration test method. If not, the penetration test of the object to be tested is stopped, and the residual traces of the test process are cleared. The residual traces include but are not limited to network traces and logs, and the network traces can be covered and cleared using a multi-layer proxy or an auxiliary proxy chain tool. The log can be deleted using a combination of system format and file to achieve the purpose of clearing the traces.
[0090] It should be understood that reference Figure 3 , Figure 3This is a schematic diagram of the overall process, which is as follows: first, clear the current vulnerability database to filter out errors, defects and other data, then scan and identify the test object to obtain the target open port and target open running service, and then filter the current vulnerability database by the target open port, target open running service, asset vulnerability data and user-set limiting conditions. After the filtering is completed, the target structured vulnerability data is obtained, and the corresponding vulnerability test case is generated according to the target structured vulnerability data. The vulnerability test case is used to perform a penetration test on the test object, and it is monitored in real time whether a session shell is received. If so, the penetration test is stopped, otherwise, the penetration test continues.
[0091] This embodiment obtains target structured vulnerability data; generates corresponding vulnerability test cases according to the target structured vulnerability data; and performs penetration testing on the test object according to the vulnerability test cases. In the above manner, the target structured vulnerability data is used to generate corresponding vulnerability test cases, and penetration testing is performed on the test object according to the vulnerability test cases, thereby effectively improving the accuracy and efficiency of penetration testing and reducing the cost of penetration testing.
[0092] In one embodiment, if Figure 4 Based on the first embodiment, a second embodiment of the penetration testing method of the present invention is proposed, wherein step S10 includes:
[0093] Step S101, obtaining a current vulnerability database, traversing the current vulnerability database, and obtaining various vulnerability data.
[0094] It should be understood that the current vulnerability database refers to a database composed of various vulnerability data. After the current vulnerability database is obtained, various vulnerability data in the current vulnerability database are traversed.
[0095] Further, step S101 includes: during the operation of the object to be tested, obtaining the current program running data; performing data flow analysis on the current program running data through a preset static program analysis strategy; performing control flow analysis on the current program running data through a preset static program analysis strategy; scanning the data flow analysis results and the control flow analysis results according to a preset vulnerability scanning strategy; and generating a current vulnerability database according to the scanning results.
[0096] It can be understood that the current program running data refers to the running data of the object to be tested during the running process. When the object to be tested is an application, the current program running data is the running data of the application. When the object to be tested is multiple applications, the current program running data is the running data of multiple applications. The preset static program analysis strategy refers to a strategy for analyzing program running data in a static manner. The preset static program analysis strategy is used to analyze the current program running data in different dimensions, which dimensions include but are not limited to data flow and control flow. The preset vulnerability scanning strategy refers to a strategy for scanning vulnerability data, specifically scanning the data flow analysis results and the control flow analysis results through the preset vulnerability scanning strategy.
[0097] Furthermore, the generating of the current vulnerability database according to the scanning results includes: obtaining vulnerability data of the object to be tested according to the scanning results; obtaining CVE fields and CNNVD fields according to preset field structuring standards; mapping the vulnerability data of the object to be tested to at least the CVE fields and CNNVD fields; and storing the CVE fields and CNNVD fields of the mapped vulnerability data to generate the current vulnerability database.
[0098] It should be understood that vulnerability data refers to the data corresponding to the vulnerabilities that exist in the object to be tested during operation. The CVE field and the CNNVD field are both fields belonging to the structured standard. The vulnerability data is then mapped to at least the CVE field and the CNNVD field, and then the CVE field and the CNNVD field that map the vulnerability data are stored. After the storage is completed, the current vulnerability database is generated.
[0099] Step S102, structuring the various vulnerability data according to a preset field structuring standard to obtain structured vulnerability data.
[0100] It can be understood that the preset field structuring standard includes but is not limited to the target open port, the target open running service, the CVE field and the CNNVD field. The preset field structuring standard is pre-defined by the vulnerability description. After obtaining each vulnerability data, each vulnerability data is structured and processed according to the preset field structuring standard to obtain structured vulnerability data.
[0101] Step S103: storing the structured vulnerability data in the current vulnerability database.
[0102] Step S104, obtaining target structured vulnerability data according to the current vulnerability database after storing the structured vulnerability data.
[0103] It should be understood that after the structured vulnerability data is stored, the current vulnerability database includes target structured data and non-target structured data, and then the target structured data is filtered out from the current vulnerability database.
[0104] Further, step S104 includes: scanning the test object to obtain the target open port and the target open running service; filtering the current vulnerability database after storing the structured vulnerability data through the target open port; filtering the filtered current vulnerability database again through the target open running service; filtering the current vulnerability database after filtering again through the limiting conditions set by the user to obtain the target structured vulnerability data.
[0105] It should be understood that the target open port and the target open operation service are both fields of the structured standard, which are obtained by scanning and identifying the object to be tested, and then the target open port and the target open operation service are used to filter the current vulnerability database after storing the structured vulnerability data respectively. The limiting condition refers to the condition set by the user for filtering the vulnerability data, that is, the current vulnerability database after re-filtering is filtered according to the limiting condition set by the user to obtain the target structured vulnerability data.
[0106] Furthermore, after filtering the filtered current vulnerability database again through the target open operation service, it also includes: obtaining asset vulnerability data according to the scanning result; and filtering the filtered current vulnerability database again through the asset vulnerability data.
[0107] It is understandable that after obtaining the scan results, asset vulnerability data is extracted from the scan results, and then the asset vulnerability data is used to filter the vulnerability data in the current vulnerability database again.
[0108] This embodiment obtains the current vulnerability database, traverses the current vulnerability database, and obtains various vulnerability data; structures the various vulnerability data according to the preset field structuring standard to obtain structured vulnerability data; stores the structured vulnerability data in the current vulnerability database; obtains target structured vulnerability data according to the current vulnerability database after storing the structured vulnerability data; through the above method, after the various vulnerability data are structured, the structured vulnerability data is stored, and then the current vulnerability database after storing the structured vulnerability data is filtered respectively, so as to effectively improve the accuracy of obtaining the target structured vulnerability data.
[0109] In one embodiment, if Figure 5 Based on the first embodiment, a third embodiment of the penetration testing method of the present invention is proposed, wherein step S30 includes:
[0110] Step S301, traverse the vulnerability test cases to obtain a number of vulnerability test cases.
[0111] It is understandable that there are multiple vulnerability test cases generated from the target structured vulnerability data. After the vulnerability test cases are obtained, a plurality of vulnerability test cases are traversed.
[0112] Step S302: obtaining a corresponding vulnerability testing process according to the plurality of vulnerability testing cases.
[0113] It should be understood that the vulnerability testing process refers to the testing process corresponding to each vulnerability testing case. For example, the vulnerability testing cases include A and B, and the vulnerability testing process of A can be a1→a2→a3, and the vulnerability testing process of B can be b1→b2→b3→b4.
[0114] Step S303: execute the plurality of vulnerability test cases according to the vulnerability test process to complete the penetration test on the object to be tested.
[0115] It can be understood that after obtaining the vulnerability testing process, the corresponding vulnerability test cases are executed according to the vulnerability testing process. After all vulnerability test cases are executed, the penetration test of the test object using the vulnerability data is completed.
[0116] Further, step S303 includes: obtaining penetration test rules; sorting a number of vulnerability test cases according to the penetration test rules to obtain a target penetration test sequence; and executing the number of vulnerability test cases according to the target penetration test sequence and the vulnerability test process.
[0117] It should be understood that penetration testing rules refer to the rules followed in conducting penetration testing. According to the penetration testing rules, the execution order of a number of vulnerability test cases, that is, the target penetration testing order, can be determined. Specifically, the penetration testing rules are used to sort a number of vulnerability test cases, and then the vulnerability test cases are executed according to the target penetration testing order and the vulnerability testing process until all vulnerability test cases are executed. For example, the vulnerability test cases include A and B, and the vulnerability testing process of A can be a1→a2→a3, and the vulnerability testing process of B can be b1→b2→b3→b4, and the target penetration testing order of vulnerability test cases A and B is B→A, so the specific execution process is b1→b2→b3→b4→a1→a2→a3.
[0118] This embodiment obtains a number of vulnerability test cases by traversing the vulnerability test cases; obtains a corresponding vulnerability test process based on the number of vulnerability test cases; executes the number of vulnerability test cases according to the vulnerability test process to complete the penetration test of the object to be tested; through the above method, the vulnerability test cases are traversed, and then the corresponding vulnerability test process is obtained according to the vulnerability test cases, and then all the vulnerability test cases are executed respectively according to the vulnerability test process, thereby effectively improving the accuracy of the penetration test object to be tested.
[0119] In addition, an embodiment of the present invention further proposes a storage medium, on which a penetration testing program is stored. When the penetration testing program is executed by a processor, the steps of the penetration testing method described above are implemented.
[0120] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought by the technical solutions of the above embodiments, which will not be described one by one here.
[0121] In addition, refer to Figure 6 The embodiment of the present invention further provides a penetration testing device, the penetration testing device comprising:
[0122] The acquisition module 10 is used to acquire target structured vulnerability data.
[0123] The generating module 20 is used to generate corresponding vulnerability test cases according to the target structured vulnerability data.
[0124] The testing module 30 is used to perform a penetration test on the test object according to the vulnerability test case.
[0125] This embodiment obtains target structured vulnerability data; generates corresponding vulnerability test cases according to the target structured vulnerability data; and performs penetration testing on the test object according to the vulnerability test cases. In the above manner, the target structured vulnerability data is used to generate corresponding vulnerability test cases, and penetration testing is performed on the test object according to the vulnerability test cases, thereby effectively improving the accuracy and efficiency of penetration testing and reducing the cost of penetration testing.
[0126] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.
[0127] In addition, for technical details not fully described in this embodiment, reference can be made to the penetration testing method provided in any embodiment of the present invention, and will not be repeated here.
[0128] In one embodiment, the acquisition module 10 is also used to obtain a current vulnerability database, traverse the current vulnerability database to obtain various vulnerability data; structure the various vulnerability data according to a preset field structuring standard to obtain structured vulnerability data; store the structured vulnerability data in the current vulnerability database; and obtain target structured vulnerability data based on the current vulnerability database after storing the structured vulnerability data.
[0129] In one embodiment, the acquisition module 10 is also used to obtain the current program running data during the operation of the object to be tested; perform data flow analysis on the current program running data through a preset static program analysis strategy; perform control flow analysis on the current program running data through a preset static program analysis strategy; scan the data flow analysis results and the control flow analysis results according to a preset vulnerability scanning strategy; and generate a current vulnerability database based on the scanning results.
[0130] In one embodiment, the acquisition module 10 is also used to obtain vulnerability data of the object to be tested based on the scanning results; obtain the CVE field and the CNNVD field according to the preset field structuring standard; map the vulnerability data of the object to be tested to at least the CVE field and the CNNVD field; and store the CVE field and the CNNVD field of the mapped vulnerability data to generate a current vulnerability database.
[0131] In one embodiment, the acquisition module 10 is also used to scan the object to be tested to obtain the target open port and the target open running service; filter the current vulnerability database after storing the structured vulnerability data through the target open port; filter the filtered current vulnerability database again through the target open running service; filter the current vulnerability database after filtering again through the limiting conditions set by the user to obtain the target structured vulnerability data.
[0132] In one embodiment, the acquisition module 10 is further used to obtain asset vulnerability data according to the scanning result; and filter the current vulnerability database after re-filtering by using the asset vulnerability data.
[0133] In one embodiment, the generation module 20 is also used to convert the target structured vulnerability data according to preset test requirement description language rules to obtain a test requirement description script; construct a test requirement visual modeling environment, and build a test requirement model in the test requirement visual modeling environment; and generate corresponding vulnerability test cases according to the target structured vulnerability data through the test requirement model.
[0134] In one embodiment, the testing module 30 is further used to traverse the vulnerability test cases to obtain a number of vulnerability test cases; obtain a corresponding vulnerability test process based on the number of vulnerability test cases; and execute the number of vulnerability test cases according to the vulnerability test process to complete the penetration test of the test object.
[0135] In one embodiment, the testing module 30 is also used to obtain penetration testing rules; sort a number of vulnerability test cases according to the penetration testing rules to obtain a target penetration testing sequence; and execute the number of vulnerability test cases according to the target penetration testing sequence and the vulnerability testing process.
[0136] In one embodiment, the testing module 30 is also used to monitor in real time whether the session shell of the object to be tested is obtained; when the session shell of the object to be tested is not obtained, the penetration test of the object to be tested is continued; when the session shell of the object to be tested is obtained, the penetration test of the object to be tested is stopped, and the residual traces of the test process are cleared.
[0137] Other embodiments of the penetration testing device of the present invention or implementation methods thereof may refer to the above-mentioned method embodiments, which will not be repeated here.
[0138] The present invention discloses A1, a penetration testing method, the penetration testing method comprising the following steps:
[0139] Obtain target structured vulnerability data;
[0140] Generate corresponding vulnerability test cases according to the target structured vulnerability data;
[0141] Perform penetration testing on the test object according to the vulnerability test cases.
[0142] A2. The penetration testing method as described in A1, wherein obtaining target structured vulnerability data comprises:
[0143] Obtain a current vulnerability database, traverse the current vulnerability database, and obtain each vulnerability data;
[0144] Structuring the various vulnerability data according to a preset field structuring standard to obtain structured vulnerability data;
[0145] Storing the structured vulnerability data in the current vulnerability database;
[0146] The target structured vulnerability data is obtained according to the current vulnerability database after storing the structured vulnerability data.
[0147] A3. The penetration testing method as described in A2, wherein obtaining the current vulnerability database comprises:
[0148] During the operation of the object to be tested, obtaining current program operation data;
[0149] Performing data flow analysis on the current program running data using a preset static program analysis strategy;
[0150] Performing control flow analysis on the current program running data using a preset static program analysis strategy;
[0151] Scan the data flow analysis results and control flow analysis results according to the preset vulnerability scanning strategy;
[0152] Generate a current vulnerability database based on the scan results.
[0153] A4. The penetration testing method as described in A3, wherein generating a current vulnerability database according to the scanning results comprises:
[0154] Obtain vulnerability data of the object to be tested based on the scanning results;
[0155] Obtain the CVE field and CNNVD field according to the preset field structure standard;
[0156] Mapping the vulnerability data of the object to be tested to at least the CVE field and the CNNVD field;
[0157] The CVE field and CNNVD field of the mapped vulnerability data are stored to generate a current vulnerability database.
[0158] A5. The penetration testing method as described in A2, wherein the target structured vulnerability data is obtained according to the current vulnerability database after storing the structured vulnerability data, comprising:
[0159] Scan the test object to obtain the target open ports and target open running services;
[0160] Filtering the current vulnerability database after storing the structured vulnerability data through the target open port;
[0161] The filtered current vulnerability database is filtered again through the target open operation service;
[0162] The current vulnerability database after re-filtering is filtered according to the limiting conditions set by the user to obtain the target structured vulnerability data.
[0163] A6. The penetration testing method as described in A5, after filtering the filtered current vulnerability database again through the target open operation service, further comprising:
[0164] Get asset vulnerability data based on the scan results;
[0165] The asset vulnerability data is used to filter the current vulnerability database after filtering again.
[0166] A7. The penetration testing method as described in A1, wherein generating corresponding vulnerability test cases according to the target structured vulnerability data comprises:
[0167] The target structured vulnerability data is converted according to a preset test requirement description language rule to obtain a test requirement description script;
[0168] Constructing a test requirement visual modeling environment, and building a test requirement model in the test requirement visual modeling environment;
[0169] The test requirement model is used to generate corresponding vulnerability test cases according to the target structured vulnerability data.
[0170] A8. The penetration testing method as described in A1, wherein the penetration testing is performed on the object to be tested according to the vulnerability test case, comprising:
[0171] Traversing the vulnerability test cases to obtain a number of vulnerability test cases;
[0172] Obtaining a corresponding vulnerability testing process according to the plurality of vulnerability testing cases;
[0173] Execute the plurality of vulnerability test cases according to the vulnerability test process to complete the penetration test on the object to be tested.
[0174] A9. The penetration testing method as described in A8, wherein the step of executing the plurality of vulnerability testing cases according to the vulnerability testing process comprises:
[0175] Get penetration testing rules;
[0176] Sorting a number of vulnerability test cases according to the penetration test rules to obtain a target penetration test sequence;
[0177] Execute the several number of vulnerability test cases according to the target penetration test sequence and vulnerability test process.
[0178] A10. The penetration testing method as described in any one of A1 to A9, after performing the penetration test on the object to be tested according to the vulnerability test case, further comprising:
[0179] Monitor in real time whether the session shell of the object to be tested is obtained;
[0180] When the session shell of the object to be tested is not obtained, the penetration test of the object to be tested continues;
[0181] When the session shell of the object to be tested is obtained, the penetration test of the object to be tested is stopped, and the residual traces of the test process are cleared.
[0182] The present invention discloses B11, a penetration testing device, the penetration testing device comprising:
[0183] The acquisition module is used to obtain the target structured vulnerability data;
[0184] A generation module, used to generate corresponding vulnerability test cases according to the target structured vulnerability data;
[0185] The testing module is used to perform penetration testing on the test object according to the vulnerability test case.
[0186] B12. In the penetration testing device as described in B11, the acquisition module is also used to acquire the current vulnerability database, traverse the current vulnerability database to obtain various vulnerability data; structure the various vulnerability data according to the preset field structuring standard to obtain structured vulnerability data; store the structured vulnerability data in the current vulnerability database; and obtain target structured vulnerability data according to the current vulnerability database after storing the structured vulnerability data.
[0187] B13. In the penetration testing device as described in B12, the acquisition module is also used to obtain the current program running data during the operation of the object to be tested; perform data flow analysis on the current program running data through a preset static program analysis strategy; perform control flow analysis on the current program running data through a preset static program analysis strategy; scan the data flow analysis results and the control flow analysis results according to a preset vulnerability scanning strategy; and generate a current vulnerability database according to the scanning results.
[0188] B14. In the penetration testing device as described in B13, the acquisition module is also used to obtain vulnerability data of the object to be tested based on the scanning results; obtain the CVE field and the CNNVD field according to the preset field structuring standard; map the vulnerability data of the object to be tested to at least the CVE field and the CNNVD field; and store the CVE field and the CNNVD field of the mapped vulnerability data to generate a current vulnerability database.
[0189] B15. In the penetration testing device as described in B14, the acquisition module is further used to scan the test object to obtain the target open port and the target open running service; filter the current vulnerability database after storing the structured vulnerability data through the target open port; filter the filtered current vulnerability database again through the target open running service; filter the current vulnerability database after filtering again through the limiting conditions set by the user to obtain the target structured vulnerability data.
[0190] B16. In the penetration testing device as described in B11, the generation module is further used to convert the target structured vulnerability data according to preset test requirement description language rules to obtain a test requirement description script; construct a test requirement visual modeling environment, and build a test requirement model in the test requirement visual modeling environment; and generate corresponding vulnerability test cases according to the target structured vulnerability data through the test requirement model.
[0191] B17. In the penetration testing device as described in B11, the testing module is further used to traverse the vulnerability testing cases to obtain a number of vulnerability testing cases; obtain a corresponding vulnerability testing process according to the number of vulnerability testing cases; and execute the number of vulnerability testing cases according to the vulnerability testing process to complete the penetration test of the test object.
[0192] B18. In the penetration testing device as described in B17, the testing module is further used to obtain penetration testing rules; sort a number of vulnerability testing cases according to the penetration testing rules to obtain a target penetration testing sequence; and execute the number of vulnerability testing cases according to the target penetration testing sequence and the vulnerability testing process.
[0193] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.
[0194] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.
[0195] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, an integrated platform workstation, or a network device, etc.) to execute the methods described in each embodiment of the present invention.
[0196] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A penetration testing method, characterized in that: The penetration testing method comprises the following steps: Obtain target structured vulnerability data; Generate corresponding vulnerability test cases according to the target structured vulnerability data; Perform penetration testing on the test object according to the vulnerability test cases.
2. The penetration testing method according to claim 1, characterized in that: The obtaining of target structured vulnerability data includes: Obtain a current vulnerability database, traverse the current vulnerability database, and obtain each vulnerability data; Structuring the various vulnerability data according to a preset field structuring standard to obtain structured vulnerability data; Storing the structured vulnerability data in the current vulnerability database; The target structured vulnerability data is obtained according to the current vulnerability database after storing the structured vulnerability data.
3. The penetration testing method according to claim 2, characterized in that: The obtaining of the current vulnerability database includes: During the operation of the object to be tested, obtaining current program operation data; Performing data flow analysis on the current program running data using a preset static program analysis strategy; Performing control flow analysis on the current program running data using a preset static program analysis strategy; Scan the data flow analysis results and control flow analysis results according to the preset vulnerability scanning strategy; Generate a current vulnerability database based on the scan results.
4. The penetration testing method according to claim 3, characterized in that: The generating of the current vulnerability database according to the scanning results includes: Obtain vulnerability data of the object to be tested based on the scanning results; Obtain the CVE field and CNNVD field according to the preset field structure standard; Mapping the vulnerability data of the object to be tested to at least the CVE field and the CNNVD field; The CVE field and CNNVD field of the mapped vulnerability data are stored to generate a current vulnerability database.
5. The penetration testing method according to claim 2, characterized in that: The step of obtaining target structured vulnerability data according to the current vulnerability database after storing the structured vulnerability data includes: Scan the test object to obtain the target open ports and target open running services; Filtering the current vulnerability database after storing the structured vulnerability data through the target open port; The filtered current vulnerability database is filtered again through the target open operation service; The current vulnerability database after re-filtering is filtered according to the limiting conditions set by the user to obtain the target structured vulnerability data.
6. The penetration testing method according to claim 1, wherein: Generating corresponding vulnerability test cases according to the target structured vulnerability data includes: The target structured vulnerability data is converted according to a preset test requirement description language rule to obtain a test requirement description script; Constructing a test requirement visual modeling environment, and building a test requirement model in the test requirement visual modeling environment; The test requirement model is used to generate corresponding vulnerability test cases according to the target structured vulnerability data.
7. The penetration testing method according to claim 1, characterized in that: The performing a penetration test on the test object according to the vulnerability test case comprises: Traversing the vulnerability test cases to obtain a number of vulnerability test cases; Obtaining a corresponding vulnerability testing process according to the plurality of vulnerability testing cases; Execute the plurality of vulnerability test cases according to the vulnerability test process to complete the penetration test on the object to be tested.
8. A penetration testing device, characterized in that: The penetration testing device comprises: The acquisition module is used to obtain the target structured vulnerability data; A generation module, used to generate corresponding vulnerability test cases according to the target structured vulnerability data; The testing module is used to perform penetration testing on the test object according to the vulnerability test case.
9. A penetration testing device, characterized in that: The penetration testing device comprises: a memory, a processor, and a penetration testing program stored in the memory and executable on the processor, wherein the penetration testing program is configured to implement the penetration testing method according to any one of claims 1 to 7.
10. A storage medium, characterized in that: The storage medium stores a penetration testing program, and when the penetration testing program is executed by the processor, the penetration testing method according to any one of claims 1 to 7 is implemented.