Vulnerability verification method and device, equipment, medium and program product

Abstract

The invention relates to the technical field of network security, and discloses a vulnerability verification method, device and equipment, a medium and a program product. The method comprises the following steps: performing asset identification on a target object according to a preset fingerprint extraction rule to obtain asset fingerprint features; searching from a vulnerability verification script library to obtain a target vulnerability verification script matched with the asset fingerprint feature; and performing vulnerability verification on the target object by adopting the target vulnerability verification script to obtain a vulnerability verification result. According to the scheme of the embodiment, the asset identification is performed based on the preset fingerprint extraction rule, and the vulnerability verification script is screened according to the asset fingerprint features, so that the association degree of the network assets and the vulnerability verification script can be improved, and efficient vulnerability verification of different types of network assets can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability verification method, device, equipment, medium and program product. Background Art

[0002] A proof of concept (POC) is a piece of program code that proves the existence of a vulnerability and demonstrates its impact in a real environment. When researchers or security experts discover a vulnerability in a program, software, or system, they will write a POC to prove the existence of the vulnerability.

[0003] At present, the existing POC vulnerability verification method, due to the insufficient correlation between POC and assets, can only execute the matching POC according to the default port screening when conducting POC-based vulnerability scanning. It has great limitations and it is difficult to realize vulnerability verification of different types of network assets. Summary of the invention

[0004] The present invention provides a vulnerability verification method, device, equipment, medium and program product, which can improve the correlation between network assets and vulnerability verification scripts and realize efficient vulnerability verification of different types of network assets.

[0005] According to one aspect of the present invention, a vulnerability verification method is provided, comprising:

[0006] Perform asset identification on the target object according to the preset fingerprint extraction rules to obtain asset fingerprint features;

[0007] Searching for a target vulnerability verification script that matches the asset fingerprint feature from a vulnerability verification script library;

[0008] The target vulnerability verification script is used to perform vulnerability verification on the target object to obtain a vulnerability verification result.

[0009] Optionally, before performing asset identification on the target object according to the preset fingerprint extraction rule to obtain the asset fingerprint feature, the following steps are further included:

[0010] According to the configuration operation of the fingerprint extraction rule in the rule configuration page, the rule configuration information is obtained, and according to the rule configuration information, the preset fingerprint extraction rule is generated.

[0011] Optionally, the rule configuration information includes at least one of a rule name, a manufacturer name, a brand name, a device model, a version identifier, a protocol type, and a port number.

[0012] Optionally, the technical solution of this embodiment further includes:

[0013] According to the configuration operation of the vulnerability verification script in the script configuration page, the script configuration information is obtained;

[0014] Generate a vulnerability verification program according to the script configuration information, and filter the executable instructions in the vulnerability verification program based on a preset blacklist to obtain a vulnerability verification script;

[0015] A vulnerability verification script library is established according to the vulnerability verification script.

[0016] Optionally, using the target vulnerability verification script to perform vulnerability verification on the target object to obtain a vulnerability verification result includes:

[0017] According to the target vulnerability verification script, the request data is sent to the target object in hexadecimal format through a preset protocol payload;

[0018] Receive response data corresponding to the request data sent by the target object, and obtain the vulnerability verification result corresponding to the target object according to the response data.

[0019] Optionally, the type of the response data includes visible characters, hexadecimal data and / or error information.

[0020] According to another aspect of the present invention, there is provided a vulnerability verification device, comprising:

[0021] The asset identification module is used to identify the assets of the target object according to the preset fingerprint extraction rules and obtain the asset fingerprint features;

[0022] A script search module, used to search for a target vulnerability verification script that matches the asset fingerprint feature from a vulnerability verification script library;

[0023] The vulnerability verification module is used to use the target vulnerability verification script to perform vulnerability verification on the target object and obtain a vulnerability verification result.

[0024] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0025] at least one processor; and

[0026] a memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vulnerability verification method described in any embodiment of the present invention.

[0028] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a processor to implement the vulnerability verification method described in any embodiment of the present invention when executed.

[0029] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the vulnerability verification method according to any embodiment of the present invention is implemented.

[0030] The technical solution of the embodiment of the present invention performs asset identification on the target object according to preset fingerprint extraction rules to obtain asset fingerprint characteristics; searches for a target vulnerability verification script that matches the asset fingerprint characteristics from a vulnerability verification script library; uses the target vulnerability verification script to perform vulnerability verification on the target object to obtain a vulnerability verification result; performs asset identification based on preset fingerprint extraction rules and screens the vulnerability verification script according to the asset fingerprint characteristics, thereby improving the correlation between network assets and vulnerability verification scripts, and realizing efficient vulnerability verification of different types of network assets.

[0031] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 is a flow chart of a vulnerability verification method provided according to Embodiment 1 of the present invention;

[0034] Figure 2 is a structural diagram of a vulnerability verification device provided according to Embodiment 2 of the present invention;

[0035] Figure 3 It is a schematic diagram of the structure of an electronic device for implementing the vulnerability verification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "first", "second", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] Embodiment 1

[0039] Figure 1 A flowchart of a vulnerability verification method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of performing a customized POC test based on asset mapping. The method can be executed by a vulnerability verification device, which can be implemented in the form of hardware and / or software. Typically, the vulnerability verification device can be configured in an electronic device, such as a computer device or a server. Figure 1 As shown, the method includes:

[0040] S110: Perform asset identification on the target object according to preset fingerprint extraction rules to obtain asset fingerprint features.

[0041] The preset fingerprint extraction rule may be a fingerprint feature extraction rule that is visually customized by the user. In this embodiment, the user may set various key fields of the fingerprint extraction rule in the front-end page to create the fingerprint extraction rule. The target object may include a device class and a network class. The network class may include a website, an application, a small program, etc., and the device class may include a router, a switch, a gateway, a firewall, etc.

[0042] Specifically, when performing asset identification, fingerprint features of the target object can be extracted according to preset fingerprint extraction rules to obtain field values ​​corresponding to each key field, and each key field and the corresponding field value can be used as the asset fingerprint feature of the target object.

[0043] Optionally, before performing asset identification on the target object according to the preset fingerprint extraction rule to obtain the asset fingerprint feature, the following may also be included:

[0044] According to the configuration operation of the fingerprint extraction rule in the rule configuration page, the rule configuration information is obtained, and according to the rule configuration information, the preset fingerprint extraction rule is generated.

[0045] The rule configuration information may include at least one of the rule name, manufacturer name, brand name, device model, version identifier, protocol type, and port number. It should be noted that the rule configuration information may also include key fields such as message header, message body, and description information, and the user may make adaptive adjustments as needed. For example, the key fields may be os, port, protocol, banner, header, title, body, and device.

[0046] In this embodiment, the user is supported to visually customize the fingerprint extraction rules through the front-end page. Specifically, the user can select the New Rule button in the rule configuration page, and can set the key fields in the rule configuration information in the newly added page to create a preset fingerprint extraction rule.

[0047] S120: Search for a target vulnerability verification script that matches the asset fingerprint feature from a vulnerability verification script library.

[0048] The vulnerability verification script library may include multiple vulnerability verification scripts, and the vulnerability verification scripts match the asset fingerprint features. For example, asset fingerprint feature 1 is manufacturer name A, brand name B, device model C, and version identifier D, corresponding to vulnerability verification script 1. The vulnerability verification script may include vulnerability scanning scripts and vulnerability attack scripts, which are used for vulnerability scanning verification and vulnerability attack verification, respectively.

[0049] In this embodiment, the operation and maintenance personnel can use a visual method to customize the vulnerability verification scripts corresponding to different vulnerabilities and add one or more test items to them, or they can directly collect existing vulnerability verification scripts from the network; then, a mapping relationship between the vulnerability verification scripts and the asset fingerprint features can be established, thereby establishing a vulnerability verification script library.

[0050] In this embodiment, after the asset fingerprint feature is identified, the target vulnerability verification script matching the current asset fingerprint feature can be found based on the mapping relationship between the pre-established vulnerability verification script and the asset fingerprint feature. Specifically, it can be determined whether the current asset fingerprint feature matches the preset asset fingerprint feature corresponding to each vulnerability verification script. If it is detected that the current asset fingerprint feature successfully matches the preset asset fingerprint feature corresponding to a vulnerability verification script, the detected vulnerability verification script can be determined as the target vulnerability verification script.

[0051] Among them, the logical operator && or || can be set to determine whether two asset fingerprint features match. If the logical operator && is used, the two asset fingerprint features can only be determined to match when the field values ​​of all key fields of the two asset fingerprint features are detected to be the same. If the logical operator || is used, the two asset fingerprint features can be determined to match as long as the field value of a key field between the two asset fingerprint features is detected to be the same.

[0052] S130: Use the target vulnerability verification script to perform vulnerability verification on the target object to obtain a vulnerability verification result.

[0053] Specifically, the operating environment of the target vulnerability verification script can be determined and configured; then, the target vulnerability verification script can be executed in the operating environment to interact with the target object, and the existence and impact of the vulnerability can be verified according to the data interaction process, thereby obtaining the vulnerability verification result. The vulnerability verification result may include whether the vulnerability exists, vulnerability description information, target object error information, etc.

[0054] Optionally, performing vulnerability verification on the target object using the target vulnerability verification script to obtain a vulnerability verification result may include:

[0055] According to the target vulnerability verification script, the request data is sent to the target object in hexadecimal format through a preset protocol payload;

[0056] Receive response data corresponding to the request data sent by the target object, and obtain the vulnerability verification result corresponding to the target object according to the response data.

[0057] The preset protocols may include the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

[0058] In this embodiment, when performing vulnerability verification, the target vulnerability verification script can be run, the request can be executed through the TCP / UDP payload, the request data packet can be sent in hexadecimal, and the industrial control protocol (such as Modbus, IEC104, S7, etc.) and the application service protocol (such as SMB, SSH, SNMP, SMTP, etc.) can be scanned and verified. When the response data of the target object is received, the response data can be parsed to obtain the vulnerability verification result.

[0059] Among them, the type of response data may include visible characters, hexadecimal data and / or error information. In this embodiment, the user can set the matching items and corresponding response matching domain information for each test item in the vulnerability verification script, so as to configure the type of response data. For example, the user can select the current response data type from recv_data (visible characters of response data), recv_data_hex (hexadecimal response data) and error (error information). After the user completes the configuration, when executing the vulnerability verification, the response data fed back by the target object is the type configured by the user. It should be noted that the user can choose a certain type of response data, or a combination of multiple types of response data.

[0060] Optionally, after receiving the response data of the target object, you can first process the response data through regular, ==, >=, <=, >, < and other matching methods to obtain the processed response data, and then obtain the vulnerability verification result based on the processed response data.

[0061] The advantage of the above setting is that it can avoid the problem that the existing visual POC only supports Hypertext Transfer Protocol or Hypertext Transfer Security Protocol, cannot scan industrial control protocols and application service protocols, and has large application limitations, and can improve the scalability of vulnerability verification.

[0062] The technical solution of the embodiment of the present invention performs asset identification on the target object according to preset fingerprint extraction rules to obtain asset fingerprint characteristics; searches for a target vulnerability verification script that matches the asset fingerprint characteristics from a vulnerability verification script library; uses the target vulnerability verification script to perform vulnerability verification on the target object to obtain a vulnerability verification result; performs asset identification based on preset fingerprint extraction rules and screens the vulnerability verification script according to the asset fingerprint characteristics, thereby improving the correlation between network assets and vulnerability verification scripts, and realizing efficient vulnerability verification of different types of network assets.

[0063] In an optional implementation of this embodiment, the technical solution of this embodiment may further include:

[0064] According to the configuration operation of the vulnerability verification script in the script configuration page, the script configuration information is obtained;

[0065] Generate a vulnerability verification program according to the script configuration information, and filter the executable instructions in the vulnerability verification program based on a preset blacklist to obtain a vulnerability verification script;

[0066] A vulnerability verification script library is established according to the vulnerability verification script.

[0067] In this embodiment, a new POC can be created on the script configuration page by using a visual parameter configuration method. The user only needs to enter the parameter value corresponding to each parameter item, and the client can automatically compile the script configuration information set by the user into the corresponding vulnerability verification program. Among them, the script configuration information may include effect judgment method, request protocol, matching item, matching domain, custom variable, target Internet Protocol address, target port, scan result, scan details, etc. The effect judgment method may include hit response matching condition, denial of service and user self-judgment, etc.

[0068] Secondly, for the visual custom parameters in the vulnerability verification program, the default whitelist can be trusted, and the vulnerability verification program can be screened by blacklist to filter executable instructions. Specifically, a blacklist can be established in advance, for example, the blacklist can include executable instructions such as exe, dll, bat, etc.; before saving the custom POC, the vulnerability verification program is automatically filtered according to the blacklist to filter out executable instructions, and finally the vulnerability verification script is obtained.

[0069] The advantage of the above settings is that it can ensure the security of the POC script, improve the security of vulnerability verification, and reduce the network security risks brought by executing the POC script.

[0070] Optionally, after establishing a custom POC, you can also configure the Internet Protocol address of the target host, select the port to be scanned, and run the custom POC for vulnerability scanning and verification to ensure the effectiveness of the custom POC.

[0071] The technical solution of the embodiment of the present invention can automatically, quickly and securely realize asset identification, vulnerability scanning and verification from multiple angles through customized fingerprint extraction rules for asset identification, customized TCP / UDP payload scanning and verification of multiple protocols, and visual customized parameters converted into scripts for security filtering, which can effectively improve the accuracy and scalability of asset identification and vulnerability verification, and can improve the security of scanning and verification scripts.

[0072] Embodiment 2

[0073] Figure 2 This is a schematic diagram of the structure of a vulnerability verification device provided by Embodiment 2 of the present invention. Figure 2As shown, the device includes: an asset identification module 210, a script search module 220 and a vulnerability verification module 230; wherein,

[0074] The asset identification module 210 is used to identify the assets of the target object according to the preset fingerprint extraction rules and obtain the asset fingerprint features;

[0075] The script search module 220 is used to search for a target vulnerability verification script that matches the asset fingerprint feature from a vulnerability verification script library;

[0076] The vulnerability verification module 230 is used to perform vulnerability verification on the target object using the target vulnerability verification script to obtain a vulnerability verification result.

[0077] The technical solution of the embodiment of the present invention performs asset identification on the target object according to preset fingerprint extraction rules to obtain asset fingerprint characteristics; searches for a target vulnerability verification script that matches the asset fingerprint characteristics from a vulnerability verification script library; uses the target vulnerability verification script to perform vulnerability verification on the target object to obtain a vulnerability verification result; performs asset identification based on preset fingerprint extraction rules and screens the vulnerability verification script according to the asset fingerprint characteristics, thereby improving the correlation between network assets and vulnerability verification scripts, and realizing efficient vulnerability verification of different types of network assets.

[0078] Optionally, the vulnerability verification device also includes:

[0079] The rule configuration module is used to obtain rule configuration information according to the configuration operation of the fingerprint extraction rule in the rule configuration page, and generate a preset fingerprint extraction rule according to the rule configuration information.

[0080] Optionally, the rule configuration information includes at least one of a rule name, a manufacturer name, a brand name, a device model, a version identifier, a protocol type, and a port number.

[0081] Optionally, the vulnerability verification device also includes:

[0082] The script configuration module is used to obtain script configuration information according to the configuration operation of the vulnerability verification script in the script configuration page;

[0083] A program filtering module, used to generate a vulnerability verification program according to the script configuration information, and filter the executable instructions in the vulnerability verification program based on a preset blacklist to obtain a vulnerability verification script;

[0084] The script library establishment module is used to establish a vulnerability verification script library according to the vulnerability verification script.

[0085] Optionally, the vulnerability verification module 230 is specifically used to send request data to the target object in hexadecimal format through a preset protocol payload according to the target vulnerability verification script;

[0086] Receive response data corresponding to the request data sent by the target object, and obtain the vulnerability verification result corresponding to the target object according to the response data.

[0087] Optionally, the type of the response data includes visible characters, hexadecimal data and / or error information.

[0088] The vulnerability verification device provided in the embodiment of the present invention can execute the vulnerability verification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0089] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0090] Embodiment 3

[0091] Figure 3 A schematic diagram of the structure of an electronic device 30 that can be used to implement an embodiment of the present invention is shown. The electronic device 30 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0092] like Figure 3 As shown, the electronic device 30 includes at least one processor 31, and a memory connected to the at least one processor 31, such as a read-only memory (ROM) 32, a random access memory (RAM) 33, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 31 can perform various appropriate actions and processes according to the computer program stored in the read-only memory 32 or the computer program loaded from the storage unit 38 to the random access memory 33. In the RAM 33, various programs and data required for the operation of the electronic device 30 can also be stored. The processor 31, the ROM 32 and the RAM 33 are connected to each other through a bus 34. The input / output (I / O) interface 35 is also connected to the bus 34.

[0093] A number of components in the electronic device 30 are connected to the I / O interface 35, including: an input unit 36, such as a keyboard, a mouse, etc.; an output unit 37, such as various types of displays, speakers, etc.; a storage unit 38, such as a disk, an optical disk, etc.; and a communication unit 39, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 39 allows the electronic device 30 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0094] The processor 31 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 31 include, but are not limited to, a central processing unit, a graphics processing unit, various special artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any appropriate processors, controllers, microcontrollers, etc. The processor 31 executes the various methods and processes described above, such as the vulnerability verification method.

[0095] In some embodiments, the vulnerability verification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 30 via the ROM 32 and / or the communication unit 39. When the computer program is loaded into the RAM 33 and executed by the processor 31, one or more steps of the vulnerability verification method described above may be performed. Alternatively, in other embodiments, the processor 31 may be configured to perform the vulnerability verification method in any other appropriate manner (e.g., by means of firmware).

[0096] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays, application specific integrated circuits, application specific standard products, systems on a chip, load programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0097] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0098] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0099] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device 30 having: a display device (e.g., a cathode ray tube or a liquid crystal display) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the electronic device 30. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0100] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area networks, wide area networks, blockchain networks, and the Internet.

[0101] This embodiment may also include a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the vulnerability verification method provided by any embodiment of the present invention.

[0102] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0103] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A vulnerability verification method, characterized in that: include: Perform asset identification on the target object according to the preset fingerprint extraction rules to obtain asset fingerprint features; Searching for a target vulnerability verification script that matches the asset fingerprint feature from a vulnerability verification script library; The target vulnerability verification script is used to perform vulnerability verification on the target object to obtain a vulnerability verification result.

2. The method according to claim 1, characterized in that Before performing asset identification on the target object according to the preset fingerprint extraction rules and obtaining the asset fingerprint features, the following steps are also included: According to the configuration operation of the fingerprint extraction rule in the rule configuration page, the rule configuration information is obtained, and according to the rule configuration information, the preset fingerprint extraction rule is generated.

3. The method according to claim 2, characterized in that The rule configuration information includes at least one of a rule name, a manufacturer name, a brand name, a device model, a version identifier, a protocol type, and a port number.

4. The method according to claim 1, characterized in that: Also includes: According to the configuration operation of the vulnerability verification script in the script configuration page, the script configuration information is obtained; Generate a vulnerability verification program according to the script configuration information, and filter the executable instructions in the vulnerability verification program based on a preset blacklist to obtain a vulnerability verification script; A vulnerability verification script library is established according to the vulnerability verification script.

5. The method according to claim 1, characterized in that Using the target vulnerability verification script to perform vulnerability verification on the target object to obtain vulnerability verification results, including: According to the target vulnerability verification script, the request data is sent to the target object in hexadecimal format through a preset protocol payload; Receive response data corresponding to the request data sent by the target object, and obtain the vulnerability verification result corresponding to the target object according to the response data.

6. The method according to claim 5, characterized in that The types of the response data include visible characters, hexadecimal data and / or error information.

7. A vulnerability verification device, characterized in that: include: The asset identification module is used to identify the assets of the target object according to the preset fingerprint extraction rules and obtain the asset fingerprint features; A script search module, used to search for a target vulnerability verification script that matches the asset fingerprint feature from a vulnerability verification script library; The vulnerability verification module is used to use the target vulnerability verification script to perform vulnerability verification on the target object and obtain a vulnerability verification result.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor, and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the vulnerability verification method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to enable a processor to implement the vulnerability verification method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that It comprises a computer program, which implements the vulnerability verification method according to any one of claims 1 to 6 when executed by a processor.

Images