Working method of automatic penetration test

Abstract

The invention relates to the technical field of computer network security, and discloses a working method of an automatic penetration test, which comprises the following steps of: scanning target information of a test object by using an Nmap scanning tool, and generating a network asset topological graph according to a scanning result; determining security vulnerabilities of the test object according to the network asset topological graph, and utilizing ATTamp; the CK framework generates an attack graph corresponding to the security vulnerability; performing penetration test on the test object according to a penetration path in the attack graph, performing vulnerability scanning and attack simulation on the target system by using a Nessus vulnerability scanning tool, and trying to break through security protection of the target system; generating a penetration test report according to a penetration test result; after the penetration test report is generated, the network security protection suggestion can be generated for the test object according to the penetration test report, and the working method of the automatic penetration test realizes rapid and accurate network security evaluation of the test object, and improves the precision and efficiency of network security evaluation.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a working method of automated penetration testing. Background Art

[0002] Penetration testing is an important means of evaluating the security of computer network systems. It can discover potential security holes and weaknesses by simulating attacks on actual systems. Traditional penetration testing mainly uses manual operation, which requires extremely high skills of operators, is prone to errors, and has low execution efficiency. It cannot meet the requirements of attack effectiveness. At the same time, due to reliance on human actions, technical experience cannot be effectively accumulated, and corresponding technical achievements cannot be transformed. Therefore, we propose an automated penetration testing working method. Summary of the invention

[0003] The purpose of the present invention is to provide a working method of automated penetration testing, which solves the problems in the background technology.

[0004] To achieve the above object, the present invention provides the following technical solution: a working method of automated penetration testing, comprising the following steps:

[0005] S1: Use the Nmap scanning tool to scan the target information of the test object and generate a network asset topology map based on the scanning results;

[0006] S2: Determine the security vulnerabilities of the test object based on the network asset topology map, and use the ATT&CK framework to generate the attack graph corresponding to the security vulnerabilities;

[0007] S3: Perform penetration testing on the test object according to the penetration path in the attack graph, use the Nessus vulnerability scanning tool to scan vulnerabilities and simulate attacks on the target system, and try to break through the security protection of the target system;

[0008] S4: Generate a penetration test report based on the results of the penetration test;

[0009] S5: After the penetration test report is generated, network security protection recommendations can be generated for the test object based on the penetration test report.

[0010] Preferably, the target information in S1 includes the basic network configuration, domain name, personnel authority division, exposed ports, system entrance and web backend entrance information of the test object.

[0011] Preferably, the report in S4 includes a detailed description and analysis of all discovered security vulnerabilities, as well as an assessment of the severity and scope of impact of the vulnerabilities.

[0012] Preferably, when performing the penetration test in S3, the feasibility of all penetration paths in the attack graph can be verified, and the penetration path that passes the feasibility verification can be set as the target penetration path, and then the penetration test is performed on the test object according to the target penetration path.

[0013] Preferably, the network asset topology diagram in S1 is used to intuitively understand the network structure and asset distribution of the test object.

[0014] Preferably, the attack graph in S2 is used to show the penetration path from initial access to privilege escalation to maintaining access.

[0015] Preferably, the penetration tool in the penetration test in S3 may be one or more of a password cracking tool, a malicious code injection tool, and a cross-site scripting attack tool.

[0016] The present invention provides a working method for automated penetration testing. The working method for automated penetration testing has the following beneficial effects:

[0017] (1) The working method of the automated penetration test realizes a rapid and accurate network security assessment of the test object, thereby improving the accuracy and efficiency of network security assessment;

[0018] (2) This method of anti-automated penetration testing uses the ATT&CK framework to generate attack graphs, which can more comprehensively identify and exploit security vulnerabilities in the target system, improving the pertinence and effectiveness of penetration testing. The generated penetration testing report records the discovered security vulnerabilities and evaluation results in detail, providing the test object with valuable network security protection suggestions, which helps the test object improve its network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0021] Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0022] like Figure 1 As shown, the present invention provides a technical solution: a working method of automated penetration testing, comprising the following steps:

[0023] S1: Use the Nmap scanning tool to scan the target information of the test object and generate a network asset topology map based on the scanning results;

[0024] The target information includes the basic network configuration, domain name, personnel authority division, exposed ports, system entrance and web backend entrance information of the test object; network asset topology map, which is used to intuitively understand the network structure and asset distribution of the test object;

[0025] Specifically, the scanning tool can also utilize other professional network scanning tools, such as Nessus or OpenVAS. These tools support vulnerability scanning of multiple operating systems and applications through plug-ins. During the scanning process, the response of the target system can be recorded for subsequent analysis. Based on the scanning results, the network asset information of the target system, including hosts, network devices, application services, etc., is organized, and this information is used to generate a network asset topology map.

[0026] S2: Determine the security vulnerabilities of the test object based on the network asset topology map, and use the ATT&CK framework to generate the attack graph corresponding to the security vulnerabilities;

[0027] Attack graphs that show the penetration path from initial access to privilege escalation to maintaining access;

[0028] Specifically, the scanning results are analyzed in detail to identify the security vulnerabilities in the target system. The public CVE vulnerability library and the general vulnerability information database established during the manual penetration process can be combined to extract vulnerability descriptions, vulnerability types, carrier information, vulnerability trigger conditions, vulnerability hazards and other information. According to the ATT&CK framework (a framework for adversarial tactics, techniques, and common knowledge), the identified security vulnerabilities are associated with the tactics, techniques and procedures (TTPs) in ATT&CK, and the ATT&CK framework is used to generate an attack graph corresponding to the security vulnerability. Then, according to the actual situation of the target system and the needs of the penetration test, the attack graph can be trimmed or expanded, and optimized to ensure the accuracy and feasibility of the attack path.

[0029] S3: Perform penetration testing on the test object according to the penetration path in the attack graph, use the Nessus vulnerability scanning tool to scan vulnerabilities and simulate attacks on the target system, and try to break through the security protection of the target system;

[0030] The penetration tool in the penetration test can be one or more of a password cracking tool, a malicious code injection tool, and a cross-site scripting attack tool. When conducting a penetration test, the feasibility of all penetration paths in the attack graph can be verified, and the penetration path that has passed the feasibility verification can be set as the target penetration path, and then the penetration test can be performed on the test object according to the target penetration path.

[0031] Specifically, during the penetration test, you can simulate various attack methods to try to break through the security protection of the target system, record each step of the penetration test and the response of the target system, evaluate the security of the target system based on the results of the penetration test, analyze the vulnerabilities and weaknesses found during the penetration test, and the security risks that these vulnerabilities and weaknesses may bring.

[0032] S4: Generate a penetration test report based on the results of the penetration test;

[0033] The report contains a detailed description and analysis of all discovered security vulnerabilities, as well as an assessment of the severity and scope of the vulnerabilities;

[0034] Specifically, organize all data collected during the penetration test, including scan results, penetration test steps, target system responses, etc., classify and organize the data for subsequent analysis, and write a detailed penetration test report based on the penetration test data and analysis results. The report should include test overview, vulnerability analysis, attack scenarios, test conclusions, and network security protection recommendations. The report should clearly, accurately, and comprehensively reflect the process and results of the penetration test.

[0035] S5: After the penetration test report is generated, network security protection suggestions can be generated for the test object based on the penetration test report;

[0036] Specifically, conduct a detailed analysis of the penetration test results, including the severity of the vulnerability, the scope of impact, possible security risks, etc. Based on the analysis results, provide network security protection recommendations for the test object.

[0037] Finally, it is necessary to repair the vulnerabilities in the target system according to the vulnerability information and network security protection recommendations in the penetration test report. During the repair process, the effectiveness and security of the repair measures should be ensured; in response to the weaknesses and security risks found during the penetration test, the security protection measures of the target system should be strengthened. Measures such as strengthening access control, improving system security, and strengthening security monitoring can be taken to improve the security of the target system; the target system should be retested regularly to ensure that vulnerabilities are repaired in a timely manner and the effectiveness of security protection measures. During the retesting process, the same or different methods and tools as the initial penetration test can be used for testing.

[0038] Embodiment 1:

[0039] The web application for a certain enterprise is as follows:

[0040] 1) Use search engines and social media to collect basic information about the target system, such as domain name, IP address, operating system, etc., and use the Nmap scanning tool to scan the open ports and services of the target system;

[0041] 2) Use OpenVAS vulnerability scanning tool to conduct a comprehensive vulnerability scan on the target system. Based on the scan results, identify security vulnerabilities such as SQL injection and cross-site scripting in the target system;

[0042] 3) Using the ATT&CK framework, an attack graph is generated based on the identified security vulnerabilities. The attack graph shows the penetration path from initial access to privilege escalation to maintaining access.

[0043] 4) According to the penetration path in the attack graph, use password cracking tools to try to crack the target system's account password, exploit SQL injection vulnerabilities, execute malicious SQL statements in the target system, and try to obtain sensitive information in the database;

[0044] 5) Organize all data and analysis results collected during the penetration test, and write a detailed penetration test report, including test overview, vulnerability analysis, attack scenarios, test conclusions, etc.

[0045] Result: The SQL injection vulnerability in the target system was successfully discovered and exploited, and sensitive information in the database was obtained. The penetration test report provided targeted network security protection suggestions for the test object.

[0046] Embodiment 2:

[0047] The internal network of a financial institution is as follows:

[0048] 1) Obtain the network topology and asset list of the target system through internal employees, and use the Nessus scanning tool to scan the internal network of the target system to obtain detailed asset information and vulnerability information;

[0049] 2) Perform a detailed analysis of the scan results to identify high-risk vulnerabilities such as remote code execution and file upload in the target system, and generate attack graphs for these vulnerabilities in combination with the ATT&CK framework;

[0050] 3) According to the penetration path in the attack graph, the remote code execution vulnerability is used to execute malicious code in the target system. Through the file upload vulnerability, the malicious file is uploaded to the target system and attempted to execute the file to gain control of the system;

[0051] 4) After successfully gaining control of the system, try to elevate permissions to obtain higher access rights, use privilege escalation tools or manually explore system vulnerabilities to obtain administrator privileges;

[0052] 5) Record each operation step during the penetration test and the response of the target system, and write a detailed penetration test report, including vulnerability analysis, attack steps, privilege escalation process, etc.

[0053] Result: The internal network of the target system was successfully penetrated and administrator privileges were obtained. The penetration test report provided the test object with detailed network security protection suggestions and repair measures.

[0054] Embodiment three:

[0055] The web server for a certain e-commerce platform is as follows:

[0056] 1) Use search engines and social media platforms to collect basic information such as the domain name, IP address, and filing information of the target e-commerce platform, and use scanning tools such as Nmap to perform port scanning on the target IP address to identify open ports and services;

[0057] 2) Deploy automated vulnerability scanning tools, such as Burp Suite, to conduct a comprehensive vulnerability scan on the target Web server, identify and record all potential vulnerabilities, such as unauthorized access vulnerabilities, sensitive information leakage vulnerabilities, input validation vulnerabilities, etc.;

[0058] 3) Based on the identified vulnerabilities and in combination with the ATT&CK framework, plan potential attack paths, determine each step from initial access to privilege escalation to maintaining access, and develop a corresponding penetration testing plan;

[0059] 4) According to the penetration test plan, gradually execute each step in the attack path, and use a combination of vulnerability scanning and manual testing to try to break through the security protection of the target Web server;

[0060] 5) Organize the data collected during the penetration test, analyze the severity and potential impact of the vulnerability, and write a detailed penetration test report, including the test process, vulnerability analysis, attack scenarios, and repair suggestions.

[0061] Results: Multiple security vulnerabilities on the target Web server were successfully discovered and exploited, including unauthorized access vulnerabilities and input validation vulnerabilities. The penetration test report provided targeted network security reinforcement recommendations for the e-commerce platform.

[0062] Embodiment 4:

[0063] The internal confidence system for a government agency is as follows:

[0064] 1) Obtain the network topology, system architecture and asset list of the target government agency through internal channels, and analyze the security configuration, access control and authority management strategy of the target system;

[0065] 2) Use professional vulnerability scanning tools, such as Nessus, to conduct a comprehensive vulnerability scan on the target system, conduct a detailed evaluation of the scan results, and determine which vulnerabilities may be exploited to carry out attacks;

[0066] 3) Based on the vulnerability scanning results and the actual situation of the target system, formulate a detailed penetration testing strategy, determine the scope, methods and expected goals of the penetration testing, and formulate a corresponding test plan;

[0067] 4) Perform penetration testing step by step according to the test plan. During the test, pay close attention to the response and changes of the target system and adjust the test strategy in a timely manner;

[0068] 5) Organize the data and analysis results collected during the penetration test, and write a detailed penetration test report, including the test process, vulnerability analysis, attack scenarios, test conclusions and repair suggestions.

[0069] Results: We successfully discovered multiple security vulnerabilities in the target government agency’s internal information system, including privilege escalation vulnerabilities and sensitive information leakage vulnerabilities. The penetration test report provided the government agency with specific network security reinforcement and vulnerability repair suggestions to help it improve the security protection capabilities of its information system.

[0070] Implementation Five:

[0071] The mobile payment application for a financial institution is as follows:

[0072] 1) Download and install the target financial institution’s mobile payment app, analyze its functions, architecture, and security, collect basic information such as the app’s version information, developer information, and permission list, use the static analysis tool APKTool to decompile the app, and analyze potential vulnerabilities in the source code;

[0073] 2) Use the dynamic analysis tool Frida to perform runtime analysis on the application to detect potential vulnerabilities, focusing on vulnerabilities such as sensitive information leakage, code injection, and insecure data storage. Try to exploit the detected vulnerabilities, simulate attacker behavior, and try to obtain sensitive data in the application or perform malicious operations;

[0074] 3) After successfully exploiting the vulnerability, try to elevate the application's permissions to obtain higher access rights, explore security control points in the application, such as fingerprint recognition, facial recognition, and secondary verification, try to bypass these control points, and record every step of the attack process and the response of the target application;

[0075] 4) Organize the data and analysis results collected during the penetration test, and write a detailed penetration test report, including the test process, vulnerability analysis, attack scenarios, test conclusions and repair suggestions.

[0076] Results: We successfully discovered multiple security vulnerabilities in the target financial institution's mobile payment applications, including sensitive information leakage vulnerabilities and code injection vulnerabilities. The penetration test report provides financial institutions with targeted network security reinforcement recommendations to help them improve the security of their mobile payment applications.

[0077] The embodiments of the present invention are given for the purpose of illustration and description, and are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. A working method of automated penetration testing, characterized in that: The following steps are involved: S1: Use the Nmap scanning tool to scan the target information of the test object and generate a network asset topology map based on the scanning results; S2: Determine the security vulnerabilities of the test object based on the network asset topology map, and use the ATT&CK framework to generate the attack graph corresponding to the security vulnerabilities; S3: Perform penetration testing on the test object according to the penetration path in the attack graph, use the Nessus vulnerability scanning tool to scan vulnerabilities and simulate attacks on the target system, and try to break through the security protection of the target system; S4: Generate a penetration test report based on the results of the penetration test; S5: After the penetration test report is generated, network security protection recommendations can be generated for the test object based on the penetration test report.

2. The method of automated penetration testing according to claim 1, characterized in that: The target information in S1 includes the basic network configuration, domain name, personnel authority division, exposed ports, system entrance and web backend entrance information of the test object.

3. The method of automated penetration testing according to claim 1, characterized in that: The report in S4 contains a detailed description and analysis of all discovered security vulnerabilities, as well as an assessment of the severity and scope of the vulnerabilities.

4. The method of automated penetration testing according to claim 1, characterized in that: When performing penetration testing in S3, the feasibility of all penetration paths in the attack graph can be verified, and the penetration paths that pass the feasibility verification can be set as target penetration paths, and then penetration testing can be performed on the test object according to the target penetration paths.

5. The method of automated penetration testing according to claim 1, characterized in that: The network asset topology diagram in S1 is used to intuitively understand the network structure and asset distribution of the test object.

6. The method of automated penetration testing according to claim 1, characterized in that: The attack graph in S2 is used to show the penetration path from initial access to privilege escalation to maintaining access.

7. The method of automated penetration testing according to claim 1, characterized in that: The penetration tool in the penetration test in S3 can be one or more of a password cracking tool, a malicious code injection tool, and a cross-site scripting attack tool.

Images