Test method and test system for penetration test

Abstract

The invention provides a penetration test method and system, and the method comprises the steps: obtaining an information updating event, judging the type of the information updating event: when the information updating event is an inherent information updating event, selecting and executing a corresponding inherent test task according to the updating content of the inherent information updating event, after the inherent test task is completed, updating the corresponding asset business information, and issuing a business information updating event; when the information updating event is a business information updating event, selecting and executing a corresponding business test task according to the updating content of the business information updating event, and entering a post penetration process after the business test task is completed; and after entering the post-penetration process, performing a post-penetration test on the corresponding electronic equipment. According to the test method and the test system for the penetration test, the efficiency and the safety of the penetration test can be improved.

Description

Technical Field

[0001] The present invention relates to the field of security detection, and in particular to a testing method and a testing system for penetration testing. Background Art

[0002] With the rapid development of modern information technology, network security has become a very challenging field. In response to the increasing threat of network attacks, penetration testing is widely used to evaluate and improve the security of information systems. However, existing automated and manual penetration testing methods face many limitations in terms of efficiency and security.

[0003] The automated penetration testing tools currently on the market usually rely on preset scripts and fixed processes. Although this method simplifies the execution of penetration testing to a certain extent, it still relies heavily on manual intervention and configuration. This makes the effectiveness of penetration testing often depend on the professional knowledge and experience level of the tester, resulting in uncertainty and variability in the test results, making it difficult to meet the requirements of standardization and quantitative evaluation. Therefore, there is room for improvement. Summary of the invention

[0004] The purpose of the present invention is to provide a testing method and a testing system for penetration testing, which can improve the efficiency and safety of penetration testing.

[0005] In order to solve the above technical problems, the present invention is achieved through the following technical solutions:

[0006] The present invention provides a penetration test method, comprising:

[0007] Get the information update event and determine the type of the information update event:

[0008] When the information update event is an inherent information update event, according to the update content of the inherent information update event, the corresponding inherent test task is selected and executed, and after the inherent test task is completed, the corresponding asset business information is updated, and the business information update event is published;

[0009] When the information update event is a business information update event, according to the update content of the business information update event, a corresponding business test task is selected and executed, and after completing the business test task, a post-penetration process is entered;

[0010] After entering the post-penetration process, a post-penetration test is performed on the corresponding electronic device.

[0011] In one embodiment of the present invention, the step of obtaining an information update event includes:

[0012] Detect network asset information of electronic devices in the target network;

[0013] When new network asset information is scanned, the corresponding asset inherent information or asset business information is updated, and the corresponding inherent information update event or business information update event is published.

[0014] In one embodiment of the present invention, the steps of selecting and executing a corresponding inherent test task according to the update content of the inherent information update event, updating the corresponding asset business information after completing the inherent test task, and publishing the business information update event include:

[0015] Determine the updated content of the asset inherent information corresponding to the inherent information update event:

[0016] When the update content of the asset inherent information includes one of the IP address, the port and the communication protocol, a password collision test task is selected and executed according to the update content, and after completing the password collision test task, the corresponding asset business information is updated and a corresponding business information update event is issued;

[0017] When the update content of the asset inherent information includes the protocol type of the website information, a crawler test task is selected and executed according to the update content. After completing the crawler test task, the corresponding asset business information is updated and the corresponding business information update event is published.

[0018] In one embodiment of the present invention, when the update content of the asset inherent information includes one of an IP address, a port, and a communication protocol, selecting and executing a password collision test task according to the update content, and after completing the password collision test task, updating the corresponding asset business information and publishing the corresponding business information update event, the steps include:

[0019] Determine whether the corresponding electronic device needs to log in with a password:

[0020] If no password is required to log in, the test is passed; if password is required to log in, select and execute the password collision test task according to the IP address, port and communication protocol update content of the asset inherent information, log in in sequence according to the password data in the preset password library, and determine whether the login is successful:

[0021] If the login fails, the test passes;

[0022] If the login is successful, the corresponding asset business information will be updated according to the successful login user name and password data, and the corresponding business information update event will be published.

[0023] In one embodiment of the present invention, when the update content of the asset inherent information includes the protocol type of the website information, the steps of selecting and executing a crawler test task according to the update content, updating the corresponding asset business information after completing the crawler test task, and publishing the corresponding business information update event include:

[0024] Determine the protocol type of the website information of the asset inherent information:

[0025] If the protocol type is not a protocol based on the Hypertext Transfer Protocol, the test passes; if the protocol type is a protocol based on the Hypertext Transfer Protocol, the crawler test task is selected and executed according to the protocol of the Hypertext Transfer Protocol, and it is determined whether the network resource identifier and its parameters are crawled:

[0026] If the network resource identifier and its parameters are not crawled, the test passes;

[0027] If the network resource identifier and its parameters are crawled, the corresponding asset business information is updated according to the updated content of the network resource identifier and its parameters, and the corresponding business information update event is published.

[0028] In one embodiment of the present invention, when the information update event is a business information update event, according to the update content of the business information update event, a corresponding business test task is selected and executed, and after completing the business test task, the step of entering the post-penetration process includes:

[0029] Determine the updated content of the asset business information corresponding to the business information update event:

[0030] When the updated content of the asset business information includes a network resource identifier and one of its parameters, selecting and executing a fuzz test task according to the updated content, and entering a post-penetration process after completing the fuzz test task;

[0031] When the updated content of the asset business information includes one of the user name and password data, a login penetration test task is selected and executed according to the updated content, and after completing the login penetration test task, a post-penetration process is entered.

[0032] In one embodiment of the present invention, when the update content of the asset service information includes a network resource identifier and one of its parameters, the step of selecting and executing a fuzz test task according to the update content, and entering a post-penetration process after completing the fuzz test task includes:

[0033] Determine whether the network resource identifier and parameters of the asset service information are updated:

[0034] If not updated, the test passes; if updated, the fuzz test task is selected and executed according to the updated network resource identifier, and it is determined whether the fuzz test risk is detected;

[0035] If not detected, the test is passed;

[0036] If detected, the corresponding fuzz testing risk is obtained to enter the post-exploitation process.

[0037] In one embodiment of the present invention, when the updated content of the asset business information includes one of the user name and password data, the step of selecting and executing the login penetration test task according to the updated content, and entering the post-penetration process after completing the login penetration test task includes:

[0038] Determine whether the username and password data of the asset business information is updated:

[0039] If it is not updated, the test passes; if it is updated, select and execute the login penetration test task according to the updated username and password data, and determine whether the login penetration is successful:

[0040] If the login penetration is not successful, the test passes;

[0041] If the penetration is successful, the post-penetration process will begin.

[0042] In one embodiment of the present invention, the method further includes:

[0043] Compare the inherent information update content and / or the business information update content in the information update event with the preset vulnerability library:

[0044] When there is no vulnerability content in the vulnerability database that is consistent with the inherent information update content and / or the business information update content, the test is passed;

[0045] Otherwise, according to the consistent vulnerability content, select and execute the vulnerability exploitation test task, and determine whether the corresponding vulnerability is successfully exploited:

[0046] If the exploit is unsuccessful, the test passes;

[0047] If the exploit is successful, the corresponding vulnerability is obtained to enter the post-exploitation process.

[0048] The present invention also provides a penetration test system, comprising:

[0049] The judgment module is used to obtain the information update event and judge the type of the information update event:

[0050] A first test module is used for, when the information update event is an inherent information update event, selecting and executing a corresponding inherent test task according to the update content of the inherent information update event, and after completing the inherent test task, updating the corresponding asset business information and publishing a business information update event;

[0051] A second testing module is used for selecting and executing a corresponding business testing task according to the updated content of the business information update event when the information update event is a business information update event, and entering a post-penetration process after completing the business testing task; and

[0052] The post-penetration module is used to perform a post-penetration test on the corresponding electronic device after entering the post-penetration process.

[0053] As described above, the present invention provides a testing method and testing system for penetration testing, which decouples the various steps of the penetration test from each other by adopting event updates and message publish-subscribe mechanisms, making each step in the penetration test process more independent, thereby greatly enhancing the flexibility and scalability of the penetration test process. The penetration test steps no longer depend on the results of the previous step, but are related to the currently collected asset information, that is, the choice of strategy is based on the dynamic growth of information rather than a static state. This flexible strategy adjustment enables penetration testing to respond quickly to information changes and make full use of newly grown information, thereby effectively identifying potential new breakthrough points. Due to the dynamic intervention conditions of the steps, the adaptability of the penetration test is significantly improved, and the testing method can dynamically adjust the test steps according to the information collected in real time, thereby improving the efficiency and effectiveness of the test.

[0054] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0056] Figure 1 A flowchart of a penetration test method according to an embodiment of the present invention;

[0057] Figure 2 Schematic diagram of a testing system for penetration testing in one embodiment of the present invention.

[0058] In the figure: 100, judgment module; 200, first test module; 300, second test module; 400, third test module; 500, post-penetration module. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] See also Figure 1 The present invention provides a penetration test method, which can be applied to the penetration test process to evaluate the security of a computer system, network or application by simulating the behavior of a hacker attacker. The test method may include the following steps:

[0061] Step S10: Obtain an information update event and determine the type of the information update event:

[0062] Step S20: When the information update event is an inherent information update event, select and execute the corresponding inherent test task according to the update content of the inherent information update event, and after completing the inherent test task, update the corresponding asset business information and publish the business information update event;

[0063] Step S30: When the information update event is a business information update event, select and execute the corresponding business test task according to the update content of the business information update event, and enter the post-penetration process after completing the business test task;

[0064] Step S40: compare the inherent information update content and / or the business information update content in the information update event with the preset vulnerability library, so as to select and execute the vulnerability exploitation test task when there is vulnerability content, and enter the post-penetration process after completing the vulnerability exploitation test task;

[0065] Step S50: After entering the post-penetration process, a post-penetration test is performed on the corresponding electronic device.

[0066] In one embodiment, when executing step S10, specifically, step S10 may include the following steps:

[0067] Step S11, detecting network asset information of electronic devices in the target network;

[0068] Step S12: When new network asset information is scanned, the corresponding asset inherent information or asset business information is updated, and the corresponding inherent information update event or business information update event is published.

[0069] In one embodiment, when step S11 is executed, specifically, the database can be used to store the asset inherent information and asset business information of the electronic device. Each electronic device can correspond to an asset inherent information and an asset business information. A password library can also be provided in the database, and the password library can include multiple preset password data. The password data can be a common weak password, for example, including passwords such as "123456", "password", and "admin", which are designed based on commonly used simple password modes to ensure wide coverage. A vulnerability library can also be stored in the database, and the vulnerability library includes multiple preset vulnerabilities.

[0070] In one embodiment, asset-specific information refers to some technical information that has been determined or attached to the electronic device when it is deployed, which may be related to the physical or network characteristics of the electronic device. Asset-specific information may include IP address, physical address, open port, communication protocol, domain name, service software and its version, website information, etc. Among them, IP address refers to the identification of the electronic device in the network. Physical address refers to the MAC address of the electronic device, etc. Open port refers to the logical channel used to distinguish different applications or services in the electronic device, and is used to identify the digital port number of different applications or services. Communication protocol refers to the network communication protocol (such as TCP / IP) used by the electronic device, which is used to specify the convention or specification of data communication rules and defines how data is transmitted, processed and applied in the network. Domain name refers to the domain name to which the electronic device belongs. Service software and its version refer to the service software running on the electronic device and its specific version information. Website information refers to the relevant website information on the electronic device.

[0071] In one embodiment, asset business information refers to information related to business functions and operations supported by an electronic device. Asset business information may include user name and password data, interface, network resource identifier and its parameters, etc. Among them, the user name refers to the user who can access the electronic device or its services. Password data refers to the verification information required for the user to access the electronic device. The interface refers to the business interface or API provided by the electronic device. The network resource identifier and its parameters refer to the information used to identify and describe specific resources on the electronic device or in the network.

[0072] In one embodiment, electronic devices in the target network can be detected by ICMP scanning and port scanning. ICMP scanning can be used to detect whether the target device is online, and port scanning can be used to check which services or applications are running on the electronic device. After detecting surviving electronic devices and open ports, the identification information (such as IP address), active status, and related port information of the electronic device can be recorded and stored. Subsequently, the new detection results can be associated and integrated with the existing asset inherent information to update the asset inherent information in the database to reflect the latest status of the current electronic device. Finally, after each update or addition of asset inherent information, an inherent information update event will be triggered. Among them, the inherent information update event can be associated with the updated or newly added asset inherent information. The inherent information update event can be used to notify other modules to work.

[0073] In one embodiment, when executing step S12, specifically, the information update events in the database and the target network can be scanned, and the information update events can include inherent information update events and business information update events. Each time the asset inherent information of the electronic device is updated, an inherent information update event can be published. Each time the asset business information of the electronic device is updated, a business information update event can be published. When an information update event is scanned, it means that there is certain update content in the asset inherent information and / or asset business information of a certain electronic device. Since different types of information update events require different processing, it is necessary to determine the type of information update event at this time.

[0074] In one embodiment, when step S20 is executed, specifically, step S20 may include the following steps:

[0075] Step S21: Determine the update content of the asset inherent information corresponding to the inherent information update event:

[0076] Step S22: when the update content of the asset inherent information includes one of the IP address, port and communication protocol, select and execute the password collision test task according to the update content, and after completing the password collision test task, update the corresponding asset business information and publish the corresponding business information update event;

[0077] Step S23: When the update content of the asset inherent information includes the protocol type of the website information, select and execute the crawler test task according to the update content. After completing the crawler test task, update the corresponding asset business information and publish the corresponding business information update event.

[0078] In one embodiment, when executing step S21, specifically, since the IP address, physical address, open port, communication protocol, domain name, service software and its version, and website information in the asset inherent information may be updated, different test processes need to be performed for different update contents. Therefore, it is necessary to first determine the update content of the asset inherent information.

[0079] In one embodiment, when step S22 is executed, specifically, step S22 may include the following steps:

[0080] Step S221: Determine whether the corresponding electronic device needs to be logged in via a password:

[0081] Step S222: If password login is not required, the test is passed; if password login is required, select and execute the password collision test task according to the IP address, port and communication protocol update content of the asset inherent information, login is performed in sequence according to the password data in the preset password library, and determine whether the login is successful:

[0082] Step S223: If the login fails, the test is passed;

[0083] Step S224: If the login is successful, the corresponding asset business information is updated according to the user name and password data of the successful login, and the corresponding business information update event is published.

[0084] In one embodiment, when executing step S221, specifically, in order to detect whether the electronic device has a weak password risk, an automatic password collision test is performed using a plurality of preset password data in the password library through a preset password collision strategy unit. The password collision strategy unit can monitor the inherent information update event of the electronic device in real time.

[0085] In one embodiment, whenever the password collision strategy unit monitors an inherent information update event, it is necessary to immediately determine whether the corresponding electronic device requires a password to log in. For example, the determination can be made based on the communication protocol used by the electronic device, such as SSH, RDP, SMB, and other protocols that require identity authentication.

[0086] In one embodiment, when executing step S222, specifically, if the corresponding electronic device does not need to log in via a password, the password collision strategy unit may consider the test to be passed, ignore the inherent information update event, and wait and listen to the next inherent information update event in real time. If the corresponding electronic device needs to log in via a password, the password collision strategy unit may select and execute the password collision test task according to the updated content of the asset inherent information, for example, the password collision test task may be selected according to the IP address, port, and communication protocol of the asset inherent information. Subsequently, the password data in the password library may be used to attempt to log in to the corresponding electronic device.

[0087] In one embodiment, when executing step S223, specifically, during the process of the password collision strategy unit trying to log in, if all attempts are unsuccessful, it means that no weak password is found. At this time, it can be considered that the test has passed, and the inherent information update event is ignored, and the next inherent information update event is waited and monitored in real time.

[0088] In one embodiment, when executing step S224, specifically, during the process of the password collision strategy unit attempting to log in, if a certain password data attempt succeeds, it indicates that there is a weak password. The password collision strategy unit can record the password data as a weakness and update the user name and password data to the corresponding asset business information. Subsequently, the password collision strategy unit can publish a corresponding business information update event for further testing.

[0089] In one embodiment, when step S23 is executed, specifically, step S23 may include the following steps:

[0090] Step S231: Determine the protocol type of the website information of the asset inherent information:

[0091] Step S232: If the protocol type is not a protocol based on the Hypertext Transfer Protocol, the test is passed; if the protocol type is a protocol based on the Hypertext Transfer Protocol, the crawler test task is selected and executed according to the protocol of the Hypertext Transfer Protocol, and it is determined whether the network resource identifier and its parameters are crawled:

[0092] Step S233: If the network resource identifier and its parameters are not crawled, the test passes;

[0093] Step S234: If the network resource identifier and its parameters are crawled, the corresponding asset business information is updated according to the updated content of the network resource identifier and its parameters, and the corresponding business information update event is published.

[0094] In one embodiment, when executing step S231, specifically, in order to timely obtain and analyze website pages and related interface information, the inherent information update event of the electronic device can be monitored in real time through a preset crawler strategy unit. Whenever the crawler strategy unit monitors the inherent information update event, it indicates that some website information in the electronic device may have changed and needs to be checked and processed.

[0095] In one embodiment, after the crawler strategy unit monitors the inherent information update event, the crawler strategy unit can obtain the asset inherent information of the relevant electronic device, especially the protocol type of the website information. Subsequently, the crawler strategy unit can determine whether the protocol type of the website information is a protocol based on the Hypertext Transfer Protocol, that is, whether it is HTTP or HTTPS protocol.

[0096] In one embodiment, when executing step S232, specifically, if it is detected that the website information of the electronic device does not use the HTTP or HTTPS protocol, it is considered that the website information of the electronic device is not suitable for the currently set crawler test, and the crawler strategy unit can consider that the test has passed, and ignore the inherent information update event, and wait and listen to the next inherent information update event in real time.

[0097] In one embodiment, if it is detected that the website information of the electronic device uses the HTTP or HTTPS protocol, the website of the electronic device is considered suitable for the currently set crawler test. Subsequently, the crawler strategy unit can select and execute the crawler test task based on the protocol of the hypertext transfer protocol, IP address, open port and domain name and other information. Before executing the crawler test task, it is necessary to confirm the website's network resource identifier (URL), appropriate access method (such as GET or POST), key access parameters and possible input data, interface details to be extracted and other information.

[0098] In one embodiment, the crawler strategy unit can access the website of the electronic device, perform traversal and data collection according to the provided URL and parameters, and then determine whether a valid network resource identifier (such as a specific URL and interface parameters) can be obtained.

[0099] In one embodiment, when executing step S233, specifically, if the network resource identifier is not crawled, that is, the task is completed without obtaining a valid network resource identifier, the crawler strategy unit can be considered to have passed the test and ignore the inherent information update event, and wait and listen to the next inherent information update event in real time.

[0100] In one embodiment, when executing step S234, specifically, if a network resource identifier is crawled, the crawler strategy unit can update the corresponding asset business information to reflect the latest network structure and function. After successfully updating the asset business information, the crawler strategy unit can publish a business information update event for further testing.

[0101] In one embodiment, when step S30 is executed, specifically, step S30 may include the following steps:

[0102] Step S31: Determine the updated content of the asset business information corresponding to the business information update event:

[0103] Step S32: When the updated content of the asset business information includes a network resource identifier and one of its parameters, a fuzzy test task is selected and executed according to the updated content, and after the fuzzy test task is completed, a post-penetration process is entered;

[0104] Step S33: When the updated content of the asset business information includes one of the user name and password data, select and execute the login penetration test task according to the updated content, and enter the post-penetration process after completing the login penetration test task.

[0105] In one embodiment, when executing step S31, specifically, since the user name and password data, interface, network resource identifier and its parameters in the asset business information may be updated, different test processes need to be performed for different update contents. Therefore, it is necessary to first determine the update content in the asset business information.

[0106] In one embodiment, when step S32 is executed, specifically, step S32 may include the following steps:

[0107] Step S321: Determine whether the network resource identifier and its parameters of the asset service information are updated:

[0108] Step S322: If not updated, the test is passed; if updated, a fuzzy test task is selected and executed according to the updated network resource identifier, and it is determined whether a fuzzy test risk is detected;

[0109] Step S323: If not detected, the test is passed;

[0110] Step S324: If detected, obtain the corresponding fuzzy test risk to enter the post-penetration process.

[0111] In one embodiment, when executing step S321, specifically, a preset fuzz testing strategy unit can be used to monitor business information update events. Business information update events can come from a password collision strategy unit and / or a crawler strategy unit. The fuzz testing strategy unit can be used to perform fuzz testing (FuzzTesting) on ​​electronic devices based on business information update events. Fuzz testing refers to a technology that automatically detects potential vulnerabilities in application programs of electronic devices by introducing a large amount of random or abnormal input data, for example, it is suitable for detecting unknown vulnerabilities such as SQL injection, cross-site scripting attacks (XSS), code injection, command injection, and arbitrary file uploads.

[0112] In one embodiment, in a complex network environment, network resource identifiers (such as URLs, API endpoints) may be updated as business logic or architecture changes. The fuzz testing strategy unit can discover potential security risks of electronic device applications on new resources or interfaces by applying fuzz testing to network resource identifiers and their parameters.

[0113] In one embodiment, the fuzz testing strategy unit can continuously monitor the update content related to the asset business information, that is, the update of the network resource identifier, such as the addition of a new URL, the deployment of a new API endpoint, or the modification of an existing resource identifier. When the fuzz testing strategy unit monitors the business information update event, it checks whether the network resource identifier in the asset business information is updated, that is, whether there is a URL containing parameters.

[0114] In one embodiment, when executing step S322, specifically, if the fuzzy test policy unit does not detect the update of the network resource identifier, it can be considered that the test has passed, and the business information update event is ignored, and the next business information update event is waited and monitored in real time. If the fuzzy test policy unit detects the update of the network resource identifier, the fuzzy test policy unit can select fuzzy test tasks in a targeted manner according to the updated network resource identifier to generate various abnormal data inputs. The fuzzy test task can focus on the interface or module corresponding to the new resource identifier to comprehensively detect its ability to handle abnormal data.

[0115] In one embodiment, during the execution of the fuzz testing task, the fuzz testing strategy unit can observe the response of the application of the electronic device, focusing on monitoring whether there are security risks or vulnerabilities caused by abnormal input. At the same time, the fuzz testing strategy unit can determine whether a fuzz testing risk is detected, and the fuzz testing risk may include risks such as application crash, unauthorized access, and input not being properly filtered.

[0116] In one embodiment, when executing step S323, specifically, if the fuzzy test strategy unit does not detect the fuzzy test risk, it can be considered that the test has passed, and the business information update event is ignored, and the next business information update event is waited and monitored in real time.

[0117] In one embodiment, when executing step S324, specifically, if the fuzzy testing strategy unit detects a fuzzy testing risk, the fuzzy testing risk will be further analyzed and processed to enter a subsequent post-penetration process.

[0118] In one embodiment, when step S33 is executed, specifically, step S33 may include the following steps:

[0119] Step S331: Determine whether the username and password data of the asset business information are updated:

[0120] Step S332: If not updated, the test is passed; if updated, the login penetration test task is selected and executed according to the updated user name and password data, and it is determined whether the login penetration is successful:

[0121] Step S333: If the login penetration is unsuccessful, the test is passed;

[0122] Step S334: If the login penetration is successful, enter the post-penetration process.

[0123] In one embodiment, when executing step S331, specifically, the preset login penetration strategy unit can be used to monitor business information update events. Business information update events can come from password collision strategy units and / or crawler strategy units. The login penetration strategy unit can be used to obtain the update content of the corresponding asset business information according to the business information update event, that is, the update content about the user name and password data. After the login penetration strategy unit obtains the update content such as the user name and password data through the password collision strategy unit, it can obtain the valid login credentials of the corresponding electronic device. The login penetration strategy unit can use the obtained valid login credentials to try to log in to the corresponding electronic device through a specific network protocol (such as HTTP, SSH, FTP, etc.). Different electronic devices may use different protocols for identity authentication and access. If the valid login credentials are valid and successfully log in to the electronic device, it means that the login penetration strategy unit has obtained certain permissions. This permission can be user-level or administrator-level, depending on the permissions of the credentials collided. After successfully logging in and obtaining permissions, the initial goal of the penetration test is achieved, that is, obtaining unauthorized access rights on the electronic device.

[0124] In one embodiment, in a network security penetration test, by monitoring the update of password data, a penetration test can be performed in a timely manner through a login penetration strategy unit when new login credentials are obtained. The login penetration unit continuously monitors business information update events and focuses on monitoring changes involving password data. This monitoring can identify any new or modified authentication information. At this time, the login penetration unit can determine whether the user name and password data in the corresponding asset business information are updated.

[0125] In one embodiment, when executing step S332, specifically, if the username and password data in the monitored asset business information are not updated, the login penetration unit can be considered to have passed the test, and ignore the business information update event, and wait and monitor the next business information update event in real time. If the username and password data in the monitored asset business information are updated, the login penetration unit can specify and execute the corresponding login penetration test task based on the new IP address, port, protocol, username and password data and other related information. The login penetration unit initiates a login attempt for the electronic device by using the newly obtained IP, port, protocol, username and password data and other related information. For example, try to log in using the updated username and password data. During the login process, it is necessary to follow specific protocols (such as SSH, FTP, RDP, etc.) to interact and observe the response of the electronic device to the login request, that is, to determine whether the login penetration is successful.

[0126] In one embodiment, when executing step S333, specifically, if the corresponding electronic device fails to be logged in successfully, the login penetration unit may consider that the test has passed, and ignore the business information update event, and wait and monitor the next business information update event in real time.

[0127] In one embodiment, when executing step S334, specifically, if the corresponding electronic device is successfully logged in, the login penetration unit has obtained the access rights of the electronic device. The login penetration unit will perform further analysis and processing and enter the subsequent post-penetration process.

[0128] In one embodiment, when step S40 is executed, specifically, step S40 may include the following steps:

[0129] Step S41: compare the inherent information update content and / or the business information update content in the information update event with the preset vulnerability library:

[0130] Step S42: When there is no vulnerability content in the vulnerability database that is consistent with the inherent information update content and / or the business information update content, the test is passed;

[0131] Step S43: Otherwise, select and execute the vulnerability exploitation test task according to the consistent vulnerability content, and determine whether the corresponding vulnerability content is successfully exploited:

[0132] Step S44: If the exploitation is unsuccessful, the test is passed;

[0133] Step S45: If the exploit is successful, the corresponding vulnerability content is obtained to enter the post-exploitation process.

[0134] In one embodiment, when executing step S41, specifically, the preset vulnerability exploitation strategy unit can be used to select and execute vulnerability exploitation test tasks according to inherent information update events and / or business information update events, and enter the post-penetration process after completing the vulnerability exploitation test tasks. Specifically, the vulnerability exploitation strategy unit can monitor inherent information update events and business information update events at the same time. Intrinsic information update events and business information update events may trigger related vulnerability exploitation conditions. For example, some vulnerabilities can only be exploited under specific conditions, such as obtaining certain access rights, and the exploitation of certain vulnerabilities requires specific permissions, especially login permissions. If the inherent information update event and / or the business information update event meets these exploitation conditions, the vulnerability exploitation strategy unit will select the corresponding vulnerability exploitation test task as needed.

[0135] In one embodiment, the vulnerability exploitation strategy unit monitors the inherent information update event as an example. In network security testing, timely identification and utilization of potential vulnerabilities helps to discover security weaknesses in advance. Through the vulnerability library in the database, rapid detection and vulnerability exploitation of network assets can be achieved. The vulnerability library includes multiple preset vulnerability contents. The vulnerability content may include vulnerability type, affected software version, conditions that can be exploited without logging in, etc.

[0136] In one embodiment, the vulnerability exploitation strategy unit can continuously monitor the inherent information update event. When monitoring the inherent information update event, the vulnerability exploitation strategy unit can search in the vulnerability library according to the update content (such as service software and its version) to determine whether there is a corresponding vulnerability, and focus on those vulnerability contents that can be exploited without logging in.

[0137] In one embodiment, the vulnerability exploitation strategy unit monitors the business information update event as an example. The business information update event can come from the password collision strategy unit and / or the crawler strategy unit. In order to improve the effectiveness of network security detection, the vulnerability exploitation strategy unit needs to flexibly identify and exploit possible vulnerabilities based on the latest changes in asset business information (such as user name and password data). By monitoring and analyzing the updated content of asset business information, vulnerabilities that require specific authentication can be effectively detected.

[0138] In one embodiment, the vulnerability exploitation strategy unit may continuously monitor business information update events. The updated content of the asset business information corresponding to the business information update event may include sensitive business information such as user name and password data.

[0139] In one embodiment, when a business information update event is detected, the vulnerability exploitation strategy unit needs to determine whether the update involves changes in key data such as user name and password data.

[0140] In one embodiment, when executing step S42, specifically, if no vulnerability content that can be exploited without logging in is found in the retrieval, the vulnerability exploitation strategy unit can consider that the test has passed and ignore the inherent information update event, and wait and listen to the next inherent information update event in real time.

[0141] In one embodiment, if the information such as the user name and password data has not changed, the vulnerability exploitation strategy unit may consider that the test has passed, and ignore the service information update event, and wait and monitor the next service information update event in real time.

[0142] In one embodiment, if the information such as the username and password data has changed, the vulnerability exploitation strategy unit can perform a further vulnerability detection process. At this time, the vulnerability exploitation strategy unit can use the updated username and password data to retrieve the vulnerability content related to it in the vulnerability library, that is, focus on the vulnerability content that requires login to be exploited. The vulnerability exploitation strategy unit can determine whether there is a vulnerability content that requires login to be exploited.

[0143] In one embodiment, when executing step S43, specifically, if it is found in the search that there is a vulnerability content that can be exploited without logging in, the vulnerability exploitation strategy unit will select and execute the corresponding vulnerability exploitation test task. The test goal of the vulnerability exploitation test task is to verify whether the vulnerability content can be successfully exploited in the current environment.

[0144] In one embodiment, if the vulnerability exploitation policy unit finds that there is no vulnerability that requires login to be exploited after searching, the vulnerability exploitation policy unit may consider that the test has passed, ignore the business information update event, and wait and monitor the next business information update event in real time.

[0145] In one embodiment, if the vulnerability exploitation strategy unit finds a vulnerability that requires login to be exploited after searching, the vulnerability exploitation strategy unit will select and execute the corresponding vulnerability exploitation test task. The test goal of the vulnerability exploitation test task is to verify the feasibility of the corresponding vulnerability using the updated password data.

[0146] In one embodiment, when executing step S44, specifically, if the vulnerability exploitation test task fails to successfully exploit the detected vulnerability content, the vulnerability exploitation strategy unit may consider the test to have passed, and ignore the inherent information update event, and wait and listen to the next inherent information update event in real time.

[0147] In one embodiment, if the vulnerability exploitation strategy unit fails to successfully exploit the corresponding vulnerability, it can be considered that the test has passed, and the service information update event is ignored, and the next service information update event is waited and monitored in real time.

[0148] In one embodiment, when executing step S45, specifically, if the vulnerability exploitation test task successfully exploits the detected vulnerability content, the vulnerability exploitation strategy unit may perform subsequent processing on the vulnerability content and enter the post-penetration process.

[0149] In one embodiment, if the vulnerability exploitation strategy unit successfully exploits the corresponding vulnerability, the vulnerability exploitation strategy unit will further analyze and process the vulnerability and enter the subsequent post-penetration process.

[0150] In one embodiment, when executing step S50, specifically, the preset post-penetration test module can be used to perform a post-penetration test on the corresponding electronic device after entering the post-penetration process. The post-penetration process can be initiated by any one of the vulnerability exploitation strategy unit, the fuzzy test strategy unit, and the login penetration strategy unit. The post-penetration test module can be used to obtain the application of the corresponding electronic device and crack it after entering the post-penetration process, and access other electronic devices based on the cracked credential information.

[0151] In one embodiment, after entering the post-penetration process, that is, after successfully obtaining access rights to the electronic device, the post-penetration testing module can be used to further explore and utilize the resources inside the electronic device, with the goal of extracting more information from the electronic device to expand the control range and strengthen the attack surface.

[0152] In one embodiment, the post-penetration testing module may first enumerate the applications installed on the electronic device. Specifically, the post-penetration testing module may use the system tools and scripts of the electronic device to deeply search the software installation records in the Windows registry to help identify the list of installed applications. For example, the post-penetration testing module may obtain the currently running process information through a program monitoring tool or a command line tool (such as `Tasklist` or `ps` command), thereby supplementing and verifying the installation status of the application.

[0153] In one embodiment, the post-penetration testing module can then obtain the installation path of the relevant application in the electronic device. Specifically, the post-penetration testing module can extract the installation path of each application from a known location in the registry. For a running application, the post-penetration testing module can use a system interface or programming tool to read its process properties and obtain possible installation path information.

[0154] In one embodiment, the post-penetration testing module can then find the file where the application stores the username and password data and try to crack it. Specifically, the post-penetration testing module can analyze the file path and format of the known stored credentials. The post-penetration testing module can develop or use an off-the-shelf cracking tool component to try to extract the plain text password according to the storage and encryption methods of different applications.

[0155] In one embodiment, the post-penetration testing module can finally obtain the credential information used by the electronic device to access other electronic devices. Specifically, the post-penetration testing module can use a special script or tool to extract valid credential information (user name and password data) from the storage file of the electronic device. The post-penetration testing module can apply the obtained credential information to other electronic devices in the target network, and automatically try to use these credentials to log in to all discovered assets (devices and services). By applying these credentials on other electronic devices in the target network, the post-penetration testing module further expands the scope of control.

[0156] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0157] It can be seen that in the above scheme, by adopting the event update and message publish-subscribe mechanism, the various steps of the penetration test are decoupled from each other, making each step in the penetration test process more independent, thereby greatly enhancing the flexibility and scalability of the penetration test process. The penetration test step no longer depends on the result of the previous step, but is related to the asset information currently collected, that is, the choice of strategy is based on the dynamic growth of information rather than the static state. This flexible strategy adjustment enables the penetration test to respond quickly to information changes and make full use of the newly increased information, thereby effectively identifying potential new breakthrough points. Due to the dynamic intervention conditions of the steps, the adaptability of the penetration test is significantly improved, and the test method can dynamically adjust the test steps according to the real-time collected information, thereby improving the efficiency and effect of the test. The update events of the inherent information monitoring module continuously trigger the subsequent modules to organize new test tasks, forming a feedback loop of "information collection-penetration test-expanding the information collection surface-expanding the penetration surface". This cycle provides a continuous driving force for information growth, allowing the penetration test to not only penetrate into existing assets, but also continuously expand the horizon and increase the opportunity to fully understand the target network.

[0158] See also Figure 2 The present invention also discloses a penetration test system, which can be applied in the above-mentioned test method to complete the penetration test of the target network. The test system can correspond to the steps of the above-mentioned test method one by one. The test system can include a judgment module 100, a first test module 200, a second test module 300, a third test module 400, and a post-penetration module 500.

[0159] In one embodiment, the determination module 100 may be used to obtain an information update event and determine the type of the information update event.

[0160] In one embodiment, the first test module 200 can be used to select and execute the corresponding inherent test task according to the update content of the inherent information update event when the information update event is an inherent information update event, and after completing the inherent test task, update the corresponding asset business information and publish the business information update event.

[0161] In one embodiment, the second test module 300 can be used to select and execute a corresponding business test task according to the update content of the business information update event when the information update event is a business information update event, and enter the post-penetration process after completing the business test task.

[0162] In one embodiment, the third test module 400 can be used to compare the inherent information update content and / or business information update content in the information update event with a preset vulnerability library, so as to select and execute a vulnerability exploitation test task when vulnerability content exists, and enter the post-penetration process after completing the vulnerability exploitation test task.

[0163] In one embodiment, the post-penetration module 500 may be used to perform a post-penetration test on the corresponding electronic device after entering the post-penetration process.

[0164] The embodiments of the present invention disclosed above are only used to help illustrate the present invention. The embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A penetration test method, characterized in that: include: Get the information update event and determine the type of the information update event: When the information update event is an inherent information update event, according to the update content of the inherent information update event, the corresponding inherent test task is selected and executed, and after the inherent test task is completed, the corresponding asset business information is updated, and the business information update event is published; When the information update event is a business information update event, according to the update content of the business information update event, a corresponding business test task is selected and executed, and after completing the business test task, a post-penetration process is entered; After entering the post-penetration process, a post-penetration test is performed on the corresponding electronic device.

2. The penetration test method according to claim 1, characterized in that: The step of obtaining the information update event comprises: Detect network asset information of electronic devices in the target network; When new network asset information is scanned, the corresponding asset inherent information or asset business information is updated, and the corresponding inherent information update event or business information update event is published.

3. The penetration test method according to claim 1, characterized in that: The step of selecting and executing a corresponding inherent test task according to the update content of the inherent information update event, updating the corresponding asset business information after completing the inherent test task, and publishing the business information update event includes: Determine the updated content of the asset inherent information corresponding to the inherent information update event: When the update content of the asset inherent information includes one of the IP address, the port and the communication protocol, a password collision test task is selected and executed according to the update content, and after completing the password collision test task, the corresponding asset business information is updated and a corresponding business information update event is issued; When the update content of the asset inherent information includes the protocol type of the website information, a crawler test task is selected and executed according to the update content. After completing the crawler test task, the corresponding asset business information is updated and the corresponding business information update event is published.

4. The penetration test method according to claim 3, characterized in that: When the update content of the asset inherent information includes one of an IP address, a port, and a communication protocol, the steps of selecting and executing a password collision test task according to the update content, updating the corresponding asset business information after completing the password collision test task, and publishing the corresponding business information update event include: Determine whether the corresponding electronic device needs to log in with a password: If no password is required to log in, the test is passed; if password is required to log in, select and execute the password collision test task according to the IP address, port and communication protocol update content of the asset inherent information, log in in sequence according to the password data in the preset password library, and determine whether the login is successful: If the login fails, the test passes; If the login is successful, the corresponding asset business information will be updated according to the successful login user name and password data, and the corresponding business information update event will be published.

5. The penetration test method according to claim 3, characterized in that: When the update content of the asset inherent information includes the protocol type of the website information, the steps of selecting and executing the crawler test task according to the update content, updating the corresponding asset business information after completing the crawler test task, and publishing the corresponding business information update event include: Determine the protocol type of the website information of the asset inherent information: If the protocol type is not a protocol based on the Hypertext Transfer Protocol, the test passes; if the protocol type is a protocol based on the Hypertext Transfer Protocol, the crawler test task is selected and executed according to the protocol of the Hypertext Transfer Protocol, and it is determined whether the network resource identifier and its parameters are crawled: If the network resource identifier and its parameters are not crawled, the test passes; If the network resource identifier and its parameters are crawled, the corresponding asset business information is updated according to the updated content of the network resource identifier and its parameters, and the corresponding business information update event is published.

6. The penetration test method according to claim 1, characterized in that: When the information update event is a business information update event, according to the update content of the business information update event, a corresponding business test task is selected and executed, and after completing the business test task, the step of entering the post-penetration process includes: Determine the updated content of the asset business information corresponding to the business information update event: When the updated content of the asset business information includes a network resource identifier and one of its parameters, selecting and executing a fuzz test task according to the updated content, and entering a post-penetration process after completing the fuzz test task; When the updated content of the asset business information includes one of the user name and password data, a login penetration test task is selected and executed according to the updated content, and after completing the login penetration test task, a post-penetration process is entered.

7. The penetration test method according to claim 6, characterized in that: When the updated content of the asset business information includes a network resource identifier and one of its parameters, the steps of selecting and executing a fuzz test task according to the updated content, and entering a post-penetration process after completing the fuzz test task include: Determine whether the network resource identifier and parameters of the asset service information are updated: If not updated, the test passes; if updated, the fuzz test task is selected and executed according to the updated network resource identifier, and it is determined whether the fuzz test risk is detected; If not detected, the test is passed; If detected, the corresponding fuzz testing risk is obtained to enter the post-exploitation process.

8. The penetration test method according to claim 6, characterized in that: When the updated content of the asset business information includes one of the user name and password data, the steps of selecting and executing the login penetration test task according to the updated content, and entering the post-penetration process after completing the login penetration test task include: Determine whether the username and password data of the asset business information is updated: If it is not updated, the test passes; if it is updated, select and execute the login penetration test task according to the updated username and password data, and determine whether the login penetration is successful: If the login penetration is not successful, the test passes; If the penetration is successful, the post-penetration process will begin.

9. The penetration test method according to claim 1, characterized in that: The method further comprises: Compare the inherent information update content and / or the business information update content in the information update event with the preset vulnerability library: When there is no vulnerability content in the vulnerability database that is consistent with the inherent information update content and / or the business information update content, the test is passed; Otherwise, select and execute the vulnerability exploitation test task according to the consistent vulnerability content, and determine whether the corresponding vulnerability content is successfully exploited: If the exploit is unsuccessful, the test passes; If the exploit is successful, the corresponding vulnerability content will be obtained to enter the post-exploitation process.

10. A penetration test system, characterized in that: include: The judgment module is used to obtain the information update event and judge the type of the information update event: A first test module is used for, when the information update event is an inherent information update event, selecting and executing a corresponding inherent test task according to the update content of the inherent information update event, and after completing the inherent test task, updating the corresponding asset business information and publishing a business information update event; The second testing module is used for selecting and executing a corresponding business testing task according to the updated content of the business information update event when the information update event is a business information update event, and entering a post-penetration process after completing the business testing task; as well as The post-penetration module is used to perform a post-penetration test on the corresponding electronic device after entering the post-penetration process.

Images