Attack and defense drill intranet penetration cooperation method and system

Abstract

The invention discloses an attack and defense drill intranet penetration cooperation method and system, and the method comprises the steps: creating a project and a target unit, and creating an agent and an asset entry according to the target unit; carrying out attack and defense drill intranet penetration according to the created project, recording boundary information of entering an intranet from the Internet, carrying out intranet scanning by using an intranet scanning tool, carrying out adaptive processing on a scanning result, and cleaning obtained asset information; whether the cleaned asset information survives or not is judged in a proxy indirect or direct access mode, screenshot processing is carried out, and a centralized collaborative algorithm is used for achieving data synchronization; and uploading the report template, counting attack results of the attack condition of each project, performing optimization and total score according to attack and defense drill rules, and performing result aggregation to obtain a final report. According to the method, a score calculation algorithm is provided, real-time information sharing of intranet penetration data is realized through a collaborative algorithm, the internal communication cost of an attack team is reduced, and the attack drilling efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer and information security technology, and in particular to an attack and defense drill intranet penetration collaboration method and system. Background Art

[0002] With the deepening of digital construction, cyber security confrontation is becoming increasingly intensified, and attack and defense drills have become an important way for enterprises to test their own security construction. Attack and defense drills simulate real attack and defense scenarios, conduct attack tests on target networks, systems, and applications, discover potential security risks and defects, and enhance the information security defense capabilities of enterprises or organizations.

[0003] Actual combat attack and defense drills are becoming more and more normalized in various enterprises and units. Attack and defense drills are characterized by tight time and high confrontation intensity, and are generally divided into attack teams and defense teams. The red team simulates external attackers and attempts to invade the target system, network or application. With limited resources, the red team needs to obtain the system permissions of the target unit as quickly as possible and discover as many security issues as possible.

[0004] Faced with the large-scale intranet of modern enterprises, the single-person penetration platform is inefficient and cannot achieve information synchronization. The general collaborative document platform has inconsistent data formats, and there is a problem of missing information in internal communication within the team. Therefore, the present invention proposes an attack and defense drill intranet penetration system, and provides a score calculation algorithm and a collaborative algorithm, which can effectively improve the efficiency of attack and defense drills, reduce the economic cost, time cost and labor cost of intranet penetration, and visualize the security level of the enterprise. Summary of the invention

[0005] The purpose of the present invention is to address the deficiencies in the prior art and provide an attack and defense drill intranet penetration collaboration method and system, which can improve the efficiency of the attack red team intranet penetration collaboration.

[0006] The object of the present invention is to achieve the following technical solution: a method for intranet penetration collaboration in attack and defense drills, the method comprising:

[0007] S1. Create projects and target units, and create agent and asset entries based on the target units;

[0008] S2. Conduct attack and defense drills to penetrate the intranet according to the created project, record the boundary information of entering the intranet from the Internet, use the intranet scanning tool to scan the intranet and adapt the scanning results, and clean the obtained asset information;

[0009] S3. Determine whether the cleaned asset information is alive through indirect or direct access by proxy, take screenshots, and use a centralized collaborative algorithm to achieve data synchronization;

[0010] S4. Upload the report template, count the attack situation and attack results of each project, optimize the total score according to the attack and defense drill rules, and aggregate the results to obtain the final report.

[0011] Furthermore, the creation of the proxy includes: configuring a forward proxy or reverse proxy tunnel built by breaking through the boundary; the forward proxy needs to directly access the target unit application service, and the reverse proxy uses the service to forward the traffic proxy. For targets that can be directly accessed, there is no need to configure a proxy.

[0012] Furthermore, the intranet scan includes asset scanning and vulnerability scanning, scanning of intranet IPs and their port openness, identification of corresponding port services, and scanning and identification of common service or application vulnerabilities.

[0013] Furthermore, the adaptation process specifically includes: abstracting the intranet scanning result data into unified structured data.

[0014] Furthermore, the cleaning of the obtained asset information includes: removing the data containing the external network domain name part in the adapted data, and scripting the removal of the data that provides services but does not provide the account and password part.

[0015] Furthermore, the centralized collaborative algorithm includes: the smallest atom of the centralized collaborative algorithm is the attribute of the sub-item,

[0016] When creating, different users generate the same sub-entries, which are distinguished by IP and port as unique primary keys. If the primary keys are the same, the user who wrote to the platform last will prevail. When multiple users modify the same attribute of the same sub-entry at the same time, the value submitted to the server last will overwrite the values ​​of other users and will be pushed to different users in real time via WebSocket.

[0017] Regarding the order in which sub-items are displayed in an asset item, if multiple users modify the position of a sub-item under an asset item at the same time, a decimal index I is used to confirm the order of the sub-items, 0≤I<1. When inserting a sub-item, the index value selected is the average of the index values ​​of the two sub-items before and after. If there are identical index values, the server modifies the index value of the sub-item submitted later to the average of the index value of the sub-item submitted first and the sub-item after the insertion position.

[0018] Furthermore, the optimization total score includes two scenarios, specifically:

[0019] Scenario 1: The server permissions are obtained, and there are other web or database permissions on the server. If the drill can score multiple times for the same type of permissions on the same server, a certain total score V can be obtained for this scenario:

[0020]

[0021] There are K categories of sub-items in total, and the number of sub-types for each of the k categories is L. k The maximum score of this category is M k ; For a sub-item j of a specific category, its asset score is v kj , the number of sub-entries is n kj , the sub-item set is S k ; Total number of sub-entries m, sorted by creation primary key, sub-entries are sorted by a 1 ,a 2 ,...,a m Indicates that, where the single asset score v kj and the maximum asset value M k It is the score provided by the exercise party and is manually entered at the beginning of the project;

[0022] For each type k, the total score of the project is the maximum value M of the asset category. k The minimum value of the total score of all subtypes; the number of sub-items corresponding to the subtype in this scenario is n kj is the number of elements in the sub-entry set;

[0023] Scenario 2: For a single asset a i In the scenario where only one score can be counted, the maximum total score is described using integer linear programming:

[0024]

[0025]

[0026] For each type k, the total score v of the project kj is the maximum value M of this asset class k The minimum value of the total score of all subtypes. ikj Indicates sub-asset a i Whether the kth category j subcategory is calculated, satisfying subitem a i Belongs to the sub-item set S kj If it is calculated, it takes 1, if it is not calculated, it takes 0; b ikj The sum of is equal to the total number of sub-entries m; since the number of assets ai that can be repeatedly calculated is small, a brute force algorithm is used to obtain the optimal solution.

[0027] On the other hand, the specification also provides an attack and defense drill intranet penetration collaboration system, the system comprising: a front-end service layer, a collaborative editing layer, and a back-end execution layer;

[0028] The front-end service layer includes a rights management module, a data visualization module, a result import module, an asset cleaning module and a result aggregation module; the rights management module is used to control the project reading and editing permissions accessible to users, the data visualization module is used to visualize the current attack profile and implementation details of the project; the result import module is used to abstract the intranet scanning result data into unified structured data; the asset cleaning module includes cleaning the obtained asset information; the result aggregation module optimizes the total score according to the attack and defense drill rules and aggregates the results;

[0029] The collaborative editing layer includes an agent management module, an asset editing module, an asset management module, a document management module and a picture management module; the agent management module is used to create and manage agents; the asset editing module implements data synchronization based on a centralized collaborative algorithm; the asset management module is used to modify entries, the document management module is used to manage achievement documents, and the document content includes attack entry and attack achievement; the picture management module is used to save and manage screenshots and record the assets corresponding to the pictures;

[0030] The back-end execution layer includes a boundary breakthrough module and a service detection module; the boundary breakthrough module includes recording boundary information entering the intranet from the Internet, and the service detection module determines whether the cleaned assets are alive through indirect or direct access by proxy, and takes screenshots of the assets.

[0031] On the other hand, the present specification also provides an attack and defense drill intranet penetration collaboration device, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, the attack and defense drill intranet penetration collaboration method is implemented.

[0032] On the other hand, the present specification also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the method of intranet penetration collaboration in attack and defense drills is implemented.

[0033] The beneficial effects of the present invention are as follows: the collaborative algorithm is used to realize the real-time information sharing of intranet penetration data, which reduces the internal communication cost of the attack team and improves the efficiency of the drill attack. A score calculation algorithm is proposed to maximize the score calculation results. The visual display results are convenient for enterprises to check system security issues and strengthen network systems after subsequent attack and defense drills. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 The basic structure of the intranet penetration collaboration system for this application attack and defense drill;

[0035] Figure 2 A flow chart of the collaborative overall working method provided for this application example;

[0036] Figure 3 A schematic diagram of the intranet scanning results imported into the present invention is provided;

[0037] Figure 4 The network topology diagram of the project unit provided by the present invention;

[0038] Figure 5 A schematic diagram of the collaborative platform achievement document provided by the present invention;

[0039] Figure 6 A schematic diagram of a centralized collaborative algorithm provided by the present invention;

[0040] Figure 7 A schematic diagram of an intranet penetration collaboration device for attack and defense drills provided by the present invention. DETAILED DESCRIPTION

[0041] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0042] like Figure 1 As shown, the present invention provides an attack and defense drill intranet penetration collaboration method, the method comprising:

[0043] S1. Create projects and target units, and create agent and asset entries based on the target units;

[0044] The creation of a proxy includes: configuring a forward proxy or reverse proxy tunnel built by breaking through the boundary. The forward proxy needs to directly access the target unit's application service. Common protocols are HTTP and HTTPS. The reverse proxy uses the service to forward the traffic proxy. The main protocols are Sock5, Sock4, and Socks4a. For targets that can be directly accessed, there is no need to configure a proxy.

[0045] S2. Conduct attack and defense drills to penetrate the intranet according to the created project, record the entry information from the Internet to the intranet, use the intranet scanning tool to scan the intranet and adapt the scanning results, and clean the obtained asset information;

[0046] The intranet scan includes asset scanning and vulnerability scanning, scanning of intranet IPs and their port opening conditions, identification of corresponding port services, and scanning and identification of common service or application vulnerabilities.

[0047] The adaptation process is to abstract the intranet scanning result data into unified structured data and import it into the system, including the adaptation of mainstream open source scanning tools such as fscan, fscan4all, afrog, etc., as well as the results of intranet vulnerability scanning tools.

[0048] The cleaning of the obtained asset information includes: the scanning tool may encounter various situations, the imported adapted data may contain external network domain names, which need to be removed, and some data that provides services but does not provide an account and password can be removed by scripting.

[0049] S3. Determine whether the cleaned asset information is alive through indirect or direct access by proxy, take screenshots, and use a centralized collaborative algorithm to achieve data synchronization;

[0050] Specifically, for cleaned assets, determine whether the resources are alive through indirect or direct access through agents, and take screenshots of the assets;

[0051] For database assets, the dataminer tool is used to link and read sample data, and the data value is manually determined later. For services such as RDP, SSH, and FTP, screenshots are mainly obtained as the basis for obtaining permissions.

[0052] The use of a centralized collaborative algorithm to achieve data synchronization includes: when creating, different users generate the same sub-item using IP and port as the unique primary key to distinguish, if the primary key is the same, the user who last wrote to the platform will prevail. When multiple users modify the same attribute of the same sub-item at the same time, the value submitted to the server last will overwrite the values ​​of other users and be pushed to different users in real time through WebSocket.

[0053] For the order in which sub-items are displayed in an asset item, if multiple users modify the position of sub-items under an asset item at the same time, a decimal index I is used to confirm the order of sub-items, 0≤I<1. Figure 6 The asset entry shown is {a 1 ,a 2}, sub-item a 3 Insert sub-entry a 1 and a 2 The index value is and Insert a new node in the middle and add a new sub-entry a 3 The index value of If the index value is the same, a' 3 , user A and user B simultaneously submitted the index I a3 , the server will modify the index value of the sub-item submitted later The index is confirmed, and the atomic operation of the sub-entries can ensure the consistency of data coordination.

[0054] S4. Upload the report template, count the attack situation and attack results of each project, optimize the total score according to the attack and defense drill rules, and aggregate the results to obtain the final report.

[0055] For the algorithm to optimize the total score. As shown in Table 1, there are K categories of sub-items in total, and the number of sub-types for each k category is L k The maximum score of this category is M k For a sub-item j of a specific category, its asset score is v kj , the number of sub-entries is n kj , the sub-item set is S k The total number of sub-entries is m, and the sub-entries can be sorted by creating the primary key using a 1 ,a 2 ,...,a m Indicates. Among them, the single asset score v kj and the maximum asset value M k It is the score provided by the exercise party and entered manually at the beginning of the project.

[0056] Table 1 Asset classification and its expression

[0057]

[0058]

[0059] Scenario 1: The server permissions are obtained, and there are other web or database permissions on the server. If the drill can score multiple times for the same server permissions, a certain total score V can be obtained for this scenario:

[0060] Where n kj =|S kj |.

[0061] For each type k, the total score of the project is the maximum value M of the asset category. k The minimum value of the total score of all subtypes. The number of sub-items corresponding to the subtype in this scenario is n kj is the number of elements in the subentries collection.

[0062] Scenario 2: For a single asset a i In the scenario where only one score can be calculated, the maximum total score can be described by integer linear programming:

[0063]

[0064]

[0065] For each type k, the total score v of the project kj is the maximum value of this asset class M k The minimum value of the total score of all subtypes. ikj Indicates sub-asset a i Whether the kth category j subcategory is calculated, satisfying subitem ai Belongs to the sub-item set S kj If it is calculated, it takes 1, if it is not calculated, it takes 0. ikj The sum of the sub-entries is equal to the total number of sub-entries m. Since the asset a can be counted repeatedly i If the number of problems is small, a brute force algorithm can be used to obtain the optimal solution.

[0066] like Figure 2 As shown, according to the method embodiment provided above, this specification also provides an embodiment of the attack and defense drill intranet penetration collaboration system. The system can be divided into a front-end service layer 100, a collaborative editing layer 200 and a back-end execution layer 300 according to function. This embodiment is suitable for larger target units and supports more collaborative work concurrency.

[0067] The front-end service layer 100 directly interacts with the user, including the display, import and export of data, and includes a permission management module 110 , a data visualization module 120 , a data import module 130 , an asset cleaning module 140 , and an achievement aggregation module 150 .

[0068] Permission management module 110, authorized administrators and team users can log in to the system, each team member can only access authorized projects, and the assets of authorized projects are divided into two permissions: readable and editable.

[0069] Data visualization module 120,Data visualization consists of two parts: attack overview and project implementation details;

[0070] The attack overview shows the penetration progress of the current project. For multiple targets of a project, it visualizes the scores of different asset types, the daily change in success, and the current scores of different asset types for each target; asset types include sensitive intranet information, Web services, and host permissions. Figure 4 The data visualization module 120 provided by the present invention provides a unit network topology diagram, which is convenient for summarizing asset information and displaying attack progress. It contains vulnerability information of boundary breakthrough entry points, and displays IP information inside and outside the entry points. Optionally, more information such as system type, system version, service type, penetration progress, etc. can be added as required. Entries of different network segments of intranet assets use different colors, and different types of operating systems use different icons. Optionally, add node horizontal coordinates based on time, and the larger the entry score, the larger the node.

[0071] The project implementation details include the unit network topology diagram, each host operating system type, corresponding IP, port enabled services and corresponding asset information on the host.

[0072] The data import module 130 abstracts the intranet scanning result data into a unified structured data import system, including the adaptation of mainstream open source scanning tools such as fscan, fscan4all, afrog, etc., as well as the results of self-developed intranet vulnerability scanning tools.

[0073] Intranet scanning tools include asset scanning and vulnerability scanning, scanning of intranet IP addresses and their port openness, identification of corresponding port services, and scanning and identification of common service or application vulnerabilities;

[0074] Asset cleaning module 140, the scanning tool will encounter various situations. The imported adapted data may contain external network domain names, which need to be removed. Some data that provides services but does not provide account passwords can be scripted for removal.

[0075] The achievement aggregation module 150 aggregates the intranet assets edited by the service exploration module and the asset management module 230; this module includes report template uploading, template editing, report management and final report export. The achievement aggregation module counts the attack situation and attack results of each project to facilitate unified data regulation and regular review. In the achievement aggregation module 150, the total score algorithm is optimized for the attack and defense drill rules as shown in the method embodiment.

[0076] The collaborative editing layer 200 includes an agent management module 210 , an asset editing module 220 , an asset management module 230 , a document management module 240 , and a picture management module 250 .

[0077] The proxy management module 210 configures the forward proxy or reverse proxy tunnel built by the boundary breakthrough. The forward proxy needs to directly access the target unit application service. The common protocols are HTTP and HTTPS. The reverse proxy uses the service to forward the traffic proxy. The main protocols are Sock5, Sock4, and Socks4a. For targets that can be directly accessed, there is no need to configure a proxy.

[0078] Asset editing module 220, which is the core of the embodiment of the present invention, is implemented through WebSocket. Traditional HTTP transmission based on B / S framework platform is one-way. Corresponding to a single entry located by ip-port-service, the attack team members who visit can log in to the WebSocket route of the single entry, and the assets, data, and screenshots of the corresponding page can be updated in real time. Sub-entries can be added to the entry on this page, and the notes, scores, and types of the sub-entries can be added and modified, and sub-entry screenshots can be added and deleted.

[0079] This module is aimed at multi-user document collaboration. The present invention implements a centralized collaborative algorithm to solve the collaboration problem under intranet penetration. The smallest atom of the collaborative operation algorithm of the present invention is the attribute of the sub-item, such as the sub-item service type, sub-item account password, etc. Modifying different attributes of the same sub-item will not cause conflicts.

[0080] When creating, different users generate the same sub-entries and use IP and port as the unique primary key to distinguish them. If the primary keys are the same, the user who last wrote to the platform will prevail. When multiple users modify the same attribute of the same sub-entry at the same time, the value submitted to the server last will overwrite the values ​​of other users and be pushed to different users in real time through WebSocket.

[0081] For the order in which sub-items are displayed in an asset item, if multiple users modify the position of sub-items under an asset item at the same time, a decimal index I is used to confirm the order of sub-items, 0≤I<1. Figure 6 The asset entry shown is {a 1 ,a 2}, sub-item a 3 Insert sub-entry a 1 and a 2 The index value is and Insert a new node in the middle and add a new sub-entry a 3 The index value of If the index value is the same, a' 3 , user A and user B simultaneously submitted the index The server will modify the index value of the sub-item submitted later The index is confirmed, and the atomic operation of the sub-entries can ensure the consistency of data coordination.

[0082] Asset management module 230, when modifying an item, network segment, target, or project, this module can be used to implement the modification, including sub-items, pictures, files and other resources of the item.

[0083] The document management module 240 manages the achievement documents. The document content includes the attack entry and the attack achievement. Optionally, the document management module simply records the document attack progress, document time, and document size. Figure 5 As shown, the document template passes through the achievement aggregation module 150 and is downloaded after data is added.

[0084] Due to different requirements for different attack and defense drills, the collaboration platform modifies and configures templates according to the requirements of the organizer. It includes the time, project, entry point, corresponding asset information, potential impact of vulnerabilities, etc. In order to seize the points during the actual drill, the results are added to the report in the form of increments, and the report supports segmented markup incremental submission. Optionally, different file versions can be deleted and modified through the document management module.

[0085] The picture management module 250 is used to manage the achievement screenshots and importance description screenshots of the document, and also records the assets corresponding to the pictures.

[0086] The backend execution layer 300 mainly includes multiple boundary breakthrough modules 310 and service detection modules 320. The boundary breakthrough module 310 is a self-owned system or other penetration tool, and the boundary points can be automatically or manually obtained. Different service detection modules can be different types of scanning nodes that can be expanded horizontally.

[0087] Boundary breakthrough module 310, there are various ways to enter the target intranet from the Internet, this module records the entry information;

[0088] Optionally, this module is used as a tool to obtain boundaries manually or to link data with the penetration permission acquisition platform. The main types include Webshell type and its account password, RDP account password, SSH account password, etc.

[0089] Figure 3 This is a schematic diagram of the intranet scan results. This document is the product of the boundary breakthrough module 310 and is also an optional input for the result import module 130, indicating that the current attack and defense drill has entered the intranet. The import report contains the network segment to which the attack target belongs, the IP open port status, the corresponding port service type, the web page title, etc. If there is a vulnerability, the corresponding vulnerability exploitation information POC is displayed. The scan report only contains IP, port, and service information for the convenience of subsequent modules.

[0090] The service detection module 320 determines whether the cleaned assets are alive through indirect or direct access by proxy, and takes screenshots of the assets;

[0091] For database assets, the dataminer tool is used to link and read sample data, and the data value is manually determined later. For services such as RDP, SSH, and FTP, screenshots are mainly obtained as the basis for obtaining permissions.

[0092] Corresponding to the aforementioned embodiment of an attack and defense drill intranet penetration collaboration method, the present invention also provides an embodiment of an attack and defense drill intranet penetration collaboration device.

[0093] See also Figure 7An attack and defense drill intranet penetration collaboration device provided by an embodiment of the present invention includes a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement an attack and defense drill intranet penetration collaboration method in the above embodiment.

[0094] An embodiment of an attack and defense drill intranet penetration collaboration device provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From the hardware level, if Figure 7 As shown, it is a hardware structure diagram of any device with data processing capability where an attack and defense drill intranet penetration collaboration device provided by the present invention is located, except Figure 7 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0095] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0096] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0097] An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, an attack and defense drill intranet penetration collaboration method in the above embodiment is implemented.

[0098] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0099] The present invention also provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the attack and defense drill intranet penetration collaboration method.

[0100] Those skilled in the art will readily appreciate other embodiments of the present application after considering the description and practicing the contents disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The description and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

[0101] It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit the present application. The present application is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the attached claims.

Claims

1. A method for intranet penetration collaboration in attack and defense drills, characterized in that: The method includes: S1. Create projects and target units, and create agent and asset entries based on the target units; S2. Conduct attack and defense drills to penetrate the intranet according to the created project, record the boundary information of entering the intranet from the Internet, use the intranet scanning tool to scan the intranet and adapt the scanning results, and clean the obtained asset information; S3. Determine whether the cleaned asset information is alive through indirect or direct access by proxy, take screenshots, and use a centralized collaborative algorithm to achieve data synchronization; S4. Upload the report template, count the attack situation and attack results of each project, optimize the total score according to the attack and defense drill rules, and aggregate the results to obtain the final report.

2. According to claim 1, the method for intranet penetration collaboration in attack and defense drills is characterized in that: The creation of the proxy includes: configuring a forward proxy or reverse proxy tunnel built by breaking through the boundary; the forward proxy needs to directly access the target unit application service, and the reverse proxy uses the service to forward the traffic proxy. For targets that can be directly accessed, there is no need to configure a proxy.

3. According to claim 1, the method for intranet penetration collaboration in attack and defense drills is characterized in that: The intranet scan includes asset scanning and vulnerability scanning, scanning of intranet IPs and their port openness, identification of corresponding port services, and scanning and identification of common service or application vulnerabilities.

4. According to claim 1, the method for intranet penetration collaboration in attack and defense drills is characterized in that: The adaptation process specifically includes: abstracting the intranet scanning result data into unified structured data.

5. According to claim 1, the method for intranet penetration collaboration in attack and defense drills is characterized in that: The cleaning of the obtained asset information includes: removing the data containing the external network domain name part in the adapted data, and scripting the removal of the data that provides services but does not provide the account and password part.

6. The method for intranet penetration collaboration in attack and defense drills according to claim 1 is characterized in that: The centralized collaborative algorithm includes: the smallest atom of the centralized collaborative algorithm is the attribute of the sub-entry, When creating, different users generate the same sub-item, which is distinguished by the unique primary key of IP and port. If the primary key is the same, the user who wrote it to the platform last will prevail. When multiple users modify the same attribute of the same sub-item at the same time, the value submitted to the server last will overwrite the value of other users, and will be pushed to different users in real time through WebSocket. Regarding the order in which sub-items are displayed in an asset item, if multiple users modify the position of a sub-item under an asset item at the same time, a decimal index I is used to confirm the order of the sub-items, 0≤I<1. When inserting a sub-item, the index value selected is the average of the index values ​​of the two sub-items before and after. If there are identical index values, the server modifies the index value of the sub-item submitted later to the average of the index value of the sub-item submitted first and the sub-item after the insertion position.

7. The method for intranet penetration collaboration in attack and defense drills according to claim 1 is characterized in that: The total optimization score includes two scenarios, specifically: Scenario 1: The server permissions are obtained, and there are other web or database permissions on the server. If the drill can score multiple times for the same type of permissions on the same server, a certain total score V can be obtained for this scenario: There are K categories of sub-items in total, and the number of sub-types for each of the k categories is L. k The maximum score of this category is M k ; For a sub-item j of a specific category, its asset score is v k j , the number of sub-entries is n k j , the sub-item set is S k ; The total number of sub-entries is m, and the sub-entries are sorted by the creation primary key using a1, a2, ..., a m Indicates that, where the single asset score v kj and the maximum asset value M k It is the score provided by the exercise party and is manually entered at the beginning of the project; For each type k, the total score of the project is the maximum value M of the asset category. k The minimum value of the total score of all subtypes; the number of sub-items corresponding to the subtype in this scenario is n k j is the number of elements in the sub-entry set; Scenario 2: For a single asset a i In the scenario where only one score can be counted, the maximum total score is described using integer linear programming: For each type k, the total score v of the project k j is the maximum value of this asset class M k and the minimum value of the total score of all subtypes; where b ikj Indicates sub-asset a i Whether the kth category j subcategory is calculated, satisfying subitem a i Belongs to the sub-item set S kj If it is calculated, it takes 1, if it is not calculated, it takes 0; b ikj The sum of the sub-items is equal to the total number of sub-items m; since the asset a can be counted repeatedly i The number of problems is small, so a brute force algorithm is used to obtain the optimal solution.

8. A system for implementing the method according to any one of claims 1 to 7, characterized in that: The system includes: a front-end service layer, a collaborative editing layer and a back-end execution layer; The front-end service layer includes a rights management module, a data visualization module, a result import module, an asset cleaning module and a result aggregation module; the rights management module is used to control the project reading and editing permissions accessible to users, the data visualization module is used to visualize the current attack profile and implementation details of the project; the result import module is used to abstract the intranet scanning result data into unified structured data; the asset cleaning module includes cleaning the obtained asset information; the result aggregation module optimizes the total score according to the attack and defense drill rules and aggregates the results; The collaborative editing layer includes an agent management module, an asset editing module, an asset management module, a document management module and a picture management module; the agent management module is used to create and manage agents; the asset editing module implements data synchronization based on a centralized collaborative algorithm; the asset management module is used to modify entries, the document management module is used to manage achievement documents, and the document content includes attack entry and attack achievement; the picture management module is used to save and manage screenshots and record the assets corresponding to the pictures; The back-end execution layer includes a boundary breakthrough module and a service detection module; the boundary breakthrough module includes recording boundary information entering the intranet from the Internet, and the service detection module determines whether the cleaned assets are alive through indirect or direct access by proxy, and takes screenshots of the assets.

9. An attack and defense drill intranet penetration collaboration device, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, an attack and defense drill intranet penetration collaboration method as described in any one of claims 1-7 is implemented.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, an attack and defense drill intranet penetration collaboration method as described in any one of claims 1-7 is implemented.

Images