Penetration test system with automatic penetration strategy generation capability
By designing an automated penetration testing system that generates penetration testing strategies, and utilizing reinforcement learning to train and generate these strategies, this system integrates information gathering, vulnerability discovery, and exploitation toolchains. This solves the problems of low efficiency and poor adaptability of traditional penetration testing tools, and enables adaptive penetration testing in multi-subnet environments of network test ranges.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- DACHUAN XINAN (CHENGDU) TECHNOLOGY CO LTD
- Filing Date
- 2026-01-29
- Publication Date
- 2026-05-01
AI Technical Summary
Traditional penetration testing tools rely on expert knowledge, are inefficient, and have poor adaptability, making it difficult to meet the needs of large-scale, automated penetration testing in complex environments with multiple subnets and multiple hosts in network test ranges. Existing penetration testing solutions based on reinforcement learning lack real-world scenario adaptation.
Design a penetration testing system with automated penetration strategy generation capability. It adopts a top-down three-layer architecture, including a visualization layer, a functional module layer, and a data interaction layer. It uses the LI-PPO algorithm for reinforcement learning training to generate penetration testing strategies and integrates information gathering, vulnerability discovery, and vulnerability exploitation toolchains to adapt to network test range environments.
It achieves a high degree of automation in penetration testing, improves testing efficiency and accuracy, reduces reliance on human expert knowledge, supports cross-subnet penetration strategy generation in multi-subnet environments, and meets the testing needs of complex network topologies.
Smart Images
Figure CN121967004A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of cybersecurity technology, and in particular to a penetration testing system with the ability to automatically generate penetration strategies. Background Technology
[0002] In the field of cybersecurity, penetration testing is a key means of assessing the security of a target system. Its core is to simulate attacker behavior, discover vulnerabilities in the target network, and verify their exploitability. Traditional penetration testing tools (such as standalone vulnerability scanners and manual attack frameworks) have significant limitations: on the one hand, these tools heavily rely on the expert knowledge of the operators, requiring manual parameter configuration and vulnerability exploitation path determination, which is a high barrier to entry and prone to incomplete testing due to human error; on the other hand, traditional tools struggle to balance testing efficiency and accuracy, and cannot adapt to dynamic changes in the target network topology, especially in complex environments like network ranges with multiple subnets and hosts, making it difficult to meet the needs of large-scale, automated penetration testing.
[0003] With the development of artificial intelligence technology, reinforcement learning offers a new path to solve the aforementioned problems. Reinforcement learning can train agents in simulated environments, enabling them to autonomously learn optimal attack strategies and reducing reliance on human intervention. However, existing penetration testing solutions based on reinforcement learning are mostly limited to theoretical models, lacking deep integration with actual penetration testing tools, and failing to form a complete closed loop of "information gathering – vulnerability discovery – strategy generation – vulnerability exploitation," thus making them unsuitable for direct application in actual testing scenarios in network ranges.
[0004] Therefore, there is an urgent need to design a penetration testing system that can integrate an automated toolchain, generate penetration strategies based on reinforcement learning, and adapt to network test environments, in order to fill the gap between existing technologies in "intelligent strategy generation" and "real-world scenario implementation" and achieve automation and efficiency of the entire penetration testing process. Summary of the Invention
[0005] Therefore, it is necessary to address the aforementioned technical issues by developing a penetration testing system with automated penetration strategy generation capabilities. This system would solve the problems of traditional penetration testing tools, such as reliance on expert knowledge, low efficiency, and poor adaptability, and enable adaptive penetration testing in multi-subnet environments of network test ranges, covering the entire process of "information gathering - vulnerability discovery - strategy generation - vulnerability exploitation".
[0006] Firstly, this application provides a penetration testing system with automated penetration strategy generation capabilities, comprising a visualization layer, a functional module layer, and a data interaction layer that are interconnected from top to bottom, wherein: The functional module layer includes an information collection module, a vulnerability discovery module, a vulnerability exploitation module, and an attack strategy generation module, with communication connections between the modules; The attack strategy generation module is configured to use the LI-PPO algorithm to build a penetration testing simulation environment based on the target network environment model, and generate penetration testing strategies for the target network through reinforcement learning training. The information collection module, vulnerability discovery module, and vulnerability exploitation module work together in sequence and all communicate with the attack strategy generation module to perform corresponding penetration testing operations based on the penetration testing strategy output by the attack strategy generation module. The visualization layer is configured to enable user interaction and display system functions and results; The data interaction layer is configured to manage and store data for each layer and module of the system.
[0007] Optionally, in one embodiment of this application, the information collection module is configured to perform at least one of the following operations: using the Nmap tool to perform target operating system identification and port scanning, using the WhatWeb tool to collect web fingerprint information, using the Python whois library to obtain the Whois information of the target domain name, using the wafw00f tool to identify whether the target has deployed a web application firewall and the type of firewall, using a web crawler to obtain the title and snapshot of the website, and using file type identification and text recognition technology to scan the target sensitive files.
[0008] Optionally, in one embodiment of this application, the target information collected by the information collection module includes target domain name, IP address, port, service type, web fingerprint, operating system type, web application firewall information, Whois registration information, and sensitive files. The web fingerprint includes CMS fingerprint, middleware information, and server-side script information, and the sensitive files include backup files, configuration files, and log files.
[0009] Optionally, in one embodiment of this application, the vulnerability discovery module is configured to integrate an Xray vulnerability scanner and a Nuclei vulnerability scanner, and the vulnerability scanning execution steps include: Read the list of target URLs to be scanned; For each target URL, start Xray and set the proxy to Xray's port, while calling Nuclei's API interface and passing in the target URL and scanning template; Obtain the Xray report output file and the Nuclei API return result respectively; The results from both are merged and transmitted to the visualization layer.
[0010] Optionally, in one embodiment of this application, the Xray vulnerability scanner supports active scanning mode and passive scanning mode. The passive scanning mode intercepts and analyzes HTTP requests and responses through a proxy. The Nuclei vulnerability scanner supports HTTP, HTTPS, DNS, TCP, and UDP protocols and is configured with built-in vulnerability scanning templates and custom templates. The vulnerability scanning templates correspond to XSS, SQL injection, SSRF, and file inclusion vulnerability types.
[0011] Optionally, in one embodiment of this application, the exploit module is configured to integrate sqlmap, Metasploit, and Pocsuite3 tools; the exploit module communicates with Metasploit through the Pymetasploit3 library, and after starting Metasploit, sets the exploit, payload, and parameters through a Python script and launches an attack, returning a session_id; the exploit module is also configured with a webssh terminal for executing SQL injection attacks via command-line operation of sqlmap; the Pocsuite3 is configured to provide vulnerability verification, vulnerability exploitation, and reverse shell functions, and supports custom exploit scripts.
[0012] Optionally, in one embodiment of this application, the attack strategy generation module's operation includes a training phase and a generation phase. The training phase is configured to abstract the target network environment into a penetration testing simulation environment. The penetration testing simulation environment includes the IP addresses, operating system types, and running service information of each host in the target network, as well as the scanning, probing, and exploitation operations that the agent can perform. The agent interacts with the penetration testing simulation environment through the LI-PPO algorithm to obtain rewards or penalties to update the Actor network and Critic network, completing reinforcement learning training. The generation phase is configured to load the trained agent model and target network environment information, generate specific attack schemes, and parse and expand the attack schemes to realize the conversion between actual network IPs and simulated environment host addresses.
[0013] Optionally, in one embodiment of this application, the visualization layer is configured with a new task page, a task list page, an attack strategy generation page, and a result display page, wherein: The new task page is configured to create penetration testing tasks and synchronize task information to the data interaction layer. The task list page is configured to manage the status and overall results of created tasks; The attack strategy generation page is configured to display penetration testing strategies generated based on information from the information gathering module and the vulnerability discovery module. The results display page is configured to show the overall results of the penetration testing task.
[0014] Optionally, in one embodiment of this application, the data interaction layer is configured to perform the following data operations: Collect, clean, and label information collection data, vulnerability scanning data, attack strategy data, and penetration test result data generated by each layer and module of the system, and store the processed data in the database. Based on the request from the visualization layer, the corresponding data is extracted from the database and transmitted to the visualization layer for display.
[0015] Optionally, in one embodiment of this application, the system is configured to adapt to the network range environment and is able to obtain host information of each subnet through the information collection module based on the multi-subnet target network composed of the DMZ zone, business zone and intranet office zone in the network range. The attack strategy generation module generates cross-subnet penetration testing strategies for the multi-subnet topology, and the vulnerability exploitation module executes operations based on the cross-subnet penetration testing strategies.
[0016] Compared with the prior art, the present invention has the following beneficial effects: First, it has a high degree of automation: it autonomously generates penetration strategies through the LI-PPO algorithm of reinforcement learning, integrates information gathering, vulnerability discovery, and vulnerability exploitation toolchains, reduces reliance on human expert knowledge, and lowers the threshold for penetration testing. Second, it balances testing efficiency and accuracy: it adopts a vulnerability scanning solution that combines Xray and Nuclei, covering both active and passive scanning scenarios, and combines optimal path planning with reinforcement learning strategies to improve testing efficiency and vulnerability discovery rate. Third, it has strong adaptability: it supports multi-subnet environments in network test ranges and can generate cross-subnet penetration strategies to meet the testing needs of complex network topologies. Fourth, it is highly operable: it enables task creation, process monitoring, and result viewing through a visual interface, supports semi-automatic vulnerability exploitation, and balances the flexibility of automation and manual intervention. Attached Figure Description
[0017] Figure 1 This is a schematic diagram of the architecture of a penetration testing system with automated penetration strategy generation capability in one embodiment; Figure 2 This is a flowchart illustrating the attack strategy generation module in one embodiment; Figure 3 This is a diagram of the experimental network topology in one embodiment; Figure 4 This is a diagram of a newly created task page in one embodiment; Figure 5This is a screenshot of a task list page in one embodiment; Figure 6 This is a diagram illustrating information collection in one embodiment; Figure 7 Here is a diagram illustrating vulnerability information in one embodiment; Figure 8 Here is a diagram showing detailed vulnerability information in one embodiment; Figure 9 Generate a page graph for an attack strategy in one embodiment; Figure 10 This is a page diagram illustrating the exploitation mechanism in one embodiment. Detailed Implementation
[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0019] In one embodiment, such as Figure 1 As shown, a penetration testing system with automated penetration strategy generation capability is provided. The system adopts a top-down three-layer communication architecture, namely a visualization layer, a functional module layer, and a data interaction layer. Data transmission and command interaction between each layer are realized through standardized interfaces to ensure the overall collaborative operation of the system.
[0020] In one embodiment, the visualization layer is configured to visualize user interaction and system functions and results, specifically including four types of core pages: Create a new task page: allows users to input the target network's IP address, IP range, or domain name, configure penetration testing task parameters (such as scan depth and policy generation mode), and synchronize task information to the database of the data interaction layer; Task list page: Displays the status of all created tasks (such as "Pending", "In Execution", "Completed"), target address, creation time, and overall test results. Users can view task details or terminate tasks. Attack strategy generation page: Based on the output data of the information gathering module and the vulnerability discovery module, it displays the penetration testing strategy generated by the reinforcement learning model, including the target host, operating system, attack actions (such as "information gathering", "vulnerability scanning" and "SSH brute force") and operation description. Results display page: Integrates information collection results (such as port services, Whois information), vulnerability scanning results (such as vulnerability URLs, verification tools), and vulnerability exploitation results (such as session IDs, control acquisition status), providing users with a holistic view of the entire penetration testing process.
[0021] In one embodiment, the functional module layer is the core execution layer of the system, including an information collection module, a vulnerability discovery module, a vulnerability exploitation module, and an attack strategy generation module. These modules communicate with each other through a data interaction layer to form a collaborative workflow, specifically including: In one embodiment of this application, the information collection module is configured to automatically acquire basic information about the target network to provide data support for subsequent vulnerability detection and strategy generation, specifically by performing the following operations: Use the Python whois library to query the Whois information of the target domain name and obtain registration data such as IP address, owner, registrar, and DNS; Use web crawling technology to extract website titles and snapshot information; Integrate the Nmap tool to perform target operating system identification (analyzing response characteristics by sending specific data packets) and port scanning (detecting open ports and corresponding services, such as FTP, SSH, and HTTP). The wafw00f tool is used to identify whether a target has deployed a Web Application Firewall (WAF) and the type of WAF (this is achieved by analyzing HTTP response headers and page characteristic strings). By using file type recognition (reading file headers and extensions) and text recognition (regular expressions and keyword matching) technologies, sensitive files (such as backup files, configuration files, and log files) in target web applications are scanned. The WhatWeb tool is used to collect web fingerprint information, including CMS type (such as WordPress, Drupal), middleware version, and server-side scripting language (such as PHP, Java).
[0022] In one embodiment of this application, the target information output by the information collection module includes: domain name, IP address, port, service type, web fingerprint, operating system type, WAF information, Whois registration information, and sensitive file path.
[0023] In one embodiment of this application, the vulnerability discovery module is configured to integrate an Xray vulnerability scanner and a Nuclei vulnerability scanner. It comprehensively detects known vulnerabilities in the target network through a combination of passive and active scanning. The execution steps are as follows: Read the list of target URLs to be scanned from the task creation window in the visualization layer; For each target URL, start Xray and set the proxy to Xray's listening port (Xray uses passive scanning mode, intercepts and analyzes HTTP requests and responses through the proxy, and detects web vulnerabilities such as SQL injection, XSS, and file inclusion). At the same time, call Nuclei's API interface, pass in the target URL and scanning template (Nuclei supports HTTP, HTTPS, DNS, TCP, UDP protocols, has built-in scanning templates for vulnerabilities such as XSS, SQL injection, and SSRF, and also supports user-defined templates). Wait for the Nuclei scan to complete and retrieve the scan results from its API interface; wait for the Xray scan to complete and extract the scan results from its configured report output file (such as JSON format); The scan results from Xray and Nuclei are deduplicated and merged, and vulnerability information in a unified format (including vulnerability URL, vulnerability type, verification tool, and POC file path) is transmitted to the visualization layer.
[0024] In one embodiment of this application, the vulnerability exploitation module is configured to integrate three tools: sqlmap, Metasploit, and Pocsuite3. Based on the penetration strategy output by the attack strategy generation module, it semi-automatically executes the vulnerability exploitation operation, as specifically implemented below: For SQL injection vulnerabilities: Through the system's built-in webssh terminal, users can operate sqlmap via command line (such as default parameter scanning and interactive injection testing), and the injection results (such as database accounts and sensitive data) are displayed in real time in the visualization layer. For common vulnerabilities (such as remote code execution and buffer overflow): Communicate with Metasploit through the Pymetasploit3 library. First, start the Metasploit RPC service, then use a Python script to set the exploit (attack module), payload, and target parameters (such as target IP and port). After launching the attack, return the session_id (used for subsequent control management). For historical or custom vulnerabilities in CMS: Utilize Pocsuite3's vulnerability verification, exploitation, and reverse shell functions. The system has built-in exploit scripts for commonly used CMS and also supports user-uploaded custom exploits. Users can select scripts and execute exploits through a visual interface.
[0025] In one embodiment of this application, the attack strategy generation module is configured to use the LI-PPO (Improved Proximity Policy Optimization) algorithm to generate an optimal penetration testing strategy based on target network environment modeling, such as... Figure 2 As shown, the working process is divided into a training phase and a generation phase: The training phase includes: First, the target network environment is abstracted into a penetration testing simulation environment. The simulation environment includes: the IP address of each host in the target network (mapped to a simulated address, such as mapping the actual IP 10.0.20.66 to (1,0)), operating system type, running service information, and attack actions that the agent can execute (such as "scan", "probe", "exploit vulnerabilities" and "privilege escalation"). Next, the agent is trained using the LI-PPO algorithm: the agent interacts with the simulated environment, performs attack actions and obtains rewards (such as a positive reward for successfully discovering a vulnerability and a negative reward for a failed attack). The Actor network (responsible for selecting attack actions) and the Critic network (responsible for evaluating the value of actions) are updated based on the reward signals until the model converges, resulting in a trained model that can generate feasible penetration strategies.
[0026] The generation phase includes: First, load the trained agent model, and at the same time read the actual target network information (such as subnet topology and host services) output by the information collection module from the data interaction layer. Then, the agent reproduces the target network topology in a simulated environment, executes a simulated attack, and generates an initial attack path; Next, the initial attack path is analyzed and expanded: the host address in the simulated environment is converted into the actual network IP (e.g., (1,0) is converted into 10.0.20.66), and the scanning operation and the tool corresponding to the target and vulnerability exploitation operation in the path are extracted (e.g., "SSH brute force" corresponds to the ssh_login module of Metasploit), forming a practical penetration testing strategy. Finally, the penetration testing strategy is transmitted to the visualization layer and the vulnerability exploitation module, which are used to demonstrate and guide attack operations, respectively.
[0027] In one embodiment of this application, the visualization layer is configured to receive output data from the information collection module, the vulnerability discovery module, and the attack strategy generation module, format the data according to the display page requirements, and transmit it to the front-end interface to ensure that users can intuitively view the test process and results.
[0028] In one embodiment, the data interaction layer is configured as the system's data hub, responsible for the full lifecycle management of data from all layers and modules. Specific operations include: Data Acquisition: Real-time reception of target information from the information collection module, scan results from the vulnerability discovery module, strategy data from the attack strategy generation module, and execution results from the vulnerability exploitation module; Data processing: Cleaning the collected raw data (such as removing invalid IPs and deduplicating vulnerability records), labeling (such as adding "high-risk" or "medium-risk" risk level labels to vulnerabilities), and format conversion (unifying to JSON or relational database format); Data storage: The processed data is stored in a database (such as MySQL for task information, or MongoDB for vulnerability details) to ensure data traceability; Data Query and Transmission: Based on the request from the visualization layer (such as a user viewing the vulnerability results of a task), extract the corresponding data from the database, format it, and then transmit it to the front-end page.
[0029] In one embodiment of this application, the system is configured to adapt to a multi-subnet environment of a network test range, enabling penetration testing of a target network consisting of a DMZ zone, a service zone, and an internal office zone. The information collection module can obtain the IP, port, and service information of hosts in various regions across subnets (such as DMZ web servers, sensitive hosts in business areas, and intranet office machines). The attack strategy generation module can generate cross-subnet penetration testing strategies based on multi-subnet topology (such as breaking through the DMZ web server, scanning the business area subnet, and then penetrating into the internal office area). The vulnerability exploitation module can call corresponding tools to perform operations based on cross-subnet policies (such as using a DMZ host as a springboard to perform SSH brute-force attacks on a business area host and to perform privilege escalation on an office area host).
[0030] In one embodiment of this application, to verify the effectiveness of the system of the present invention, a small-scale multi-subnet target was built based on a certain network test range environment, and the network topology is as follows: Figure 3 As shown in Table 1, the target configuration is as follows: Table 1
[0031] The testing process is as follows: 1. Information gathering stage Users can create new tasks through the visual presentation layer (such as...). Figure 4 As shown in the image, all created tasks are displayed in a way that... Figure 5 The page shown.
[0032] Enter the target entry IP 10.0.20.66 and the IP ranges 192.168.0.0 / 24 and 192.168.1.0 / 24 to start the information collection task: The system calls Nmap to scan the target IPs and identifies 10.0.20.66 as a Linux system with ports 80 (HTTP) and 22 (SSH) open; 192.168.0.10 with ports 22 (SSH) and 80 (HTTP) open; and 192.168.1.10~12 as Windows systems with port 22 (SSH) open. Use the Python whois library to retrieve the domain registration information (such as registrar and DNS server) corresponding to 10.0.20.66. WhatWeb identifies the web fingerprint of version 10.0.20.66 as "Nginx / 1.18.0+PHP / 5.6.40", and the CMS is a custom development. A check using wafw00f revealed that WAF was not deployed on version 10.0.20.66. A scan of sensitive files revealed a backup file named backup.sql in the web root directory of version 10.0.20.66.
[0033] The information collection results are displayed on the IP information page (e.g., Figure 6 As shown in the image, the information includes the port, service, operating system, web server version, etc.
[0034] 2. Vulnerability Discovery Phase Once the information collection is complete, the system will automatically initiate the vulnerability discovery task: Start Xray and set the proxy to port 8080. Access the web application on 10.0.20.66 through the browser proxy. Xray intercepts the HTTP request and detects an SQL injection vulnerability in / login.php. By calling the Nuclei API and passing in the target URL http: / / 10.0.20.66 and the template "phpstudy_backdoor_rce", a backdoor remote code execution vulnerability was detected in Phpstudy used by the web application. Merge Xray and Nuclei results on the vulnerability information page (e.g., Figure 7 As shown, this displays the vulnerable URL, type (SQL injection, remote code execution), verification tool (Xray, Nuclei), and POC file path. Clicking on a vulnerability entry allows you to view detailed request / response data (such as...). Figure 8 (As shown).
[0035] 3. Attack strategy generation stage Users enter the attack strategy generation page (e.g.) Figure 9 As shown), the system loads the trained LI-PPO model and, combined with information gathering and vulnerability discovery results, generates a cross-subnet penetration strategy: 10.0.20.66 (Linux): Execute "Information Gathering → Vulnerability Scanning → HTTP Vulnerability Exploitation (Phpstudy Backdoor) → Subnet Scan (192.168.0.0 / 24)"; 192.168.0.10 (Linux): Execute "SSH brute-force → Subnet scan (192.168.1.0 / 24)"; 192.168.1.12 (Windows): Executing "Privilege Elevation (Daclsvc Vulnerability)".
[0036] 4. Vulnerability Exploitation Phase Based on the generated penetration strategy, users access the vulnerability exploit page (such as...). Figure 10 (As shown) Perform the following operation: Targeting the Phpstudy backdoor vulnerability in version 10.0.20.66: By calling the "multi / http / phpstudy_backdoor_rce" module of Metasploit, setting rhosts to 10.0.20.66, and executing the run command, a Meterpreter session (session 1) was successfully established, gaining control of the host. Using 10.0.20.66 as a jump server, scan 192.168.0.10: call Metasploit's ssh_login module to brute-force the SSH account password (successfully obtained account root / password 123456), and log in to the host; Scanning from 192.168.0.10 to 192.168.1.12: Exploiting the Daclsvc vulnerability in Windows, the Pocsuite3 EXP script was called to perform privilege escalation, gain administrator privileges, and successfully read the employee information file of the host.
[0037] The above experimental tests show that the system of the present invention can complete the full-process penetration test in a multi-subnet target environment, successfully discover and exploit vulnerabilities in the target network, and gain control of sensitive hosts. Compared with the traditional manual toolchain, it reduces the difficulty of penetration testing, improves the efficiency of penetration testing, and does not require operators to have complex expert knowledge, thus meeting the penetration testing needs of network target environments.
[0038] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0039] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.
[0040] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.
[0041] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0042] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A penetration testing system with automated penetration strategy generation capability, characterized in that, It includes a visualization layer, a functional module layer, and a data interaction layer that are connected from top to bottom, in that order: The functional module layer includes an information collection module, a vulnerability discovery module, a vulnerability exploitation module, and an attack strategy generation module, with communication connections between the modules; The attack strategy generation module is configured to use the LI-PPO algorithm to build a penetration testing simulation environment based on the target network environment model, and generate penetration testing strategies for the target network through reinforcement learning training. The information collection module, vulnerability discovery module, and vulnerability exploitation module work together in sequence and all communicate with the attack strategy generation module to perform corresponding penetration testing operations based on the penetration testing strategy output by the attack strategy generation module. The visualization layer is configured to enable user interaction and display system functions and results; The data interaction layer is configured to manage and store data for each layer and module of the system.
2. The penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The information collection module is configured to perform at least one of the following operations: use Nmap to identify the target operating system and perform port scanning; use WhatWeb to collect web fingerprint information; use the Python whois library to obtain the whois information of the target domain; use wafw00f to identify whether the target has deployed a web application firewall and the type of firewall; use a web crawler to obtain the title and snapshot of the website; and use file type recognition and text recognition technology to scan the target's sensitive files.
3. The penetration testing system with automated penetration strategy generation capability according to claim 2, characterized in that, The target information collected by the information collection module includes target domain name, IP address, port, service type, web fingerprint, operating system type, web application firewall information, whois registration information, and sensitive files. The web fingerprint includes CMS fingerprint, middleware information, and server-side script information, and the sensitive files include backup files, configuration files, and log files.
4. The penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The vulnerability discovery module is configured to integrate the Xray vulnerability scanner and the Nuclei vulnerability scanner. The vulnerability scanning execution steps include: Read the list of target URLs to be scanned; For each target URL, start Xray and set the proxy to Xray's port, while calling Nuclei's API interface and passing in the target URL and scanning template; Obtain the Xray report output file and the Nuclei API return result respectively; The results from both are merged and transmitted to the visualization layer.
5. A penetration testing system with automated penetration strategy generation capability according to claim 4, characterized in that, The Xray vulnerability scanner supports active and passive scanning modes. The passive scanning mode intercepts and analyzes HTTP requests and responses through a proxy. The Nuclei vulnerability scanner supports HTTP, HTTPS, DNS, TCP, and UDP protocols, and is configured with built-in vulnerability scanning templates and custom templates. The vulnerability scanning templates correspond to XSS, SQL injection, SSRF, and file inclusion vulnerability types.
6. A penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The exploit module is configured to integrate sqlmap, Metasploit, and Pocsuite3 tools. It communicates with Metasploit via the Pymetasploit3 library. After starting Metasploit, it uses a Python script to set the exploit, payload, and parameters, and launches the attack, returning a session ID. The module also includes a web SSH terminal for executing SQL injection attacks via command-line commands using sqlmap. Pocsuite3 is configured to provide vulnerability verification, exploitation, and reverse shell functionality, and supports custom exploit scripts.
7. A penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The attack strategy generation module's operation includes a training phase and a generation phase. The training phase involves abstracting the target network environment into a penetration testing simulation environment. This simulation environment includes the IP addresses, operating system types, and running service information of each host in the target network, as well as the scanning, probing, and exploitation operations that the agent can perform. The agent interacts with the penetration testing simulation environment using the LI-PPO algorithm to obtain rewards or penalties to update the Actor and Critic networks, completing reinforcement learning training. The generation phase involves loading the trained agent model and target network environment information, generating specific attack schemes, and parsing and expanding these schemes to achieve the conversion between actual network IPs and simulated environment host addresses.
8. A penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The visualization layer includes a new task page, a task list page, an attack strategy generation page, and a result display page, wherein: The new task page is configured to create penetration testing tasks and synchronize task information to the data interaction layer. The task list page is configured to manage the status and overall results of created tasks; The attack strategy generation page is configured to display penetration testing strategies generated based on information from the information gathering module and the vulnerability discovery module. The results display page is configured to show the overall results of the penetration testing task.
9. A penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The data interaction layer is configured to perform the following data operations: Collect, clean, and label information collection data, vulnerability scanning data, attack strategy data, and penetration test result data generated by each layer and module of the system, and store the processed data in the database. Based on the request from the visualization layer, the corresponding data is extracted from the database and transmitted to the visualization layer for display.
10. A penetration testing system with automated penetration strategy generation capability according to claim 1, characterized in that, The system is configured to adapt to the network test environment and can acquire host information of each subnet through the information collection module based on the multi-subnet target network composed of the DMZ zone, business zone and intranet office zone in the network test environment. The attack strategy generation module generates cross-subnet penetration testing strategies for the multi-subnet topology, and the vulnerability exploitation module executes operations based on the cross-subnet penetration testing strategies.