Vulnerability scanning system and method, and storage medium

Abstract

The present invention relates to the field of vulnerability scanning, and provides a vulnerability scanning system and method, and a storage medium. The vulnerability scanning system comprises a client and a server. The client is configured to: import client IP data and a client key password, and send the client IP data and the client key password to the server. The server is configured to: perform IP verification on the client IP data to obtain an IP verification result, and obtain initial system data on the basis of the IP verification result; analyze the initial system data on the basis of the client key password to obtain an analysis result; and perform vulnerability scanning on the analysis result to obtain a vulnerability scanning result, and send the vulnerability scanning result to the client. The present invention improves the response speed and the resource utilization rate of the system, reduces cost, improves the scanning speed and compatibility, and greatly improves the vulnerability scanning efficiency.

Description

Vulnerability scanning system, method and storage medium TECHNICAL FIELD

[0001] The present application mainly relates to the technical field of vulnerability scanning, and particularly relates to a vulnerability scanning system, method and storage medium. BACKGROUND

[0002] A conventional vulnerability scanning system needs to perform in-depth scanning and testing on a target system, which consumes a large amount of computing resources and time. If the performance and efficiency of the vulnerability scanning system are not high, the scanning process may be slow, which is harmful to the system and even affects normal use. At the same time, the conventional vulnerability scanning system is complex to write, and needs to be designed separately according to different vulnerability types and verification methods, which has low compatibility, especially for the verification of non-echo class vulnerabilities and deserialization vulnerabilities, thereby causing extremely low vulnerability scanning efficiency. SUMMARY

[0003] The present application mainly relates to the technical field of vulnerability scanning, and particularly relates to a vulnerability scanning system, method and storage medium.

[0004] The technical solution of the present application to solve the above technical problems is as follows: a vulnerability scanning system, comprising a client and a server,

[0005] The client is used to import client IP data and client key password, and send the client IP data and the client key password to the server;

[0006] The server is used to perform IP verification on the client IP data to obtain an IP verification result, and obtain initial system data according to the IP verification result;

[0007] The initial system data is parsed according to the client key password to obtain a parsing result;

[0008] The parsing result is scanned for vulnerabilities to obtain a vulnerability scanning result, and the vulnerability scanning result is sent to the client.

[0009] Another technical solution of the present application to solve the above technical problems is as follows: a vulnerability scanning method, comprising the following steps:

[0010] Importing client IP data and client key password;

[0011] Performing IP verification on the client IP data to obtain an IP verification result, and obtaining initial system data according to the IP verification result;

[0012] Parsing the initial system data according to the client key password to obtain a parsing result;

[0013] The analysis result is subjected to vulnerability scanning to obtain a vulnerability scanning result.

[0014] The present application has the advantages that: by importing the client IP data and the client key password, IP verification of the client IP data is performed to obtain an IP verification result, and initial system data is obtained according to the IP verification result, the analysis result is obtained by analyzing the initial system data according to the client key password, and the vulnerability scanning result is obtained by performing vulnerability scanning on the analysis result, so that the response speed and resource utilization of the system are improved, the cost is reduced, the scanning speed and compatibility are improved, and the vulnerability scanning efficiency is greatly improved. BRIEF DESCRIPTION OF DRAWINGS

[0015] Fig. 1 is a module block diagram of a vulnerability scanning system provided by an embodiment of the present application.

[0016] Fig. 2 is a flowchart of a vulnerability scanning method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0017] The principles and characteristics of the present application are described below in combination with the drawings, and the examples are only used to explain the present application, and are not used to limit the scope of the present application.

[0018] Fig. 1 is a module block diagram of a vulnerability scanning system provided by an embodiment of the present application.

[0019] As shown in Fig. 1, a vulnerability scanning system includes a client and a server,

[0020] The client is configured to import client IP data and a client key password, and send the client IP data and the client key password to the server.

[0021] The server is configured to perform IP verification on the client IP data to obtain an IP verification result, and obtain initial system data according to the IP verification result.

[0022] The initial system data is analyzed according to the client key password to obtain an analysis result.

[0023] The analysis result is subjected to vulnerability scanning to obtain a vulnerability scanning result, and the vulnerability scanning result is sent to the client.

[0024] It should be understood that the client IP data includes an IP address and a port number.

[0025] In the above embodiment, the IP verification of the client IP data and the client key password obtains an IP verification result, and the initial system data is obtained according to the IP verification result, the analysis of the initial system data according to the client key password obtains an analysis result, and the vulnerability scanning of the analysis result obtains a vulnerability scanning result, thereby improving the response speed and resource utilization of the system, reducing the cost, improving the scanning speed and compatibility, and greatly improving the vulnerability scanning efficiency.

[0026] Optionally, as an embodiment of the present application, in the server, the process that the client IP data is subjected to IP verification to obtain an IP verification result, and the initial system data is obtained according to the IP verification result, comprises:

[0027] The client IP data is subjected to verification with any preset IP data in a preset IP database, if the verification is successful, a data obtaining instruction is generated, and the data obtaining instruction is sent to the client;

[0028] The client sends the received initial system data to the server according to the data obtaining instruction.

[0029] It should be understood that the server attempts to establish a connection with the client by using the IP address and the port number (i.e. the client IP data).

[0030] In the above embodiment, the IP verification of the client IP data obtains an IP verification result, and the initial system data is obtained according to the IP verification result, thereby improving the response speed and resource utilization of the system, reducing the cost, improving the scanning speed and compatibility.

[0031] Optionally, as an embodiment of the present application, in the server, the process that the initial system data is subjected to analysis according to the client key password to obtain an analysis result, comprises:

[0032] S31: The client key password is subjected to verification with any preset key password in a preset key database, if the verification is successful, S32 is executed;

[0033] S32: The initial system data is subjected to analysis, if the analysis is successful, analyzed system data is obtained.

[0034] It should be understood that the password transmitted by the client is used to authenticate the key (i.e. the client key password) established by the deployment node.

[0035] It should be understood that the analysis can be the analysis of the data format.

[0036] Specifically, factors such as incorrect data format or failure to obtain corresponding system parameters can cause the operation to be unable to be completed or the required information to be unable to be obtained.

[0037] In the above embodiment, the initial system data is parsed according to the client key password to obtain a parsing result, so that the response speed and resource utilization of the system are improved, the cost is reduced, and the scanning speed and compatibility are improved.

[0038] Optionally, as an embodiment of the present application, the parsed system data includes POC payload data, a thread pool quantity, an execution task target, and client identification information,

[0039] In the server, the process of performing vulnerability scanning on the parsing result to obtain a vulnerability scanning result includes:

[0040] A thread pool is constructed according to the thread pool quantity;

[0041] The execution task target is detected according to a preset task target detection rule to obtain an execution task target detection result;

[0042] The client identification information is matched with all preset identification information in a preset identification information library, if the matching is successful, the corresponding identification application of the matched preset identification information is obtained, and the identification application is taken as an identification recognition result; if the matching fails, the information that the matching is unsuccessful is taken as the identification recognition result;

[0043] The POC payload data is detected according to a preset vulnerability detection rule to obtain a vulnerability detection result;

[0044] Corresponding vulnerability information is obtained from a preset vulnerability information library according to the vulnerability detection result;

[0045] The thread pool, the execution task target detection result, the identification recognition result, the vulnerability detection result, and the vulnerability information are taken as a vulnerability scanning result.

[0046] It should be understood that the server establishes a thread pool and starts a thread to execute a corresponding task.

[0047] Specifically, the task target detection of the execution task target refers to performing survival detection on an incoming target (i.e., an execution task target), including performing socket communication and request detection homepage connectivity.

[0048] Specifically, the identification of the identification information refers to identifying a target application by using identification and judgment conditions of different manufacturers.

[0049] It should be understood that the vulnerability detection of the POC payload data is used to verify whether a target has a vulnerability, which is to judge whether a target system has a related vulnerability according to related conditions and logic of POC code.

[0050] Specifically, after the POC verification succeeds (i.e., the vulnerability detection result is obtained), a utilization operation is performed according to the relevant information (i.e., the vulnerability information) collected by the EXP code, and a result is returned.

[0051] Specifically, the task target detection result includes a host normal and a host abnormal, and the vulnerability detection result includes a POC payload data verification success and a POC payload data verification failure.

[0052] In the above embodiment, the vulnerability scanning result is obtained by performing vulnerability scanning on the parsing result, which improves the response speed and resource utilization rate of the system, reduces the cost, improves the scanning speed and compatibility, and greatly improves the vulnerability scanning efficiency.

[0053] Optionally, as an embodiment of the present application, the server further comprises:

[0054] If the verification fails, the client IP data verification failure is sent to the client.

[0055] It should be understood that the client IP data verification failure is taken as the vulnerability scanning result.

[0056] In the above embodiment, the response speed and resource utilization rate of the system are improved, the cost is reduced, the scanning speed and compatibility are improved, and the vulnerability scanning efficiency is greatly improved.

[0057] Optionally, as an embodiment of the present application, the server further comprises:

[0058] If the verification fails, the client key password verification failure is sent to the client.

[0059] It should be understood that the client key password verification failure is taken as the vulnerability scanning result.

[0060] In the above embodiment, the response speed and resource utilization rate of the system are improved, the cost is reduced, the scanning speed and compatibility are improved, and the vulnerability scanning efficiency is greatly improved.

[0061] Optionally, as another embodiment of the present application, the present application can maintain a stable session state during the scanning process. This feature ensures the continuity and accuracy of the scanning, avoiding errors or missed vulnerabilities due to the loss of session state during the scanning process. In contrast, many other frameworks may rely on external tools or manual settings to manage the session state, which may result in low scanning efficiency or unstable results.

[0062] Optionally, as another embodiment of the present application, the present application encapsulates a large number of built-in methods to improve the compatibility of framework writing and simplify the development of the developer writing process. This means that the developer can perform the vulnerability scanning task more quickly and efficiently without having to delve into the details of the underlying implementation or frequently write repetitive code. In contrast, many other frameworks may require developers to write complex scripts or configuration files themselves, thereby increasing the workload of development and maintenance.

[0063] Optionally, as another embodiment of the present application, the AST (Abstract Syntax Tree) of the present application can be used to implement intelligent modification and rapid development of templates. By analyzing the structure of the source code, an abstract syntax tree of the corresponding AST can be generated. In combination with the template, the AST corresponding node can be referenced to represent the template structure, such as loops, conditions, etc., and the user only needs to modify the AST node without having to understand the underlying implementation in depth. The concise request parameters enable the user to quickly customize the template. This design reduces the technical threshold, and the user can more easily customize the template, achieve rapid development, reduce errors, and improve development efficiency and quality.

[0064] Optionally, as another embodiment of the present application, the present application provides a variety of functionally rich methods for encapsulating HTTP requests when POC verification is performed, and supports customized parameters and processing request results. Supported request methods: GET, POST, PUT, HEAD, DELETE.

[0065] Optionally, as another embodiment of the present application, the present application supports httplog and dnslog functions, (1) httplog: records all HTTP information between the client and the server. (2) dnsLog: records the verification of non-echo vulnerabilities.

[0066] Optionally, as another embodiment of the present application, the present application uses Java deserialization, which is the process of restoring serialized data of an object into a Java object. The serialized data is read by the ObjectInputStream class, and the Serializable interface marks the serializable class. Security risks need to be noted that malicious serialized data may cause code execution vulnerabilities. Input should be verified and the scope of deserialization classes should be limited.

[0067] Optionally, as another embodiment of the present application, the present application uses an asynchronous task processing method based on TCP communication, which is as follows:

[0068] TCP communication processing. This code is based on TCP communication and uses the asyncio library to implement asynchronous processing. The handle_stream method is used to process client requests, receive serialized JSON data, and perform corresponding operations according to the action field.

[0069] The thread pool executes the task.

[0070] Optionally, as another embodiment of the application, the application creates a thread pool using ThreadPoolExecutor, executes the task asynchronously through the run_in_executor method, gets the task from the task queue and executes it. After the task is executed, the result is put into the result queue.

[0071] Optionally, as another embodiment of the application, the application deserializes object_data during task execution, creates an object and executes the task, and puts the result into the result queue. Exceptions are captured during task execution, recorded in the result, and the next task is executed until the task queue is empty.

[0072] Optionally, as another embodiment of the application, the application maintains the state and shared configuration.

[0073] Optionally, as another embodiment of the application, the application's custom method or overridden existing method to achieve specific functions. This can be more fine-grained control over HTTP requests according to your own needs, such as adding additional authentication mechanisms, modifying request headers, modifying request bodies.

[0074] Optionally, as another embodiment of the application, the application inherits the requests.Session class to better manage HTTP requests, providing higher-level abstraction and greater flexibility, which allows the creation of a persistent session object to maintain state between multiple HTTP requests, including cookies, HTTP connection persistence, and HTTP header information. The main purpose of inheriting this class is to extend its functionality or customize its behavior.

[0075] Optionally, as another embodiment of the application, the application implements asynchronous task processing; multi-request encapsulation; task concurrency processing, which can process the number of tasks faster and complete the task; AST processing abstract syntax tree; maintain state and shared configuration.

[0076] Optionally, as another embodiment of the application, the application has the following beneficial effects:

[0077] 1. Asynchronous task processing improves the system's response speed and resource utilization;

[0078] 2. Multi-request encapsulation simplifies user operations on HTTP requests and provides a more convenient interface;

[0079] 3. Dynamic selection of multiple response bodies;

[0080] 4. Saves code writing time and reduces costs;

[0081] 5. Keeping state and sharing configuration can reduce repeated code and improve code maintainability.

[0082] FIG. 2 is a flowchart of a vulnerability scanning method according to an embodiment of the present application.

[0083] Optionally, as another embodiment of the present application, a vulnerability scanning method is shown in FIG. 2, which includes the following steps:

[0084] Importing client IP data and client key password;

[0085] IP verifying the client IP data to obtain an IP verification result, and obtaining initial system data according to the IP verification result;

[0086] Analyzing the initial system data according to the client key password to obtain an analysis result;

[0087] Vulnerability scanning the analysis result to obtain a vulnerability scanning result.

[0088] Optionally, as an embodiment of the present application, the process of IP verifying the client IP data to obtain an IP verification result, and obtaining initial system data according to the IP verification result includes:

[0089] Verifying the client IP data with any preset IP data in a preset IP database, and generating a data obtaining instruction if the verification is successful;

[0090] Sending the received initial system data to a server according to the data obtaining instruction.

[0091] Optionally, another embodiment of the present application provides a vulnerability scanning system, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the vulnerability scanning method as described above is realized. The system can be a computer system.

[0092] Optionally, another embodiment of the present application provides a computer readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the vulnerability scanning method as described above is realized.

[0093] It should be noted that, in the specification, the terms "comprises", "comprising", "includes", "including" or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0094] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described apparatus and unit can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0095] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. For example, the apparatus embodiments described above are only schematic, for example, the division of units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0096] The unit described as a separate component can or can not be physically separated, and the component displayed as a unit can or can not be a physical unit, that is, it can be located in one place, or it can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment of the present application.

[0097] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0098] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. For such understanding, the technical solutions of the present application or all or part of the technical solutions that essentially contribute to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0099] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A vulnerability scanning system, characterized by, Comprise: A client and a server, The client is used to import client IP data and client key password, and send the client IP data and the client key password to the server; The server is used for IP verification of the client IP data, obtaining IP verification result, and obtaining initial system data according to the IP verification result; According to the client key password, the initial system data is parsed to obtain the parsing result; The vulnerability scanning result is obtained by scanning the parsing result, and the vulnerability scanning result is sent to the client.

2. The vulnerability scanning system of claim 1, wherein, In the server, the process of IP verification of the client IP data, obtaining IP verification result, and obtaining initial system data according to the IP verification result comprises: The client IP data is verified with any preset IP data in the preset IP database, if the verification is successful, the data obtaining instruction is generated, and the data obtaining instruction is sent to the client; The client sends the received initial system data to the server according to the data obtaining instruction.

3. The vulnerability scanning system of claim 1, wherein, In the server, the process of parsing the initial system data according to the client key password to obtain the parsing result comprises: S31: the client key password is verified with any preset key password in the preset key database, if the verification is successful, S32 is executed; S32: the initial system data is parsed, if the parsing is successful, the parsed system data is obtained.

4. The vulnerability scanning system of claim 3, wherein, The parsed system data comprises POC payload data, thread pool quantity, execution task target and client identification information, The process of scanning the parsing result to obtain the vulnerability scanning result in the server comprises: A thread pool is constructed through the thread pool quantity; According to the preset task target detection rule, the execution task target is detected to obtain the execution task target detection result; The client identification information is matched with all preset identification information in the preset identification information library, if the matching is successful, the corresponding identification application of the matched preset identification information is obtained, and the identification application is taken as the identification recognition result; if the matching fails, the matching unsuccessful information is taken as the identification recognition result; According to the preset vulnerability detection rule, the POC payload data is detected to obtain the vulnerability detection result; According to the vulnerability detection result, the corresponding vulnerability information is obtained from the preset vulnerability information library; The thread pool, the execution task target detection result, the identification recognition result, the vulnerability detection result and the vulnerability information are taken as the vulnerability scanning result.

5. The vulnerability scanning system of claim 2, wherein, The server further comprises: If the verification fails, the client IP data verification failure is sent to the client.

6. The vulnerability scanning system of claim 3, wherein, The server further comprises: If the verification fails, the client key password verification failure is sent to the client.

7. A vulnerability scanning method characterized by, Comprise the following steps: Import client IP data and client key password; The client IP data is verified to obtain IP verification result, and initial system data is obtained according to the IP verification result; According to the client key password, the initial system data is parsed to obtain a parsing result; The parsing result is subjected to vulnerability scanning to obtain a vulnerability scanning result.

8. The vulnerability scanning method of claim 7, wherein, The process of performing IP verification on the client IP data to obtain an IP verification result and obtaining initial system data according to the IP verification result comprises: The client IP data is verified with any preset IP data in a preset IP database, and if the verification is successful, a data obtaining instruction is generated; According to the data obtaining instruction, the received initial system data is sent to a server.

9. A vulnerability scanning system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the computer program, the vulnerability scanning method of any one of claims 7-8 is implemented.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. When the computer program is executed by the processor, the vulnerability scanning method of any one of claims 7-8 is implemented.

Images