TWI738078B - Penetration test monitoring server and system - Google Patents

Abstract

The present invention discloses a penetration test monitoring server and system, including: an attacking terminal for executing a hacking exercise on a target website; a monitoring server electrically connected to the target website and the attacking terminal, and including a A virtual platform and an analysis platform, wherein the virtual platform provides a virtual account, the attacker logs into the virtual account and executes the hacking exercise through the target website; the analysis platform is electrically connected to the virtual platform to record the attack The hacker attack exercise performed by the terminal; an observation terminal is electrically connected to the monitoring server and the attacking terminal to monitor the attacking terminal; the present invention uses the monitoring server to monitor and record the attacking behavior of the attacking terminal to avoid The attacker added a virus program without authorization during information security testing to improve the quality of protection during information security testing.

Description

Penetration test monitoring server and system

The present invention is a penetration test monitoring server and system, in particular to a server and system that can monitor all attacking behaviors of the attacker during information security detection.

Please refer to Figure 3, which is a schematic diagram of the conventional information security architecture test. In the past technology for detecting whether the information security protection of a target website 90 has loopholes, the owner of the target website 90 would ask an information security company to undertake the information security inspection business. The information security company provides an attack terminal 80 that acts as a hacker to attack the target website 90 to test whether the security protection measures such as the firewall of the target website 90 are sufficiently complete, and further generate a test result that contains the test results. Information security report 81. The information security report 81 will record whether there are weaknesses in the information security protection measures of the target website 90, as well as the location of the weakness area or which attacks are less protective.

However, during the testing process, the owner of the target website 90 generally cannot know the details of the various attack simulations carried out by the information security company. Therefore, if the information security company secretly implants a Trojan horse in the target website 90 during the test process Such as spyware or viruses, taking this opportunity to monitor the target website 90 privately or intend to paralyze the target website 90 now or in the future. It is difficult for the owner of the target website 90 to prevent unauthorized installation of malicious software during the testing process. .

In order to prevent the related service interruption caused by the target website during the testing process, or the unauthorized implantation of malicious software by an unscrupulous information security company, which may cause more serious information security problems, the present invention provides a penetration testing monitoring server and system. The monitoring server provides a virtual platform that requires login permissions, so that when an information security company conducts an information security test, it must log in to the virtual platform to perform a simulated attack. At the same time, the virtual platform can record all the attack commands carried out by the information security company to allow trusted The third party can immediately monitor or check whether malicious software has been implanted afterwards, or leave a complete third-party implementation track record of the information security company to facilitate future audits to clarify the attribution of responsibility.

To achieve the above objective, the penetration test monitoring system disclosed in the present invention includes: An attacker, used to perform a hacking exercise on a target website, and generate a first attack report based on the result of the attack on the target website; A monitoring server, electrically connected to the target website and the attacker, and includes a virtual platform and an analysis platform, wherein the virtual platform is equipped with the software tools used by the attacker to execute the hacking exercise, and provides A virtual account. After logging in to the virtual account, the attacker executes the hacking exercise on the target website through the virtual platform; the analysis platform is electrically connected to the virtual platform to record the execution of the attacker on the virtual platform The hacking exercise and receiving the first attack report; An observation terminal, electrically connected to the monitoring server and the attacking terminal, for monitoring the attacking terminal and collecting the result of the target website being attacked, generating a second attack report, and sending the second attack report to the analysis platform.

The present invention also provides a penetration test monitoring server, which is electrically connected to a target website, an attack terminal and an observation terminal; the penetration test monitoring server includes: A virtual platform that is equipped with the software tools used by the attacker to execute the hacking exercise and provides a virtual account. The attacker logs into the virtual account and executes the hack on the target website through the virtual platform. Offensive attack exercises; An analysis platform, wherein the analysis platform is electrically connected to the virtual platform for recording the hacking exercise performed by the attacker on the virtual platform and receiving the first attack report.

In the present invention, by setting more than one virtual machine in the monitoring server, the attacker can log in to the virtual machine to perform a simulated attack during the security test, and the one or more virtual machines can record the attack performed by the attacker. All attacks prevent the attacker from implanting malicious software on the target website without authorization, and reduce the risk of paralysis or attack on the target website in the future due to the malicious software implanted in the security test.

Please refer to FIG. 1, the present invention is a penetration testing monitoring system, which is executed by a monitoring server 20, and the penetration testing monitoring system includes: an attack terminal 10, the monitoring server 20 and an observation terminal 30. In the present invention, an information security company can provide the attack terminal 10 and the observation terminal 30, the provider of the target website provides the monitoring server 20, and the information security company internally divides the attack terminal 10 and the observation terminal 30 into a hacker attack. The observation terminal 30 of the security maintenance engineer, or the attack terminal 10 provided by an information security company to simulate a hacker attack, and another high-trust information security company provides the observation terminal 30. The observer 30 observes the attack data when the attacker 10 attacks the target website, generates a security report of the target website, and monitors all the attack behaviors of the attacker 10 at any time through the monitoring server 20 to prevent the attacker 10 Under the guise of penetration testing, privately implant programs such as Trojan horses that will endanger information security.

The attack terminal 10 is used to perform a hacking exercise on a target website 40 and can generate a first attack report based on the result of the attack on the target website 40. The attack terminal 10 can be constituted by a hacker or a first security company. For example, the hacking exercise can be Penetration Testing (PT) or Red Teaming.

The monitoring server 20 is electrically connected to the target website 40 and the attacking terminal 10, and includes a virtual platform 21 and an analysis platform 22, wherein the virtual platform 21 carries the attacking terminal 10 used when performing the hacking exercise It also provides a virtual account. The attacker 10 needs to log in to the virtual account to execute the hacking exercise on the target website 40 through the virtual platform 21. Furthermore, the software tool may include, but is not limited to, IBM AppScan, Netsparker, Acunetix, Probely, ImmuniWeb, Indusface, Tenable Nessus, Core Impact, Canvas, w3af, ZAP, Sqlninja, OpenVAS. In actual operation, the virtual platform 21 will perform FingerPrint feature analysis to learn which software is currently used for one or more attacks.

Please further refer to FIG. 2. In a preferred embodiment of the virtual platform 21, the virtual platform 21 includes more than one virtual machine (Virtual Machine, VM) 211, and the attacker 10 logs in the one or more virtual machines through the virtual account. The machine 211 then executes the hacking exercise on the target website 40. The analysis platform 22 is electrically connected to the virtual platform 21 for recording the hacking exercise performed by the attacker 10 on the virtual platform 21 and receiving the first attack report. Specifically, the first attack report may be Including but not limited to the following two contents: 1. If the attack is successful, it will be classified according to the previously defined attack items. The classified items may include: detailed analysis of the attack, attack time, attack means, attack effect, and after the attack 2. If the attack fails, it will be classified according to the previously defined attack items. The classified items may include: the risk of the target website 40 and does not contain the details of the attack. Since the virtual platform 21 is equipped with the software tools used by the attacker 10 to execute the hacking exercise, the owner of the target website 40 or an objective third-party information security company can check the Whether the software tools in the virtual platform 21 are at risk of being tampered with or implanted with viruses, so as to avoid actual attacks during information security testing.

Furthermore, since the virtual platform 21 can include multiple virtual machines 211, the attacker 10 can execute more than one type of hacking exercises on the target website 40 through multiple virtual machines 211 to improve the level of information security detection. Test how high-intensity hacker attacks the target website 40 can bear.

The observation terminal 30 is electrically connected to the monitoring server 20 and the attack terminal 10 to monitor the attack terminal 10 and collect the result of the target website 40 being attacked to generate a second attack report, and report the second attack Transmitted to the analysis platform 22. The observation terminal 30 may be provided by the first information security company or an objective third-party information security company. Specifically, the second attack report may include information such as ineffective (risk-free) behaviors during the failure of the attack, which information security software was used to attack, whether the attack caused threats, and which threats were safe.

The present invention establishes the virtual platform 21 to monitor the attacker 10 performing all the attacks in the hacking exercise on the target website 40, which can prevent the attacker 10 from concealing spyware or Trojan horses or other spyware or Trojan horses without authorization when the attacker 10 attacks the target website 40 The virus protects the target website 40 from the attacker 10 at the same time when the information security analysis of the target website 40 is performed. Specifically, the virtual platform 21 can monitor attack behaviors in the following two ways: 1. The virtual platform 21 can be set up on physical hardware, and all the attack behaviors can be obtained as a record through the underlying network service; 2. The virtual platform 21 pairs The target website 40 performs network behavior traffic analysis, and analyzes the transmitted and retracted packet transmission content.

The present invention may further include a risk assessment terminal 50, which is electrically connected to the observation terminal 30, and is used for analyzing the first attack report, the second attack report, and the hacking exercise of the analysis platform 22. As a result, a review process (After Action Review, AAR) is performed, and a comprehensive information security report is generated based on the results of the review process, and the comprehensive information security report is sent to the owner of the target website 40, wherein the comprehensive information security report Including the information security protection system of the target website 40 whether there are defects, the integrity of the firewall, the weakness of the firewall, etc., so that the comprehensive report can be evaluated objectively and effectively, and the team's trust, security, and minimum consumption can be improved Resources, effective supervision, penetration attacks against network domains, thorough simulation of hacking techniques and other beneficial effects.

Furthermore, the process of the review procedure includes: 1. The first step: through the independent operation of the attacker 10, the observer 30, and the target website 40, the relevant record reports are generated, and the attack items defined above are taken as Basically, mutually confirm whether the content of the successful part of the attack is different from each other; then record which information security weakness area the attacker 10 has attacked, and compare whether the target website 40 has been attacked in the above information security weakness area Risks, in which areas of information security are safe, this process can also prove that the attacker 10 did not conceal the fact that the attack was successful. Therefore, the content of the first attack report must be more complete than that disclosed in the second attack report; 2. The second step: review the security and information event management (SIEM) and information event management (SIEM) of the target website 40 based on the data in the first step Information Security Monitoring Center (SOC) information related information is sufficient and effective, take the opportunity to verify whether the daily self-recording and defense mechanism of the target website 40 is sound to achieve the audit effect.

Specifically, the comprehensive information security report includes the content of the first attack report, the second attack report, and a record of information, where the record information is collected from the IP network transmission content used by the virtual platform 21 during the attack. The generated and transmitted content may include: observation, discovery, early warning, detection, interception, blocking, establishment of information security incidents, follow-up processing, relevant record reports and other information.

Specifically, in the preferred embodiment of the present invention, the observer 30 performs packet recording based on a security protocol information (such as SSL Access Log), and generates the second attack report after analysis. The owner of the target website 40 transmits the first attack report, the second attack report, and the record information to the risk assessment terminal 50 so that the risk assessment terminal 50 generates the comprehensive information security report, and the comprehensive information security report The report is sent to the owner of the target website 40. For example, if the target website 40 has an SSL encryption function, because SSL uses a dynamic key by default, the monitoring server 50 cannot decrypt the SSL. Therefore, the risk assessment end 50 can generate a fixed key for the attacker. 10. Make the attacker 10 use the fixed key as the SSL encryption key, then the monitoring server 20 can make a complete and clear connection record of the encrypted connection of the attacker 10 to the target website 40; The recorded information includes a Security Information and Event Management (SIEM), an Intrusion Prevention System (IPS), an Intrusion Detection System (IDS), and a website application firewall (Web Application Firewall, WAF) or a Web Access Log (Web Access Log) and other information.

In addition, the observation terminal 30 can be provided by an independent information security company (for example, FIG. 1), but can also be set in the monitoring server 20 (for example, FIG. 2), and the attack terminal 10 can also be observed to execute the hacking exercise. the process of.

The present invention allows the attacker 10 to perform the hacking exercise on the target website 40 through the monitoring server 20, and the observer 30 monitors the attacker 10 at the same time. The attack terminal 10 and the observation terminal 30 generate the first attack report and the second attack report according to the hacking exercise, and then send them to the analysis platform 22 through the target website 40 for objective analysis. The evaluation terminal 50 generates the comprehensive information security report, so as to analyze the comprehensive information security report from an objective and effective standpoint, which can enhance the team’s sense of trust, security, minimize resource consumption, effective supervision, and penetration attacks against the network domain. , Thorough simulation of hacking techniques and other advantages.

10: Attack side 20: Monitoring server 21: Virtual Platform 22: Analysis platform 30: Observation end 40: Target website 50: Risk Assessment End 80: Attacker 81: Information Security Report 90: Target website

Figure 1: The circuit block diagram of the first preferred embodiment of the present invention. Figure 2: A schematic block diagram of the circuit of the second preferred embodiment of the present invention. Figure 3: Schematic diagram of conventional information security testing architecture.

10: Attack side

20: Monitoring server

21: Virtual Platform

22: Analysis platform

30: Observation end

40: Target website

50: Risk Assessment End

Claims (10)

A penetration test monitoring system, including: an attacker, used to execute a hacking exercise on a target website, and generate a first attack report based on the result of the attack on the target website; a monitoring server, electrical connection The target website and the attacker include a virtual platform and an analysis platform. The virtual platform is equipped with software tools used by the attacker to execute the hacking exercise, and provides a virtual account. The attacker logs in The virtual account then executes the hacking exercise on the target website through the virtual platform; the analysis platform is electrically connected to the virtual platform to record the hacking exercise performed by the attacker on the virtual platform and receive the The first attack report; an observation terminal, which is electrically connected to the monitoring server and the attack terminal, is used to monitor the attack terminal and collect the results after the target website is attacked to generate a second attack report, and to report the second attack The report is sent to the analysis platform. According to the penetration test monitoring system of claim 1, the virtual platform includes more than one virtual machine, and the attacker logs in the more than one virtual machine through the virtual account and executes the hacking exercise on the target website. The penetration test monitoring system according to claim 2, further comprising a risk assessment terminal, the risk assessment terminal is electrically connected to the observation terminal, and is used according to the first attack report, the second attack report and the analysis platform A review procedure is performed on the results of the hacking exercise, and a comprehensive information security report is generated based on the results of the review procedure. For the penetration testing monitoring system described in claim 3, the comprehensive information security report is generated by the risk assessment terminal based on the comprehensive analysis of the first attack report, the second attack report, and a piece of record information, wherein the record information is generated by the The virtual platform is generated after consolidating the network transmission content used during the attack. For the penetration testing monitoring system described in claim 4, the observation terminal is set in the monitoring server. For the penetration test monitoring system described in claim 5, the second attack report is generated by the observation terminal after packet recording and analysis according to a security protocol information. A penetration test monitoring server is electrically connected to a target website, an attacker, and an observation end; the penetration test monitoring server includes: a virtual platform that carries the attacker to execute the hacking exercise The software tool used and a virtual account are provided. The attacker logs in to the virtual account and executes the hacking exercise on the target website through the virtual platform; an analysis platform in which the analysis platform is electrically connected to the virtual platform, Used to record the hacking exercise performed by the attacker on the virtual platform and receive the first attack report; wherein the observation end is electrically connected to the penetration test monitoring server and the attacker to monitor the attack And collecting the result of the target website being attacked to generate a second attack report, and transmit the second attack report to the analysis platform. For the penetration test monitoring server described in claim 7, the virtual platform includes more than one virtual machine, and the attacker logs in the more than one virtual machine through the virtual account and executes the hacking exercise on the target website. For example, the penetration test monitoring server described in claim 8 is further electrically connected to a risk assessment terminal through the observation terminal, and the risk assessment terminal is used for analyzing the first attack report, the second attack report, and the A review procedure is performed on the results of the hacking exercise, and a comprehensive information security report is generated based on the results of the review procedure. For the penetration test monitoring server described in claim 9, the review process includes: the first step: through the independent operation of the attacker, the observer, and the target website, the relevant record reports are generated to mutually confirm the attack Whether the content of the successful part is different from each other; then Record the areas of information security weaknesses in which the attacker is attacking, and compare whether the target website is at risk of being attacked in the aforementioned areas of information security weaknesses; the second step: check the security and security of the target website based on the data in the first step Whether information related to information incident management and information security monitoring center information is sufficient and effective.

Images