WO2019144549A1 - 漏洞测试方法、装置、计算机设备和存储介质 - Google Patents

漏洞测试方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2019144549A1
WO2019144549A1 PCT/CN2018/088864 CN2018088864W WO2019144549A1 WO 2019144549 A1 WO2019144549 A1 WO 2019144549A1 CN 2018088864 W CN2018088864 W CN 2018088864W WO 2019144549 A1 WO2019144549 A1 WO 2019144549A1
Authority
WO
WIPO (PCT)
Prior art keywords
test
vulnerability
target
tested
feature
Prior art date
Application number
PCT/CN2018/088864
Other languages
English (en)
French (fr)
Inventor
林嘉思
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019144549A1 publication Critical patent/WO2019144549A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Definitions

  • the present application relates to a vulnerability testing method, apparatus, computer device and storage medium.
  • a vulnerability testing method includes:
  • the current set of devices to be tested comprising a plurality of devices to be tested;
  • the vulnerability test result is that the test device has a vulnerability
  • the vulnerability test is performed on the device under test in the corresponding target device under test according to the vulnerability.
  • a vulnerability testing device includes:
  • a current set obtaining module configured to obtain a current set of devices to be tested for performing a vulnerability test, where the current set of devices to be tested includes a plurality of devices to be tested;
  • a combination module configured to acquire target features of each device to be tested in the current set of devices to be tested, and combine the devices to be tested having the same target feature to obtain a target device to be tested corresponding to each target feature;
  • a selection module configured to respectively select at least one test device from each set of the device under test, the number of the test devices being less than the number of all devices to be tested in the corresponding target test set;
  • test device test module configured to obtain a vulnerability test case corresponding to each target feature, perform a vulnerability test on the corresponding test device according to the vulnerability test case corresponding to the target feature, and obtain a vulnerability test result
  • the device under test module is configured to perform a vulnerability test on the device to be tested in the corresponding target device under test according to the vulnerability when the vulnerability test result is a vulnerability in the test device.
  • a computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors such that the one or more The processors perform the following steps:
  • the current set of devices to be tested comprising a plurality of devices to be tested;
  • the vulnerability test result is that the test device has a vulnerability
  • the vulnerability test is performed on the device under test in the corresponding target device under test according to the vulnerability.
  • One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps:
  • the current set of devices to be tested comprising a plurality of devices to be tested;
  • the vulnerability test result is that the test device has a vulnerability
  • the vulnerability test is performed on the device under test in the corresponding target device under test according to the vulnerability.
  • FIG. 1 is an application scenario diagram of a vulnerability testing method in accordance with one or more embodiments.
  • FIG. 2 is a flow diagram of a vulnerability testing method in accordance with one or more embodiments.
  • FIG. 3 is a schematic flowchart of a vulnerability testing procedure for a device under test in a corresponding target device under test according to a vulnerability when the vulnerability test result is a vulnerability in the test device according to one or more embodiments.
  • FIG. 4 is a schematic flow chart of a vulnerability testing method in another embodiment.
  • FIG. 5 is a step of acquiring target features of each device under test in a current set of devices under test, combining devices to be tested having the same target feature, and obtaining a target device to be tested corresponding to each target feature according to one or more embodiments. Schematic diagram of the process.
  • FIG. 6 is a block diagram of a vulnerability testing device in accordance with one or more embodiments.
  • FIG. 7 is a block diagram of a device under test module in accordance with one or more embodiments.
  • Figure 8 is a block diagram of a vulnerability testing device in another embodiment.
  • FIG. 9 is a block diagram of a combined module in accordance with one or more embodiments.
  • Figure 10 is a block diagram of a computer device in accordance with one or more embodiments.
  • the vulnerability testing method provided by the present application can be applied to an application environment as shown in FIG. 1.
  • the terminal 102 is taken as an example in which the current device under test includes three devices to be tested 104A, 104B, and 104C.
  • the terminal 102 can communicate with the device under test that is currently set by the device under test, for example, can communicate through a network.
  • the terminal 102 obtains a current set of devices to be tested that need to be tested for a vulnerability, and performs a vulnerability testing method provided by the embodiment of the present application to perform testing to improve the vulnerability testing efficiency.
  • the device under test can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, portable wearable devices, servers, and the like. It can be understood that the application can also be used as the device to be tested.
  • the vulnerability testing method provided by the embodiment of the present application may also be a server or the like.
  • a vulnerability testing method is provided to perform the vulnerability testing method for the terminal in FIG. 1 as an example, including the following steps:
  • Step S202 Acquire a current set of devices to be tested to be tested for vulnerability, and the current device to be tested includes a plurality of devices to be tested.
  • the current device to be tested may be preset, for example, a device corresponding to the financial service has been set in advance as the current device to be tested.
  • the device detection tool may also be used to detect the device to obtain a current set of devices to be tested.
  • the communication data packet is sent to the device of the preset IP segment, and the surviving device in the preset IP segment is determined according to the returned communication data packet, and the surviving device is formed into the current device to be tested.
  • the number of devices to be tested in the current set of devices to be tested is multiple, and the specific number can be determined according to actual conditions. For example, it may be a fixed number, which may be determined according to a computer device that survives in the service platform, or may be selected by the tester as needed.
  • Step S204 Acquire target features of each device under test in the current device under test, and combine the devices to be tested with the same target feature to obtain a target device to be tested corresponding to each target feature.
  • the target feature of the device to be tested may be an operating system of the device to be tested, a version of the operating system, a function on the service platform, a programming language used by the device, a port opened by the device, and a domain name, etc. It can be set as needed.
  • the target feature of the device under test may be pre-fetched.
  • a fingerprint detection tool can be utilized to determine the target characteristics of the device under test. For example, an HTTP request for acquiring a feature may be constructed by using the whatweb tool to interact with the device under test to obtain a response packet returned by the device under test, and the target feature is obtained according to the information in the response packet.
  • the devices to be tested having the same target feature are combined to obtain a target device to be tested corresponding to the target feature.
  • the target features corresponding to the A devices are a, b, and c
  • the target features corresponding to the B devices are a, b
  • the target features corresponding to the C devices are a, c.
  • the target device to be tested corresponding to the target feature a includes the A device, the B device, and the C device
  • the target device under test corresponding to the target feature b includes the A device and the B device
  • the target device to be tested corresponding to the target feature c includes the A. Equipment and C equipment.
  • Step S206 Select at least one test device from each set of target devices to be tested, and the number of test devices is less than the number of all devices to be tested in the corresponding target test set.
  • the test device for the target device under test set having the same target feature, a part of the device under test is selected as the test device, that is, the number of test devices is smaller than the number of all devices under test in the target test set.
  • the number of selected test devices may be one or more.
  • the A device and the C device may be selected as the device to be tested, and for the target device to be tested corresponding to the target feature b, the B device may be selected as the testing device.
  • the C device can be selected as the test device.
  • Step S208 Obtain a vulnerability test case corresponding to each target feature, perform a vulnerability test on the corresponding test device according to the vulnerability test case corresponding to the target feature, and obtain a vulnerability test result.
  • the correspondence between the target feature and the vulnerability test case is set, and the corresponding relationship can be set as needed.
  • the corresponding test case may include a vulnerability to test the account lockout function. Test cases can be pre-set. Therefore, after obtaining the vulnerability test case according to the target feature, the vulnerability test case is sent to the test device selected in the target device to be tested corresponding to the target feature to perform a vulnerability test, and the vulnerability test result is obtained. The vulnerability test resulted in a vulnerability or no vulnerability.
  • the vulnerability test case corresponding to the target feature may have one or more.
  • the vulnerability test case may include one or a combination of the test case corresponding to the black box test and the test case corresponding to the white box test.
  • the A device and the C device may be selected as the device to be tested, and for the target device to be tested corresponding to the target feature b, the B device may be selected as the testing device.
  • the C device can be selected as the test device. Therefore, the vulnerability test case corresponding to the target feature a can be sent to the A device and the C device, and the vulnerability test case corresponding to the target feature b can be sent to the B device. The vulnerability test case corresponding to the target feature c is sent to the C device.
  • Step S210 When the vulnerability test result is a vulnerability in the test device, the vulnerability test is performed on the device to be tested in the corresponding target device under test according to the vulnerability.
  • the test case corresponding to the vulnerability may be obtained, and the device to be tested except the test device in the target device device with a test device vulnerability is tested for vulnerability. It is also possible to perform vulnerability testing on some or all of the devices to be tested of the target device under test whose test device is vulnerable according to the characteristics related to the vulnerability. For example, the variable constraint of the code related to the vulnerability, the function of the vulnerability corresponding code, and one or more code features related to the vulnerability corresponding to the code identifier of the code in which the vulnerability is located may be obtained, and the corresponding test case pair is obtained according to the code feature. The device under test corresponding to the target device under test is tested for vulnerability.
  • the vulnerability test case includes a white box test case, and the white box test may be performed first, and the code corresponding to the white box test case is scanned during the vulnerability test to obtain a code statement corresponding to the variable constraint condition in the code.
  • you can obtain the variable constraints in the code corresponding to the vulnerability and then get the parameters of the corresponding test case in the black box test according to the variable constraints to construct a black box test case, and wait for the target according to the black box test case.
  • the device under test corresponding to the set of test devices is tested for vulnerability.
  • a variable constraint is a restriction on the input variable in the current code.
  • the boundary values of the variable constraints can be constructed as test parameters.
  • the parameter near the boundary value 5 can be constructed as a test parameter of the black box, such as 5.1, 4.9999999999, and the like.
  • the test parameter when the variable constraint condition includes more than two, the test parameter may be constructed according to each variable constraint condition, and then the test parameters of each variable constraint condition are combined to obtain a final test parameter.
  • the variable constraint for a login password consists of two: greater than 10 characters and the first character is a number. Then, a valid test parameter of more than 10 characters and an invalid test parameter of 10 characters or less can be constructed according to a variable constraint of more than 10 characters. And constructing a valid test parameter whose first letter is a number according to a variable constraint whose first character is a number, and an invalid test parameter whose first character is a non-numeric.
  • test parameters constructed according to the variable constraints are combined in pairs to obtain the test parameters of the black box. It is assumed that the test parameter of less than 10 characters is 1001, and the test parameter of the first character is number is a, then the combination is finally obtained. The test parameter is a1001.
  • the test parameters in the black box test case may be constructed according to the test parameters of the white box test case corresponding to the vulnerability, such as the black box test case parameter as black.
  • the test parameters of the box, or the test parameters of the white box are deformed to obtain the test parameters of the black box.
  • the test parameter is the username "admin" in the white box test, and there is a vulnerability when logging in with the username. You can use admin and admin1 as test parameters for the black box test case.
  • the correspondence between the white box test case and the black box test case may be preset, and the corresponding black box test case may be obtained according to the white box test case.
  • the correspondence between the test case of the black box and the code function may be set. Therefore, when the white box test is performed, the control corresponding to the code corresponding to the white box test case is obtained, and then the corresponding code is obtained according to the function description of the control. Function, and then get the corresponding black box test case.
  • the functional description of the control can be pre-set.
  • an open port in the code corresponding to the test case may be obtained, and a test case corresponding to the open port is sent to the device under test in the target device under test set.
  • a vulnerability test when a vulnerability test is required, a current set of devices to be tested for vulnerability testing is obtained, and the device to be tested includes a plurality of devices to be tested, and acquires target features of each device to be tested in the current device to be tested. And combining the devices to be tested having the same target feature, obtaining a target device to be tested corresponding to each target feature, selecting a corresponding test device from the target device to be tested, acquiring a vulnerability test case, and testing the device according to the vulnerability test case Vulnerability testing is performed to obtain the vulnerability test result.
  • the vulnerability test result is a vulnerability in the test device
  • the device under test corresponding to the target device under test is tested for vulnerability.
  • test device Since the test device is selected from the set of target devices under test having the same target feature for testing in the vulnerability test, when the test is vulnerable, the corresponding device under test in the target device under test is tested for vulnerability, so that the test can be reduced.
  • the number of test cases for vulnerability testing in each device under test improves the efficiency of vulnerability testing.
  • step S210 is that when the vulnerability test result is a vulnerability of the test device, according to the vulnerability, a vulnerability test is performed on the device under test in the corresponding target device under test device.
  • the steps include:
  • Step S302 when the vulnerability test result is a vulnerability in the test device, the test feature corresponding to the vulnerability is obtained.
  • the test feature corresponding to the vulnerability refers to a feature related to the vulnerability.
  • a vulnerability test case that can detect a vulnerability a test parameter of a vulnerability test case that detects a vulnerability, or a code feature corresponding to a vulnerability.
  • the code corresponding to the vulnerability refers to the code that discovered the vulnerability.
  • the code can be a code segment or a code block.
  • the code features may include variable constraints corresponding to the code and/or control identifiers corresponding to the code, and the like.
  • Step S304 obtaining a corresponding target test case according to the test feature.
  • the corresponding target test case is obtained by using the test feature.
  • the test parameters of the test case can be constructed according to the condition of the test variable.
  • the variable constraint condition in the code is x greater than 10
  • parameters such as 9.9 and 10.1 near the boundary value can be constructed as test parameters.
  • the constructed test parameters are then replaced with the parameters in the original vulnerability test case to form the target test case.
  • the corresponding control may be obtained according to the function of the corresponding code of the vulnerability, and then the test case that triggers the control is constructed, and the test parameter in the test case that triggers the control may be the test parameter in the vulnerability test case.
  • the vulnerability test case includes a white box test case
  • the code feature includes a control identifier corresponding to the current code
  • the step of obtaining the corresponding target test case according to the code feature includes: according to the control identifier and the test parameter of the white box test case Construct a black box test case as a target test case.
  • control identifier corresponding to the code may be obtained by detecting the code, or may be preset. After obtaining the control identifier, construct the test parameters of the black box test case according to the test parameters in the white box test case, and construct a black box test case in which the trigger control identifies the corresponding control to send the test parameter for testing, to simulate the user input test parameter and trigger
  • the control performs the vulnerability test and performs a vulnerability test on the device to be tested. For example, when the test parameter is the username "admin" in the white box test, and there is a vulnerability when logging in with the username. You can use admin and admin1 as test parameters for the black box test case.
  • the vulnerability test case includes a white box test case
  • the code feature includes a variable constraint corresponding to the current code and a control identifier corresponding to the current code, so the step of obtaining the corresponding target test case according to the code feature includes:
  • the identification and variable constraints construct a black box test case as a target test case.
  • control identifier corresponding to the code may be obtained by detecting the code, or may be preset. After the control identifier is obtained, the test parameters of the black box test case are constructed according to the variable constraints, and the black box test case corresponding to the control identifier is constructed to simulate the test parameter of the input black box test case and trigger the action of the control, and the device to be tested is vulnerable. test. For example, when the variable constraint condition in the code is x greater than 5, a parameter greater than 5 can be constructed as a test parameter of the black box, such as 5.1, 190000000, and the like.
  • Step S306 performing a vulnerability test on the device under test in the corresponding target device under test according to the target test case.
  • the target test case may be sent to the device under test corresponding to the target device under test to perform a vulnerability test on the device to be tested corresponding to the target device under test set.
  • the vulnerability testing method further includes:
  • Step S402 Obtain a risk of a vulnerability of each device to be tested in the current device to be tested.
  • the risk of a vulnerability indicates the degree of danger of the vulnerability, and the higher the level, the more dangerous it is.
  • Numerical values such as 90 minutes, 80 minutes, and the like can be expressed by numerical values. It can also be expressed in terms of levels, such as high, medium, low, and the like.
  • the risk of the vulnerability can be set in advance. After the vulnerability test of the current target test set is completed, the risk corresponding to the detected vulnerability is obtained.
  • Step S404 Obtain a security risk of the current device under test according to the risk of each vulnerability and the importance of the corresponding device to be tested.
  • the security risk can be expressed numerically or by level.
  • the importance indicates the importance of the device to be tested. The higher the importance, the more important it is.
  • the importance can be expressed numerically or by level, such as high, medium, low, etc.
  • the importance of the device to be tested may be preset. It can be determined according to the function assumed by the device to be tested, for example, the correspondence between the function and the importance can be set.
  • the corresponding function can be obtained according to the port open to the device under test. For example, when the device under test is open to port 80, it is considered that the device under test assumes a server function in the business system, and the importance is high.
  • the method for obtaining the security risk of the current device under test according to the risk of each vulnerability and the importance of the corresponding device under test can be set according to actual needs. Among them, the security risk is positively correlated with the risk, and the security risk is positively correlated with the importance. For example, the risk score, the important score, and the number of the vulnerability in the current device under test can be multiplied to obtain the score corresponding to the vulnerability, and the scores of each vulnerability in the current device set to be tested are summed to obtain the current test. The risk score for the collection of devices.
  • the security risk of the current device under test can show the risk of the current device to be tested, so that the tester can understand the dangerous situation of the current device to be tested. For example, when a vulnerability test is performed on a set of computer devices corresponding to a service, such as an insurance service, the risk situation of the insurance business as a whole can be obtained.
  • the target feature includes a domain name feature.
  • step S204 is to acquire target features of each device under test in the current device under test, and combine the devices to be tested having the same target feature to obtain each
  • the steps of the target device under test corresponding to the target feature include:
  • Step S502 Acquire a domain name of each device to be tested in the current device to be tested, and filter invalid information of the domain name of each device to be tested to obtain a domain name feature.
  • the invalid information of the domain name may be preset, and may be set as needed. Filtering means removing invalid information. For the domain name "http://www.test.com/login”, "http://" and “/login” are invalid information. For the domain name "https://www.baidu.com”, “https://www.baidu.cn", "com” and “cn” are invalid information. After filtering the invalid information, the domain name feature is obtained. For example, the domain name feature of http://ww.test.com/login" is www.test.com.
  • Step S504 combining the devices under test having the same domain name feature to obtain a target device to be tested corresponding to the same domain name feature.
  • the domain name features of the devices to be tested are obtained, the domain name features of the device to be tested are matched, and the devices under test having the same domain name feature are combined to obtain a target test set corresponding to the same domain name feature.
  • the domain name of the device to be tested is “https://www.baidu.com”
  • the domain name of the device to be tested is “https://www.baidu.cn”
  • the invalid information “com” is removed.
  • the domain name features are the same, so the A device under test and the device to be tested can be combined into a target device to be tested. Because the device under test with the same domain name characteristics is likely to be designed and coded by the same team, it may have the same vulnerability. Therefore, when the device to be tested detects that the vulnerability is detected, the vulnerability detection may be performed on the B device to be tested with the same domain name feature and the A device to be tested, thereby improving the testing efficiency.
  • the device under test having a similar domain name can be used as the device under test having the same characteristics.
  • the domain name of the device to be tested can be obtained according to the external network IP address of the device to be tested, and then the domain name of the device to be tested is compared to find a domain name with a similar degree of similarity, and then the domain name is similar.
  • the intranet IP address of the device under test is associated. Therefore, when the device under test is found to have a vulnerability, the intranet IP address of another device to be tested is obtained, and the vulnerability test case is sent to the device under test according to the intranet IP address.
  • the method of whether the domain name is similar is set as needed. For example, it can be the same if the primary domain name is the same.
  • a vulnerability testing apparatus including: a current set obtaining module 602, a combining module 604, a selecting module 606, a testing device testing module 608, and a device under test module 610, wherein :
  • the current collection obtaining module 602 is configured to obtain a current device to be tested to be tested for vulnerability, and the current device to be tested includes a plurality of devices to be tested.
  • the combining module 604 is configured to acquire target features of each device to be tested in the current device to be tested, and combine the devices to be tested having the same target feature to obtain a target device to be tested corresponding to each target feature.
  • the selection module 606 is configured to select at least one test device from each set of the target device under test, the number of the test devices being less than the number of all devices to be tested in the corresponding target test set.
  • the test device test module 608 is configured to obtain a vulnerability test case corresponding to each target feature, and perform a vulnerability test on the corresponding test device according to the vulnerability test case corresponding to the target feature to obtain a vulnerability test result.
  • the device under test 610 is configured to perform a vulnerability test on the device to be tested in the corresponding target device under test according to the vulnerability when the vulnerability test result is a vulnerability in the test device.
  • the device under test 610 includes:
  • the test feature obtaining unit 610A is configured to: when the vulnerability test result is a vulnerability of the test device, obtain a test feature corresponding to the vulnerability.
  • the target test case obtaining unit 610B is configured to obtain a corresponding target test case according to the test feature.
  • the device under test 610C is configured to perform a vulnerability test on the device under test in the corresponding target device under test according to the target test case.
  • the test feature corresponding to the vulnerability includes a code feature corresponding to the current code in which the vulnerability is located, and the target test case obtaining unit 610B is configured to: obtain a corresponding target test case according to the code feature.
  • the vulnerability test case includes a white box test case
  • the code feature includes a control identifier corresponding to the current code
  • the target test case obtaining unit 610B is configured to: construct a black box test according to the control identifier and the test parameter of the white box test case. Use cases as target test cases.
  • the vulnerability test case includes a white box test case
  • the code feature includes a variable constraint corresponding to the current code
  • the target test case obtaining unit 610B is configured to: according to the control identifier and the variable constraint Construct a black box test case as a target test case.
  • the vulnerability detecting apparatus further includes:
  • the risk obtaining module 802 is configured to acquire a risk of a vulnerability of each device to be tested in the current device to be tested.
  • the risk obtaining module 804 is configured to obtain a security risk of the current device under test according to the risk degree of each vulnerability and the importance of the device to be tested, and the security risk is positively correlated with the risk, and the security risk is positively correlated with the importance.
  • the target feature includes a domain name feature.
  • the combination module 604 includes:
  • the domain name obtaining unit 604A is configured to obtain a domain name of each device to be tested in the current device to be tested, and filter invalid information of the domain name of each device to be tested to obtain a domain name feature.
  • the combining unit 604B is configured to combine the devices under test having the same domain name feature to obtain a target device to be tested corresponding to the same domain name feature.
  • Each of the above-described vulnerability testing devices may be implemented in whole or in part by software, hardware, and combinations thereof.
  • Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.
  • a computer device which may be a server or a terminal, and its internal structure diagram may be as shown in FIG.
  • the computer device includes a processor, memory, and network interface coupled by a system bus.
  • the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores operating systems and computer readable instructions.
  • the internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection.
  • the computer readable instructions are executed by the processor to implement a vulnerability detection method.
  • FIG. 10 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied.
  • the specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.
  • a computer apparatus comprising a memory and one or more processors having stored therein computer readable instructions that, when executed by a processor, implement the steps of the vulnerability testing method provided in any one of the embodiments of the present application.
  • One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, causing one or more processors to implement the vulnerabilities provided in any one embodiment of the present application The steps of the test method.
  • Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory can include random access memory (RAM) or external cache memory.
  • RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain.
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM Synchl ink DRAM
  • RDRAM direct RAM
  • DRAM direct memory bus dynamic RAM
  • RDRAM memory bus dynamic RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种漏洞测试方法，包括：获取待进行漏洞测试的当前待测装置集合，当前待测装置集合包括多个待测装置；获取当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到各个目标特征对应的目标待测装置集合；从各个目标待测装置集合中分别选取测试装置，测试装置的数量小于对应的目标测试集合中全部待测装置的数量；获取各个目标特征对应的漏洞测试用例，根据目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；当漏洞测试结果为测试装置存在漏洞，根据漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。

Description

漏洞测试方法、装置、计算机设备和存储介质
相关申请的交叉引用
本申请要求于2018年1月26日提交中国专利局，申请号为2018100791881，申请名称为“漏洞测试方法、装置、计算机设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及一种漏洞测试方法、装置、计算机设备和存储介质。
背景技术
随着信息技术的发展，计算机设备提供的功能越来越多，由于系统设计或者编码的缺陷等导致的漏洞问题也越来越多。为了避免漏洞被有意或无意地利用，从而造成损失，需要对计算机系统进行漏洞测试。传统技术中，当需要对漏洞进行检测时，可以构造测试用例，然后将测试用例发送到对应的计算机设备上进行测试。然而，由于计算机功能多且代码复杂，测试用例数量大，导致漏洞测试时间长，测试效率低。
发明内容
根据本申请公开的各种实施例，提供一种漏洞测试方法、装置、计算机设备和存储介质。
一种漏洞测试方法包括：
获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
一种漏洞测试装置包括：
当前集合获取模块，用于获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
组合模块，用于获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
选取模块，用于从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
测试装置测试模块，用于获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
待测装置测试模块，用于当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
一种计算机设备，包括存储器和一个或多个处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为根据一个或多个实施例中漏洞测试方法的应用场景图。
图2为根据一个或多个实施例中漏洞测试方法的流程示意图。
图3为根据一个或多个实施例中当漏洞测试结果为测试装置存在漏洞，根据漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试步骤的流程示意图。
图4为另一个实施例中漏洞测试方法的流程示意图。
图5为根据一个或多个实施例中获取当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到各个目标特征对应的目标待测装置集合步骤的流程示意图。
图6为根据一个或多个实施例中漏洞测试装置的框图。
图7为根据一个或多个实施例中待测装置测试模块的框图。
图8为另一个实施例中漏洞测试装置的框图。
图9为根据一个或多个实施例中组合模块的框图。
图10为根据一个或多个实施例中计算机设备的框图。
具体实施方式
为了使本申请的技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的漏洞测试方法，可以应用于如图1所示的应用环境中。以当前待测设备集合包括三个待测装置104A、104B、104C，进行漏洞测试的为终端102为例。终端102可以与当前待测设备集合的待测设备进行通信，例如可以是通过网络进行通信。终端102获取需要进行漏洞测试的当前待测装置集合，执行本申请实施例提供的漏洞测试方法进行测试，以提高漏洞测试效率。其中待测装置可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑、便携式可穿戴设备以及服务器等。可以理解，也可以将应用程序作为待测装置。此外，执行本申请实施例提供的漏洞测试方法的也可以服务器等。
在一些实施例中，如图2所示，提供了一种漏洞测试方法，以执行该漏洞测试方法为图1中的终端为例进行说明，包括以下步骤：
步骤S202，获取待进行漏洞测试的当前待测装置集合，当前待测装置集合包括多个待测装置。
具体地，当前待测装置集合可以是预先设置的，例如已经预先设置了金融业务对应的设备作为当前待测装置集合。在一些实施例中，也可以利用装置探测工具对设备进行探测，得到当前待测装置集合。例如，向预设IP段的设备发送通信数据包，根据返回的通信数据包确定预设IP段内存活的设备，将存活的设备组成当前待测装置集合。当前待测装置集合的中待测装置的个数为多个，具体数量可以根据实际情况确定。例如可以是固定的个数，可以是根据业务平台中存活的计算机设备确定，也可以由测试人员根据需要进行选择。
步骤S204，获取当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到各个目标特征对应的目标待测装置集合。
具体地，待测装置的目标特征可以是待测装置的操作系统、操作系统的版本、在业务平 台上具有的功能、装置上应用所使用的程序语言、装置开放的端口以及域名等特征，具体可以根据需要进行设置。待测装置的目标特征可以是预先获取的。可以利用指纹探测工具确定待测装置的目标特征。例如可以利用whatweb工具构造获取特征的HTTP请求与待测装置进行交互，得到待测装置返回的响应包，根据响应包中的信息得到目标特征。得到待测装置的目标特征后，将具有相同目标特征的待测装置进行组合，得到目标特征所对应的目标待测装置集合。举个例子，假设有三个计算机设备为待测装置，A设备对应的目标特征为a、b以及c，B设备对应的目标特征为a、b，C设备对应的目标特征为a、c。则目标特征a对应的目标待测装置集合包括A设备、B设备以及C设备，目标特征b对应的目标待测装置集合包括A设备以及B设备，目标特征c对应的目标待测装置集合包括A设备以及C设备。
步骤S206，从各个目标待测装置集合中分别选取至少一个测试装置，测试装置的数量小于对应的目标测试集合中全部待测装置的数量。
具体地，对于具有相同目标特征的目标待测装置集合，从中选择部分待测装置作为测试装置，即测试装置的数量小于该目标测试集合全部待测装置的数量。选择的测试装置的个数可以为一个或多个。例如，对于目标特征a对应的目标待测装置集合，可以选择A设备以及C设备作为待测装置，对于目标特征b对应的目标待测装置集合，可以选择B设备作为测试装置。对于目标特征C对应的目标待测装置集合，可以选择C设备作为测试装置。
步骤S208，获取各个目标特征对应的漏洞测试用例，根据目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果。
具体地，设置了目标特征与漏洞测试用例的对应关系，对应关系具体可以根据需要进行设置。例如，对于具有XP操作系统且符合UPnP(Universal Plug and Play、通用即插即用)协议的特征的计算机设备，对应的测试用例可以包括对账号锁定功能进行测试的漏洞。测试用例可以是预先设置的。因此，根据目标特征得到漏洞测试用例后，将漏洞测试用例发送到该目标特征所对应的目标待测装置集合中选取的测试装置，以进行漏洞测试，得到漏洞测试结果。漏洞测试结果为存在漏洞或者不存在漏洞。可以理解，目标特征对应的漏洞测试用例可以有一个或多个。漏洞测试用例可以包括黑盒测试对应的测试用例以及白盒测试对应的测试用例中的一个或者组合。
例如，对于目标特征a对应的目标待测装置集合，可以选择A设备以及C设备作为待测装置，对于目标特征b对应的目标待测装置集合，可以选择B设备作为测试装置。对于目标特征C对应的目标待测装置集合，可以选择C设备作为测试装置。因此，可以将目标特征a对应的漏洞测试用例发送给A设备以及C设备，将目标特征b对应的漏洞测试用例发送给B设备。将目标特征c对应的漏洞测试用例发送给C设备。
步骤S210，当漏洞测试结果为测试装置存在漏洞，根据漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
具体地，当检测到漏洞后，可以获取漏洞所对应的测试用例对测试装置存在漏洞的目标待测装置集合中除测试装置外的待测装置进行漏洞测试。也可以根据漏洞相关的特征对测试装置存在漏洞的目标待测装置集合的部分或者全部待测装置进行漏洞测试。例如，可以获取 与漏洞相关的代码的变量约束条件、漏洞对应代码的功能以及漏洞所在的代码对应的控件标识中的一个或多个与漏洞相关的代码特征，根据代码特征获取对应的测试用例对目标待测装置集合对应的待测装置进行漏洞测试。
在一些实施例中，漏洞测试用例包括白盒测试用例，可以先进行白盒测试，在漏洞测试过程中对白盒测试用例对应的代码进行扫描，得到代码中变量约束条件对应的代码语句。当存在漏洞，可以获取该漏洞所对应的代码中的变量约束条件，然后根据变量约束条件得到对应的黑盒测试中测试用例的参数，以构造黑盒测试用例，根据黑盒测试用例对目标待测装置集合对应的待测装置进行漏洞测试。变量约束条件是指当前代码中对输入的变量进行限制的限制条件。
在一些实施例中，可以构造变量约束条件的边界值作为测试参数。例如，当代码中变量约束条件为x大于5，则可以构造边界值5附近的参数作为黑盒的测试参数，如5.1、4.9999999999等。
在一些实施例中，当变量约束条件包括两个以上时，则可以根据各个变量约束条件构造测试参数，再将各个变量约束条件的测试参数进行组合，得到最终的测试参数。例如登录密码的变量约束条件包括两个：大于10个字符以及首字符为数字。则可以根据大于10个字符的变量约束条件构造大于10个字符的有效测试参数、小于等于10个字符的无效测试参数。以及根据首字符为数字的变量约束条件构造首字母为数字的有效测试参数、首字符为非数字的无效测试参数。然后将根据变量约束条件构造的测试参数进行两两组合，得到黑盒的测试参数，假设构造的小于10个字符的测试参数为1001，首字符为数字的测试参数为a，则组合后最终得到的测试参数为a1001。
在一些实施例中，当进行白盒测试时中发现漏洞，可以根据漏洞所对应的白盒测试用例的测试参数构造黑盒测试用例中的测试参数，如将白盒的测试用例的参数作为黑盒的测试参数，或者将白盒的测试参数进行变形后得到黑盒的测试参数。例如，当在白盒测试中测试参数为用户名“admin”，且利用该用户名进行登录时存在漏洞。则可以将admin、admin1作为黑盒测试用例的测试参数。
在一些实施例中，白盒测试用例与黑盒测试用例的对应关系可以是预先设置的，可以根据白盒测试用例获取对应的黑盒测试用例。
在一些实施例中，可以设置黑盒的测试用例与代码功能的对应关系，因此在进行白盒测试时，获取白盒测试用例对应的代码对应的控件，然后根据控件的功能描述得到对应的代码功能，进而得到对应的黑盒测试用例。控件的功能描述可以是预先设置的。
在一些实施例中，在根据漏洞测试用例进行测试时，可以获取测试用例所对应的代码中开放的端口，向目标待测装置集合中的待测装置发送与开放的端口对应的测试用例。
上述漏洞测试方法中，在需要进行漏洞测试时，获取待进行漏洞测试的当前待测装置集合，待测装置集合包括多个待测装置，获取当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到各个目标特征对应的目标待测装置集合，从目标待测装置集合中选取对应的测试装置，获取漏洞测试用例，根据漏洞测试用例对测试装 置进行漏洞测试，得到漏洞测试结果，当漏洞测试结果为测试装置存在漏洞，对目标待测装置集合对应的待测装置进行漏洞测试。由于在进行漏洞测试时，首先从具有相同目标特征的目标待测装置集合中选取测试设备进行测试，当测试存在漏洞时对目标待测装置集合中对应的待测装置进行漏洞测试，因此可以减少在各个待测装置进行漏洞测试的测试用例的数量，提高了漏洞测试效率。
如图3所示，在一些实施例中，步骤S210即当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试的步骤包括：
步骤S302，当漏洞测试结果为测试装置存在漏洞，获取漏洞对应的测试特征。
具体地，漏洞对应的测试特征指与漏洞有关的特征。例如可以检测出漏洞的漏洞测试用例，检测出漏洞的漏洞测试用例的测试参数或者是漏洞对应的代码特征。漏洞对应的代码是指发现漏洞的代码。代码可以是一个代码段或代码块。代码特征可以包括代码对应的变量约束条件和/或代码所对应的控件标识等。
步骤S304，根据测试特征得到对应的目标测试用例。
具体地，得到测试特征后，利用测试特征得到对应的目标测试用例。例如，可以根据测试变量条件构造测试用例的测试参数，当代码中变量约束条件为x大于10，则可以构造边界值附近的参数如9.9、10.1作为测试参数。然后将构造的测试参数替换原漏洞测试用例中的参数，形成目标测试用例。或者可以根据漏洞对应代码的功能获取对应的控件，然后构造触发该控件的测试用例，触发该控件的测试用例中的测试参数可以是漏洞测试用例中的测试参数。
在一些实施例中，漏洞测试用例包括白盒测试用例，代码特征包括当前代码对应的控件标识，因此根据代码特征得到对应的目标测试用例的步骤包括：根据控件标识以及白盒测试用例的测试参数构造黑盒测试用例，作为目标测试用例。
具体地，代码对应的控件标识可以是对代码进行检测得到的，也可以是预先设置的。得到控件标识后，根据白盒测试用例中的测试参数构造黑盒测试用例的测试参数，并构造触发控件标识对应控件以发送测试参数进行测试的黑盒测试用例，以模拟用户输入测试参数并触发控件进行漏洞测试的动作，对待测装置进行漏洞测试。例如，当在白盒测试中测试参数为用户名“admin”，且利用该用户名进行登录时存在漏洞。则可以将admin、admin1作为黑盒测试用例的测试参数。
在一些实施例中，漏洞测试用例包括白盒测试用例，代码特征包括当前代码对应的变量约束条件以及当前代码对应的控件标识，因此因此根据代码特征得到对应的目标测试用例的步骤包括：根据控件标识以及变量约束条件构造黑盒测试用例，作为目标测试用例。
具体地，代码对应的控件标识可以是对代码进行检测得到的，也可以是预先设置的。得到控件标识后，根据变量约束条件构造黑盒测试用例的测试参数，并构造控件标识对应的黑盒测试用例，以模拟输入黑盒测试用例的测试参数并触发控件的动作，对待测装置进行漏洞测试。例如当代码中变量约束条件为x大于5，则可以构造大于5的参数作为黑盒的测试参数，如5.1、190000000等。
步骤S306，根据目标测试用例对对应的目标待测装置集合中的待测装置进行漏洞测试。
具体地，得到目标测试测试用例后，可以向对应的目标待测装置集合的待测装置发送目标测试用例，以对目标待测装置集合对应的待测装置进行漏洞测试。
在一些实施例中，如图4所示，漏洞测试方法还包括：
步骤S402，获取当前待测装置集合中各个待测装置的漏洞的危险度。
具体地，漏洞的危险度表示漏洞的危险程度，级别越高，则越危险。可以用数值表示例如90分、80分等。也可以用等级进行表示，例如高、中、低等。漏洞的危险度可以预先设置。当对当前目标待测集合的漏洞测试完成后，获取检测到的漏洞对应的危险度。
步骤S404，根据各个漏洞的危险度以及对应的待测装置的重要度得到当前待测装置集合的安全风险。
具体地，安全风险可以用数值表示，也可以用等级进行表示。重要度表示待测装置的重要程度，重要度越高，则越重要。重要度可以用数值表示，也可以用等级进行表示，例如高、中、低等。待测装置的重要度可以是预先设置的。可以根据待测装置的所承担的功能确定，例如可以设置功能与重要度的对应关系。在一些实施例中，可以根据待测装置开放的端口得到对应的功能。例如，当待测装置开放的是80端口，则认为该待测装置在业务系统中承担服务器功能，重要度高。当计算机设备开放的是306端口，则认为待测装置在业务系统中承担数据库功能，重要度比服务器功能较低。根据各个漏洞的危险度及对应的待测装置的重要度得到当前待测装置集合的安全风险的方法可以根据实际需要进行设置。其中，安全风险与危险度呈正相关关系，安全风险与重要度呈正相关关系。例如，可以将危险分、重要分以及当前待测装置集合中该漏洞的个数进行相乘，得到该漏洞对应的分数，将当前待测装置集合中各个漏洞的分数进行求和得到当前待测装置集合的风险评分。结合漏洞的危险度以及对应的待测装置的重要度得到当前待测装置集合的安全风险能够展现当前待测装置集合的风险，以方便测试人员了解当前待测装置集合的危险情况。例如，当对业务例如保险业务对应的计算机设备集合进行漏洞测试，则可以得到该保险业务整体的风险情况。
在一些实施例中，目标特征包括域名特征，如图5所示，步骤S204即获取当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到各个目标特征对应的目标待测装置集合的步骤包括：
步骤S502，获取当前待测装置集合中各个待测装置的域名，对各个待测装置的域名的无效信息进行过滤，得到域名特征。
具体地，域名的无效信息可以是预先设置的，具体可以根据需要进行设置。过滤是指去除无效信息，对于域名“http://www.test.com/login”，“http://”以及“/login”是无效信息。对于域名“https://www.baidu.com”、“https://www.baidu.cn”，“com”、“cn”是无效信息。对无效信息进行过滤后，得到域名特征。例如，http://ww.test.com/login”的域名特征是www.test.com。
步骤S504，将具有相同域名特征的待测装置进行组合，得到相同的域名特征对应的目标待测装置集合。
具体地，得到各个待测装置的的域名特征后，对待测装置的域名特征进行匹配，将具有相同域名特征的待测装置进行组合，得到相同的域名特征对应的目标待测集合。例如当A待测装置对应的域名为“https://www.baidu.com”，B待测装置对应的域名为“https://www.baidu.cn”，去除无效的信息“com”、“cn”后，域名特征相同，故可以将A待测装置以及B待测装置组合成目标待测装置集合。由于域名特征相同的待测装置很大可能都是由相同的团队设计以及编写代码的，可能具有相同的漏洞。因此当发现A待测装置检测到了漏洞，则可以对域名特征与A待测装置相同的B待测装置进行漏洞检测，提高测试效率。
在一些实施例中，可以将域名相似的待测装置作为具有相同特征的待测装置。在获取待测装置的域名时，可以根据待测装置的外网IP地址得到待测装置的域名，然后对待测装置的域名进行对比，找出相似度大的域名，然后将域名相似度大的待测装置的内网IP地址进行关联。因此，当发现待测装置存在漏洞时，获取其关联的另一个待测装置的内网IP地址，根据内网IP地址向待测装置发送漏洞测试用例。域名是否相似的方法根据需要进行设置。例如，可以是主域名相同则为相似。
应该理解的是，虽然上述的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，上述中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
在一些实施例中，如图6所示，提供了一种漏洞测试装置，包括：当前集合获取模块602、组合模块604、选取模块606、测试装置测试模块608和待测装置测试模块610，其中：
当前集合获取模块602，用于获取待进行漏洞测试的当前待测装置集合，当前待测装置集合包括多个待测装置。
组合模块604，用于获取当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到各个目标特征对应的目标待测装置集合。
选取模块606，用于从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量。
测试装置测试模块608，用于获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果。
待测装置测试模块610，用于当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
在其中一个实施例中，如图7所示，待测装置测试模块610包括：
测试特征得到单元610A，用于当漏洞测试结果为测试装置存在漏洞，获取漏洞对应的测试特征。
目标测试用例得到单元610B，用于根据测试特征得到对应的目标测试用例。
待测装置测试单元610C，用于根据目标测试用例对对应的目标待测装置集合中的待测装置进行漏洞测试。
在其中一个实施例中，漏洞对应的测试特征包括漏洞所在的当前代码对应的代码特征，目标测试用例得到单元610B用于：根据代码特征得到对应的目标测试用例。
在其中一个实施例中，漏洞测试用例包括白盒测试用例，代码特征包括当前代码对应的控件标识，目标测试用例得到单元610B用于：根据控件标识以及白盒测试用例的测试参数构造黑盒测试用例，作为目标测试用例。
在其中一个实施例中，漏洞测试用例包括白盒测试用例，代码特征包括当前代码对应的变量约束条件以及当前代码对应的控件标识，目标测试用例得到单元610B用于：根据控件标识以及变量约束条件构造黑盒测试用例，作为目标测试用例。
在其中一个实施例中，如图8所示，漏洞检测装置还包括：
危险度获取模块802，用于获取当前待测装置集合中各个待测装置的漏洞的危险度。
风险得到模块804，用于根据各个漏洞的危险度以及对应的待测装置的重要度得到当前待测装置集合的安全风险，安全风险与危险度呈正相关关系，安全风险与重要度呈正相关关系
在其中一个实施例中，目标特征包括域名特征，如图9所示，组合模块604包括：
域名获取单元604A，用于获取当前待测装置集合中各个待测装置的域名，对各个待测装置的域名的无效信息进行过滤，得到域名特征。
组合单元604B，用于将具有相同域名特征的待测装置进行组合，得到相同的域名特征对应的目标待测装置集合。
关于漏洞测试装置的具体限定可以参见上文中对于漏洞测试方法的限定，在此不再赘述。上述漏洞测试装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一些实施例中，提供了一种计算机设备，该计算机设备可以是服务器也可以是终端，其内部结构图可以如图10所示。该计算机设备包括通过系统总线连接的处理器、存储器和网络接口。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统和计算机可读指令。该内存储器为非易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机可读指令被处理器执行时以实现一种漏洞检测方法。
本领域技术人员可以理解，图10中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和一个或多个处理器，存储器中存储有计算机可读指令，计算机可读指令被处理器执行时实现本申请任意一个实施例中提供的漏洞测试方法的步骤。
一个或多个存储有计算机可读指令的非易失性存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器实现本申请任意一个实施例中提供的漏洞测试方法的步骤。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机可读指令来指令相关的硬件来完成，所述的计算机可读指令可存储于一非易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchl ink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种漏洞测试方法，包括：
    获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
    获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
    从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
    获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
    当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
  2. 根据权利要求1所述的方法，其特征在于，所述当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试，包括：
    当所述漏洞测试结果为所述测试装置存在漏洞，获取所述漏洞对应的测试特征；
    根据所述测试特征得到对应的目标测试用例；及
    根据所述目标测试用例对对应的目标待测装置集合中的待测装置进行漏洞测试。
  3. 根据权利要求2所述的方法，其特征在于，所述漏洞对应的测试特征包括所述漏洞所在的当前代码对应的代码特征，所述根据所述测试特征得到对应的目标测试用例，包括：
    根据所述代码特征得到对应的目标测试用例。
  4. 根据权利要求3所述的方法，其特征在于，所述漏洞测试用例包括白盒测试用例，所述代码特征包括所述当前代码对应的控件标识，所述根据所述代码特征得到对应的目标测试用例，包括：
    根据所述控件标识以及所述白盒测试用例的测试参数构造黑盒测试用例，作为目标测试用例。
  5. 根据权利要求3所述的方法，其特征在于，所述漏洞测试用例包括白盒测试用例，所述代码特征包括所述当前代码对应的变量约束条件以及所述当前代码对应的控件标识，所述根据所述代码特征得到对应的目标测试用例，包括：
    根据所述控件标识以及所述变量约束条件构造黑盒测试用例，作为目标测试用例。
  6. 根据权利要求1～5任意一项所述的方法，其特征在于，还包括：
    获取所述当前待测装置集合中各个待测装置的漏洞的危险度；及
    根据所述各个漏洞的危险度以及对应的待测装置的重要度得到所述当前待测装置集合的安全风险，所述安全风险与所述危险度呈正相关关系，所述安全风险与所述重要度呈正相关关系。
  7. 根据权利要求1～5任意一项所述的方法，其特征在于，所述目标特征包括域名特征，所述获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合，包括：
    获取所述当前待测装置集合中各个待测装置的域名，对所述各个待测装置的域名的无效信息进行过滤，得到域名特征；及
    将具有相同域名特征的待测装置进行组合，得到相同的域名特征对应的目标待测装置集合。
  8. 一种漏洞测试装置，所述装置包括：
    当前集合获取模块，用于获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
    组合模块，用于获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
    选取模块，用于从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
    测试装置测试模块，用于获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
    待测装置测试模块，用于当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
  9. 一种计算机设备，包括存储器及一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
    获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
    从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
    获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
    当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
  10. 根据权利要求9所述的计算机设备，其特征在于，所述处理器所执行的所述当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试，包括：
    当所述漏洞测试结果为所述测试装置存在漏洞，获取所述漏洞对应的测试特征；
    根据所述测试特征得到对应的目标测试用例；及
    根据所述目标测试用例对对应的目标待测装置集合中的待测装置进行漏洞测试。
  11. 根据权利要求10所述的计算机设备，其特征在于，所述漏洞对应的测试特征包括所述漏洞所在的当前代码对应的代码特征，所述处理器所执行的所述根据所述测试特征得到对应的目标测试用例，包括：
    根据所述代码特征得到对应的目标测试用例。
  12. 根据权利要求11所述的计算机设备，其特征在于，所述漏洞测试用例包括白盒测试用例，所述代码特征包括所述当前代码对应的控件标识，所述处理器所执行的所述根据所述代码特征得到对应的目标测试用例，包括：
    根据所述控件标识以及所述白盒测试用例的测试参数构造黑盒测试用例，作为目标测试用例。
  13. 根据权利要求11所述的计算机设备，其特征在于，所述漏洞测试用例包括白盒测试用例，所述代码特征包括所述当前代码对应的变量约束条件以及所述当前代码对应的控件标识，所述处理器所执行的所述根据所述代码特征得到对应的目标测试用例，包括：
    根据所述控件标识以及所述变量约束条件构造黑盒测试用例，作为目标测试用例。
  14. 根据权利要求9～13任意一项所述的计算机设备，其特征在于，所述计算机可读指令被所述处理器执行时还执行以下步骤：
    获取所述当前待测装置集合中各个待测装置的漏洞的危险度；及
    根据所述各个漏洞的危险度以及对应的待测装置的重要度得到所述当前待测装置集合的安全风险，所述安全风险与所述危险度呈正相关关系，所述安全风险与所述重要度呈正相关关系。
  15. 一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    获取待进行漏洞测试的当前待测装置集合，所述当前待测装置集合包括多个待测装置；
    获取所述当前待测装置集合中各个待测装置的目标特征，将具有相同目标特征的待测装置进行组合，得到所述各个目标特征对应的目标待测装置集合；
    从所述各个目标待测装置集合中分别选取至少一个测试装置，所述测试装置的数量小于对应的目标测试集合中全部待测装置的数量；
    获取所述各个目标特征对应的漏洞测试用例，根据所述目标特征对应的漏洞测试用例对对应的测试装置进行漏洞测试，得到漏洞测试结果；及
    当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试。
  16. 根据权利要求15所述的存储介质，其特征在于，所述处理器所执行的所述当所述漏洞测试结果为所述测试装置存在漏洞，根据所述漏洞对对应的目标待测装置集合中的待测装置进行漏洞测试，包括：
    当所述漏洞测试结果为所述测试装置存在漏洞，获取所述漏洞对应的测试特征；
    根据所述测试特征得到对应的目标测试用例；及
    根据所述目标测试用例对对应的目标待测装置集合中的待测装置进行漏洞测试。
  17. 根据权利要求16所述的存储介质，其特征在于，所述漏洞对应的测试特征包括所述漏洞所在的当前代码对应的代码特征，所述处理器所执行的所述根据所述测试特征得到对应 的目标测试用例，包括：
    根据所述代码特征得到对应的目标测试用例。
  18. 根据权利要求17所述的存储介质，其特征在于，所述漏洞测试用例包括白盒测试用例，所述代码特征包括所述当前代码对应的控件标识，所述处理器所执行的所述根据所述代码特征得到对应的目标测试用例，包括：
    根据所述控件标识以及所述白盒测试用例的测试参数构造黑盒测试用例，作为目标测试用例。
  19. 根据权利要求17所述的存储介质，其特征在于，所述漏洞测试用例包括白盒测试用例，所述代码特征包括所述当前代码对应的变量约束条件以及所述当前代码对应的控件标识，所述处理器所执行的所述根据所述代码特征得到对应的目标测试用例，包括：
    根据所述控件标识以及所述变量约束条件构造黑盒测试用例，作为目标测试用例。
  20. 根据权利要求15～19任意一项所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时还执行以下步骤：
    获取所述当前待测装置集合中各个待测装置的漏洞的危险度；及
    根据所述各个漏洞的危险度以及对应的待测装置的重要度得到所述当前待测装置集合的安全风险，所述安全风险与所述危险度呈正相关关系，所述安全风险与所述重要度呈正相关关系。
PCT/CN2018/088864 2018-01-26 2018-05-29 漏洞测试方法、装置、计算机设备和存储介质 WO2019144549A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810079188.1 2018-01-26
CN201810079188.1A CN108256334B (zh) 2018-01-26 2018-01-26 漏洞测试方法、装置、计算机设备和存储介质

Publications (1)

Publication Number Publication Date
WO2019144549A1 true WO2019144549A1 (zh) 2019-08-01

Family

ID=62742940

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/088864 WO2019144549A1 (zh) 2018-01-26 2018-05-29 漏洞测试方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN108256334B (zh)
WO (1) WO2019144549A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108958890A (zh) * 2018-07-25 2018-12-07 北京奇艺世纪科技有限公司 容器镜像检测方法、装置及电子设备
CN109376082A (zh) * 2018-09-27 2019-02-22 北京小米智能科技有限公司 漏洞挖掘方法、装置及可读存储介质
CN110311886A (zh) * 2019-04-04 2019-10-08 平安科技（深圳）有限公司 服务器漏洞检测方法、装置、设备和存储介质
CN110297764B (zh) * 2019-05-30 2023-04-07 北京百度网讯科技有限公司 漏洞测试模型训练方法和装置
CN111062040A (zh) * 2019-12-19 2020-04-24 成都烽创科技有限公司 一种确定未知漏洞的方法、服务器及计算机可读存储介质
CN111488287B (zh) * 2020-04-16 2023-05-16 南开大学 注入漏洞测试用例的生成方法、装置、介质及电子设备
CN112769845B (zh) * 2021-01-18 2023-05-26 杭州安恒信息技术股份有限公司 漏洞测试方法、装置、电子装置和计算机设备
CN113238926B (zh) * 2021-04-14 2023-11-10 北京信安世纪科技股份有限公司 一种数据库脚本检测方法、装置、电子设备及存储介质
CN114969766B (zh) * 2022-07-29 2022-10-21 杭州孝道科技有限公司 账号锁定绕过逻辑漏洞检测方法、系统以及存储介质
CN116502238B (zh) * 2023-06-26 2023-10-10 中汽智联技术有限公司 一种基于车联网产品安全漏洞专业库cavd的防护方法
CN117473513B (zh) * 2023-12-28 2024-04-12 北京立思辰安科技术有限公司 一种设备检测方法、存储介质及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120304157A1 (en) * 2011-05-23 2012-11-29 International Business Machines Corporation Method for testing operation of software
CN103077348A (zh) * 2012-12-28 2013-05-01 华为技术有限公司 一种Web站点漏洞扫描方法和装置
CN104699616A (zh) * 2015-03-31 2015-06-10 北京奇虎科技有限公司 一种应用测试的方法、装置及系统
CN107133519A (zh) * 2017-05-15 2017-09-05 华中科技大学 一种安卓应用网络通信中隐私泄漏检测方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9282114B1 (en) * 2011-06-30 2016-03-08 Emc Corporation Generation of alerts in an event management system based upon risk
CN104077215B (zh) * 2013-03-26 2017-12-01 腾讯科技（深圳）有限公司 一种软件测试方法和装置
CN104142888B (zh) * 2014-07-14 2017-06-27 北京理工大学 一种有状态协议的规则化状态机模型设计方法
CN106487813A (zh) * 2016-12-13 2017-03-08 北京匡恩网络科技有限责任公司 工控网络安全检测系统及检测方法
CN107480531A (zh) * 2017-07-18 2017-12-15 北京计算机技术及应用研究所 基于漏洞库的自动化软件漏洞验证系统及方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120304157A1 (en) * 2011-05-23 2012-11-29 International Business Machines Corporation Method for testing operation of software
CN103077348A (zh) * 2012-12-28 2013-05-01 华为技术有限公司 一种Web站点漏洞扫描方法和装置
CN104699616A (zh) * 2015-03-31 2015-06-10 北京奇虎科技有限公司 一种应用测试的方法、装置及系统
CN107133519A (zh) * 2017-05-15 2017-09-05 华中科技大学 一种安卓应用网络通信中隐私泄漏检测方法及系统

Also Published As

Publication number Publication date
CN108256334B (zh) 2019-06-04
CN108256334A (zh) 2018-07-06

Similar Documents

Publication Publication Date Title
WO2019144549A1 (zh) 漏洞测试方法、装置、计算机设备和存储介质
US20200296137A1 (en) Cybersecurity profiling and rating using active and passive external reconnaissance
US9984365B2 (en) Device identification based on deep fingerprint inspection
CN113574838A (zh) 通过客户端指纹过滤互联网流量的系统和方法
US20210258330A1 (en) Detecting compromised credentials in a credential stuffing attack
CN109800258B (zh) 数据文件部署方法、装置、计算机设备及存储介质
US20090119777A1 (en) Method and system of determining vulnerability of web application
WO2019144548A1 (zh) 安全测试方法、装置、计算机设备和存储介质
RU2651196C1 (ru) Способ обнаружения аномальных событий по популярности свертки события
US12015596B2 (en) Risk analysis using port scanning for multi-factor authentication
CN109669859B (zh) 服务测试方法、装置、计算机设备和存储介质
US20210281609A1 (en) Rating organization cybersecurity using probe-based network reconnaissance techniques
CN113472803A (zh) 漏洞攻击状态检测方法、装置、计算机设备和存储介质
CN110619022B (zh) 基于区块链网络的节点检测方法、装置、设备及存储介质
CN111125748A (zh) 越权查询的判断方法、装置、计算机设备和存储介质
US8750520B2 (en) Appraising systems with zero knowledge proofs
CN116776390A (zh) 一种数据泄漏行为的监测方法、装置、存储介质及设备
CN114070768B (zh) 渗透测试方法、装置、计算机设备和存储介质
CN117896186B (zh) 一种基于日志分析的漏洞扫描方法、系统及存储介质
KR101436495B1 (ko) 컴퓨터시스템 및 컴퓨터시스템의 악성사이트 여부 판단 방법
CN114124439B (zh) 登录鉴权方法、装置、设备与存储介质
CN113347203B (zh) 网络攻击的检测方法、装置、电子设备及存储介质
CN112711538B (zh) 测试系统模拟方法、装置、计算机设备及存储介质
CN117118740A (zh) 网络安全分析方法、装置、通信设备及存储介质
US20240089268A1 (en) Detecting malicious behavior from handshake protocols using machine learning

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18902379

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 09.11.2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18902379

Country of ref document: EP

Kind code of ref document: A1