WO2022100020A1 - 漏洞测试方法及装置 - Google Patents

漏洞测试方法及装置 Download PDF

Info

Publication number
WO2022100020A1
WO2022100020A1 PCT/CN2021/090138 CN2021090138W WO2022100020A1 WO 2022100020 A1 WO2022100020 A1 WO 2022100020A1 CN 2021090138 W CN2021090138 W CN 2021090138W WO 2022100020 A1 WO2022100020 A1 WO 2022100020A1
Authority
WO
WIPO (PCT)
Prior art keywords
test
server
field
service
message
Prior art date
Application number
PCT/CN2021/090138
Other languages
English (en)
French (fr)
Inventor
杨利东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022100020A1 publication Critical patent/WO2022100020A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G06F16/9566—URL specific, e.g. using aliases, detecting broken or misspelled links
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Definitions

  • the present application relates to the field of computers, and in particular, to a vulnerability testing method and device.
  • a vulnerability scanner is a computer program that evaluates a computer, network, or application for known vulnerabilities. For example, vulnerability scanners are able to identify and detect vulnerabilities due to misconfiguration or flawed programming in network-based assets such as firewalls, routers, web servers, application servers, etc. Usually, vulnerability scanners will initiate vulnerability tests to test targets based on pre-set configuration information, such as IP addresses or domain names.
  • the embodiments of the present application provide a vulnerability testing method and apparatus, which can improve the testing effect.
  • the technical solution is as follows.
  • a vulnerability testing method is provided.
  • a first packet transmitted between a terminal and a server is obtained through a gateway device, the gateway device is deployed between the terminal and the server, and the gateway device is deployed between the terminal and the server.
  • the first message includes a first field, and the server is used to provide services to other devices; the service description information of the server is identified according to the content of the first field included in the first message, and the service description information includes The application type to which the service belongs, the protocol type on which the service is provided, the resource path uniform resource locator (URL) on which the service is provided, or the version identifier of the service provided; obtain the test load corresponding to the service description information , the test payload is a character string used to test the vulnerability corresponding to the service; a test message is sent to the server through the gateway device, and the test message is generated according to the test payload; The gateway device receives a response message for the test message from the server; if the response message includes an expected result corresponding to the test payload, it is determined that the server has the vulnerability, and the expected result indicates The test load is executed successfully.
  • the service description information of the server is identified according to the content of the first field included in the first message, and the service description information includes The application type to which the service belongs, the
  • a gateway device deployed between the terminal and the server is used to obtain the message that the terminal interacts with the server, and the message is automatically identified according to the content of the fields in the message.
  • Get some specific information about the service provided by the server such as application type, protocol type, URL or version, etc., use the identified information to obtain the corresponding test payload, use the test payload to construct a test packet, and use the server to respond to the test packet.
  • the efficiency of the vulnerability test is improved, and on the other hand, the target of the test is more refined, so the effect of the vulnerability test can be significantly improved.
  • the identifying the service description information of the server according to the content of the first field included in the first packet includes: querying a service identification library according to the content of the first field, where the service identification library is stored in the service identification library. Used to save the correspondence between the character string in the first field and the service description information; if the content of the first field and the target string in the service identification library meet the matching conditions, the The service description information corresponding to the target string is determined to be the service description information of the server.
  • the sending a test packet to the server through the gateway device includes: acquiring, through the gateway device, a second packet transmitted between the terminal and the server; if the second packet is The message includes the URL of the server, and the test payload is used to replace the content of the specified field in the second message, so as to generate the test message; the generated test message is sent to the server through the gateway device.
  • the vulnerability testing process for the target server can be triggered, so as to detect the traffic transmitted in real time.
  • the frequency of actively launching the test is low, and the detection target is relatively broad.
  • the second message is a request message from the terminal with the server as a destination.
  • the specified field is a URL field, a hypertext transfer protocol (hyper text transfer protocol, HTTP) header field, an HTTP body field or a payload field.
  • HTTP hypertext transfer protocol
  • the method before replacing the content of the specified field in the second message with the test payload, the method further includes: using the URL in the second message as a query index, querying the payload configuration library to obtain the test load and description information, the load configuration library is used to save the correspondence between the query index, the test load, and the description information, and the description information is used to indicate that the test load is used to replace the specified
  • the content of the field is determined according to the description information.
  • the sending a test packet to the server through the gateway device includes: generating a test packet according to the test load, the address of the server, and the URL of the server, and the value of the test packet is
  • the payload field includes the test payload
  • the destination address field of the test packet includes the address of the server
  • the URL field of the test packet includes the URL of the server
  • the gateway device sends the generated data to the server. of the test message.
  • vulnerability testing can be initiated more quickly, supporting emergency response scenarios.
  • the service description information further includes at least one of a container type on which the service is provided, a database type on which the service is provided, and a scripting language on which the service is provided.
  • the first message is a request message from the terminal with the server as the destination, or the first message is from the server and with the terminal as the destination party's response message.
  • the first field includes at least one of an internet protocol (internet protocol, IP) address field, a domain name field, a URL field, a status code field, an identification field of a network transmission protocol, a port number field, and a payload field.
  • IP internet protocol
  • a vulnerability testing apparatus in a second aspect, is provided, and the vulnerability testing apparatus has the function of implementing the first aspect or any optional manner of the first aspect.
  • the vulnerability testing apparatus includes at least one unit, and the at least one unit is configured to implement the method provided in the first aspect or any optional manner of the first aspect.
  • the units in the vulnerability testing apparatus are implemented by software, and the units in the vulnerability testing apparatus are program modules. In other embodiments, the units in the vulnerability testing apparatus are implemented by hardware or firmware.
  • a test server in a third aspect, includes a processor and a communication interface, the processor is used for executing program codes, so that the test server executes the first aspect or any optional manner of the first aspect.
  • the communication interface is used for receiving or sending messages.
  • a gateway device in a fourth aspect, includes a processor and a communication interface, the processor is configured to execute program codes, so that the gateway device executes the first aspect or any optional manner of the first aspect.
  • the communication interface is used for receiving or sending messages.
  • a computer-readable storage medium is provided, and at least one piece of program code is stored in the storage medium, and the at least one piece of program code is read by a processor to cause the test server or gateway device to execute the first aspect or the first A method provided in any optional manner of the aspect.
  • a computer program product includes one or more computer program instructions, when the computer program instructions are loaded and executed by a computer, cause the computer to perform the above-mentioned first aspect or the first aspect.
  • a chip is provided, when the chip runs on a test server, the test server is made to execute the method provided in the first aspect or any optional manner of the first aspect.
  • a chip is provided, which, when the chip runs on a gateway device, enables the gateway device to execute the method provided in the first aspect or any optional manner of the first aspect.
  • a network system in a ninth aspect, includes a test server and a gateway device, the test server and the gateway device are connected through a network, and the network system is used to perform the above-mentioned first aspect or any one of the optional first aspects. method described.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a test server or gateway device provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of a vulnerability testing method provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of a vulnerability testing method provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of a vulnerability testing method provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a vulnerability testing apparatus provided by an embodiment of the present application.
  • Vulnerability testing is an important technology in the field of network security. Through vulnerability testing, it is possible to discover vulnerabilities in network-based assets (such as firewalls, routers, web servers, application servers, etc.), so that network security vulnerabilities and system misconfigurations can be corrected in a timely manner according to the discovered vulnerabilities, thereby effectively avoiding Hackers use loopholes to launch network attacks to prevent them from happening.
  • network-based assets such as firewalls, routers, web servers, application servers, etc.
  • IP Internet Protocol
  • the embodiments of the present application provide a solution for implementing efficient vulnerability testing based on a gateway.
  • the technical solution can be applied in scenarios such as emergency network emergency and application security testing, and can quickly implement security vulnerability testing, reduce security emergency response time and application security testing time, and improve security testing efficiency.
  • the technical solution can greatly improve the use cost and the precise effect. Testing in actual data can achieve 100% test target resource coverage.
  • security vulnerability testing tasks can be completed in a multi-process, high-efficiency, and high-output manner without manual participation.
  • FIG. 1 is a schematic diagram of a typical application scenario 100 of an embodiment of the present application.
  • the scenario 100 shown in FIG. 1 includes a gateway device 110 , a terminal 130 and at least one service server 150 .
  • the scenario 100 shown in FIG. 1 further includes a test server 120 .
  • Each device in the scenario shown in FIG. 1 is introduced separately below.
  • the terminal 130 is, for example, a server, a host, a personal computer, a mobile phone, or a workstation.
  • the terminal 130 is installed with browser software or an application client, and the terminal 130 sends a request message through the browser software or the application client, thereby accessing the service server 150 .
  • the service server 150 is used to provide services to the terminal 130 or other devices.
  • the service server 150 is a web server, and the service server 150 is configured to generate and return an HTTP response in response to a hypertext transfer protocol (HTTP) request from the browser software in the terminal 130, thereby providing the terminal 130 with access to the web page required resources.
  • HTTP hypertext transfer protocol
  • the service server 150 is another application server, such as a game server, a file server, a database server, a search engine server, an instant messaging server, etc.
  • the service server 150 is used to respond to the service processing request from the application client in the terminal 130, so as to provide The application provides background services.
  • the gateway device 110 is deployed between the terminal 130 and the service server 150 .
  • the gateway device 110 is used to obtain the packets exchanged between the terminal 130 and the service server 150 , send the test packets to the service server 150 , and receive the test packets from the service server 150 for the test packets. response message.
  • the gateway device 110 is, for example, deployed between an enterprise network and the Internet.
  • the enterprise network includes switches and service servers 150 .
  • the service server 150 is connected to the switch.
  • the switch is used to forward data transmitted between the service server 150 and the gateway device 110 .
  • the test server 120 is connected to the gateway device 110 through a network.
  • the test server 120 is used to interact with the gateway device 110 to support the process of vulnerability testing.
  • the test server 120 is used for service identification, transmission of test payloads, and verification of response messages.
  • FIG. 1 is an example illustrating the separation of the gateway device 110 and the test server 120 .
  • gateway device 110 is physically integrated with test server 120 .
  • the test server 120 is a functional module inside the gateway device 110.
  • the physical entity of the test server 120 is a service board. By setting the service board in the gateway device 110, the gateway device 110 integrates the function of vulnerability testing.
  • the gateway device 110 can act as a communication bridge between the service server 150 and the terminal 130 .
  • the gateway device 110 is responsible for forwarding the service server 150 Messages exchanged with the terminal 130 .
  • the service server 150 communicates with the terminal 130 in a request and response manner.
  • the flow of processing a request sent by the terminal 130 by the service server 150 includes the following steps 1 to 6.
  • Step 1 The user performs an operation on the terminal 130.
  • the terminal 130 accesses Internet application services (eg, search engine services, instant messaging applications, etc.) on the service server 150 through a browser or other client.
  • Internet application services eg, search engine services, instant messaging applications, etc.
  • Step 2 The terminal 130 sends a request message to the service server 150.
  • the protocol corresponding to the request message is, for example, HTTP or other protocols.
  • the request message is sent by the terminal 130 and arrives at the gateway device 110 .
  • Step 3 After receiving the request message, the gateway device 110 parses the content of the request message, determines that the sender of the request message is the terminal 130 and the destination of the request message is the service server 150, and then forwards the request message to the service server 150.
  • Step 4 After receiving the request message, the service server 150 processes the request message.
  • the service server 150 generates a response message according to the processing result, and returns the response message to the terminal 130 .
  • Step 5 During the process of sending the response message from the service server 150 to the terminal 130, the response message will pass through the gateway device 110. After the gateway parses and processes the response message, it forwards the response message to the terminal 130 in the original way.
  • Step 6 After receiving the response message, the terminal 130 completes a request-response process.
  • FIG. 2 shows a schematic structural diagram of a device 200 provided by an exemplary embodiment of the present application.
  • the device 200 shown in FIG. 2 is, for example, the gateway device 110 or the test device in the application scenario shown in FIG. 1 .
  • Device 200 includes at least one processor 201 , communication bus 202 , memory 203 , and at least one communication interface 204 .
  • the processor 201 is, for example, a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a graphics processing unit (graphics processing unit, GPU), a neural-network processing unit (neural-network processing units, NPU) ), a data processing unit (DPU), a microprocessor or one or more integrated circuits for implementing the solution of the present application.
  • the processor 201 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the communication bus 202 is used to transfer information between the aforementioned components.
  • the communication bus 202 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 2, but it does not mean that there is only one bus or one type of bus.
  • the memory 203 is, for example, a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) or a memory device that can store information and instructions.
  • Other types of dynamic storage devices such as electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of Any other medium accessed by a computer without limitation.
  • the memory 203 exists independently, for example, and is connected to the processor 201 through the communication bus 202 .
  • the memory 203 may also be integrated with the processor 201 .
  • the Communication interface 204 uses any transceiver-like device for communicating with other devices or a communication network.
  • the communication interface 204 includes a wired communication interface, and may also include a wireless communication interface.
  • the wired communication interface may be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface or a combination thereof.
  • the wireless communication interface may be a wireless local area network (wireless local area networks, WLAN) interface, a cellular network communication interface or a combination thereof, and the like.
  • the processor 201 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 2 .
  • the device 200 may include multiple processors, such as the processor 201 and the processor 205 shown in FIG. 2 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the device 200 may further include an output device and an input device.
  • the output device communicates with the processor 201 and can display information in a variety of ways.
  • the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, a projector, or the like.
  • the input device communicates with the processor 201 and can receive user input in a variety of ways.
  • the input device may be a mouse, a keyboard, a touch screen device, or a sensor device, or the like.
  • the memory 203 is used to store the program code 210 for executing the solutions of the present application, and the processor 201 can execute the program code 210 stored in the memory 203 . That is, the device 200 can implement the methods provided by the following method embodiments through the processor 201 and the program code 210 in the memory 203 .
  • the device 200 in this embodiment of the present application may correspond to the gateway device or the test server in the following method embodiments, and the processor 201, the communication interface 204, etc. in the device 200 may implement the gateway device or the test server in the above method embodiments. Test the functions and/or the various steps and methods implemented by the server. For brevity, details are not repeated here.
  • FIG. 3 is a flowchart of a vulnerability testing method 300 provided by an embodiment of the present application.
  • the method 300 involves two types of servers, one type of server plays the role of test target, and the other type of server plays the role of providing relevant configuration such as test load.
  • the method 300 uses "target server” and "test server” to refer to these two different types of servers, respectively.
  • the deployment scenario of the gateway device, the terminal, the target server and the test server involved in the method 300 is shown in FIG. 1 .
  • the gateway device in the method 300 is the gateway device 110 in FIG. 1
  • the terminal in the method 300 is the terminal 130 in FIG. 1
  • the target server in the method 300 is the one in FIG. 1 .
  • the service server 150 in the method 300 is the test server 120 in FIG. 1 .
  • FIG. 3 illustrates an example in which the gateway device and the test server are two separate hardware devices.
  • the gateway device and the test server are integrated into the same hardware device (eg, integrated on the gateway device) in a co-located manner, the following steps executed by the test server are actually executed by the gateway device.
  • the gateway device, terminal, target server and test server in FIG. 3 have the hardware structure shown in FIG. 2 .
  • the vulnerability testing method provided by the embodiment of the present application includes steps S310 to S370.
  • Step S310 the test server obtains the first message transmitted between the terminal and the target server through the gateway device.
  • the gateway device acts as a bridge for communication between the terminal and the target server.
  • the packets sent by the terminal or the target server will reach the gateway device, and the gateway device can obtain the packets.
  • first packet and second packet are used to describe different packets respectively.
  • the type of the first packet includes various situations.
  • the first message is a request message from the terminal with the target server as the destination.
  • the terminal generates and sends the first packet, and the gateway device receives the first packet from the terminal.
  • the first packet is a response packet from the target server with the terminal as the destination.
  • the target server generates and sends the first packet, and the gateway device receives the first packet from the target server.
  • the first message includes a request message and a response message.
  • Step S320 the test server identifies the service description information of the target server according to the content of the first field included in the first packet.
  • the first message includes the first field.
  • the first field includes at least one of an IP address field, a domain name field, a uniform resource locator (uniform resource locator, URL) field, a status code field, an identification field of a network transmission protocol, a port number field, and a payload field.
  • the content of the IP address field is the IP address.
  • the content of the domain name field is the domain name.
  • the content of the URL field is the URL.
  • the content of the status code field is the status code.
  • the content of the identification field of the network transmission protocol is the identification of the network transmission protocol.
  • the content of the port number field is the port number.
  • the content of the payload field is payload.
  • the service description information is used to describe the service provided by the target server.
  • the service description information includes the application type to which the service provided by the target server belongs, the protocol type on which the target server provides the service, the resource path URL on which the target server provides the service, or the version identifier of the service provided by the target server.
  • the application type is, for example, WebLogic (a kind of application server software) or Apache (a kind of web server software) or the like.
  • the protocol type is, for example, a service message block (server message block, SMB, a file sharing transfer protocol), HTTP, a remote desktop protocol (remote desktop protocol, RDP), a secure shell protocol (secure shell, SSH) and the like.
  • the resource path URL includes at least one of a port number and a URL.
  • the version identifier is, for example, the version number that provides the service. For example, the version IDs are 1.0, 2.0.
  • the service description information further includes at least one of a container type based on which the service is provided, a database type based on which the service is provided, and a scripting language based on which the service is provided.
  • the container type is, for example, apache, tomcat, etc.
  • the scripting language is, for example, a hypertext preprocessor (PHP), a java server page (JSP), and the like.
  • step S320 is performed by the gateway device. Specifically, after the gateway device obtains the first packet, the gateway device parses the first field in the first packet to obtain the content in the first field. The gateway device identifies the service description information according to the content in the first field.
  • This embodiment can achieve the following two effects by providing step S320.
  • step S320 since the content of the fields in the message is used to identify the information of the target server in various dimensions such as application type, protocol type, resource path URL, version identification, etc., it is helpful to refine the test target to the service-specific application type, Protocol type, URL, and version make the object of vulnerability testing more accurate.
  • the target server in various dimensions such as application type, protocol type, resource path URL, version identification, etc. is identified, the services provided by the target server can be clearly described, and the corresponding tests can be loaded more accurately according to the service description information. load, so as to improve the vulnerability testing effect.
  • Step S330 the test server acquires the test load corresponding to the service description information.
  • the test payload is a string used to test the vulnerability corresponding to the service.
  • the target server parses the test payload, it converts the string to the corresponding command. This command is used to simulate an attack against the service provided by the target server. If the target server successfully executes the instruction, it means that the target server has a vulnerability corresponding to the service; if the target server refuses to execute the instruction, it means that the target server does not have a vulnerability corresponding to the service.
  • the test payload includes whoami.
  • whoami is a command found on many operating systems.
  • whoami is a concatenation of the words "Who am I?" (Who am I?). If the computer executes the whoami command, the effective username of the current user is printed.
  • an unauthorized user attempts to execute the system command whoami on the server.
  • the target server returns the user names (such as root, admin, administrator) found by executing the whoami command for the test packet, it indicates that the target server has a vulnerability.
  • the test payload includes /ws_utc/config.do. /ws_utc/config.do is used to test vulnerabilities corresponding to Weblogic services.
  • the vulnerability is to upload a webshell to an unauthorized access page in WebLogic through the ws_utc/config.do path.
  • Step S340 the test server sends a test message to the target server through the gateway device.
  • the gateway device generates a test packet according to the test payload, and sends the generated test packet to the target server, so that the test payload is transmitted to the target server along with the test packet.
  • test message is a request message.
  • the test message is an HTTP request message.
  • the test message is an HTTP get (get) request message or an HTTP submit (post) request message.
  • the test message is an HTTP request message using other request methods other than get and post.
  • the test message includes a test payload.
  • the carrying position of the test payload in the test packet includes various situations.
  • the test packet includes a specified field
  • the content of the specified field in the test packet includes a test payload.
  • the test payload is carried in the specified field in the test packet.
  • a part of the content in the specified field of the test packet is a test payload
  • another part of the content in the specified field is content other than the test payload (such as URL or normal service data).
  • the specified field containing the test payload is the URL field.
  • the content of the URL field in the test packet includes the test payload.
  • GET is the content of the request method field in the test message.
  • /login.php? a whoami is the content of the URL field in the test message.
  • whoami is the test payload in the URL field.
  • HTTP/1.1 is the content of the protocol version field in the test packet.
  • Case 2 The specified field containing the test payload is the HTTP header field.
  • the content of the HTTP header field in the test packet includes the test payload.
  • the specified field is specifically a host field, a cookie field, and the like in the HTTP header field. In other words, use the host field and cookie field in the HTTP header field to carry the test payload.
  • Case 3 The specified field containing the test payload is the HTTP body field.
  • the content of the HTTP body field in the test packet includes the test payload.
  • Case 4 The specified field containing the test payload is the payload field.
  • the content of the payload field in the test packet includes the test payload.
  • the content of the payload field in the test packet includes the test payload.
  • Step S350 the target server receives the test message from the gateway device, and the target server generates a response message for the test message.
  • the target server After the target server receives the test message, the target server obtains the test payload according to the test message. For example, the target server obtains the test payload from the specified field of the test packet. The target server parses the test payload and responds to the test payload, thereby generating a response message. In some embodiments, when the test message is an HTTP request message, the response message is an HTTP response message.
  • Step S360 the target server sends a response message for the test message to the gateway device.
  • Step S370 The test server receives a response message for the test message from the target server through the gateway device.
  • Step S380 if the response message includes the expected result corresponding to the test payload, the test server determines that the target server has a vulnerability.
  • the expected result indicates that the test payload was executed successfully.
  • the test payload is whoami
  • the expected result corresponding to whoami is the username found by executing the whoami command on the target server.
  • the expected result corresponding to whoami contains keywords such as root, admin, and administrator. If the response message includes root, admin, or administrator, the target server is determined to be vulnerable.
  • This embodiment provides a method for implementing vulnerability testing based on a gateway.
  • a gateway device deployed between the terminal and the server is used to obtain packets of interaction between the terminal and the server.
  • the content of the field in the field automatically identifies some specific information of the service provided by the server, such as application type, protocol type, URL or version, etc., uses the identified information to obtain the corresponding test load, and uses the test load to construct a test packet. Test the response message of the message to discover the vulnerabilities on the server.
  • the efficiency of the vulnerability test is improved, and on the other hand, the target of the test is more refined, so the effect of the vulnerability test can be significantly improved.
  • the vulnerability testing method shown in FIG. 3 includes a passive method and an active method.
  • the passive method refers to triggering the vulnerability testing process for the target server when the client requests the target server to provide services.
  • the active method means that the gateway device actively initiates the vulnerability testing process for the target server.
  • the passive method refers to triggering the vulnerability testing process for the target server when the client requests the target server to provide services.
  • the active method means that the gateway device actively initiates the vulnerability testing process for the target server.
  • implementation method 2 the gateway device actively initiates the vulnerability testing process for the target server.
  • Implementation Mode 1 When the traffic transmitted between the terminal and the server passes through the gateway device, the gateway device replaces the received message to send a test message.
  • the first implementation specifically includes the following steps a to c.
  • Step a Obtain the second packet transmitted between the terminal and the target server through the gateway device.
  • the packets will pass through the gateway device.
  • the gateway device will determine whether the packet contains the URL on which the target server provides services. Taking the packet received by the gateway device including the second packet and the third packet as an example, the gateway device respectively determines whether the second packet and the third packet contain the URL of the target server. The gateway device determines that the second packet contains the URL on which the target server provides the service, and performs the following step b for the second packet. The gateway device determines that the third packet does not contain the URL on which the target server provides the service, and forwards the third packet normally.
  • Step b If the second packet includes the URL of the target server, use the test payload to replace the content of the specified field in the second packet, thereby generating a test packet.
  • the second message is a request message from the terminal with the target server as the destination.
  • the destination IP address field of the second packet includes the IP address of the target server.
  • the domain name field of the second packet includes the domain name of the target server.
  • the source IP address field of the second packet includes the IP address of the terminal.
  • the second message is an HTTP message.
  • the second message is an HTTP request (HTTP request) message.
  • the second message is an HTTP get request message or an HTTP post request message.
  • the second packet is an HTTP request packet using other request methods other than get and post.
  • a part of the content of the specified field in the second packet is replaced with the test payload, and another part of the content of the specified field is kept as the original content, so that the test payload and the part of the content of the specified field are spliced into the whole of the specified field content.
  • the content of the specified field in the test packet includes the test payload and the original content of the specified field.
  • the specified field is the URL field. If the packet passing through the gateway device includes the URL of the target server, the gateway device replaces and splices the URL in the packet with the test payload to obtain the test packet.
  • Step c sending the generated test message to the target server through the gateway device.
  • the gateway device queries the routing table entry according to the destination IP address of the second packet, and forwards the test packet to the target server according to the forwarding path corresponding to the second packet, so that the test packet follows the original Some forwarding paths forward to the target server.
  • the gateway device only sends the generated test message to the target server, and does not forward the second message; alternatively, the gateway device also sends the generated test message to the target server.
  • the second packet can be forwarded normally.
  • the traffic transmitted in real time can be detected, and the frequency of actively initiating the test is relatively low, and the detection target is relatively broad.
  • Implementation mode 2 The gateway device actively constructs and sends a test packet.
  • the gateway device acts as the initiator of the test packet.
  • a vulnerability test needs to be performed (eg, a test request from a test server is received)
  • the gateway device When a vulnerability test needs to be performed (eg, a test request from a test server is received), the gateway device generates a test packet according to the test load, the address of the target server, and the URL of the target server.
  • the gateway device sends the generated test message to the target server.
  • the load field of the test packet includes the test load, and the URL field of the test packet includes the URL of the target server.
  • a vulnerability test can be initiated more quickly, and an emergency response scenario can be supported. For example, when there is no traffic transmitted to the target server in the network, the above-mentioned implementation mode 2 is executed to immediately perform the test.
  • the functional modules related to vulnerability testing include a service identification library, an information record library, a payload configuration library, and a payload response verification module. These functional modules are introduced in detail through (1) to (4) below.
  • the service identification library supports the function of identifying the service description information in the above method 300 .
  • the service identification library is used to store the correspondence between the character string appearing in the message and the service description information.
  • the service identification library includes at least one entry.
  • Each entry in the service identification library includes two types of content.
  • One type of content is a string that may appear in the message, such as at least one of IP address, domain name, URL, status code, network transmission protocol identification, port number, and payload. This kind of content is used in the process of querying the service identification library. can act as a query index.
  • Another type of content is service description information.
  • Table 1 is an example of entries in the service identification library.
  • Each entry in Table 1 includes URL, status code, port number, and application type to which the service belongs.
  • the URL, status code, and port number are examples of strings that appear in the message, and application types are examples of service description information. If the content of the URL field in the message is /console/login/LoginForm.jsp, the content of the status code field is 200, and the content of the port number field is 7001, by querying the entries shown in Table 1, it is possible to identify which service the service belongs to.
  • the application type is Weblogic service.
  • URL status code The port number Application Type /console/login/LoginForm.jsp 200 7001 Weblogic /wls-wsat/CoordinatorPortType 200 7001 Weblogic /_async/AsyncresponseService 200 7001 Weblogic
  • Table 2 is also an example of table entries in the service identification library.
  • the entries in Table 2 include the TCP payload, the port number, and the application type to which the service belongs.
  • the TCP payload and the port number are examples of character strings appearing in the message, and the application type to which the service belongs is an example of the service description information. If the content of the payload field in the packet includes SSH-2.0-OpenSSH_7.2p2Ubuntu-4ubuntu2.8 and the content of the port number field is 7001, by querying the entries shown in Table 2, it can be identified that the application type to which the service belongs is SSH service .
  • the information record library is used to store the correspondence between the server and the service description information identified for the server.
  • each entry in the service identification library includes two types of content.
  • One type of content is the identification of the server, such as the IP address of the server, the name of the server, and the port number of the port on the server; the other type of content is the service description information of the server.
  • the information record library is a relational database; or, the information record library is a non-relational database.
  • Table 3 is an example of entries in the service identification library.
  • the entries in Table 3 include the IP address, port number, protocol type of the server, and application type to which the service belongs.
  • the IP address and the port number are examples of the identification of the server
  • the protocol type and the application type are examples of the service description information.
  • IP address of the server The port number agreement type Application Type 192.168.1.3 7001 HTTP Weblogic
  • the load configuration library supports the function of acquiring the test load in the above method 300 .
  • the load configuration library is used to save the corresponding relationship between query index, test load, and description information.
  • the payload configuration library includes at least one entry. Each entry in the payload configuration library includes three types of content. One type of content is the test load, the other type of content is the query index corresponding to the test load, and the other type of content is the description information about the test load.
  • the query index is used to query the corresponding test load in the load configuration library.
  • the query index and the service description information have all or part of the same content.
  • the query index is application type, protocol type, URL or version identifier.
  • the description information is used to indicate that the test payload is used to replace the content of the specified field.
  • the specified field can be determined by querying the description information in the load configuration library. For example, in the process of replacing the second packet with the test payload, the gateway device uses the URL in the second packet as a query index to query the payload configuration library to obtain the test payload and description information. Determine the specified field according to the description information.
  • the load configuration library is also used to store expected results corresponding to the test loads.
  • each entry in the load configuration library includes the expected result corresponding to the test load in addition to the three types of information: the test load, the query index and the description information.
  • the payload configuration library includes entries as shown in Table 5 below.
  • the load configuration library can be queried to obtain the expected results corresponding to the test load.
  • the test load is obtained as whoami, and the expected results corresponding to the test load are root, admin, and administrator.
  • each entry in the load configuration library is stored in the form of a key-value pair.
  • the key in the key-value pair is the query index.
  • the value in the key-value pair includes the test payload, description information, and expected result.
  • the above service identification library and load configuration library are set through the configuration operation of the network administrator.
  • the network administrator preconfigures various service description information in the service identification library, and the network administrator preconfigures the expected results corresponding to various test loads in the load configuration library, so as to obtain the service identification library and the load configuration library according to the configuration operation.
  • the payload response verification module is used to verify whether there is a vulnerability corresponding to the service on the target server according to the content of the response message. Specifically, the load response verification module determines whether the content of the response packet contains the expected result corresponding to the test load, and if the content of the response packet contains the expected result corresponding to the test load, the load response verification module determines that there is a vulnerability corresponding to the service on the target server ; If the content of the response message does not contain the expected result corresponding to the test payload, the payload response verification module determines that there is no vulnerability corresponding to the service on the target server. In some embodiments, the load response verification module queries the load configuration library to obtain expected results corresponding to the test load.
  • the various functional modules introduced above can be arbitrarily allocated between the gateway device and the test server.
  • all functional modules introduced above are all set in the test server; in other embodiments, all functional modules introduced above are all set in the gateway device; Among the functional modules, some of the functional modules are set on the gateway device, and another part of the functional modules is set on the test server.
  • the gateway device and the test server respectively undertake different functions in the method 300 .
  • the gateway device and the test server cooperate to perform the method 300 by interacting.
  • the implementation methods of the gateway device and the test server include joint setting and separate setting.
  • the gateway device and the test server respectively correspond to two separate hardware devices.
  • the gateway device and the test server are integrated in the same hardware device.
  • the test server interacts with the gateway device to execute the vulnerability test.
  • the service identification library, the information recording library, the load configuration library and the load response verification module are deployed in the test server.
  • the test server includes a service identification library 401 , an information record library 402 , a load configuration library 403 , a load response verification module 405 and a load delivery module 404 .
  • the service identification library 401 , the information recording library 402 , the load configuration library 403 , and the load response verification module 405 please refer to the descriptions of (1) to (4) above.
  • the load delivery module 404 is configured to deliver the test load in the load configuration library 403 to the gateway device.
  • the flow of vulnerability testing in method A includes the following steps S41 to S49.
  • Step S41 the traffic of the Internet enters the target server through the gateway device.
  • Step S42 the gateway device accesses the service identification library 401 preset in the test server, and identifies the service description information by querying the service identification library 401 .
  • the gateway device receives the first packet from the terminal or the server, and the gateway device queries the service identification library 401 according to the content of the first field included in the first packet, thereby identifying the service description information of the server.
  • step S42 includes steps S421 to S422.
  • Step S421 The gateway device queries the service identification library 401 in the test server according to the content of the first field included in the first packet.
  • Step S422 If the content of the first field and the target string in the service identification library 401 satisfy the matching condition, the gateway device determines the service description information corresponding to the target string in the service identification library 401 as the service description information of the target server.
  • the target character string is a character string stored in the service identification library 401, and specifically refers to a character string that satisfies the matching condition with the content of the first field.
  • the service identification library 401 includes a first entry, and the first entry includes a character string in the first field and service description information.
  • the gateway device matches the content of the first field with the character string in the first entry, and determines whether the content of the first field and the character string in the first entry satisfy the matching condition. If the content of the first field and the string in the first entry meet the matching conditions, then the string in the first entry is the target string, and the gateway device will determine the service description information in the first entry as the target The service description information of the server. If the content of the first field and the character string in the first entry do not satisfy the matching condition, the gateway device continues to query other entries in the service identification library 401 except the first entry.
  • the matching condition is determined according to the requirement for recognition accuracy. For example, when the recognition accuracy is high precision, the gateway device determines that the content of the first field is the same as the character string in the first entry as a matching condition; when the recognition accuracy is low precision, the gateway device determines that the content of the first field includes The character string in the first entry is determined as the matching condition.
  • a one-to-one match of all fields is used when querying the service identification library 401 .
  • the first field includes multiple items of an IP address field, a domain name field, a URL field, a status code field, an identification field of a network transmission protocol, a port number field, and a payload field.
  • Each entry in the service identification library 401 includes a plurality of character strings.
  • the gateway device uses the entire content of the first field to match all the character strings in the table entry respectively. If the entire content of the first field and all the character strings in the first entry respectively satisfy the matching conditions, the gateway device determines the service description information in the first entry as the service description information of the target server.
  • the content of the URL field in the message is /console/login/LoginForm.jsp
  • the content of the status code field is 200
  • the content of the port number field is 7001.
  • /console/login/LoginForm.jsp 200 and 7001 query the entries shown in Table 1 in the service identification library 401, and confirm that /console/login/LoginForm.jsp is the same as the URL saved in the first entry in Table 1 , and 200 is the same as the status code stored in the first entry in Table 1, and 7001 is the same as the port number stored in the first entry in Table 1, then determine that the application type to which the service belongs is the first entry in Table 1. Items are saved in Weblogic.
  • Step S43 the gateway device uploads the identified service description information to the test server.
  • the test server receives the service description information sent by the gateway device, and records the service description information in the information recording library 402 .
  • Step S44 the test server queries the load configuration library 403 according to the content stored in the information record library 402, so as to determine the test load.
  • the test server queries the information record library 402 according to the IP address of the intranet server, and obtains from the information record library 402 the information that the intranet server provides the Weblogic service. based on the URL.
  • the test server queries the load configuration library 403 according to the URL, so as to obtain the test load corresponding to the Weblogic service corresponding to the URL.
  • the service description information is stored by using the information record library 402.
  • the pre-stored service description information is read from the information record library 402, and there is no need to temporarily proactively detect the target server to obtain specific service description information during the test process, thereby improving the test efficiency.
  • Step S45 the load issuing module 404 in the test server generates and sends a test request to the gateway device.
  • test request is used to instruct the gateway device to send a test packet to the server according to the test load.
  • the test request includes the test payload, the address of the target server, and the URL on which the target server provides services.
  • the test server transmits the test payload to the gateway device by sending the test request.
  • Step S46 the gateway device receives the test request from the test server.
  • the gateway device obtains the test payload from the test request.
  • the gateway device generates test packets according to the test payload.
  • the gateway device sends a test packet to the target server.
  • Step S47 the target server receives the test message from the gateway device, and the target server generates a response message for the test message.
  • the target server sends a response message to the gateway device.
  • Step S48 After the gateway device receives the response message, the gateway device parses the response message to obtain the content of the response message. The gateway device sends the content of the response message to the test server.
  • Step S49 the test server receives the content of the response message.
  • the load response verification module 405 in the test server determines the vulnerability test result according to the content of the response message. Specifically, the load response verification module 405 determines whether the response packet includes the expected result corresponding to the test load. If the content of the response message includes the expected result corresponding to the test load, the test server determines that the target server has a vulnerability corresponding to the service, that is, the target server has a security problem. If the content of the response packet does not include the expected result corresponding to the test load, the test server determines that the target server does not have a vulnerability corresponding to the service, that is, the target server does not have a security problem.
  • Mode B The gateway device performs the vulnerability test locally.
  • the service identification library 401, the information record library 402, the load configuration library 403, and the load response verification module 405 are deployed in the gateway device.
  • the gateway device includes a service identification library 401 , an information record library 402 , a load configuration library 403 and a load response verification module 405 .
  • the flow of vulnerability testing in method B includes the following steps S51 to S59.
  • the difference between steps S51 to S59 and the above steps S41 to S49 mainly lies in the difference of the execution subject.
  • steps S51 to S59 please refer to the description of the above steps S41 to S49.
  • Step S51 the traffic of the Internet enters the target server through the gateway device.
  • Step S52 the gateway device identifies the service description information according to the locally preset service identification library 401.
  • the gateway device receives the first packet from the terminal or the server, and the gateway device queries the service identification library 401 according to the content of the first field included in the first packet, thereby identifying the service description information of the server.
  • Step S53 the gateway device saves the identified service description information to the local information record library 402 .
  • Step S54 the gateway device queries the load configuration library 403 according to the content stored in the information record library 402, so as to determine the test load.
  • Step S56 the gateway device generates a test packet according to the test load.
  • the gateway device sends a test packet to the target server.
  • Step S57 the target server receives the test message from the gateway device, and the target server generates a response message for the test message.
  • the target server sends a response message to the gateway device.
  • Step S58 After the gateway device receives the response message, the gateway device parses the response message to obtain the content of the response message.
  • Step S59 the load response verification module 405 in the gateway device determines whether the content of the response packet includes the expected result corresponding to the test load. If the content of the response packet includes the expected result corresponding to the test payload, the gateway device determines that the target server has a vulnerability corresponding to the service. If the content of the response packet does not include the expected result corresponding to the test payload, the gateway device determines that the target server does not have a vulnerability corresponding to the service.
  • test configuration module is implemented inside the gateway, there is no need to configure a physical device separately, and the complete identification and test logic is implemented inside the gateway, which is more efficient.
  • the service description information is the URL based on which the target server provides services, specifically www.test.com/login.php? a.
  • the test payload is specifically whoami.
  • the response message for the test message is an HTTP response message.
  • the following example includes the following steps S61 to S65.
  • step S61 adopts the above-mentioned first implementation manner, that is, the passive manner, after the gateway device receives the test request from the test server, it continuously silently observes the traffic passing through the gateway device. Whether the gateway device parses the traffic contains the URL (www.test.com/login.php?a) on which the target server provides services. If the URL (www.test.com/login.php?a) on which the target server provides services does not appear in the traffic passing through the gateway device, the gateway device normally forwards the traffic. If the gateway device is found in the traffic and matches www.test.com/login.php?
  • a xxx HTTP request
  • the content of the request message is as follows, and the value corresponding to the parameter a in the URL field of the request message is whoami.
  • the value corresponding to the parameter a in the URL field of the above request message is whoami.
  • Step S63 the target server responds after parsing, and generates an HTTP response message. Specifically, the target server parses the value of the a parameter in the request message to obtain whoami. For a target server with vulnerabilities, the target server parses whoami and executes the whoami command during the execution of the backend code, and returns an HTTP response message.
  • the HTTP response packet includes the username found by executing the whoami command. For example, the content of the HTTP response packet is as follows, and the body field of the HTTP response packet includes root.
  • Step S64 After receiving the HTTP response message sent by the target server, the gateway device parses the HTTP response message to obtain the content of the HTTP response message.
  • Step S65 the test server or the gateway device verifies the content of the HTTP response message.
  • the specific verification method is to determine whether the content of the HTTP response message includes keywords such as root, admin or administrator. If the content of the HTTP response message includes keywords such as root, admin or administrator, it is determined that the payload is successfully executed and there is a security problem on the server side. . For example, for the HTTP response message shown above, since the HTTP response message includes root, it is determined that the target server has a vulnerability.
  • step S61 adopts the first implementation manner
  • the gateway device further executes the following step S66.
  • the gateway device does not execute the following step S66.
  • Step S66 after the gateway device performs payload verification, the gateway device forwards the response packet to the corresponding destination device (eg, server or terminal) according to the original sending direction of the traffic.
  • the corresponding destination device eg, server or terminal
  • the vulnerability testing apparatus provided by the embodiments of the present application is described below.
  • the vulnerability testing apparatus described below has any function of the testing server or gateway device in the method shown in FIG. 3 , FIG. 4 or FIG. 5 .
  • FIG. 6 shows a possible schematic structural diagram of the vulnerability testing apparatus 800 .
  • the apparatus 800 shown in FIG. 6, for example, implements the function of the test server or gateway device in the method shown in FIG. 3, or the apparatus 800 implements the function of the test server or gateway device in the method shown in FIG. 4, or the apparatus 800 implements the function of the test server or gateway device in FIG. Test the functionality of the server or gateway device in the method shown.
  • the apparatus 800 shown in FIG. 6 is the gateway device 110 or the test server 120 in the application scenario shown in FIG. 1 .
  • the apparatus 800 shown in FIG. 6 is the device 200 shown in FIG. 2 .
  • the apparatus 800 includes an obtaining unit 801 , a processing unit 802 and a sending unit 803 .
  • Each unit in the apparatus 800 is implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • Each unit in the apparatus 800 is used to execute the corresponding function of the test server or the gateway device in the method shown in FIG. 3 , FIG. 4 or FIG. 5 .
  • the obtaining unit 801 is configured to support the apparatus 800 to perform S310, S330 and S370 in FIG. 3 .
  • the processing unit 802 is configured to support the apparatus 800 to execute S320 and S380 in FIG. 3 .
  • the sending unit 803 is configured to support the apparatus 800 to perform S340 in FIG. 3 .
  • the obtaining unit 801, the processing unit 802, or the sending unit 803 are further configured to support the apparatus 800 to perform other processes performed by the test server or gateway device in the techniques described herein.
  • the obtaining unit 801 is configured to support the apparatus 800 to perform step a in the first implementation, the process of receiving service description information in step S43, the process of receiving a test request in step S46, and other receiving operations performed by the test server or gateway device.
  • the processing unit 802 is used to support the apparatus 800 to perform step b in the first implementation, the step of generating a test packet in the second implementation, the process of recording the service description information in the steps S42 and S43 in FIG.
  • the sending unit 803 is used to support the device 800 to perform step c in the first implementation, the step of sending the test message in the second implementation, the process of sending the test message in the step S45 in FIG. 4 , the step S45 or the step S46, FIG. 5 .
  • step S56 and other sending operations performed by the test server or gateway device.
  • the various units in the apparatus 800 are integrated into one unit.
  • each unit in the device 800 is integrated on the same chip.
  • the chip includes a processing circuit, an input interface and an output interface that are internally connected and communicated with the processing circuit.
  • the processing unit 802 is implemented by a processing circuit in the chip.
  • the acquiring unit 801 is implemented through an input interface in the chip.
  • the sending unit 803 is implemented through an output interface in the chip.
  • the chip is implemented through one or more field-programmable gate arrays (FPGAs), programmable logic devices (PLDs), controllers, state machines, gate logic, discrete hardware components, any Other suitable circuits, or any combination of circuits capable of performing the various functions described throughout this application, are implemented.
  • FPGAs field-programmable gate arrays
  • PLDs programmable logic devices
  • controllers state machines, gate logic, discrete hardware components, any Other suitable circuits, or any combination of circuits capable of performing the various functions described throughout this application, are implemented.
  • each unit of the apparatus 800 exists physically separately. In other embodiments, some of the units of the apparatus 800 exist physically alone, and some of the units are integrated into one unit.
  • the processing unit 802 and the sending unit 803 are the same unit. In other embodiments, the processing unit 802 and the sending unit 803 are different units.
  • the integration of different units is implemented in the form of hardware, that is, different units correspond to the same hardware. For another example, the integration of different units is implemented in the form of software units.
  • the processing unit 802 in the apparatus 800 is implemented by, for example, the processor 201 in the device 200 shown in FIG. 2 .
  • the acquiring unit 801 and the sending unit in the apparatus 800 are implemented, for example, by the communication interface 204 in the device 200 shown in FIG. 2 .
  • each unit in the apparatus 800 is, for example, software generated after the processor 201 in the device 200 reads the program code 210 stored in the memory 203 .
  • apparatus 800 is a virtualization device.
  • the virtualization device includes, but is not limited to, at least one of a virtual machine, a container, and a Pod.
  • the apparatus 800 is deployed on a hardware device (eg, a physical server) in the form of a virtual machine.
  • the apparatus 800 is implemented based on a general-purpose physical server combined with network functions virtualization (NFV) technology.
  • NFV network functions virtualization
  • the apparatus 800 is, for example, a virtual host, a virtual router or a virtual switch.
  • the apparatus 800 is deployed on a hardware device in the form of a container (eg, a docker container).
  • a container eg, a docker container
  • the process of the apparatus 800 executing the above method embodiments is encapsulated in an image file, and the hardware device creates the apparatus 800 by running the image file.
  • the apparatus 800 is deployed on a hardware device in the form of a Pod.
  • a Pod includes a plurality of containers, each container being used to implement one or more units in the apparatus 800 .
  • first the terms “first”, “second” and other words are used to distinguish the same or similar items that have basically the same function and function. It should be understood that there is no logical OR between “first” and “second”. Timing dependencies, and do not limit the number and execution order.
  • a first message may be referred to as a second message, and, similarly, a second message may be referred to as a first message, without departing from the scope of the various examples.
  • Both the first message and the second message may be messages, and in some cases, may be separate and distinct messages.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer program instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of the present application are generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program instructions may be transmitted from a website site, computer, server or data center via Wired or wireless transmission to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media integrated.
  • the usable medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital video disc (DVD), or a semiconductor medium (such as a solid-state disk), etc.
  • the aforementioned storage medium includes: U disk , mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Mining & Analysis (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种漏洞测试方法及装置，属于计算机领域。本申请提供了一种基于网关实现漏洞测试的方法，通过在终端与服务器进行交互的过程中，利用部署在终端与服务器之间的网关设备来获取终端与服务器交互的报文，根据报文中字段的内容自动地识别出服务器提供服务的一些具体信息，例如应用类型、协议类型、URL或者版本等，利用识别出的信息获得相应的测试载荷，利用测试载荷构造测试报文，根据服务器针对测试报文的响应报文从而发现服务器上存在的漏洞。一方面提高了漏洞测试效率，另一方面测试的目标更加精细，因此能够显著提升漏洞测试效果。

Description

漏洞测试方法及装置
本申请要求于2020年11月16日提交的申请号为202011278854.8、发明名称为“漏洞测试方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机领域，特别涉及一种漏洞测试方法及装置。
背景技术
传统的漏洞测试依赖于漏洞扫描器(vulnerability scanner)实现。漏洞扫描器是一种计算机程序，用于评估计算机，网络或应用程序是否存在已知漏洞。例如，漏洞扫描器能够识别和检测由于基于网络的资产(例如防火墙，路由器，Web服务器，应用程序服务器等)中的错误配置或有缺陷的编程而导致的漏洞。通常漏洞扫描器会根据预先设定的配置信息，如IP地址或者域名等等，向测试目标发起漏洞测试。
现有漏洞扫描器测试时效率较低，测试效果不佳。
发明内容
本申请实施例提供了一种漏洞测试方法及装置，能够提升测试效果。所述技术方案如下。
第一方面，提供了一种漏洞测试方法，在该方法中，通过网关设备获取终端与服务器之间传输的第一报文，所述网关设备部署于所述终端与所述服务器之间，所述第一报文包括第一字段，所述服务器用于向其他设备提供服务；根据所述第一报文包括的第一字段的内容识别所述服务器的服务描述信息，所述服务描述信息包括服务所属的应用类型、提供服务所基于的协议类型、提供服务所基于的资源路径统一资源定位器(uniform resource locator，URL)、或提供服务的版本标识；获取所述服务描述信息对应的测试载荷，所述测试载荷是用于测试所述服务对应的漏洞的字符串；通过所述网关设备向所述服务器发送测试报文，所述测试报文是根据所述测试载荷生成的；通过所述网关设备接收来自所述服务器的针对于所述测试报文的响应报文；如果所述响应报文包括所述测试载荷对应的预期结果，确定所述服务器存在所述漏洞，所述预期结果表示所述测试载荷执行成功。
第一方面介绍的方法中，通过在终端与服务器进行交互的过程中，利用部署在终端与服务器之间的网关设备来获取终端与服务器交互的报文，根据报文中字段的内容自动地识别出服务器提供服务的一些具体信息，例如应用类型、协议类型、URL或者版本等，利用识别出的信息获得相应的测试载荷，利用测试载荷构造测试报文，根据服务器针对测试报文的响应报文从而发现服务器上存在的漏洞。由于利用网关设备上通过的报文识别服务器提供服务的具体信息从而对服务器漏洞测试，一方面提高了漏洞测试效率，另一方面测试的目标更加精细，因此能够显著提升漏洞测试效果。
可选地，所述根据所述第一报文包括的第一字段的内容识别所述服务器的服务描述信息，包括：根据所述第一字段的内容查询服务识别库，所述服务识别库中用于保存第一字段中的 字符串与服务描述信息的对应关系；如果所述第一字段的内容与所述服务识别库中的目标字符串满足匹配条件，将所述服务识别库中所述目标字符串对应的服务描述信息确定为所述服务器的服务描述信息。
基于上述可选方式，有助于提高服务识别的准确性。
可选地，所述通过所述网关设备向所述服务器发送测试报文，包括：通过所述网关设备获取所述终端与所述服务器之间传输的第二报文；如果所述第二报文包括所述服务器的URL，使用所述测试载荷替换所述第二报文中指定字段的内容，从而生成所述测试报文；通过所述网关设备向所述服务器发送生成的测试报文。
基于上述可选方式，能够在客户端请求目标服务器提供服务的情况下，触发针对目标服务器的漏洞测试流程，从而对实时传输的流量进行检测，同时主动发起测试的频率较低，检测目标较为宽泛。
可选地，所述第二报文为来自于所述终端、以所述服务器为目的方的请求报文。
可选地，所述指定字段为URL字段、超文本传输协议(hyper text transfer protocol，HTTP)头字段、HTTP体字段或者载荷字段。
可选地，所述使用所述测试载荷替换所述第二报文中指定字段的内容之前，所述方法还包括：以所述第二报文中的所述URL为查询索引，查询载荷配置库，得到所述测试载荷以及说明信息，所述载荷配置库用于保存查询索引、测试载荷、说明信息之间的对应关系，所述说明信息用于指示所述测试载荷用于替换所述指定字段的内容；根据所述说明信息确定所述指定字段。
可选地，所述通过所述网关设备向所述服务器发送测试报文，包括：根据所述测试载荷、所述服务器的地址以及所述服务器的URL生成测试报文，所述测试报文的载荷字段包括所述测试载荷，所述测试报文的目的地址字段包括所述服务器的地址，所述测试报文的URL字段包括所述服务器的URL；通过所述网关设备向所述服务器发送生成的所述测试报文。
基于上述可选方式，能够更快速地发起漏洞测试，支持应急响应的场景。
可选地，所述服务描述信息还包括提供服务所基于的容器类型、提供服务所基于的数据库类型、提供服务所基于的脚本语言中的至少一项。
基于上述可选方式，有助于更加清晰地描述目标服务器提供的服务，根据服务描述信息便于更精确加载相应的测试载荷，使得漏洞测试的对象更加精准，从而提升漏洞测试效果。
可选地，所述第一报文为来自于所述终端、以所述服务器为目的方的请求报文，或者，所述第一报文为来自于所述服务器、以所述终端为目的方的响应报文。
可选地，所述第一字段包括互联网协议(internet protocol，IP)地址字段、域名字段、URL字段、状态码字段、网络传输协议的标识字段、端口号字段、载荷字段中的至少一项。
基于上述可选方式，灵活地定义了测试载荷在测试报文中的很多种携带位置，在实际使用过程中能够根据业务需求选择测试载荷的具体携带位置。
第二方面，提供了一种漏洞测试装置，该漏洞测试装置具有实现上述第一方面或第一方面任一种可选方式的功能。该漏洞测试装置包括至少一个单元，至少一个单元用于实现上述第一方面或第一方面任一种可选方式所提供的方法。
在一些实施例中，漏洞测试装置中的单元通过软件实现，漏洞测试装置中的单元是程序模块。在另一些实施例中，漏洞测试装置中的单元通过硬件或固件实现。第二方面提供的漏 洞测试装置的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第三方面，提供了一种测试服务器，该测试服务器包括处理器和通信接口，该处理器用于执行程序代码，使得该测试服务器执行上述第一方面或第一方面任一种可选方式所提供的方法，所述通信接口用于接收或发送报文。第三方面提供的测试服务器的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第四方面，提供了一种网关设备，该网关设备包括处理器和通信接口，该处理器用于执行程序代码，使得该网关设备执行上述第一方面或第一方面任一种可选方式所提供的方法，所述通信接口用于接收或发送报文。第四方面提供的网关设备的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第五方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条程序代码，该至少一条程序代码由处理器读取以使测试服务器或网关设备执行上述第一方面或第一方面任一种可选方式所提供的方法。
第六方面，提供了一种计算机程序产品，所述计算机程序产品包括一个或多个计算机程序指令，当所述计算机程序指令被计算机加载并执行时，使得所述计算机执行上述第一方面或第一方面任一种可选方式所提供的方法。
第七方面，提供了一种芯片，当该芯片在测试服务器上运行时，使得测试服务器执行上述第一方面或第一方面任一种可选方式所提供的方法。
第八方面，提供了一种芯片，当该芯片在网关设备上运行时，使得网关设备执行上述第一方面或第一方面任一种可选方式所提供的方法。
第九方面，提供了一种网络系统，该网络系统包括测试服务器以及网关设备，该测试服务器与网关设备通过网络相连，该网络系统用于执行上述第一方面或第一方面任一种可选方式所述的方法。
附图说明
图1是本申请实施例提供的一种应用场景的示意图；
图2是本申请实施例提供的一种测试服务器或网关设备的结构示意图；
图3是本申请实施例提供的一种漏洞测试方法的流程图；
图4是本申请实施例提供的一种漏洞测试方法的流程图；
图5是本申请实施例提供的一种漏洞测试方法的流程图；
图6是本申请实施例提供的一种漏洞测试装置的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
漏洞测试是网络安全领域中的重要技术。通过漏洞测试，能够发现基于网络的资产(例如防火墙，路由器，Web服务器，应用程序服务器等)上存在的漏洞，以便根据发现的漏洞及时更正网络安全漏洞和系统中的错误配置，从而有效地避免黑客利用漏洞发起网络攻击行为，实现防范于未然。
传统的漏洞测试依赖于漏洞扫描器实现。在研究过程中发现，使用漏洞扫描器进行漏洞 测试时效率较低，而且测试的效果难以保证。主要原因是并不清楚测试目标提供服务的具体信息，比如不清楚测试目标的提供的服务所属的应用类型、测试目标的系统版本、测试目标的资源路径，无法将测试任务快速拆解为细粒度的测试目标，只能将人工设定的互联网协议(internet protocol，IP)地址或者域名作为测试目标进行粗粒度的测试。因此，传统的漏洞扫描器技术使用成本较高，测试效率低下，精确程度不足，测试效果不佳。
而本申请实施例提供了一种基于网关实现高效率漏洞测试的方案。本技术方案能够应用在现网应急及应用安全测试等场景中，能够快速实现安全漏洞测试，降低安全应急响应时间、以及应用安全测试时间，提升安全测试效率。相对于传统的漏洞扫描器技术而言，本技术方案在使用成本及精确效果等方面均能够大幅度提升。在实际数据中测试，可100％实现测试目标资源覆盖，特有场景下，无需人工参与，即可多进程、高效率、高产出方式完成安全漏洞测试任务。
下面，从应用场景、硬件装置、软件装置、方法流程等多个角度，对本技术方案进行详细介绍。
参见附图1，附图1是本申请实施例的典型应用场景100的示意图。附图1所示的场景100包括网关设备110、终端130以及至少一个业务服务器150。可选地，附图1所示的场景100还包括测试服务器120。下面对附图1所示的场景中的各个设备分别进行介绍。
(1)终端130
终端130例如是服务器、主机、个人计算机、手机或者工作站等。在一些实施例中，终端130安装了浏览器软件或者应用客户端，终端130通过浏览器软件或者应用客户端发送请求报文，从而访问业务服务器150。
(2)业务服务器150
业务服务器150用于向终端130或者其他设备提供服务。例如，业务服务器150为网页服务器，业务服务器150用于响应来自终端130中浏览器软件的超文本传输协议(hyper text transfer protocol，HTTP)请求，生成并返回HTTP响应，从而为终端130提供访问网页所需的资源。又如，业务服务器150为其他应用服务器，例如游戏服务器、文件服务器、数据库服务器、搜索引擎服务器、即时通信服务器等等，业务服务器150用于响应来自终端130中应用客户端的业务处理请求，从而为应用程序提供后台服务。
(3)网关设备110
网关设备110部署于终端130与业务服务器150之间。在对业务服务器150进行漏洞测试的过程中，网关设备110用于获取终端130与业务服务器150之间交互的报文、向业务服务器150发送测试报文、接收来自业务服务器150的针对于测试报文的响应报文。网关设备110例如部署在企业网与互联网之间。企业网包括交换机以及业务服务器150。业务服务器150与交换机相连。交换机用于转发业务服务器150与网关设备110之间传输的数据。
(4)测试服务器120
测试服务器120与网关设备110通过网络相连。测试服务器120用于与网关设备110进行交互从而支持漏洞测试的流程。例如，测试服务器120用于进行服务识别、测试载荷的传递以及对响应报文的验证。
值得说明的一点是，附图1是对网关设备110与测试服务器120分离设置的举例说明。在另一些实施例中，网关设备110与测试服务器120物理上集成在一起。例如，测试服务器 120为网关设备110内部的功能模块。比如说，测试服务器120的物理实体是一个业务板，通过在网关设备110中设置该业务板，使得网关设备110集成了漏洞测试的功能。
在附图1所示的应用场景中，网关设备110能够充当业务服务器150与终端130之间的通信桥梁，在业务服务器150与终端130之间交互的过程中，网关设备110负责转发业务服务器150与终端130之间交互的报文。具体地，业务服务器150与终端130以请求和应答的方式通信。业务服务器150对终端130发送的一次请求进行处理的流程包括以下步骤1至步骤6。
步骤1、用户在终端130上执行操作。终端130响应于用户的操作，通过浏览器或其他客户端访问业务服务器150上的互联网应用服务(例如搜索引擎服务、即时通信应用等)。
步骤2、终端130向业务服务器150发送请求报文。其中，请求报文对应的协议例如为HTTP或其他协议。请求报文由终端130发出，到达网关设备110处。
步骤3、网关设备110接收到请求报文后，对请求报文的内容进行解析，确定请求报文的发送方为终端130，请求报文的目的方为业务服务器150，则将请求报文转发至业务服务器150。
步骤4、业务服务器150接收到请求报文后，对请求报文进行处理。业务服务器150根据处理结果生成响应报文，向终端130返回响应报文。
步骤5、在响应报文从业务服务器150发送到终端130的过程中，响应报文会经过网关设备110。网关对响应报文解析处理后，将响应报文原路转发到终端130。
步骤6、终端130收到响应报文后，完成一次请求应答流程。
参见附图2，附图2示出了本申请一个示例性实施例提供的设备200的结构示意图，附图2所示设备200例如为附图1所示的应用场景中的网关设备110或者测试服务器120。设备200包括至少一个处理器201、通信总线202、存储器203以及至少一个通信接口204。
处理器201例如是通用中央处理器(central processing unit，CPU)、网络处理器(network processer，NP)、图形处理器(graphics processing unit，GPU)、神经网络处理器(neural-network processing units，NPU)、数据处理单元(data processing unit，DPU)、微处理器或者一个或多个用于实现本申请方案的集成电路。例如，处理器201包括专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。PLD例如是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线202用于在上述组件之间传送信息。通信总线202可以分为地址总线、数据总线、控制总线等。为便于表示，附图2中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器203例如是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，又如是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据 结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器203例如是独立存在，并通过通信总线202与处理器201相连接。存储器203也可以和处理器201集成在一起。
通信接口204使用任何收发器一类的装置，用于与其它设备或通信网络通信。通信接口204包括有线通信接口，还可以包括无线通信接口。其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器201可以包括一个或多个CPU，如附图2中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，设备200可以包括多个处理器，如附图2中所示的处理器201和处理器205。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，设备200还可以包括输出设备和输入设备。输出设备和处理器201通信，可以以多种方式来显示信息。例如，输出设备可以是液晶显示器(liquid crystal display，LCD)、发光二级管(light emitting diode，LED)显示设备、阴极射线管(cathode ray tube，CRT)显示设备或投影仪(projector)等。输入设备和处理器201通信，可以以多种方式接收用户的输入。例如，输入设备可以是鼠标、键盘、触摸屏设备或传感设备等。
在一些实施例中，存储器203用于存储执行本申请方案的程序代码210，处理器201可以执行存储器203中存储的程序代码210。也即是，设备200可以通过处理器201以及存储器203中的程序代码210，来实现下述方法实施例提供的方法。
本申请实施例的设备200可对应于下述各个方法实施例中的网关设备或者测试服务器，并且，该设备200中的处理器201、通信接口204等可以实现上述各个方法实施例中网关设备或者测试服务器所具有的功能和/或所实施的各种步骤和方法。为了简洁，在此不再赘述。
下面结合附图3对本申请实施例提供的漏洞测试方法进行介绍。附图3是本申请实施例提供的漏洞测试方法300的流程图。
方法300涉及两类服务器，一类服务器扮演着测试目标的角色，另一类服务器扮演着等提供测试载荷等相关配置的角色。为了区分描述，方法300用“目标服务器”、“测试服务器”分别指代这两类不同的服务器。
可选地，方法300涉及的网关设备、终端、目标服务器以及测试服务器的部署场景如附附图1所示。例如，结合附图1来看，方法300中的网关设备为附图1中的网关设备110，方法300中的终端为附图1中的终端130，方法300中的目标服务器为附图1中的业务服务器150，方法300中的测试服务器为附图1中的测试服务器120。
附图3是以网关设备与测试服务器是两个单独的硬件设备为例进行说明的。在网关设备与测试服务器以合设的方式集成在同一台硬件设备(如集成在网关设备上)的情况下，以下测试服务器执行的步骤实际上是网关设备执行的。
附图3中的网关设备、终端、目标服务器以及测试服务器具备附图2所示的硬件结构。
请参照附图3，本申请实施例提供的漏洞测试方法包括步骤S310至步骤S370。
步骤S310、测试服务器通过网关设备获取终端与目标服务器之间传输的第一报文。
在终端与目标服务器之间传输报文的过程中，网关设备作为终端与目标服务器之间通信的桥梁，终端或者目标服务器发送的报文会到达网关设备，网关设备能够得到报文。为了区分描述不同的报文，用“第一报文”、“第二报文”分别描述不同的报文。
第一报文的类型包括多种情况。在一些实施例中，第一报文为来自于终端、以目标服务器为目的方的请求报文。终端生成并发送第一报文，网关设备接收来自于终端的第一报文。在另一些实施例中，第一报文为来自于目标服务器、以终端为目的方的响应报文。目标服务器生成并发送第一报文，网关设备接收来自于目标服务器的第一报文。在另一些实施例中，第一报文包括请求报文和响应报文。
步骤S320、测试服务器根据第一报文包括的第一字段的内容识别目标服务器的服务描述信息。
第一报文包括第一字段。第一字段包括IP地址字段、域名字段、统一资源定位器(uniform resource locator，URL)字段、状态码字段、网络传输协议的标识字段、端口号字段、载荷字段中的至少一项。IP地址字段的内容为IP地址。域名字段的内容为域名。URL字段的内容为URL。状态码字段的内容为状态码。网络传输协议的标识字段的内容为网络传输协议的标识。端口号字段的内容为端口号。载荷字段的内容为载荷。
服务描述信息用于描述目标服务器提供的服务。具体地，服务描述信息包括目标服务器提供的服务所属的应用类型、目标服务器提供服务所基于的协议类型、目标服务器提供服务所基于的资源路径URL、或目标服务器提供服务的版本(version)标识。应用类型例如为WebLogic(一种应用服务器软件)或者Apache(一种网页服务器软件)等。协议类型例如为服务消息块(server message block，SMB，一种文件共享传输协议)、HTTP、远程桌面协议(remote desktop protocol，RDP)、安全外壳协议(secure shell，SSH)等。资源路径URL包括端口号以及URL中的至少一项。版本标识例如为提供服务的版本号。例如，版本标识为1.0、2.0。
在一些实施例中，服务描述信息还包括提供服务所基于的容器类型、提供服务所基于的数据库类型、提供服务所基于的脚本语言中的至少一项。容器类型例如为apache、tomcat等。脚本语言例如为超文本预处理器(hypertext preprocessor，PHP)、java服务器页面(javaserver page，JSP)等。
在一些实施例中，由网关设备执行步骤S320。具体地，网关设备获得第一报文之后，网关设备解析第一报文中第一字段，得到第一字段中的内容。网关设备根据第一字段中的内容识别服务描述信息。
本实施例通过提供步骤S320能够达到以下两方面的效果。
一方面，有助于漏洞测试时快速拆解出单一测试目标。具体地，现有的漏洞扫描器自定义程度较为困难，通常扫描目标局限为IP地址、域名等。而步骤S320由于利用报文中字段的内容，识别出目标服务器在应用类型、协议类型、资源路径URL、版本标识等各种维度的信息，有助于将测试目标精细到服务特定的应用类型、协议类型、URL、版本，使得漏洞测试的对象更加精准。
另一方面，由于识别出目标服务器在应用类型、协议类型、资源路径URL、版本标识等各种维度的信息，从而清晰地描述目标服务器提供的服务，根据服务描述信息便于更精确加载相应的测试载荷，从而提升漏洞测试效果。
步骤S330、测试服务器获取服务描述信息对应的测试载荷。
测试载荷是用于测试服务对应的漏洞的字符串。目标服务器解析测试载荷的过程中，会将该字符串转换为相应的命令。该命令用于模拟针对目标服务器提供的服务的攻击。如果目标服务器成功执行该指令，表示目标服务器存在服务对应的漏洞；如果目标服务器拒绝执行该指令，表示目标服务器不存在服务对应的漏洞。
例如，测试载荷包括whoami。在计算机领域，whoami是一个能够在很多操作系统上找到的命令。whoami是一连串单词“Who am I？”(我是谁？)的串联。如果计算机执行whoami命令，会打印当前用户的有效用户名。本实施例中，通过构造包含whoami的测试报文，模拟了一个未授权用户尝试在服务器执行系统命令whoami。对于服务器来说，不应该存在未授权情况下，任何人或程序能够在服务器执行系统命令whoami。因此，将包含whoami的测试报文发送给目标服务器之后，如果目标服务器针对测试报文返回了执行whoami命令查找到的用户名(例如root、admin、administrator这些用户名)，说明目标服务器存在漏洞。
又如，测试载荷包括/ws_utc/config.do。/ws_utc/config.do用于测试Weblogic服务对应的漏洞。该漏洞具体为通过ws_utc/config.do路径，向WebLogic中未授权访问页面上传webshell。
步骤S340、测试服务器通过网关设备向目标服务器发送测试报文。
在一些实施例中，网关设备根据测试载荷生成测试报文，向目标服务器发送生成的测试报文，使得测试载荷随着测试报文传输到目标服务器。
测试报文的类型包括多种情况。在一些实施例中，测试报文为请求(request)报文。例如，测试报文为HTTP请求(HTTP request)报文。比如说，测试报文为HTTP获取(get)请求报文或者HTTP提交(post)请求报文。或者，测试报文为使用get、post之外的其他请求方法的HTTP请求报文。
在一些实施例中，测试报文包括测试载荷。测试载荷在测试报文中的携带位置包括多种情况。例如，测试报文包括指定字段，测试报文中指定字段的内容包括测试载荷。换句话说，测试载荷携带在测试报文中的指定字段。可选地，测试报文的指定字段中一部分内容为测试载荷，指定字段中另一部分内容为除测试载荷之外的内容(如URL或者正常的业务数据)。
下面通过情况一至情况四，对包含测试载荷的指定字段举例说明。
情况一、包含测试载荷的指定字段为URL字段。
在情况一下，使用URL字段携带测试载荷。测试报文中URL字段的内容包括测试载荷。例如，测试报文包括GET/login.php？a＝whoami HTTP/1.1。GET是测试报文中请求方法字段的内容。/login.php？a＝whoami是测试报文中URL字段的内容。其中，whoami是URL字段中的测试载荷。HTTP/1.1是测试报文中协议版本字段的内容。
情况二、包含测试载荷的指定字段为HTTP头(HTTP header)字段。
在情况二下，使用HTTP头字段携带测试载荷。测试报文中HTTP头字段的内容包括测试载荷。例如，指定字段具体为HTTP头字段中的主机(host)字段、cookie字段等。换句话说，使用HTTP头字段中的host字段、cookie字段携带测试载荷。
情况三、包含测试载荷的指定字段为HTTP体(HTTP body)字段。
在情况三下，使用HTTP体字段携带测试载荷。测试报文中HTTP体字段的内容包括测试载荷。
情况四、包含测试载荷的指定字段为载荷(payload)字段。
在情况四下，使用载荷字段携带测试载荷。测试报文中载荷字段的内容包括测试载荷。测试报文中载荷字段的内容包括测试载荷。
通过上述情况一至情况四，灵活地定义了测试载荷在测试报文中的很多种携带位置，在实际使用过程中能够根据业务需求选择测试载荷的具体携带位置。
步骤S350、目标服务器接收来自网关设备的测试报文，目标服务器针对测试报文生成响应报文。
目标服务器收到测试报文之后，目标服务器根据测试报文获得测试载荷。例如，目标服务器从测试报文的指定字段获得测试载荷。目标服务器对测试载荷进行解析，并针对测试载荷作出响应，从而生成响应报文。在一些实施例中，在测试报文为HTTP请求报文的情况下，响应报文为HTTP响应(response)报文。
步骤S360、目标服务器向网关设备发送针对于测试报文的响应报文。
步骤S370、测试服务器通过网关设备接收来自目标服务器的针对于测试报文的响应报文。
步骤S380、如果响应报文包括测试载荷对应的预期结果，测试服务器确定目标服务器存在漏洞。
预期结果表示测试载荷执行成功。例如，测试载荷为whoami，whoami对应的预期结果为目标服务器执行whoami命令查找到的用户名。例如，whoami对应的预期结果包含：root、admin、administrator等关键字。如果响应报文包括root、admin或者administrator，则确定目标服务器存在漏洞。
本实施例提供了一种基于网关实现漏洞测试的方法，通过在终端与服务器进行交互的过程中，利用部署在终端与服务器之间的网关设备来获取终端与服务器交互的报文，根据报文中字段的内容自动地识别出服务器提供服务的一些具体信息，例如应用类型、协议类型、URL或者版本等，利用识别出的信息获得相应的测试载荷，利用测试载荷构造测试报文，根据服务器针对测试报文的响应报文从而发现服务器上存在的漏洞。由于利用网关设备上通过的报文识别服务器提供服务的具体信息从而对服务器漏洞测试，一方面提高了漏洞测试效率，另一方面测试的目标更加精细，因此能够显著提升漏洞测试效果。
附图3所示的漏洞测试方法包括被动的方式以及主动的方式。被动的方式是指在客户端请求目标服务器提供服务的情况下，触发针对目标服务器的漏洞测试流程，具体参见下述实现方式一。主动的方式是指由网关设备主动发起针对目标服务器的漏洞测试流程，具体参见下述实现方式二。
实现方式一、当终端与服务器之间传输的流量通过网关设备时，网关设备对收到的报文进行替换从而发送测试报文。
例如，实现方式一具体包括下述步骤a至步骤c。
步骤a、通过网关设备获取终端与目标服务器之间传输的第二报文。
具体地，在终端与服务器之间传输报文的过程中，报文会经过网关设备。网关设备在转发报文的过程中会判断报文中是否包含目标服务器提供服务所基于的URL。以网关设备收到的报文包括第二报文和第三报文为例，网关设备分别判断第二报文和第三报文是否包含目标服务器的URL。网关设备确定第二报文包含目标服务器提供服务所基于的URL，则针对第二报文执行以下步骤b。网关设备确定第三报文不包含目标服务器提供服务所基于的URL，则正常转发第三报文。
步骤b、如果第二报文包括目标服务器的URL，使用测试载荷替换第二报文中指定字段的内容，从而生成测试报文。
在一些实施例中，第二报文为来自于终端、以目标服务器为目的方的请求报文。例如，第二报文的目的IP地址字段包括目标服务器的IP地址。第二报文的域名字段包括目标服务器的域名。第二报文的源IP地址字段包括终端的IP地址。
在一些实施例中，第二报文为HTTP报文。例如，第二报文为HTTP请求(HTTP request)报文。例如，第二报文为HTTP get请求报文或者HTTP post请求报文。又如，第二报文为使用get、post之外的其他请求方法的HTTP请求报文。
在一些实施例中，使用测试载荷替换第二报文中指定字段的一部分内容，并保持指定字段的另一部分内容为原有内容，从而将测试载荷与指定字段的部分内容拼接为指定字段的全部内容。在采用这种方式时，测试报文中指定字段的内容包括测试载荷以及指定字段的原有内容。例如，指定字段为URL字段，如果通过网关设备的报文包括目标服务器的URL，则网关设备将报文中的URL与测试载荷进行替换拼接，从而得到测试报文。
例如，目标服务器上提供服务的URL为www.test.com/login.php？a＝。服务对应的测试载荷为whoami，如果网关设备在流量中发现且匹配有www.test.com/login.php？a＝xxx的HTTP请求报文(第二报文)，则用测试载荷whoami替换HTTP请求报文中www.test.com/login.php？a＝xxx中的xxx，并保持HTTP请求报文中www.test.com/login.php？a＝xxx中www.test.com/login.php？a＝不变。替换后的HTTP请求报文的URL字段的内容为www.test.com/login.php？a＝whoami。
步骤c、通过网关设备向目标服务器发送生成的测试报文。
例如，网关设备生成测试报文后，网关设备根据第二报文的目的IP地址查询路由表项，按照第二报文对应的转发路径将测试报文转发至目标服务器，使得测试报文按照原有的转发路径转发至目标服务器。
可选地，在方式一中网关设备只向目标服务器发送生成的测试报文，不再转发第二报文；可替换地，网关设备在向目标服务器发送生成的测试报文的情况下，也可以正常转发第二报文。
通过上述实现方式一，能够对实时传输的流量进行检测，同时主动发起测试的频率较低，检测目标较为宽泛。
实现方式二、网关设备主动构造和发送测试报文。
在实现方式二中，由网关设备充当测试报文的发起方。当需要进行漏洞测试(如接收到来自测试服务器的测试请求)时，网关设备根据测试载荷、目标服务器的地址以及目标服务器的URL生成测试报文。网关设备向目标服务器发送生成的测试报文。其中，测试报文的载荷字段包括测试载荷，测试报文的URL字段包括目标服务器的URL。
通过上述实现方式二，能够更快速地发起漏洞测试，支持应急响应的场景。例如，当网络中不存在向目标服务器传输的流量时，通过执行上述实现方式二，从而立即进行测试。
下面对实现漏洞测试相关的一些功能模块进行介绍。
在一些实施例中，漏洞测试相关的功能模块包括服务识别库、信息记录库、载荷配置库以及载荷响应验证模块。下面通过(1)至(4)对这些功能模块分别具体介绍。
(1)服务识别库
服务识别库支持上述方法300中识别服务描述信息的功能。服务识别库用于保存报文中出现的字符串与服务描述信息的对应关系。服务识别库包括至少一个表项。服务识别库中每一个表项包括两类内容。一类内容是报文中可能出现的字符串，例如IP地址、域名、URL、状态码、网络传输协议的标识、端口号、载荷中的至少一项，这类内容在查询服务识别库的过程中能够充当查询索引。另一类内容是服务描述信息。
例如，请参考下表1，表1是对服务识别库中的表项的举例说明。表1中的每个表项包括URL、状态码、端口号以及服务所属的应用类型。其中，URL、状态码以及端口号是对报文中出现的字符串的举例说明，应用类型是对服务描述信息的举例说明。如果报文中URL字段的内容为/console/login/LoginForm.jsp，状态码字段的内容为200，端口号字段的内容为7001，通过查询表1所示的表项，能够识别出服务所属的应用类型为Weblogic服务。
表1
URL 状态码 端口号 应用类型
/console/login/LoginForm.jsp 200 7001 Weblogic
/wls-wsat/CoordinatorPortType 200 7001 Weblogic
/_async/AsyncresponseService 200 7001 Weblogic
又如，请参考下表2，表2也是对服务识别库中的表项的举例说明。表2中的表项包括TCP载荷、端口号以及服务所属的应用类型。其中，TCP载荷以及端口号是对报文中出现的字符串的举例说明，服务所属的应用类型是对服务描述信息的举例说明。如果报文中载荷字段的内容包括SSH-2.0-OpenSSH_7.2p2Ubuntu-4ubuntu2.8，端口号字段的内容为7001，通过查询表2所示的表项，能够识别出服务所属的应用类型为SSH服务。
表2
Figure PCTCN2021090138-appb-000001
(2)信息记录库
信息记录库用于保存服务器与针对服务器识别出的服务描述信息之间的对应关系。例如，服务识别库中每一个表项包括两类内容。一类内容是服务器的标识，如服务器的IP地址、服务器的名称、服务器上端口的端口号；另一类内容是服务器的服务描述信息。可选地，信息记录库为关系型数据库；或者，信息记录库为非关系型数据库。
例如，请参考下表3，表3是对服务识别库中的表项的举例说明。表3中的表项包括服务器的IP地址、端口号、协议类型以及服务所属的应用类型。其中，IP地址以及端口号是对服务器的标识的举例说明，协议类型以应用类型是对服务描述信息的举例说明。
表3
服务器的IP地址 端口号 协议类型 应用类型
192.168.1.3 7001 HTTP Weblogic
(3)载荷配置库
载荷配置库支持上述方法300中获取测试载荷的功能。述载荷配置库用于保存查询索引、测试载荷、说明信息之间的对应关系。载荷配置库包括至少一个表项。载荷配置库中每一个表项包括三类内容。一类内容是测试载荷，另一类内容是测试载荷对应的查询索引，另一类 内容是关于测试载荷的说明信息。
查询索引用于在载荷配置库中查询对应的测试载荷。查询索引与服务描述信息具有全部或部分相同的内容。例如，查询索引为应用类型、协议类型、URL或版本标识。
说明信息用于指示测试载荷用于替换指定字段的内容。通过在载荷配置库中保存关于测试载荷的说明信息，能够通过查询载荷配置库中的说明信息来确定指定字段。例如，在使用测试载荷对第二报文进行替换的过程中，网关设备以第二报文中的URL为查询索引，查询载荷配置库，得到测试载荷以及说明信息。根据说明信息确定指定字段。
例如，载荷配置库包括如下表4所示的表项。如果报文中URL字段的内容是www.test.com/login.php？a＝xxx，以www.test.com/login.php？a＝为查询索引，通过查询表4所示的表项，得到测试载荷为whoami，测试载荷的说明信息为替换URL字段中a参数的内容，从而确定要使用whoami替换报文中URL字段中a参数的内容，也即是将www.test.com/login.php？a＝xxx修改为www.test.com/login.php？a＝whoami。在这个例子中，URL字段即为测试载荷要替换的指定字段。
表4
Figure PCTCN2021090138-appb-000002
在一些实施例中，载荷配置库还用于保存测试载荷对应的预期结果。例如，载荷配置库中的每条表项除了包括测试载荷、查询索引以及说明信息这三类信息之外，还包括测试载荷对应的预期结果。例如，载荷配置库包括如下表5所示的表项。
表5
查询索引 测试载荷 说明信息 预期结果
www.test.com/login.php？a＝ whoami 替换URL字段 root、admin、administrator
通过使用载荷配置库保存预期结果，在执行附图3所示的漏洞测试方法的过程中，能够查询载荷配置库从而获得测试载荷对应的预期结果。例如，目标服务器上提供服务的URL为www.test.com/login.php？a＝，网关设备以www.test.com/login.php？a＝为查询索引，通过查询表5所示的表项，得到测试载荷为whoami，测试载荷对应的预期结果为root、admin、administrator。
在一些实施例中，载荷配置库中每一个表项采用键值对的形式存储。键值对中的键(key)为查询索引。键值对中的值(value)包括测试载荷、说明信息以及预期结果。
在一些实施例中，以上服务识别库以及载荷配置库通过网管人员的配置操作设置。例如，网管人员在服务识别库预先配置各种服务描述信息，网管人员在载荷配置库预先配置各种测试载荷对应的预期结果，从而根据配置操作获得服务识别库以及载荷配置库。
(4)载荷响应验证模块
载荷响应验证模块用于根据响应报文的内容验证目标服务器上是否存在服务对应的漏洞。具体地，载荷响应验证模块判断响应报文的内容是否包含测试载荷对应的预期结果，如果响应报文的内容包含测试载荷对应的预期结果，则载荷响应验证模块确定目标服务器上存在服务对应的漏洞；如果响应报文的内容不包含测试载荷对应的预期结果，则载荷响应验证模块 确定目标服务器上不存在服务对应的漏洞。在一些实施例中，载荷响应验证模块查询载荷配置库，从而获得测试载荷对应的预期结果。
以上介绍的各个功能模块能够在网关设备与测试服务器之间任意分配。在一些实施例中，以上介绍的各个功能模块全部设置在测试服务器中；在另一些实施例中，以上介绍的各个功能模块全部设置在网关设备中；在另一些实施例中，以上介绍的各个功能模块中一部分功能模块设置在网关设备，另一部分功能模块设置在测试服务器，换句话说，网关设备与测试服务器分别承担方法300中不同的功能。网关设备与测试服务器通过进行交互来协作执行方法300。
下面，对如何利用以上介绍的各个功能模块实现方法300进行说明。
其中，网关设备以及测试服务器的实现方式包括合设和分设。在采用分设的方式时，网关设备与测试服务器分别对应于两个单独的硬件设备。采用合设的方式时，网关设备与测试服务器集成在同一台硬件设备中。
下面结合附图4，对采用分设的方式时如何部署上述各个功能模块以及如何通过上述各个功能模块进行漏洞测试举例说明，具体参见方式A；结合附图5，对采用合设的方式时如何部署上述各个功能模块以及如何通过上述各个功能模块进行漏洞测试举例说明，具体参见方式B。
方式A、测试服务器与网关设备之间进行交互从而执行漏洞测试。
具体地，服务识别库、信息记录库、载荷配置库以及载荷响应验证模块部署在测试服务器中。例如，请参考附图4，测试服务器包括服务识别库401、信息记录库402、载荷配置库403、载荷响应验证模块405以及载荷下发模块404。其中，服务识别库401、信息记录库402、载荷配置库403、载荷响应验证模块405请参考上述(1)至(4)的介绍。载荷下发模块404用于将载荷配置库403中的测试载荷下发至网关设备。方式A中漏洞测试的流程包括以下步骤S41至步骤S49。
步骤S41、因特网的流量通过网关设备进入目标服务器。
步骤S42、网关设备访问测试服务器中预置的服务识别库401，通过查询服务识别库401识别服务描述信息。
例如，网关设备接收来自于终端或者服务器的第一报文，网关设备根据第一报文包括的第一字段的内容查询服务识别库401，从而识别服务器的服务描述信息。
具体地，步骤S42包括步骤S421至步骤S422。
步骤S421、网关设备根据第一报文包括的第一字段的内容查询测试服务器中的服务识别库401。
步骤S422、如果第一字段的内容与服务识别库401中的目标字符串满足匹配条件，网关设备将服务识别库401中目标字符串对应的服务描述信息确定为目标服务器的服务描述信息。
目标字符串是服务识别库401中保存的字符串，具体是指与第一字段的内容满足匹配条件的字符串。
例如，服务识别库401包括第一表项，第一表项包括第一字段中的字符串以及服务描述信息。在执行步骤S422的过程中，网关设备对第一字段的内容与第一表项中的字符串进行匹配，判断第一字段的内容与第一表项中的字符串是否满足匹配条件。如果第一字段的内容与第一表项中的字符串满足匹配条件，那么第一表项中的字符串即为目标字符串，网关设备会 将第一表项中的服务描述信息确定为目标服务器的服务描述信息。如果第一字段的内容与第一表项中的字符串不满足匹配条件，则网关设备继续查询服务识别库401中除第一表项之外的其他表项。
在一些实施例中，第一字段的内容与第一表项中的字符串满足匹配条件是指第一字段的内容与第一表项中的字符串相同。在另一些实施例中，第一字段的内容与第一表项中的字符串满足匹配条件是指第一字段的内容包括第一表项中的字符串。可选地，匹配条件根据对识别精度的需求确定。例如，当识别精度为高精度时，网关设备将第一字段的内容与第一表项中的字符串相同确定为匹配条件；当识别精度为低精度时，网关设备将第一字段的内容包括第一表项中的字符串确定为匹配条件。
在一些实施例中，查询服务识别库401时采用全字段一一匹配的方式。具体地，第一字段包括IP地址字段、域名字段、URL字段、状态码字段、网络传输协议的标识字段、端口号字段、载荷字段中的多项。服务识别库401中的每个表项包括多个字符串。在查询服务识别库401的过程中，网关设备使用第一字段的全部内容与表项中全部字符串分别进行匹配。如果第一字段的全部内容与第一表项中全部字符串分别满足匹配条件，网关设备会将第一表项中的服务描述信息确定为目标服务器的服务描述信息。
例如，请参考上表1，采用URL字段、状态码字段以及端口号字段这三个字段作为服务识别时使用的字段(第一字段)。报文中URL字段的内容为/console/login/LoginForm.jsp，状态码字段的内容为200，端口号字段的内容为7001。根据/console/login/LoginForm.jsp、200以及7001，查询服务识别库401中表1所示的表项，确定/console/login/LoginForm.jsp与表1中第一条表项保存的URL相同、且200与表1中第一条表项保存的状态码相同、且7001与表1中第一条表项保存的端口号相同，则确定服务所属的应用类型为表1中第一条表项保存的Weblogic。
步骤S43、网关设备将识别出的服务描述信息上送至测试服务器。测试服务器接收网关设备上送的服务描述信息，将服务描述信息记录至信息记录库402。
步骤S44、测试服务器根据信息记录库402保存的内容查询载荷配置库403，从而确定测试载荷。
举例来说，当需要对一台提供Weblogic服务的内网服务器进行漏洞测试时，测试服务器根据内网服务器的IP地址查询信息记录库402，从信息记录库402中获得内网服务器提供Weblogic服务所基于的URL。测试服务器根据URL查询载荷配置库403，从而获得URL对应的Weblogic服务对应的测试载荷。
通过执行上述步骤S43至步骤S44，由于利用信息记录库402存储服务描述信息。当需要进行漏洞测试时，从信息记录库402读取预先存储的服务描述信息，而无需在测试过程中对目标服务器临时进行主动探测以获知具体服务描述信息，从而提升测试效率。
步骤S45、测试服务器中的载荷下发模块404生成并向网关设备发送测试请求。
其中，测试请求用于指示网关设备根据测试载荷向服务器发送测试报文。测试请求包括测试载荷、目标服务器的地址、目标服务器提供服务所基于的URL。例如，测试请求包括192.168.1.1/www.test.com、/login.php？a＝、“whoami”。测试服务器通过发送测试请求，从而将测试载荷传递给网关设备。
步骤S46、网关设备接收来自测试服务器的测试请求。网关设备从测试请求中获得测试 载荷。网关设备根据测试载荷生成测试报文。网关设备向目标服务器发送测试报文。
步骤S47、目标服务器接收来自网关设备的测试报文，目标服务器针对测试报文生成响应报文。目标服务器向网关设备发送响应报文。
步骤S48、网关设备收到响应报文之后，网关设备对响应报文进行解析，得到响应报文的内容。网关设备将响应报文的内容发送至测试服务器。
步骤S49、测试服务器接收响应报文的内容。测试服务器中的载荷响应验证模块405根据响应报文的内容确定漏洞测试结果。具体地，载荷响应验证模块405判断据响应报文是否包括测试载荷对应的预期结果。如果响应报文的内容包括测试载荷对应的预期结果，则测试服务器确定目标服务器存在服务对应的漏洞，即目标服务器存在安全问题。如果响应报文的内容不包括测试载荷对应的预期结果，则测试服务器确定目标服务器不存在服务对应的漏洞，即目标服务器不存在安全问题。
方式B、网关设备本地执行漏洞测试。
具体地，服务识别库401、信息记录库402、载荷配置库403以及载荷响应验证模块405部署在网关设备中。例如，请参考附图5，网关设备包括服务识别库401、信息记录库402、载荷配置库403以及载荷响应验证模块405。方式B中漏洞测试的流程包括以下步骤S51至步骤S59。步骤S51至步骤S59与上述步骤S41至步骤S49之间的区别主要在于执行主体的不同，步骤S51至步骤S59的细节可参考上述步骤S41至步骤S49的描述。
步骤S51、因特网的流量通过网关设备进入目标服务器。
步骤S52、网关设备根据本地预置的服务识别库401识别服务描述信息。
例如，网关设备接收来自于终端或者服务器的第一报文，网关设备根据第一报文包括的第一字段的内容查询服务识别库401，从而识别服务器的服务描述信息。
步骤S53、网关设备将识别出的服务描述信息保存至本地的信息记录库402。
步骤S54、网关设备根据信息记录库402保存的内容查询载荷配置库403，从而确定测试载荷。
步骤S56、网关设备根据测试载荷生成测试报文。网关设备向目标服务器发送测试报文。
步骤S57、目标服务器接收来自网关设备的测试报文，目标服务器针对测试报文生成响应报文。目标服务器向网关设备发送响应报文。
步骤S58、网关设备收到响应报文之后，网关设备对响应报文进行解析，得到响应报文的内容。
步骤S59、网关设备中的载荷响应验证模块405判断响应报文的内容是否包括测试载荷对应的预期结果。如果响应报文的内容包括测试载荷对应的预期结果，则网关设备确定目标服务器存在服务对应的漏洞。如果响应报文的内容不包括测试载荷对应的预期结果，则网关设备确定目标服务器不存在服务对应的漏洞。
通过上述方式B，由于测试配置模块放置在网关内部实现，不需要单独配置物理设备，完整识别测试逻辑在网关内部实现，效率更高。
下面结合一个实例，对漏洞测试的完整流程进行说明。
在下述实例中，服务描述信息为目标服务器提供服务所基于的URL，该URL具体为www.test.com/login.php？a。测试载荷具体为whoami。测试报文为HTTP请求报文，具体为HTTP://www.test.com/login.php？a＝whoami请求报文。针对于测试报文的响应报文为HTTP 响应报文。下述实例包括以下步骤S61至步骤S65。
步骤S61、网关设备生成HTTP://www.test.com/login.php？a＝whoami请求报文。
如果步骤S61采用上述实现方式一，即被动的方式，网关设备接收到来自于测试服务器的测试请求后，持续静默观测通过网关设备的流量。网关设备解析流量中中是否包含目标服务器提供服务所基于的URL(www.test.com/login.php？a)。如果通过网关设备的流量未出现目标服务器提供服务所基于的URL(www.test.com/login.php？a)，则网关设备正常进行流量转发。如果网关设备在流量中发现且匹配有www.test.com/login.php？a＝xxx的HTTP请求，则网关设备使用whoami替换HTTP请求中的URL字段的部分内容，从而生成HTTP://www.test.com/login.php？a＝whoami请求报文。网关设备向目标服务器发送生成的HTTP://www.test.com/login.php？a＝whoami请求报文，使得目标服务器收到HTTP://www.test.com/login.php？a＝whoami请求报文。HTTP://www.test.com/login.php？a＝whoami请求报文内容如下，该请求报文URL字段a参数对应的值为whoami。
HTTP://www.test.com/login.php？a＝whoami请求报文
GET/login.php？a＝whoami HTTP/1.1
host:www.test.com
User-Agent:Mozilla/5.0(Macintosh；Intel Mac OS X 10.9；rv:50.0)Gecko/20100101 Firefox/50.0
Accept:text/html，application/xhtml+xml，application/xml；q＝0.9，*/*；q＝0.8
以上请求报文URL字段a参数对应的值为whoami。
如果步骤S61采用上述实现方式二，即主动的方式，网关设备确定测试载荷为whoami、目标服务器的URL为www.test.com/login.php？a＝，网关设备基于载荷协议构造内容如下所示的HTTP请求报文，并主动向目标服务器发送构造出的HTTP请求报文。
HTTP://www.test.com/login.php？a＝whoami
GET/login.php？a＝whoami HTTP/1.1
host:www.test.com
User-Agent:Mozilla/5.0(Macintosh；Intel Mac OS X 10.9；rv:50.0)Gecko/20100101 Firefox/50.0
Accept:text/html，application/xhtml+xml，application/xml；q＝0.9，*/*；q＝0.8
步骤S62、目标服务器对网关设备转发来的HTTP://www.test.com/login.php？a＝whoami请求报文进行解析。
步骤S63、目标服务器解析后作出响应，产生HTTP响应报文。具体地，目标服务器对请求报文中a参数的值进行解析，得到whoami。对于存在漏洞的目标服务器而言，目标服务器解析whoami在后端代码执行过程中，执行whoami命令，返回HTTP响应报文。HTTP响应报文包括执行whoami命令查找到的用户名。例如，HTTP响应报文的内容如下所示，HTTP响应报文的body字段包括root。
HTTP/1.1 200 OK
Date:Sat，31 Dec 2005 23:59:59 GMT
Content-Type:text/html；charset＝ISO-8859-1
Content-Length:122
＜html＞
＜head＞
＜/head＞
＜body＞
root
＜/body＞
＜/html＞
步骤S64、网关设备收到目标服务器发送过来的HTTP响应报文后，对HTTP响应报文进行解析，得到HTTP响应报文的内容。
步骤S65、测试服务器或者网关设备对HTTP响应报文的内容进行验证。具体验证方式为判断HTTP响应报文的内容是否包括root、admin或者administrator等关键字，如果HTTP响应报文的内容包括root、admin或者administrator等关键字，则确定载荷执行成功，服务端存在安全问题。例如针对如上所示的HTTP响应报文而言，由于HTTP响应报文包括root，则确定目标服务器存在漏洞。
可选地，在步骤S61采用上述实现方式一的情况下，网关设备还执行以下步骤S66。在步骤S61采用上述实现方式二的情况下，网关设备不执行以下步骤S66。
步骤S66、网关设备进行载荷验证之后，网关设备按照流量原始发送方向，将响应报文转发至相应的目的设备(如服务器或终端)。
以下介绍本申请实施例提供的漏洞测试装置。以下介绍的漏洞测试装置具有上述图3、图4或图5所示方法中测试服务器或者网关设备的任意功能。
图6示出了漏洞测试装置800的一种可能的结构示意图。图6所示的装置800例如实现图3所示方法中测试服务器或者网关设备的功能，或者，装置800实现图4所示方法中测试服务器或者网关设备的功能，或者，装置800实现图5所示方法中测试服务器或者网关设备的功能。可选地，图6所示装置800为附图1所示的应用场景中的网关设备110或者测试服务器120。可选地，图6所示装置800为图2中的设备200。
请参考附图6，装置800包括获取单元801、处理单元802和发送单元803。装置800中的各个单元全部或部分地通过软件、硬件、固件或者其任意组合来实现。装置800中的各个单元用于执行上述图3、图4或图5所示方法中测试服务器或者网关设备的相应功能。具体地，获取单元801用于支持装置800执行图3中的S310、S330以及S370。处理单元802用于支持装置800执行图3中的S320以及S380。发送单元803用于支持装置800执行图3中的S340。
在一些实施例中，获取单元801、处理单元802或发送单元803还用于支持装置800执行本文所描述的技术中测试服务器或者网关设备执行的其它过程。例如，获取单元801用于支持装置800执行实现方式一中的步骤a、步骤S43中接收服务描述信息的过程、步骤S46中接收测试请求的过程、以及测试服务器或者网关设备执行的其他接收操作。处理单元802用于支持装置800执行实现方式一中的步骤b、实现方式二中生成测试报文的步骤、图4中的步骤S42、步骤S43中记录服务描述信息的过程、步骤S44、步骤S45或步骤S46中生成测试报文的过程、步骤S48中解析响应报文的过程、步骤S49中确定漏洞测试结果的过程、图5中的步骤S52、步骤S53、步骤S54、步骤S59、以及测试服务器或者网关设备执行的其 他处理操作。发送单元803用于支持装置800执行实现方式一中的步骤c、实现方式二中发送测试报文的步骤、图4中的步骤S45、步骤S45或步骤S46中发送测试报文的过程、图5中的步骤S56、以及测试服务器或者网关设备执行的其他发送操作。具体执行过程请参考图3、图4或图5所示方法中相应步骤的详细描述，这里不再一一赘述。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可选地有另外的划分方式。
在一些实施例中，装置800中各个单元集成在一个单元中。例如，装置800中各个单元集成在同一个芯片上。该芯片包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口。处理单元802通过芯片中的处理电路实现。获取单元801通过芯片中的输入接口实现。发送单元803通过芯片中的输出接口实现。例如，该芯片通过一个或多个现场可编程门阵列(field－programmable gate array，FPGA)、可编程逻辑器件(programmable logic device，PLD)、控制器、状态机、门逻辑、分立硬件部件、任何其它适合的电路、或者能够执行本申请通篇所描述的各种功能的电路的任意组合实现。
在另一些实施例中，装置800各个单元单独物理存在。在另一些实施例中，装置800一部分单元单独物理存在，另一部分单元集成在一个单元中。例如，在一些实施例中，处理单元802和发送单元803是同一个单元。在另一些实施例中，处理单元802和发送单元803是不同的单元。在一些实施例中，不同单元的集成采用硬件的形式实现，即，不同单元对应于同一个硬件。又如，不同单元的集成采用软件单元的形式实现。
在装置800中通过硬件实现的情况下，装置800中处理单元802例如通过附图2所示的设备200中的处理器201实现。装置800中获取单元801、发送单元例如通过附图2所示的设备200中的通信接口204实现。
在装置800中通过软件实现的情况下，装置800中各个单元例如为设备200中的处理器201读取存储器203中存储的程序代码210后生成的软件。例如，装置800为虚拟化设备。虚拟化设备包括而不限于虚拟机、容器、Pod中的至少一种。在一些实施例中，装置800以虚拟机的形式，部署在硬件设备(如物理服务器)上。例如，基于通用的物理服务器结合网络功能虚拟化(network functions virtualization，NFV)技术来实现装置800。采用虚拟机的方式实现时，装置800例如为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出装置800。在另一些实施例中，装置800以容器(例如docker容器)的形式，部署在硬件设备上。例如，装置800执行上述方法实施例的流程被封装在镜像文件中，硬件设备通过运行镜像文件来创建装置800。在另一些实施例中，装置800以Pod的形式，部署在硬件设备上。Pod包括多个容器，每个容器用于实现装置800中的一个或多个单元。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装 置和单元的具体工作过程，可以参见前述方法实施例中的对应过程，在此不再赘述。
本申请中术语“第一”、“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。例如，在不脱离各种示例的范围的情况下，第一报文可以被称为第二报文，并且类似地，第二报文可以被称为第一报文。第一报文和第二报文都可以是报文，并且在某些情况下，可以是单独且不同的报文。
本申请中术语“至少一个”的含义是指一个或多个。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。
该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (19)

  1. 一种漏洞测试方法，其特征在于，所述方法包括：
    通过网关设备获取终端与服务器之间传输的第一报文，所述网关设备部署于所述终端与所述服务器之间，所述第一报文包括第一字段，所述服务器用于向其他设备提供服务；
    根据所述第一报文包括的第一字段的内容识别所述服务器的服务描述信息，所述服务描述信息包括服务所属的应用类型、提供服务所基于的协议类型、提供服务所基于的资源路径URL、或提供服务的版本标识；
    获取所述服务描述信息对应的测试载荷，所述测试载荷是用于测试所述服务对应的漏洞的字符串；
    通过所述网关设备向所述服务器发送测试报文，所述测试报文是根据所述测试载荷生成的；
    通过所述网关设备接收来自所述服务器的针对于所述测试报文的响应报文；
    如果所述响应报文包括所述测试载荷对应的预期结果，确定所述服务器存在所述漏洞，所述预期结果表示所述测试载荷执行成功。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述第一报文包括的第一字段的内容识别所述服务器的服务描述信息，包括：
    根据所述第一字段的内容查询服务识别库，所述服务识别库中用于保存第一字段中的字符串与服务描述信息的对应关系；
    如果所述第一字段的内容与所述服务识别库中的目标字符串满足匹配条件，将所述服务识别库中所述目标字符串对应的服务描述信息确定为所述服务器的服务描述信息。
  3. 根据权利要求1所述的方法，其特征在于，所述通过所述网关设备向所述服务器发送测试报文，包括：
    通过所述网关设备获取所述终端与所述服务器之间传输的第二报文；
    如果所述第二报文包括所述服务器的统一资源定位器URL，使用所述测试载荷替换所述第二报文中指定字段的内容，从而生成所述测试报文；
    通过所述网关设备向所述服务器发送生成的测试报文。
  4. 根据权利要求3所述的方法，其特征在于，所述第二报文为来自于所述终端、以所述服务器为目的方的请求报文。
  5. 根据权利要求3所述的方法，其特征在于，所述指定字段为URL字段、超文本传输协议HTTP头字段、HTTP体字段或者载荷字段。
  6. 根据权利要求3所述的方法，其特征在于，所述使用所述测试载荷替换所述第二报文中指定字段的内容之前，所述方法还包括：
    以所述第二报文中的所述URL为查询索引，查询载荷配置库，得到所述测试载荷以及说明信息，所述载荷配置库用于保存查询索引、测试载荷、说明信息之间的对应关系，所述说明信息用于指示所述测试载荷用于替换所述指定字段的内容；
    根据所述说明信息确定所述指定字段。
  7. 根据权利要求1所述的方法，其特征在于，所述通过所述网关设备向所述服务器发送测试报文，包括：
    根据所述测试载荷、所述服务器的地址以及所述服务器的URL生成测试报文，所述测试报文的载荷字段包括所述测试载荷，所述测试报文的目的地址字段包括所述服务器的地址，所述测试报文的URL字段包括所述服务器的URL；
    通过所述网关设备向所述服务器发送生成的所述测试报文。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述服务描述信息还包括提供服务所基于的容器类型、提供服务所基于的数据库类型、提供服务所基于的脚本语言中的至少一项。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述第一报文为来自于所述终端、以所述服务器为目的方的请求报文，或者，
    所述第一报文为来自于所述服务器、以所述终端为目的方的响应报文。
  10. 根据权利要求1至9中任一项所述的方法，其特征在于，所述第一字段包括互联网协议IP地址字段、域名字段、URL字段、状态码字段、网络传输协议的标识字段、端口号字段、载荷字段中的至少一项。
  11. 一种漏洞测试装置，其特征在于，所述漏洞测试装置包括：
    获取单元，用于通过网关设备获取终端与服务器之间传输的第一报文，所述网关设备部署于所述终端与所述服务器之间，所述第一报文包括第一字段，所述服务器用于向其他设备提供服务；
    处理单元，用于根据所述第一报文包括的第一字段的内容识别所述服务器的服务描述信息，所述服务描述信息包括服务所属的应用类型、提供服务所基于的协议类型、提供服务所基于的资源路径URL、或提供服务的版本标识；
    所述获取单元，还用于获取所述服务描述信息对应的测试载荷，所述测试载荷是用于测试所述服务对应的漏洞的字符串；
    发送单元，用于通过所述网关设备向所述服务器发送测试报文，所述测试报文是根据所述测试载荷生成的；
    所述获取单元，还用于通过所述网关设备接收来自所述服务器的针对于所述测试报文的响应报文；
    所述处理单元，还用于如果所述响应报文包括所述测试载荷对应的预期结果，确定所述服务器存在所述漏洞，所述预期结果表示所述测试载荷执行成功。
  12. 根据权利要求11所述的漏洞测试装置，其特征在于，所述处理单元，用于根据所述第一字段的内容查询服务识别库，所述服务识别库中用于保存第一字段中的字符串与服务描述信息的对应关系；如果所述第一字段的内容与所述服务识别库中的目标字符串满足匹配条件，将所述服务识别库中所述目标字符串对应的服务描述信息确定为所述服务器的服务描述信息。
  13. 根据权利要求11所述的漏洞测试装置，其特征在于，所述获取单元，还用于通过所述网关设备获取所述终端与所述服务器之间传输的第二报文；
    所述处理单元，还用于如果所述第二报文包括所述服务器的统一资源定位器URL，使用所述测试载荷替换所述第二报文中指定字段的内容，从而生成所述测试报文；
    所述发送单元，用于通过所述网关设备向所述服务器发送生成的测试报文。
  14. 根据权利要求13所述的漏洞测试装置，其特征在于，所述处理单元，还用于以所述第二报文中的所述URL为查询索引，查询载荷配置库，得到所述测试载荷以及说明信息，所述载荷配置库用于保存查询索引、测试载荷、说明信息之间的对应关系，所述说明信息用于指示所述测试载荷用于替换所述指定字段的内容；根据所述说明信息确定所述指定字段。
  15. 根据权利要求11所述的漏洞测试装置，其特征在于，所述处理单元，还用于根据所述测试载荷、所述服务器的地址以及所述服务器的URL生成测试报文，所述测试报文的载荷字段包括所述测试载荷，所述测试报文的目的地址字段包括所述服务器的地址，所述测试报文的URL字段包括所述服务器的URL；
    所述发送单元，用于通过所述网关设备向所述服务器发送生成的所述测试报文。
  16. 一种测试服务器，其特征在于，所述测试服务器包括处理器和通信接口，所述处理器用于执行程序代码，使得所述测试服务器执行如权利要求1至权利要求10中任一项所述的漏洞测试方法，所述通信接口用于接收或发送报文。
  17. 一种网关设备，其特征在于，所述网关设备包括处理器和通信接口，所述处理器用于执行程序代码，使得所述网关设备执行如权利要求1至权利要求10中任一项所述的漏洞测试方法，所述通信接口用于接收或发送报文。
  18. 一种网络系统，其特征在于，所述网络系统包括测试服务器和网关设备，所述网络系统用于执行如权利要求1至权利要求10中任一项所述的漏洞测试方法。
  19. 一种计算机程序产品，其特征在于，所述计算机程序产品包括一个或多个计算机程序指令，当所述计算机程序指令被计算机加载并执行时，使得所述计算机执行权利要求1至10中任一项所述的漏洞测试方法。
PCT/CN2021/090138 2020-11-16 2021-04-27 漏洞测试方法及装置 WO2022100020A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011278854.8 2020-11-16
CN202011278854.8A CN114584330A (zh) 2020-11-16 2020-11-16 漏洞测试方法及装置

Publications (1)

Publication Number Publication Date
WO2022100020A1 true WO2022100020A1 (zh) 2022-05-19

Family

ID=81600752

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/090138 WO2022100020A1 (zh) 2020-11-16 2021-04-27 漏洞测试方法及装置

Country Status (2)

Country Link
CN (1) CN114584330A (zh)
WO (1) WO2022100020A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884854A (zh) * 2022-06-30 2022-08-09 成都星联芯通科技有限公司 信关站服务器报文测试方法、装置、存储介质及电子设备
CN115001863A (zh) * 2022-07-26 2022-09-02 浙江涂鸦智能电子有限公司 网络安全漏洞检测方法、装置、介质和电子设备
CN115378709A (zh) * 2022-08-23 2022-11-22 南方电网科学研究院有限责任公司 基于weblogic的自动化渗透测试方法和装置
CN118573464A (zh) * 2024-07-08 2024-08-30 国家工业信息安全发展研究中心 工控系统安全漏洞的测试方法、系统、设备及介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115051873B (zh) * 2022-07-27 2024-02-23 深信服科技股份有限公司 网络攻击结果检测方法、装置和计算可读存储介质
CN118631586A (zh) * 2024-08-06 2024-09-10 中国人民解放军国防科技大学 一种基于载荷自动生成的域名系统安全测试方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110231935A1 (en) * 2010-03-22 2011-09-22 Tenable Network Security, Inc. System and method for passively identifying encrypted and interactive network sessions
CN110324311A (zh) * 2019-05-21 2019-10-11 平安科技（深圳）有限公司 漏洞检测的方法、装置、计算机设备和存储介质
CN110881043A (zh) * 2019-11-29 2020-03-13 杭州迪普科技股份有限公司 一种web服务器漏洞的检测方法及装置
CN111294345A (zh) * 2020-01-20 2020-06-16 支付宝(杭州)信息技术有限公司 一种漏洞检测方法、装置及设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6205551B1 (en) * 1998-01-29 2001-03-20 Lucent Technologies Inc. Computer security using virus probing
US7359962B2 (en) * 2002-04-30 2008-04-15 3Com Corporation Network security system integration
CN100387004C (zh) * 2005-11-16 2008-05-07 华为技术有限公司 一种协议测试装置及测试方法
CN108696481A (zh) * 2017-04-07 2018-10-23 北京京东尚科信息技术有限公司 漏洞检测方法和装置
CN111865928A (zh) * 2020-06-29 2020-10-30 中国人民解放军战略支援部队信息工程大学 一种拟态交换机的安全性测试装置及测试方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110231935A1 (en) * 2010-03-22 2011-09-22 Tenable Network Security, Inc. System and method for passively identifying encrypted and interactive network sessions
CN110324311A (zh) * 2019-05-21 2019-10-11 平安科技（深圳）有限公司 漏洞检测的方法、装置、计算机设备和存储介质
CN110881043A (zh) * 2019-11-29 2020-03-13 杭州迪普科技股份有限公司 一种web服务器漏洞的检测方法及装置
CN111294345A (zh) * 2020-01-20 2020-06-16 支付宝(杭州)信息技术有限公司 一种漏洞检测方法、装置及设备

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884854A (zh) * 2022-06-30 2022-08-09 成都星联芯通科技有限公司 信关站服务器报文测试方法、装置、存储介质及电子设备
CN115001863A (zh) * 2022-07-26 2022-09-02 浙江涂鸦智能电子有限公司 网络安全漏洞检测方法、装置、介质和电子设备
CN115001863B (zh) * 2022-07-26 2022-11-22 浙江涂鸦智能电子有限公司 网络安全漏洞检测方法、装置、介质和电子设备
CN115378709A (zh) * 2022-08-23 2022-11-22 南方电网科学研究院有限责任公司 基于weblogic的自动化渗透测试方法和装置
CN118573464A (zh) * 2024-07-08 2024-08-30 国家工业信息安全发展研究中心 工控系统安全漏洞的测试方法、系统、设备及介质

Also Published As

Publication number Publication date
CN114584330A (zh) 2022-06-03

Similar Documents

Publication Publication Date Title
WO2022100020A1 (zh) 漏洞测试方法及装置
US11616690B2 (en) Discovery of virtualization environments
CN109067914B (zh) Web服务的代理方法、装置、设备及存储介质
US11457080B1 (en) Service mesh management
US11303647B1 (en) Synthetic request injection to disambiguate bypassed login events for cloud policy enforcement
KR102046700B1 (ko) 메시지 버스 서비스 디렉토리
US11985168B2 (en) Synthetic request injection for secure access service edge (SASE) cloud architecture
US11757944B2 (en) Network intermediary with network request-response mechanism
US11831683B2 (en) Cloud object security posture management
US11271972B1 (en) Data flow logic for synthetic request injection for cloud security enforcement
US11159576B1 (en) Unified policy enforcement management in the cloud
US11271973B1 (en) Synthetic request injection to retrieve object metadata for cloud policy enforcement
US11336698B1 (en) Synthetic request injection for cloud policy enforcement
US11848949B2 (en) Dynamic distribution of unified policies in a cloud-based policy enforcement system
US11647052B2 (en) Synthetic request injection to retrieve expired metadata for cloud policy enforcement
US9936027B2 (en) Methods, systems, and computer readable media for application session sharing
US12015619B2 (en) Dynamic routing of access request streams in a unified policy enforcement system
US11777993B2 (en) Unified system for detecting policy enforcement issues in a cloud-based environment
WO2023151264A1 (zh) 负载均衡方法、装置、节点及存储介质
CN109120556B (zh) 一种云主机访问对象存储服务器的方法及系统
US20220012110A1 (en) Networking-related system call interception and modification
WO2022165061A1 (en) Unified policy enforcement management in the cloud
WO2023021306A1 (en) Systems and methods for data linkage and entity resolution of continuous and un-synchronized data streams
WO2022267564A1 (zh) 报文处理方法、装置、设备、系统及可读存储介质
US11503038B1 (en) Policy enforcement and visibility for IaaS and SaaS open APIs

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21890555

Country of ref document: EP

Kind code of ref document: A1