Journal of University of Chinese Academy of Sciences >
Automatic penetration test framework based on unified data format mechanism
Received date: 2010-09-01
Revised date: 2010-11-08
Online published: 2011-09-15
Backtrack4 is a highly evaluated penetration test platform. It contains large database of security tool collection up-to-date, but it can not work efficiently without data supporting. We propose a penetration test framework (PTF) with unified data format mechanism, which can accomplish penetration testing automatically and efficiently. Tools are used automatically for information detection, vulnerability assessment, and report createment. Real network experiments show that PTF can highly enhance the effectiveness of penetration test using Backtrack4.
WEN Guan-Xing , ZHANG Yuan-Chao , ZHANG Yu-Qing . Automatic penetration test framework based on unified data format mechanism[J]. Journal of University of Chinese Academy of Sciences, 2011 , 28(5) : 676 -683 . DOI: 10.7523/j.issn.2095-6134.2011.5.016
[1] Offensive Security. BackTrack Linux . http://www.backtrack-linux.org/.
[2] Fyodor. The art of port scanning . Phrack Magazine, 1997, 7(51): Article 11 .http: //nmap.org/nmap_doc.html.
[3] Deraison R. The nessus attack scripting language reference guide .(2000) http://www.virtualblueness.net/nasl.html.
[4] McNab C. Network security assessment
[M]. O’Reilly Media, 2007.
[5] Kwon O H, Lee S M, Lee H, et al. HackSim: An automation of penetration testing for remote buffer overflow vulnerabilities //Information Networking - Convergence in Broadband and Mobile Networking-International Conference. 2005.
[6] Lee J. Exploit Automation with the Metasploit Framework . BlackHat-DC-2010-Egypt, 2010.
[7] Blyth A. An XML-based architecture to perform data integration and data unification in vulnerability assessments
[J]. Information Security Technical Report, 2003, 8(4):14-25.
[8] Open Information Systems Security Group. ISSAF . . http://www.oissg.org/downloads/issaf/.
[9] Pete Herzog. Open Source security testing methodology manual . . http://www.isecom.org/osstmm/.
[10] InSecure. Nmap data standard . . http://www.insecure.org/nmap/data/nmap.dtd.
[11] Juanma M P. Nessus XMLRPC implementation in Ruby . http://nessus-xmlrpc.rubyforge.org/.
/
| 〈 |
|
〉 |