1 Security Vulnerability Lifecycle
In the penetration testing process, the core content is to find out the security loopholes in the target system and implement penetration attacks to enter the target system. The most important underlying foundation of this process is the security vulnerability (Vulnerability) existing in the target system. Security vulnerabilities refer to flaws or improper configurations in information systems that allow attackers to access or destroy systems without authorization, resulting in information systems facing security risks. A program that uses security holes to cause intrusion or damage is called penetration code (Exploit), or exploit code.
The game of offensive and defensive technologies around the life cycle of security vulnerabilities has always been an eternal topic in the security community, and a typical life cycle of security vulnerabilities includes the following seven parts: 1 Research and mining of security vulnerabilities: developed by highly skilled hackers and
infiltrators Testers carry out, mainly using methods such as source code review (white box testing), reverse engineering (grey box testing), Fuzz testing (black box testing) and other methods to dig out exploitable security loopholes in the target system.
2) Penetration code development and testing: While mining security vulnerabilities, hackers will develop proof-of-concept penetration attack code (POC) to verify whether the security vulnerabilities found actually exist and confirm whether they can be exploited 3
) Security vulnerabilities and penetration codes are circulated in closed teams: After discovering security vulnerabilities and providing penetration attack codes, the responsible "white hats" adopt a processing strategy of first notifying the manufacturer to fix it, and then proceed after the manufacturer provides the patch. Announcement: The "black hats" and "gray hats" generally share secrets in closed small-scale teams to make full use of the attack value brought by these security holes and penetration attack codes.
4) Security vulnerabilities and penetration codes begin to spread: Due to various reasons, the security vulnerabilities and penetration codes that are secretly shared among closed teams will eventually be disclosed and published on the Internet, and the "black hats" will quickly grasp them and applications, and began to spread rapidly in the security community.
5) Malicious programs appear and start to spread: "Black hats" will further develop malicious programs that are easier to use and more capable of automatic dissemination on the basis of mastering security vulnerabilities and penetration codes, and spread them through the social organization structure of the hacker community and the Internet . During this process (or before and after), the vendor completes the patch development and testing, and releases it