CN111291382B - Vulnerability Scanning System - Google Patents

Abstract

The invention provides a vulnerability scanning system, which is used for carrying out vulnerability scanning on address asset information of a user and automatically generating a corresponding security report file to be checked by the user, and is characterized by comprising the following steps: at least one user terminal, which is held by users with different account information; and the scanning server is in communication connection with the user terminal, wherein the user terminal comprises a user side picture storage part and a user side input display part, the scanning server comprises a vulnerability scanning part, a report template storage part, a scanning task generation part and a service side communication part, and the user side picture storage part stores a scanning request picture and a report inquiry picture.

Description

Vulnerability Scanning System

technical field

The invention belongs to the field of Internet security, in particular to a vulnerability scanning system.

Background technique

With the rapid development and expansion of Internet business, the traditional business boundaries have gradually blurred, and the various businesses of the enterprise are intertwined with each other. The loopholes in the enterprise website and system have also become more and more with the rapid development of the enterprise business. The more, the security risks are rising sharply, and the information security risks faced by enterprises are becoming more and more serious. At the same time, the intrusion methods of attackers are constantly strengthening. When these vulnerabilities are exploited by attackers, it will bring direct huge losses to enterprises.

In order to detect vulnerabilities in websites and systems, traditional vulnerability scanning methods use different scanning tools to scan. Common scanning tools include nmap, nessus, and awvs.

However, the above-mentioned vulnerability scanning tools can only scan a single vulnerability, such as scanning ports, web vulnerabilities, and host vulnerabilities. These scanning tools are of mixed quality and have many types of functions. Therefore, testers need to spend a lot of labor costs to detect the vulnerabilities of websites and systems. At the same time, due to the gap in strength between testers, problems such as scanning errors and omissions occur.

Further, after the scan is completed, the tester also needs to perform a security analysis and write a security report according to the scan result, which will also cause a workload to the tester.

SUMMARY OF THE INVENTION

In order to solve the above problems, a vulnerability scanning system is provided that integrates various types of scanning tools, and at the same time allows users to input addresses to be detected and required scanning types to automatically complete vulnerability scanning and report generation. The vulnerability scanning system adopts the following technical solutions :

The present invention provides a vulnerability scanning system, which is used to perform vulnerability scanning on a user's address asset information and automatically generate a corresponding security report file for the user to view. The user holds the information; and the scan server is connected in communication with the user terminal, wherein the user terminal includes a user-side screen storage unit and a user-side input display unit, and the scan server includes a vulnerability scanning unit, a report template storage unit, and a scan task generation unit And the service-side communication part, the user-side screen storage part stores the scan request screen and the report query screen, the report template storage part stores the preset report template for generating the security report file, and the vulnerability scanning part includes many different types and uses. For domain name scanners for security scanning of domain names and various types of IP scanners for security scanning of IP, the input display part on the user side displays a scan request screen for the user to input information including domain name information to be scanned, IP information and a scan request indicating the scan type to be performed, and send the scan request to the scan server. Once the scan server receives the scan request, the scan job generation unit generates the domain name information for assigning domain name information based on the scan type information. The domain name scanning task for the corresponding domain name scanner and the IP scanning task for allocating IP information to the corresponding IP scanner to complete the task assignment operation. The domain name scanner performs vulnerability scanning on the corresponding domain name information when receiving the domain name scanning task. Thereby, the domain name vulnerability scanning result is generated, and the scanning IP information including the scanned IP information is sent to the scanning task generation unit. When receiving the IP scanning task, the IP scanner performs vulnerability scanning on the corresponding IP information to generate the IP vulnerability scanning result. , and send the scan domain name information including the scanned domain name information to the scan task generation unit, and the scan task generation unit generates new scan request, scan IP information and scan domain name information based on the scan request, scan IP information and scan domain name information when receiving the scan IP information and scan domain name information. Once the domain name scan tasks and IP scan tasks assigned by the scan task generation section have been scanned, the security report generation section based on the report template, all domain name vulnerability scan results and all IP vulnerabilities The scanning result generates a safety report file, the service-side communication part sends the safety report file to the corresponding user terminal according to the account information, and the user-side input display part displays the received safety report file on the report query screen for the user to view.

The vulnerability scanning system provided by the present invention may also have such technical features, wherein the vulnerability scanning unit further includes a subdomain blaster for blasting subdomains of the domain name, and the scanning task generation unit performs a task assignment operation based on the scanning type information When receiving the domain name scanning task, the sub-domain blaster will perform sub-domain blasting on the corresponding domain name information to obtain the blasting domain name information containing multiple sub-domain information of the corresponding domain name information and It is sent to the scanning task generation unit, and upon receiving the blasting domain name information, the scanning task generation unit allocates a new domain name scanning task to the corresponding domain name scanner based on the scan request and the blasting domain name information.

The vulnerability scanning system provided by the present invention may also have such technical features, wherein, the scanning task generating unit includes: a duplicate checking unit for checking all domain name information and IP information for duplicates and removing duplicate domain name information and IP information The domain name distribution unit is used to distribute the domain name information after the deduplication to the corresponding domain name scanner according to the scan type information to form a domain name scan task; The IP task distribution unit is used to distribute the IP information after the deduplication according to the scan type information An IP scan task is formed for the corresponding IP scanner; the task buffer unit is used for buffering the domain name scan task and the IP scan task being allocated to the domain name scanner and the IP scanner.

The vulnerability scanning system provided by the present invention may also have such technical features, wherein, the security report generation unit includes: a standard information storage unit, which stores preset vulnerability security standard information; a risk level generation unit, based on the vulnerability security standard information, All domain name vulnerability scanning results and IP vulnerability scanning results generate a risk level score; the vulnerability information acquisition unit obtains the corresponding vulnerability description information and solution suggestion information from the vulnerability security standard information based on all domain name vulnerability scanning results and IP vulnerability scanning results. The report generation unit imports all domain name vulnerability scan results, all IP vulnerability scan results, risk level scores and vulnerability information into the corresponding location of the report template to complete the generation of the security report file.

The vulnerability scanning system provided by the present invention may also have such technical features, wherein each type of domain name scanner or IP scanner includes a plurality of scanners of the same type set in a cluster.

The vulnerability scanning system provided by the present invention may also have such technical features, further comprising: a management terminal held by the administrator and connected to the scanning server in communication, wherein the management terminal includes a management-side screen storage unit and a management-side input display unit part, the management side screen storage part stores the scanner management screen, and the management side input display part displays the status of all domain name scanners and IP scanners in the vulnerability scanning part in the scanner management screen, so that the administrator can monitor the domain name scanners and IP scanners. Scanner usage status or number of clusters are managed.

Invention action and effect

According to the vulnerability scanning system of the present invention, since the scanning server is provided with a vulnerability scanning section including a plurality of different types of domain name scanners and IP scanners, and a scanning task generating section for assigning scanning tasks, the scanning server receives When the user makes a scanning request, the domain name information and IP information to be scanned can be sent to the corresponding scanner for scanning and the corresponding vulnerability scanning results can be obtained. It has the effect of freely conducting the required vulnerability analysis according to the different needs of users. At the same time, because the security report generation department automatically generates security report files based on report templates and all vulnerability scanning results, it also solves the tedious problem of manually writing reports. The vulnerability scanning system of the present invention can complete 80% of penetration tests and automate reports, while reducing the burden of analysts to write reports, making up for the technical gap between engineers, and forming a system of security testing services and security testing toolsets , so as to efficiently complete the penetration test.

Further, through the vulnerability scanning system of the present invention, the user can send a scanning request to the scanning server through the user terminal and obtain the returned security report file, so it is also convenient for the user to take the initiative to perform security scanning, and it is more beneficial for the user to perform security scanning on his own network assets. effective protection.

Description of drawings

1 is a structural block diagram of a vulnerability scanning system in an embodiment of the present invention;

2 is a structural block diagram of a scan server in an embodiment of the present invention;

3 is an exemplary diagram of a safety report file in an embodiment of the present invention;

Fig. 4 is the processing flow chart of scanning server in the embodiment of the present invention;

5 is a structural block diagram of a user terminal in an embodiment of the present invention; and

FIG. 6 is a structural block diagram of a management terminal in an embodiment of the present invention.

Detailed ways

In order to make the technical means, creation features, achievement goals and effects of the present invention easy to understand, the following describes the vulnerability scanning system of the present invention in detail with reference to the embodiments and the accompanying drawings.

<Example>

FIG. 1 is a structural block diagram of a vulnerability scanning system in an embodiment of the present invention.

As shown in FIG. 1 , the vulnerability scanning system 100 includes a scanning server 101 , a plurality of user terminals 102 , a management terminal 103 and a communication network 104 .

Among them, the scanning server 101 is held by a service provider that provides vulnerability scanning services, the user terminal 102 is a smart terminal (such as a computer, a smart phone, etc.) held by users with different user accounts, and the management terminal 103 is the reason for the scanning server. 101 A computer owned by an administrator who manages and manages user information. In this embodiment, the vulnerability scanning system 100 adopts a B/S architecture, the communication network 104 is the World Wide Web, and the user can use a browser on the user terminal 102 so that the user terminal 2 sends a request or obtains information to the scanning server 101 through the communication network 3. The scan server 101 and the administrator terminal 103 are communicatively connected through a data cable (in other embodiments, the scan server 101 and the administrator terminal 103 may also be connected through a communication network such as a local area network).

FIG. 2 is a structural block diagram of a scan server in an embodiment of the present invention.

As shown in FIG. 2, the scan server 101 includes a report template storage unit 11, a scan task generation unit 12, a vulnerability scanning unit 13, a scan result storage unit 14, a security report generation unit 15, a system communication unit 16, and a System control unit 17 .

Among them, the system communication unit 16 is used for data communication between various components of the vulnerability scanning system 100 and between the vulnerability scanning system 100 and other systems. A computer program for controlling each component of the vulnerability scanning system 100 is stored in the system control unit 17 .

The report template storage unit 11 stores a report template for generating a safety report file.

In this embodiment, the report template is a safety report template with a preset format. When generating the safety report file, the computer fills in the obtained information correspondingly in the preset position of the report template to complete the generation of the report file.

The scan task generation unit 12 is used to perform a task assignment operation on the vulnerability scan unit 13 .

In this embodiment, the user may send a scan request to the scan server 1 through the user terminal 2, where the scan request includes domain name information, IP information, scan type information, and account information of the corresponding user. Among them, the domain name information and IP information are the address information to be scanned, and the scanning server 1 completes the security detection of the user's web application and the host by performing vulnerability scanning on these address information; the scanning type information corresponds to the specific scanning method that the user needs to perform, Corresponding to the type of each scanner in the vulnerability scanning unit 13 of this embodiment; the account information is information such as the account name, IP address and other information of each user, and the scanning server 1 identifies the user's identity and communicates with the user terminal 2 through the account information. .

When the scan server 101 receives the scan request sent by the user, the scan task generation unit 12 will assign the domain name information and IP information to the corresponding scanner under the vulnerability scan unit 13 according to the scan type information to complete the task assignment operation. At the same time, when each scanner performs a scanning task, the domain name information or IP information obtained by scanning will also be returned to the scanning task generating unit 12, and the task assignment operation will be performed again. In this embodiment, the scanning task generating unit 12 specifically includes a duplicate checking unit 121 , a domain name assigning unit 122 , an IP task assigning unit 123 and a task buffering unit 124 .

The duplicate checking unit 121 is configured to check duplicates of all received domain name information and IP information and remove duplicate domain name information and IP information.

In this embodiment, the duplicate checking unit 121 checks all the scanning requests and the domain name information and IP information obtained by scanning under one scanning request, so as to prevent the scanner from performing repeated scanning operations.

The domain name assigning unit 122 is configured to assign the domain name information after deduplication to the corresponding domain name scanner according to the scan type information, so as to form a domain name scan task.

The IP task assignment unit 123 is configured to assign the deduplicated IP information to the corresponding IP scanner according to the scan type information to form an IP scan task.

The task buffering unit 124 is used for buffering the domain name scan tasks and IP scan tasks that are being allocated to the domain name scanner and the IP scanner.

In this embodiment, the task buffer unit 124 uses RabbitMQ to scan tasks for domain names and IP scan tasks, so as to avoid problems such as missed processing and error processing caused by too many scanning tasks to be allocated at the same time.

The vulnerability scanning unit 13 is used to perform vulnerability scanning operations on domain name information and IP information, including sub-domain name blasters, multiple domain name scanners, and multiple IP scanners.

In this embodiment, the sub-domain name blaster is used to blast the sub-domain name information on the domain name information, so as to obtain various sub-domain names under the corresponding domain name. Domain name scanners are used to perform security scans on corresponding web applications based on domain name information, including scanners such as Awvs for popular security vulnerability detection and Whatweb for web fingerprinting. IP scanners are used to perform security scans on corresponding ports and hosts based on IP information, including scanners such as Nessus for host vulnerability detection and Nmap for port scanning. The above types of scanners are common vulnerability scanning related tools, and are used to perform different processing operations, which will not be repeated here.

After the vulnerability scanning unit 13 receives the scanning task, the specific processing procedures of each scanner are as follows:

When receiving the domain name scan task, the subdomain blaster performs subdomain blasting on the corresponding domain name information to obtain blasted domain name information including multiple subdomain information corresponding to the domain name information, and sends the blasted domain name information to the scan task generation unit 12 .

When receiving the domain name scanning task, the domain name scanner performs vulnerability scanning on the corresponding domain name information to generate a domain name vulnerability scanning result, and sends the scanning IP information including the scanned IP information to the scanning task generating unit 12 .

When receiving the IP scanning task, the IP scanner performs vulnerability scanning on the corresponding IP information to generate an IP vulnerability scanning result, and sends the scanning domain name information including the scanned domain name information to the scanning task generating unit 12 .

In this embodiment, the blasting domain name information, scanning IP information and scanning domain name information scanned by each scanner of the vulnerability scanning unit 13 will be sent to the scanning task generating unit 12 for duplicate checking and task assignment, so as to ensure that all domain names and IP addresses been fully scanned.

In addition, in the vulnerability scanning unit 13 of this embodiment, a plurality of scanners of the same type can be set in a cluster setting, so that when there are too many scanning tasks to be processed by the scanners of this type, parallel processing is used to speed up the process. The processing speed of the scan task.

The scan result storage unit 14 is configured to store the domain name vulnerability scan result and the IP vulnerability scan result scanned by the vulnerability scan unit 13 in correspondence with the corresponding domain name information and IP information.

The security report generation unit 15 is configured to generate a corresponding security report file according to the domain name vulnerability scan result and the IP vulnerability scan result scanned by the vulnerability scan unit 13 .

In this embodiment, the security report generation unit 15 includes a standard information storage unit 151 , a risk level generation unit 152 , a vulnerability information acquisition unit 153 , and a report generation unit 154 .

The standard information storage unit 151 stores preset vulnerability security standard information.

In this embodiment, the vulnerability security standard information is a conventional security standard for analyzing various types of vulnerabilities and problems, such as web standards: owasp top 10, international standard open wasp top 10, etc. As a result, the vulnerability security standard information is retrieved to obtain the corresponding vulnerability detailed description and solution suggestions.

The risk level generating unit 152 generates a risk level score based on the vulnerability security standard information, all domain name vulnerability scan results and IP vulnerability scan results.

In this embodiment, the risk level generating unit 152 may search the international standard open wasptop 10 according to the vulnerability scanning result, so as to obtain the level corresponding to the scanned vulnerability, so as to define a corresponding score according to the level, for example, "low risk" , "medium risk", "high risk", etc.

The vulnerability information acquiring unit 153 acquires vulnerability information including corresponding vulnerability description information and solution suggestion information from vulnerability security standard information based on all domain name vulnerability scanning results and IP vulnerability scanning results.

The report generating unit 154 is configured to import all domain name vulnerability scanning results, all IP vulnerability scanning results, risk level scores and vulnerability information into corresponding positions of the report template to complete the generation of the security report file.

In this embodiment, taking the vulnerability scanning of the website address whose domain name information is "http://xxxx.cn/" as an example, a schematic diagram of a finally generated security report file is shown in Figure 3. In Figure 3, a The information in the area is the risk level score generated by the risk level generating unit 152, the information in the b area and the e area are the vulnerability description information and the solution suggestion information acquired by the vulnerability information acquisition unit 153 respectively, and the information in the c area is the corresponding domain name information (or IP information), and the d area is the vulnerability scanning result obtained by the vulnerability scanning unit 13 scanning “http://xxxx.cn/”. The report generating unit 154 can obtain the corresponding security report file by filling the risk level score, vulnerability description information, solution suggestion information, domain name information (IP information) and vulnerability scanning results into the corresponding positions shown in FIG. 3 in the report template.

Further, if multiple domain name information and IP information are scanned during the scanning process, each domain name information and IP information will generate a corresponding report as shown in Figure 3, and all reports form a security report file.

FIG. 4 is a process flow chart of a scan server in an embodiment of the present invention.

As shown in the figure, after the scan server 1 obtains the scan request sent by the user terminal 2, the following steps are started:

Step S1, the scanning task generation unit 12 performs a task assignment operation on each scanner of the vulnerability scanning unit 13, and then proceeds to step S2;

In step S2, each scanner performs corresponding processing on the respective scanning tasks to obtain the vulnerability scanning result, and then proceeds to step S3. At the same time, the domain name information and IP information obtained during the scanning process will be fed back to the scanning task generation unit 12 to pass step S1. Assign tasks again;

Step S3, the scanning result storage unit 14 stores the vulnerability scanning results obtained by each scanner respectively and corresponding domain name information or IP information, and then enters step S4;

Step S4, the security report generation unit 15 generates a corresponding security report file according to the vulnerability scan result, and then enters step S5;

In step S5, the system communication unit 16 sends the security report file to the corresponding user terminal 2 according to the account information in the scan request, and then enters the end state.

FIG. 5 is a structural block diagram of a user terminal in an embodiment of the present invention.

As shown in FIG. 5 , the user terminal 102 includes a user-side screen storage unit 21 , a user-side input display unit 22 , a user-side communication unit 23 , and a user-side control unit 24 .

Among them, the user-side communication unit 23 is used to perform data communication between various components of the user terminal 102 and between the user terminal 102 and other terminals or servers. The user-side control unit 24 stores a computer program for controlling each component of the user terminal 102 .

In this embodiment, the user needs to log in to the user terminal 102 by entering a user name and password to perform corresponding operations. At this time, the user name and password input by the user will be stored in the user terminal 102 as the user's account information.

The user-side screen storage unit 21 stores an operation selection screen, a scan request screen, and a report inquiry screen.

The operation selection screen is used for displaying when the user enters the system of the user terminal 102 so as to allow the user to select a corresponding operation and enter the corresponding screen.

The scan request screen is displayed when the user selects a scan request operation and allows the user to input a scan request in this screen.

In this embodiment, the scan request screen displays input boxes corresponding to domain name information and IP information respectively, and option boxes corresponding to each scan type. The scan type of each option box corresponds to each scanner in Scan Server 1, respectively. After the user completes the input and selection, the user terminal 102 packages the input domain name information, IP information, scan type information and the current user's account information into a scan request and sends it to the scan server 1 through the user-side communication unit 23 .

In addition, when the user inputs the domain name information and the IP information, the user can also input only one of the information, so as to perform vulnerability scanning only on the domain name or the IP.

The report query screen is used to display when the user selects the query report operation, and displays the names of all the security report files received by the user terminal 2 in this screen so that the user can select one for detailed viewing.

In this embodiment, the names of the safety report files are displayed in the report query screen in the form of a list, and after the user selects one, the specific content of the safety report file is displayed to the user for detailed viewing.

The user-side input display unit 22 is used to display the above-mentioned screens, so that the user can complete the corresponding human-computer interaction through these screens.

FIG. 6 is a structural block diagram of a management terminal in an embodiment of the present invention.

As shown in FIG. 6 , the management terminal 103 includes a management-side screen storage unit 31 , a management-side input display unit 32 , a management-side communication unit 33 , and a management-side control unit 34 .

Among them, the management-side communication unit 33 is used to perform data communication between various components of the management terminal 103 and between the management terminal 103 and other terminals or servers. The management-side control unit 34 stores a computer program for controlling each component of the management terminal 103 .

The management-side screen storage 31 stores an operation selection screen, a scanner management screen, and an account management screen.

The operation selection screen is displayed when the administrator enters the system of the management terminal 103 so as to allow the user to select a corresponding operation and enter the corresponding screen.

The scanner management screen is displayed when the administrator selects the scanner management operation, and the scanners owned by the vulnerability scanning unit 13 are displayed on the screen so that the administrator can manage them.

In this embodiment, when displaying the scanner management screen, the management terminal 103 acquires the working status of all the scanners from the scan server 1 in real time, and displays them on the scanner management screen. When managing through this screen, specifically, the administrator can choose to disable a certain type of scanner to maintain or update the scanner, or choose to import a new type of scanner and update the vulnerability scanning unit 13. At the same time, you can also set the number of cluster settings for a certain type of scanner, so as to adjust the working efficiency of this type of scanner.

The account management screen is used to display when the administrator selects the account management operation, and displays the account information of all users in this screen to allow the administrator to manage.

In this embodiment, the scanning server 1 also stores account information of all users, and the management terminal 103 acquires the account information of all users from the scanning server 1 in real time when displaying the account management screen, and displays the account information on the account management screen. In this embodiment, since the management of user accounts is the same as the conventional technology, details are not described here.

Example function and effect

According to the vulnerability scanning system provided in this embodiment, since the scanning server is provided with a vulnerability scanning unit including a plurality of different types of domain name scanners and IP scanners, and a scanning task generating unit for assigning scanning tasks, the When receiving the scanning request from the user, it can send the domain name information and IP information to be scanned to the corresponding scanner for scanning and obtain the corresponding vulnerability scanning result, which not only realizes various types of vulnerability scanning for various domain names and IPs, Moreover, the effect of freely performing the required vulnerability analysis according to the different needs of users is realized. At the same time, because the security report generation department automatically generates security report files based on report templates and all vulnerability scanning results, it also solves the tedious problem of manually writing reports. The vulnerability scanning system of this embodiment can complete 80% of penetration tests and automate reports, which not only reduces the burden of analysts to write reports, but also bridges the technical gap between engineers and forms a security testing service and a security testing tool set into one system to efficiently complete penetration testing.

Further, through the vulnerability scanning system of this embodiment, the user can send a scanning request to the scanning server through the user terminal and obtain the returned security report file, so it is also convenient for the user to take the initiative to perform security scanning, which is more beneficial for the user to monitor their own network assets. effective protection.

In addition, in the embodiment, since the scanning task generation unit has a duplicate checking unit, a domain name assignment unit, an IP task assignment unit and a task buffer unit, the duplicate checking unit can avoid repeated scanning of the unified domain name or IP, resulting in Waste of system resources. At the same time, after the domain name allocation unit and the IP task allocation unit allocate the scan tasks, the scan tasks are buffered by the task buffer unit, so that the decoupling between the scan task generation department and the vulnerability scan department is realized, avoiding the need for When there are too many scanning tasks, the scanner's work may be confused.

In addition, in the embodiment, since each type of scanner can be clustered with multiple scanners of the same type, when a certain scanner usually has many scanning tasks, the number of clusters of the scanner can be increased to improve its parallel processing The ability to further improve the overall efficiency of the vulnerability scanning system.

The above embodiments are only used to illustrate specific embodiments of the present invention, and the present invention is not limited to the description scope of the above embodiments.

For example, in the above embodiment, the security report file generated by the security report generation unit in the scan server is directly sent to the user terminal for the user to view. In other solutions of the present invention, the security report file can also be sent to analysts for analysis and review before being sent to the user terminal, so that errors and omissions in the security report file are corrected, and the security report file is further reviewed by the analysts. The report file is sent to the user terminal. Through such a solution, it is possible to avoid abnormal problems such as errors, omissions, language errors, etc. in the security report file generated by the computer, so that the user can receive a more complete security report file.

At the same time, in the above embodiment, the security report generating unit generates a security report file containing a risk level based on the vulnerability security standard information and the vulnerability scanning result of the vulnerability scanning unit. In other solutions of the present invention, the risk level can also be generated by each scanner (some scanners have their own risk analysis function), and the security report generating unit can directly generate a security report file containing the risk level according to the existing risk level.

For another example, in the above embodiment, the scan request only includes domain name information, IP information, scan type information and account information, and the scan server performs corresponding vulnerability scan processing according to the scan request. In other solutions of the present invention, the scan request may also include a scan time, so that the user can set the scan time, the scan server temporarily stores the scan request after receiving the scan request, and starts the corresponding vulnerability when the scan time is triggered Scan processing. Through such a solution, the user can set the scan execution time more flexibly, so as to realize the effect of staggering the peak period of the business system.

Claims (6)

1. A vulnerability scanning system is used for vulnerability scanning of address asset information of a user and automatically generating a corresponding security report file to be checked by the user, and is characterized by comprising the following steps:

at least one user terminal held by the users having different account information, respectively; and

a scanning server in communication connection with the user terminal,

wherein the user terminal comprises a user side picture storage part and a user side input display part,

the scanning server comprises a vulnerability scanning part, a report template storage part, a scanning task generation part and a service side communication part,

the user side picture storage part stores a scanning request picture and a report inquiry picture,

the report template storage part stores a preset report template for generating the safety report file,

the vulnerability scanning section includes a plurality of different types of domain name scanners for securely scanning domain names and a plurality of different types of IP scanners for securely scanning IPs,

the user side input display part displays the scanning request picture to allow the user to input a scanning request including domain name information to be scanned, IP information to be scanned, and scanning type information indicating a type of scanning to be performed and to transmit the scanning request to the scanning server,

upon the scan server receiving the scan request, the scan job generation section generates a domain name scan job for assigning the domain name information to a corresponding domain name scanner and an IP scan job for assigning the IP information to a corresponding IP scanner based on the scan type information to complete a job assignment operation,

the domain name scanner scans corresponding domain name information for loophole when receiving the domain name scanning task so as to generate a domain name loophole scanning result, and sends scanning IP information containing the scanned IP information to the scanning task generating part,

the IP scanner scans corresponding IP information for loophole when receiving the IP scanning task so as to generate an IP loophole scanning result, and sends scanning domain name information containing the scanned domain name information to the scanning task generating part,

the scan job generating unit generates a new domain name scan job and a new IP scan job based on the scan request, the scan IP information, and the scan domain name information, respectively, upon receiving the scan IP information and the scan domain name information,

once the domain name scanning task and the IP scanning task assigned by the scanning task generating part are all scanned, the security report generating part generates the security report file based on the report template, all the domain name vulnerability scanning results and all the IP vulnerability scanning results,

the service side communication part sends the safety report file to the corresponding user terminal according to the account information,

the user-side input display unit displays the received security report file on the report inquiry screen for the user to view.

2. The vulnerability scanning system of claim 1, wherein:

wherein the vulnerability scanning part also comprises a sub-domain name blaster for performing sub-domain name blasting on the domain name,

the scan job generating section may further allocate the domain name scan job to the sub domain name blaster when the job allocation operation is performed based on the scan type information,

the sub domain name blaster performs sub domain name blasting on the corresponding domain name information when receiving the domain name scanning task to obtain blasting domain name information containing a plurality of sub domain name information corresponding to the domain name information and sends the blasting domain name information to the scanning task generating part,

the scan task generating unit, upon receiving the blasting domain name information, allocates new domain name scan tasks to the corresponding domain name scanners based on the scan request and the blasting domain name information, respectively.

3. The vulnerability scanning system of claim 1, wherein:

wherein the scan job generating section includes:

the duplication checking unit is used for carrying out duplication checking on all the domain name information and the IP information and removing repeated domain name information and IP information;

a domain name distribution unit, configured to distribute the domain name information from which the duplication is removed to the corresponding domain name scanner according to the scanning type information, so as to form the domain name scanning task;

the IP task allocation unit is used for allocating the IP information after the repetition is removed to the corresponding IP scanner according to the scanning type information so as to form the IP scanning task;

a task buffering unit for buffering the domain name scanning task and the IP scanning task which are being allocated to the domain name scanner and the IP scanner.

4. The vulnerability scanning system of claim 1, wherein:

wherein the security report generation section includes:

the standard information storage unit stores preset vulnerability security standard information;

a risk level generation unit which generates a risk level score based on the vulnerability security standard information, all the domain name vulnerability scanning results and the IP vulnerability scanning results;

the vulnerability information acquisition unit is used for acquiring vulnerability description information and vulnerability solution suggestion information from the vulnerability security standard information based on all the domain name vulnerability scanning results and the IP vulnerability scanning results;

and the report generation unit is used for importing all the domain name vulnerability scanning results, all the IP vulnerability scanning results, the risk grade scores and the vulnerability information into corresponding positions of the report template so as to complete the generation of the safety report file.

5. The vulnerability scanning system of claim 1, wherein:

wherein each type of the domain name scanner or the IP scanner includes a plurality of scanners of the same type arranged in a cluster.

6. The vulnerability scanning system of claim 5, further comprising:

a management terminal held by an administrator and communicatively connected with the scan server,

wherein the management terminal comprises a management side screen storage part and a management side input display part,

the management-side screen storage section stores a scanner management screen,

the management side input display part displays the states of all the domain name scanners and the IP scanners in the vulnerability scanning part in the scanner management screen so that the administrator can manage the using states or the cluster number of the domain name scanners and the IP scanners.

Images