Secondary vocational network security skills competition P100 vulnerability detection

There are three methods of vulnerability detection , Respectively ：

• Direct tests (Test): Direct testing refers to the method of using vulnerability characteristics to find system vulnerabilities . To find out the common vulnerabilities in the system , The most obvious way is to try to penetrate the loophole . Penetration testing refers to the use of scripts or programs designed for vulnerability characteristics to detect vulnerabilities . According to the different infiltration methods , Tests can be divided into two different types ： Tests that can be observed directly and tests that can only be observed indirectly .

• infer (Inference): Inference refers to the method of judging whether a vulnerability exists without taking advantage of system vulnerabilities . It does not directly penetrate vulnerabilities , Just indirectly looking for evidence of the existence of vulnerabilities . The detection methods using inference methods mainly include version checking ( VersionCheck)、 Program behavior analysis 、 Operating system stack fingerprint analysis and timing analysis .

• Test with certificate (TestwithCredentials): Voucher refers to visit Ask the user name or password required by the service , Include UNIX Login permission and call from the network WindowsNT Of API The ability of . The test definition with credentials is ： In addition to the target host IP Out of address , Neither direct testing nor inference requires any other information .

Vulnerability detection

1. Via local PC Medium penetration test platform Kali For the server scenario p100_win03-20 In a semi open manner ping Scan mode and cooperate with a, The output format of scanning information is required to be xml File format , Get local area network information from the generated scan results （ for example 172.16.101.0/24） Medium survival target , With xml Format to output information to the specified file （ Using tools NMAP, Use the parameters that must be used ）, And will xml Format direction