基于Docker的漏洞验证框架的设计与实现

Design and implementation of vulnerability verification framework based on Docker

漏洞是信息安全研究的重要对象,但目前漏洞种类繁多,验证方法复杂。针对搭建安全漏洞环境困难、复现漏洞困难的问题,基于Docker虚拟化技术,设计了一种将漏洞环境部署在容器中,并使用相应漏洞利用脚本实现验证的框架系统。此框架系统验证过程需要提供Dockerfile文件或Docker镜像以及相匹配的漏洞验证脚本。首先,系统运行一个拥有漏洞程序的Docker容器。然后,框架再调用与此漏洞相匹配的验证或攻击脚本来验证漏洞可用性。经过测试,此系统可以大幅提高漏洞复现速度,同时降低了漏洞复现难度与技术门槛。

Vulnerability is an important object in the research of information security,but there are many kinds of vulnerabilities at present,and the verification is complex.In view of the difficulties of building security vulnerabilities and the difficulties of vulnerabilities reappearing,a framework system is designed to deploy vulnerabilities in containers based on Docker virtualization technology,and the corresponding verification script is used to implement the framework system.The framework system verification process needs to provide Dockerfile file or Docker mirrors,as well as matching vulnerability verification scripts.Firstly,the system runs a Docker container with a vulnerability program.The framework then calls the verification or attack scripts that match the vulnerability to verify the availability.After testing,the system can greatly improve the speed of the vulnerabilities recovery,and reduce the difficulty and the technical threshold for the reappearing of the vulnerabilities.