AI重塑渗透测试：智能用例生成新未来

# 基于大语言模型的渗透测试用例生成示例
# 运行环境：Python 3.8+, pip install openai langchain pandas

import os
import json
import pandas as pd
from langchain.chat_models import ChatOpenAI
from langchain.prompts import ChatPromptTemplate
from langchain.output_parsers import StructuredOutputParser, ResponseSchema

# 配置大语言模型（这里使用OpenAI的GPT模型作为示例）
# 实际应用中，您可以根据需要选择其他大语言模型
llm = ChatOpenAI(
    temperature=0.7,  # 控制生成内容的随机性，值越高越随机
    model_name="gpt-4",  # 使用的模型名称
    openai_api_key=os.getenv("OPENAI_API_KEY")  # 从环境变量获取API密钥
)

# 定义响应格式
response_schemas = [
    ResponseSchema(name="test_case_id", description="测试用例ID"),
    ResponseSchema(name="test_case_name", description="测试用例名称"),
    ResponseSchema(name="test_objective", description="测试目标"),
    ResponseSchema(name="attack_vector", description="攻击向量"),
    ResponseSchema(name="test_steps", description="测试步骤，以列表形式表示"),
    ResponseSchema(name="expected_result", description="预期结果"),
    ResponseSchema(name="severity", description="漏洞严重程度，如High、Medium、Low"),
]

output_parser = StructuredOutputParser.from_response_schemas(response_schemas)
format_instructions = output_parser.get_format_instructions()

# 定义测试用例生成提示模板
prompt_template = ChatPromptTemplate.from_template(
    """
你是一名经验丰富的渗透测试工程师，擅长为各种Web应用生成高质量的渗透测试用例。
请根据以下信息，为目标Web应用生成渗透测试用例：

Web应用类型：{app_type}
主要功能：{main_features}
技术栈：{tech_stack}
已知的业务流程：{business_flows}

请生成针对{target_vulnerability}的渗透测试用例。

请按照以下格式输出结果：
{format_instructions}
"""
)

# 生成渗透测试用例
def generate_penetration_test_cases(app_info, target_vulnerability, num_cases=5):
    test_cases = []
    
    for i in range(num_cases):
        # 创建提示
        prompt = prompt_template.format_prompt(
            app_type=app_info["app_type"],
            main_features=app_info["main_features"],
            tech_stack=app_info["tech_stack"],
            business_flows=app_info["business_flows"],
            target_vulnerability=target_vulnerability,
            format_instructions=format_instructions
        )
        
        # 调用大语言模型生成测试用例
        response = llm(prompt.to_messages())
        
        try:
            # 解析输出结果
            parsed_output = output_parser.parse(response.content)
            test_cases.append(parsed_output)
        except Exception as e:
            print(f"解析测试用例{i+1}失败: {e}")
            print(f"原始响应: {response.content}")
    
    return test_cases

# 评估测试用例质量
def evaluate_test_cases(test_cases):
    evaluation_results = []
    
    for i, test_case in enumerate(test_cases):
        # 简单的质量评估指标（实际应用中可以根据需要扩展）
        quality_score = 0
        
        # 检查必填字段是否齐全
        required_fields = ["test_case_id", "test_case_name", "test_objective", 
                          "attack_vector", "test_steps", "expected_result", "severity"]
        
        missing_fields = [field for field in required_fields if field not in test_case]
        if not missing_fields:
            quality_score += 50
        else:
            print(f"测试用例{i+1}缺少字段: {missing_fields}")
        
        # 检查测试步骤是否详细
        if "test_steps" in test_case and isinstance(test_case["test_steps"], list) and len(test_case["test_steps"]) > 3:
            quality_score += 30
        
        # 检查严重程度是否合理
        if "severity" in test_case and test_case["severity"] in ["High", "Medium", "Low"]:
            quality_score += 20
        
        evaluation_results.append({
            "test_case_id": test_case.get("test_case_id", f"unknown_{i+1}"),
            "quality_score": quality_score
        })
    
    return evaluation_results

# 主函数
def main():
    # 示例Web应用信息（实际应用中，这些信息可以从应用程序分析中自动获取）
    app_info = {
        "app_type": "金融交易平台",
        "main_features": "用户注册、登录、账户管理、资金转账、投资交易",
        "tech_stack": "Java Spring Boot后端，React前端，MySQL数据库",
        "business_flows": "用户注册→身份验证→充值→交易→提现"
    }
    
    # 目标漏洞类型
    target_vulnerability = "SQL注入"
    
    # 生成测试用例
    print(f"正在生成针对{target_vulnerability}的渗透测试用例...")
    test_cases = generate_penetration_test_cases(app_info, target_vulnerability, num_cases=3)
    
    # 评估测试用例质量
    print("\n正在评估测试用例质量...")
    evaluation_results = evaluate_test_cases(test_cases)
    
    # 输出结果
    print("\n生成的渗透测试用例：")
    for i, test_case in enumerate(test_cases):
        print(f"\n测试用例{i+1}:")
        print(json.dumps(test_case, indent=2, ensure_ascii=False))
    
    print("\n测试用例质量评估结果：")
    for result in evaluation_results:
        print(f"测试用例{result['test_case_id']}: 质量得分{result['quality_score']}/100")
    
    # 保存测试用例到CSV文件（便于后续使用和管理）
    if test_cases:
        # 将列表形式的测试步骤转换为字符串
        for test_case in test_cases:
            if isinstance(test_case["test_steps"], list):
                test_case["test_steps"] = "\n".join(test_case["test_steps"])
        
        df = pd.DataFrame(test_cases)
        df.to_csv("penetration_test_cases.csv", index=False, encoding="utf-8-sig")
        print("\n测试用例已保存到penetration_test_cases.csv文件")

if __name__ == "__main__":
    main()