# US 2021/0243216 A1 · Penetration tests of systems under test > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243216 A1 - Document ID: US20210243216A1 - Status: Published application - Kind: A1 - Application number: 16/776,881 - Filed: 2020-01-30 - Published: 2021-08-05 - Earliest claimed: 2020-01-30 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Suhas Shivanna; Supriya Kamthania; Nishant Rawtani; Anoop Chandra Bidugalu Nagesh; Ragashree Mysuru Chandrashekar - Web page: https://patentgrep.com/patent/US20210243216A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - G06F 11/3684: {for test design, e.g. generating new test cases} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some examples, a system receives information traffic communicated over a network by or with a system under test (SUT), and analyzes the information traffic to identify a potential attack point in the SUT and a technology used by the SUT. The system determines a collection of penetration tests for testing a stack comprising a plurality of layers associated with the SUT based on the identified potential attack point and the identified technology, and further based on a dynamic knowledge base that includes information relating to vulnerabilities and threats. ## Claims ### Claim 1 A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to: receive information traffic communicated over a network by or with a system under test (SUT); analyze the information traffic to identify a potential attack point in the SUT and a technology used by the SUT; and determine a collection of penetration tests for testing a stack comprising a plurality of layers associated with the SUT based on the identified potential attack point and the identified technology, and further based on a dynamic knowledge base that includes information relating to vulnerabilities and threats. ### Claim 2 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified potential attack point comprises an interface of the SUT that employs an unsecured communication protocol. ### Claim 3 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified potential attack point comprises a component of the SUT that employs a clear text credential. ### Claim 4 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified potential attack point comprises a design violation in data communications. ### Claim 5 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified potential attack point comprises a potential malware that has infected the SUT. ### Claim 6 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified technology comprises a client and server communication protocol used by a client and the SUT. ### Claim 7 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified technology comprises a type of interface of the SUT. ### Claim 8 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the identified technology comprises a technology stack of the SUT. ### Claim 9 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the knowledge base correlates different technologies to different vulnerabilities and threats, and wherein the determining of the collection of penetration tests is based on information of a given vulnerability or threat retrieved from the dynamic knowledge base, the given vulnerability or threat correlated by the dynamic knowledge base to the identified technology. ### Claim 10 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the knowledge base identifies trending vulnerabilities and threats, and wherein the determining of the collection of penetration tests for testing the SUT is based on at least one vulnerability or threat of the trending vulnerabilities and threats. ### Claim 11 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the knowledge base specifies a protection used by a technology against a vulnerability or threat, and wherein the determining of the collection of penetration tests does not test for the vulnerability or threat responsive to the knowledge base specifying that the identified technology as identified by the analyzing of the information traffic has the protection against the vulnerability or threat. ### Claim 12 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the determining of the collection of penetration tests comprises selecting a test plan from a test toolkit that includes a plurality of different test plans correlated to different combinations of vulnerabilities, threats, technologies, product types, and communication protocols. ### Claim 13 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to: receive profile information of the SUT, the profile information indicating a penetration test mode of a plurality of penetration test modes to be used for the SUT, wherein the determining of the collection of penetration tests is further based on the penetration test mode indicated by the profile information. ### Claim 14 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to: receive profile information of the SUT, the profile information indicating a risk level of a plurality of risk levels for the SUT, wherein the determining of the collection of penetration tests is further based on the risk level indicated by the profile information. ### Claim 15 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to: discover, based on the analyzing of the information traffic, a role name in the SUT, wherein the determining of the collection of penetration tests is further based on the role name. ### Claim 16 (depends on 1) The non-transitory machine-readable storage medium of claim 1, wherein the instructions upon execution cause the system to: perform the collection of penetration tests; and determine a further penetration test based on the identified technology, the further penetration test to perform lateral movement to a further machine in the network. ### Claim 17 A system comprising: a processor; and a non-transitory machine-readable storage medium storing instructions executable on the processor to: receive information traffic communicated over a network by or with a system under test (SUT); receive profile information of the SUT, the profile information indicating a penetration test mode for the SUT; analyze the information traffic to identify a technology used by the SUT; and determine a collection of penetration tests for testing the SUT based on the identified technology and the penetration test mode indicated by the profile information, and further based on a dynamic knowledge base that includes information relating to vulnerabilities and threats. ### Claim 18 (depends on 17) The system of claim 17, wherein the knowledge base correlates different technologies to different vulnerabilities and threats, and specifies a protection used by a technology against a vulnerability or threat, and wherein the determining of the collection of penetration tests for testing the SUT is based on information of a first vulnerability or threat retrieved from the dynamic knowledge base, the first vulnerability or threat correlated by the dynamic knowledge base to the identified technology, and wherein the determining of the collection of penetration tests for testing the SUT does not test for a second vulnerability or threat responsive to the knowledge base specifying that the identified technology as identified by the analyzing of the information traffic has the protection against the second vulnerability or threat. ### Claim 19 A method performed by a system comprising a hardware processor, comprising: receiving information traffic communicated over a network by or with a system under test (SUT); analyzing the information traffic to identify a technology stack and a communication protocol used by the SUT; and determining a collection of penetration tests for testing the SUT based on the identified technology stack and the identified communication protocol, and further based on a dynamic knowledge base that includes information relating to vulnerabilities and threats, wherein the determining of the collection of penetration tests for testing the SUT is based on information of a first vulnerability or threat retrieved from the dynamic knowledge base, the first vulnerability or threat correlated by the dynamic knowledge base to the identified technology stack, and wherein the determining of the collection of penetration tests for testing the SUT does not test for a second vulnerability or threat responsive to the knowledge base specifying that the identified technology stack as identified by the analyzing of the information traffic has the protection against the second vulnerability or threat. ### Claim 20 (depends on 19) The method of claim 19, wherein the knowledge base identifies trending vulnerabilities and threats, correlates different technologies to different vulnerabilities and threats, and specifies a protection used by a technology against a vulnerability or threat.