New System Security Assessment Service

The contents of the evaluation for the launch of the new system are as follows:

• Vulnerability scan: An automated vulnerability scan tool is used to remotely scan hosts, network security devices, and databases.
• Port scan: Scan to see if there are dangerous open ports such as: 445, 3389, 135, 139, etc.
• Framework bugs: Check for framework bugs, such as Struts2 arbitrary code execution vulnerabilities.
• Middleware bugs: Check for middleware vulnerabilities, such as undeleted installation files, weak Tomcat/Weblogic/JBoss management console passwords, and other common vulnerability scans.
• Manual testing: Manually check for logical bugs, such as horizontal/vertical infringement, SMS bombing, parameter forgery, file upload, arbitrary password resets, etc.
• Directory analysis: Detects whether there are directory traversals, directory browsing, backup files not deleted, sensitive information leaks, etc.