The invention provides an automatic
vulnerability validation method. The method comprises the steps that firstly, validation information is collected, wherein an
active detection way is adopted for carrying out information detection, topological detection,
vulnerability detection and website
directory structure detection on a target; secondly, the validation information is packaged, wherein suspicious
vulnerability key information in
vulnerability detection results is extracted, uniform-interface modularized packaging is carried out on the data; thirdly, a validation strategy is searched for, wherein according to the suspicious vulnerability identity and variety information, an appropriate
attack script template and a vulnerability utilizing tool are selected; vulnerability validation is carried out, wherein scripts are called to be loaded into the packaged vulnerability information to carry out validation
attack, and an utilization
voucher is obtained and stored; fifthly, validation traces are removed, wherein validation
attack traces are removed, sessions are recycled; finally, a scanning report is generated. The automatic vulnerability validation method solves the problem that an existing
vulnerability scanning system is high in
false alarm rate and cannot carry out effective validation, is automatic and procedural, can automatically recognize and validate vulnerabilities, lowers the requirement for the ability of non-
professional staff and improves the vulnerability validation efficiency.