{"id":90406,"date":"2020-08-01T01:41:57","date_gmt":"2020-07-31T23:41:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu"},"modified":"2020-08-01T01:41:57","modified_gmt":"2020-07-31T23:41:57","slug":"chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","title":{"rendered":"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/f2bfcb839356ceed6ff0c8d47cec3497.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNS tunelov\u00e1n\u00ed p\u0159etv\u00e1\u0159\u00ed syst\u00e9m dom\u00e9nov\u00fdch jmen na zbra\u0148 hacker\u016f. DNS je v podstat\u011b obrovsk\u00fd telefonn\u00ed seznam internetu. A tak\u00e9 je DNS z\u00e1kladn\u00edm protokolem, kter\u00fd umo\u017e\u0148uje administr\u00e1tor\u016fm pos\u00edlat dotazy na datab\u00e1zi DNS serveru. Zat\u00edm to vypad\u00e1 srozumiteln\u011b. Ale mazan\u00ed hacke\u0159i si uv\u011bdomili, \u017ee mohou tajn\u011b komunikovat s ob\u011bt\u00ed po\u010d\u00edta\u010de t\u00edm, \u017ee vlo\u017e\u00ed ovl\u00e1dac\u00ed p\u0159\u00edkazy a data do protokolu DNS. Tento n\u00e1pad le\u017e\u00ed v z\u00e1kladu DNS tunelov\u00e1n\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Jak funguje DNS tunelov\u00e1n\u00ed<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/f19bf65f1c0eba1326b5eaa4363b7c94.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro v\u0161echno na internetu existuje sv\u016fj vlastn\u00ed protokol. A DNS podporuje relativn\u011b jednoduch\u00fd <noindex><a rel=\"nofollow\" href=\"https:\/\/www.verisign.com\/en_US\/website-presence\/online\/how-dns-works\/index.xhtml\">protokol <\/a><\/noindex>typ dotaz-odpov\u011b\u010f. Pokud chcete vid\u011bt, jak to funguje, m\u016f\u017eete spustit nslookup - hlavn\u00ed n\u00e1stroj pro prov\u00e1d\u011bn\u00ed DNS dotaz\u016f. M\u016f\u017eete po\u017e\u00e1dat o adresu jednodu\u0161e t\u00edm, \u017ee uvedete dom\u00e9nov\u00e9 jm\u00e9no, kter\u00e9 v\u00e1s zaj\u00edm\u00e1, nap\u0159\u00edklad:<\/p>\n<p><img decoding=\"async\" alt=\"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/0125acad0c2431eccbc0ea21b9b854fe.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV na\u0161em p\u0159\u00edpad\u011b protokol odpov\u011bd\u011bl IP adresou dom\u00e9ny. V term\u00ednech protokolu DNS jsem provedl dotaz na adresu, nebo dotaz tzv. typu \u201eA\u201c. Existuj\u00ed i dal\u0161\u00ed typy dotaz\u016f a protokol DNS bude odpov\u00eddat s r\u016fzn\u00fdmi sadami datov\u00fdch pol\u00ed, kter\u00e9, jak uvid\u00edme pozd\u011bji, mohou zneu\u017e\u00edt hacke\u0159i.<\/p>\n<p>A\u0165 tak \u010di onak, DNS protokol se v podstat\u011b zab\u00fdv\u00e1 p\u0159enosem po\u017eadavku na server a jeho odpov\u011bd\u00ed zp\u011bt klientovi. A co kdyby \u00fato\u010dn\u00edk p\u0159idal skrytou zpr\u00e1vu do po\u017eadavku dom\u00e9nov\u00e9ho jm\u00e9na? Nap\u0159\u00edklad m\u00edsto zad\u00e1n\u00ed zcela legitimn\u00edho URL by zadal data, kter\u00e1 chce p\u0159en\u00e9st:<\/p>\n<p><img decoding=\"async\" alt=\"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/676fc6d7878912b590e315b1664565ce.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159edstavme si, \u017ee \u00fato\u010dn\u00edk ovl\u00e1d\u00e1 DNS server. Pak m\u016f\u017ee p\u0159en\u00e1\u0161et data \u2013 nap\u0159\u00edklad osobn\u00ed \u00fadaje \u2013 a nemus\u00ed b\u00fdt nutn\u011b odhalen. Konec konc\u016f, pro\u010d by m\u011bl b\u00fdt DNS dotaz n\u011b\u010d\u00edm nelegitimn\u00edm? <\/p>\n<p>Ovl\u00e1d\u00e1n\u00edm serveru mohou hacke\u0159i fal\u0161ovat odpov\u011bdi a pos\u00edlat data zp\u011bt na c\u00edlov\u00fd syst\u00e9m. To jim umo\u017e\u0148uje p\u0159en\u00e1\u0161et zpr\u00e1vy, skryt\u00e9 v r\u016fzn\u00fdch pol\u00edch DNS odpov\u011bdi, do malware na infikovan\u00e9m po\u010d\u00edta\u010di, s pokyny jako nap\u0159\u00edklad hled\u00e1n\u00ed v ur\u010dit\u00e9 slo\u017ece.<\/p>\n<p>\u010c\u00e1st t\u00e9to \u00fatoku, kter\u00e1 se naz\u00fdv\u00e1 \u201etunelov\u00e1n\u00ed\u201c, spo\u010d\u00edv\u00e1 v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/powershell-obfuscation-stealth-through-confusion-part-i\/\">skryt\u00ed <\/a><\/noindex> dat a p\u0159\u00edkaz\u016f p\u0159ed detekc\u00ed monitorovac\u00edmi syst\u00e9my. Hacke\u0159i mohou pou\u017e\u00edvat sady znak\u016f base32, base64 atd., nebo dokonce \u0161ifrovat data. Takov\u00e1 k\u00f3dov\u00e1n\u00ed projde bez pov\u0161imnut\u00ed kolem jednoduch\u00fdch detek\u010dn\u00edch n\u00e1stroj\u016f, kter\u00e9 prob\u00edraj\u00ed otev\u0159en\u00fd text.<\/p>\n<p>A to je DNS tunelov\u00e1n\u00ed!<\/p>\n<h2> Historie \u00fatok\u016f prost\u0159ednictv\u00edm DNS tunelov\u00e1n\u00ed<\/h2>\n<p>\nV\u0161echno m\u00e1 sv\u016fj za\u010d\u00e1tek, v\u010detn\u011b my\u0161lenky zneu\u017eit\u00ed protokolu DNS pro hackersk\u00e9 \u00fa\u010dely. Podle dostupn\u00fdch informac\u00ed byl prvn\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/groups.google.com\/forum\/#!msg\/muc.lists.bugtraq\/Myj1gKWzCAY\/QI6BrCtG7cgJ\">diskuze <\/a><\/noindex>takov\u00fd \u00fatok proveden Oskarem Pearsonem v diskusn\u00ed skupin\u011b Bugtraq v dubnu 1998.<\/p>\n<p>Do roku 2004 bylo DNS tunelov\u00e1n\u00ed prezentov\u00e1no na konferenci Black Hat jako hackersk\u00e1 metoda v prezentaci Dana Kaminskyho. Tak se my\u0161lenka velmi rychle prom\u011bnila v skute\u010dn\u00fd \u00fatok.<\/p>\n<p>Dnes m\u00e1 DNS tunelov\u00e1n\u00ed pevn\u00e9 m\u00edsto na map\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/www.securityweek.com\/iranian-hackers-heavily-reliant-dns-tunneling\">potenci\u00e1ln\u00edch hrozeb <\/a><\/noindex>(a bloge\u0159i zab\u00fdvaj\u00edc\u00ed se informa\u010dn\u00ed bezpe\u010dnost\u00ed jsou \u010dasto po\u017e\u00e1d\u00e1ni, aby ji vysv\u011btlili).<\/p>\n<p>Sly\u0161eli jste o <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.talosintelligence.com\/2019\/04\/seaturtle.html\">Sea Turtle <\/a><\/noindex>? \u042d\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a \u2014 \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u2014 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0437\u0430\u0445\u0432\u0430\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u0446\u0435\u043b\u044c\u044e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f DNS-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u00ab\u043f\u043b\u043e\u0445\u0438\u0435\u00bb IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Google \u0438\u043b\u0438 FedEx. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0435 \u043d\u0435\u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e \u0432\u0432\u0435\u0434\u0443\u0442 \u0438\u0445 \u043d\u0430 \u0442\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445. \u042d\u0442\u043e \u043d\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e \u0441\u043a\u0432\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438.<\/p>\n<h2> Hrozby DNS tunelov\u00e1n\u00ed<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/368dcf4cbd442f994cb3385788f0bbd2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNS tunelov\u00e1n\u00ed je jak\u00fdsi indik\u00e1tor za\u010d\u00e1tku f\u00e1ze \u0161patn\u00fdch zpr\u00e1v. Jak\u00fdch konkr\u00e9tn\u011b? Ji\u017e jsme hovo\u0159ili o n\u011bkolika, ale poj\u010fme je strukturovat:<\/p>\n<ul>\n<li><strong>\u00danik dat (exfiltrace)<\/strong> \u2013 hacker diskretne p\u0159en\u00e1\u0161\u00ed kritick\u00e1 data p\u0159es DNS. Ur\u010dit\u011b to nen\u00ed nejefektivn\u011bj\u0161\u00ed zp\u016fsob p\u0159enosu informac\u00ed z po\u010d\u00edta\u010de ob\u011bti \u2013 vzhledem k ve\u0161ker\u00fdm n\u00e1klad\u016fm a k\u00f3dov\u00e1n\u00ed \u2013 ale funguje to a nav\u00edc \u2013 skryt\u011b!<\/li>\n<li><strong>\u0158\u00edzen\u00ed a kontrola (Command and Control, zkr\u00e1cen\u011b C2)<\/strong> \u2013 hacke\u0159i vyu\u017e\u00edvaj\u00ed protokol DNS k odes\u00edl\u00e1n\u00ed jednoduch\u00fdch \u0159\u00eddic\u00edch p\u0159\u00edkaz\u016f, \u0159ekn\u011bme, prost\u0159ednictv\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/koadic-lol-malware-meets-python-based-command-and-control-c2-server-part-i\/\">trojsk\u00e9ho kon\u011b pro vzd\u00e1len\u00fd p\u0159\u00edstup <\/a><\/noindex>(Remote Access Trojan, zkr\u00e1cen\u011b RAT).<\/li>\n<li><strong>Tunelov\u00e1n\u00ed IP-Over-DNS <\/strong>\u2013 to m\u016f\u017ee zn\u00edt \u0161\u00edlen\u011b, ale existuj\u00ed n\u00e1stroje, kter\u00e9 implementuj\u00ed IP z\u00e1sobn\u00edk nad dotazy a odpov\u011b\u010fmi protokolu DNS. To usnad\u0148uje p\u0159enos dat pomoc\u00ed FTP, Netcat, ssh atd. Je to nesm\u00edrn\u011b zlov\u011bstn\u00e9!<\/li>\n<\/ul>\n<p><\/p>\n<h2>Odhalov\u00e1n\u00ed DNS tunelov\u00e1n\u00ed<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Co je DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/8e182ef5a3d5be38b27f79317008ca0f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nExistuj\u00ed dva hlavn\u00ed metody detekce zneu\u017eit\u00ed DNS: anal\u00fdza zat\u00ed\u017een\u00ed a anal\u00fdza dopravy.<\/p>\n<p>P\u0159i <strong>anal\u00fdza zat\u00ed\u017een\u00ed <\/strong> obrann\u00e1 strana hled\u00e1 anom\u00e1lie v datech p\u0159en\u00e1\u0161en\u00fdch ob\u011bma sm\u011bry, kter\u00e9 mohou b\u00fdt detekov\u00e1ny statistick\u00fdmi metodami: divn\u011b vypadaj\u00edc\u00ed n\u00e1zvy hostitel\u016f, typ DNS z\u00e1znamu, kter\u00fd se nepou\u017e\u00edv\u00e1 tak \u010dasto, nebo nestandardn\u00ed k\u00f3dov\u00e1n\u00ed.<\/p>\n<p>P\u0159i <strong>anal\u00fdza dopravy <\/strong>Hodnot\u00ed se po\u010det DNS dotaz\u016f na ka\u017edou dom\u00e9nu v porovn\u00e1n\u00ed s pr\u016fm\u011brnou \u00farovn\u00ed. \u00dato\u010dn\u00edci vyu\u017e\u00edvaj\u00edc\u00ed DNS tunelov\u00e1n\u00ed generuj\u00ed velk\u00e9 mno\u017estv\u00ed provozu na server. Teoreticky to zna\u010dn\u011b p\u0159ekra\u010duje norm\u00e1ln\u00ed v\u00fdm\u011bnu DNS zpr\u00e1v. A je pot\u0159eba to sledovat! <\/p>\n<h3>N\u00e1stroje pro DNS tunelov\u00e1n\u00ed<\/h3>\n<p>\nPokud chcete prov\u00e9st vlastn\u00ed penetra\u010dn\u00ed test a zjistit, jak dob\u0159e va\u0161e spole\u010dnost dok\u00e1\u017ee odhalit a reagovat na takovou aktivitu, existuje n\u011bkolik n\u00e1stroj\u016f. V\u0161echny um\u00ed tunelovat v re\u017eimu <em>IP-Over-DNS<\/em>:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/code.kryo.se\/iodine\/\">Iodine <\/a><\/noindex>\u2013 dostupn\u00fd na mnoha platform\u00e1ch (Linux, Mac OS, FreeBSD a Windows). Umo\u017e\u0148uje nastavit SSH shell mezi c\u00edlov\u00fdm a \u0159\u00eddic\u00edm po\u010d\u00edta\u010dem. Zde je dobr\u00fd <noindex><a rel=\"nofollow\" href=\"https:\/\/calebmadrigal.com\/dns-tunneling-with-iodine\/\">n\u00e1vody <\/a><\/noindex>n\u00e1vod k nastaven\u00ed a pou\u017eit\u00ed Iodine.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/dankaminsky.com\/?s=ozymandns\">OzymanDNS<\/a><\/noindex> \u2013 projekt DNS tunelov\u00e1n\u00ed od Dana Kaminsk\u00e9ho, napsan\u00fd v Perlu. S n\u00edm se lze p\u0159ipojit p\u0159es SSH.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/iagox86\/dnscat2\">DNSCat2 <\/a><\/noindex>\u2013 \"DNS tunel, po kter\u00e9m nen\u00ed na zvracen\u00ed\". Vytv\u00e1\u0159\u00ed \u0161ifrovan\u00fd C2 kan\u00e1l pro sd\u00edlen\u00ed\/stahov\u00e1n\u00ed soubor\u016f, spou\u0161t\u011bn\u00ed shell\u016f atd.<\/li>\n<\/ul>\n<p><\/p>\n<h3>N\u00e1stroje pro monitoring DNS<\/h3>\n<p>\nN\u00ed\u017ee je uveden seznam n\u011bkolika n\u00e1stroj\u016f, kter\u00fd bude u\u017eite\u010dn\u00fd pro detekci tunelov\u00fdch \u00fatok\u016f:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/hunttools.gitbooks.io\/mercenary-linux\/content\/dnshunter_module.html\">dnsHunter<\/a><\/noindex> \u2013 Python modul, napsan\u00fd pro MercenaryHuntFramework a Mercenary-Linux. \u010cte .pcap soubory, extrahuje DNS dotazy a prov\u00e1d\u00ed geoloka\u010dn\u00ed mapov\u00e1n\u00ed, co\u017e pom\u00e1h\u00e1 p\u0159i anal\u00fdze.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.vs.uni-due.de\/wander\/reassemble_dns\/\">reassemble_dns <\/a><\/noindex>\u2013 n\u00e1stroj v Pythonu, kter\u00fd \u010dte .pcap soubory a analyzuje DNS zpr\u00e1vy.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Mikro FAQ o DNS tunelov\u00e1n\u00ed<\/h2>\n<p>\nU\u017eite\u010dn\u00e9 informace ve form\u011b ot\u00e1zek a odpov\u011bd\u00ed!<\/p>\n<p><strong>Ot\u00e1zka: Co je tunelov\u00e1n\u00ed?<\/strong><br \/>\n<strong>Odpov\u011b\u010f:<\/strong> To je prost\u011b zp\u016fsob, jak p\u0159en\u00e1\u0161et data p\u0159es existuj\u00edc\u00ed protokol. Z\u00e1kladn\u00ed protokol zaji\u0161\u0165uje vyhrazen\u00fd kan\u00e1l nebo tunel, kter\u00fd se n\u00e1sledn\u011b pou\u017e\u00edv\u00e1 k maskov\u00e1n\u00ed informac\u00ed, kter\u00e9 se opravdu p\u0159en\u00e1\u0161ej\u00ed.<\/p>\n<p><strong>Ot\u00e1zka: Kdy byla provedena prvn\u00ed \u00fatok pomoc\u00ed DNS tunelov\u00e1n\u00ed?<\/strong><br \/>\n<strong>Odpov\u011b\u010f: <\/strong> Nev\u00edme! Pokud v\u00edte \u2013 dejte n\u00e1m pros\u00edm v\u011bd\u011bt. Podle na\u0161ich informac\u00ed byla prvn\u00ed diskuse o \u00fatoku iniciov\u00e1na Oscarem Pirsanem na mailing listu Bugtraq v dubnu 1998.<\/p>\n<p><strong>Ot\u00e1zka: Jak\u00e9 \u00fatoky jsou podobn\u00e9 DNS tunelov\u00e1n\u00ed?<\/strong><br \/>\n<strong>Odpov\u011b\u010f: <\/strong>DNS \u2013 rozhodn\u011b nen\u00ed jedin\u00fdm protokolem, kter\u00fd lze pou\u017e\u00edt pro tunelov\u00e1n\u00ed. Nap\u0159\u00edklad \u0161kodliv\u00e9 programy pro \u0159\u00edzen\u00ed a kontrolu (C2) \u010dasto pou\u017e\u00edvaj\u00ed HTTP k maskov\u00e1n\u00ed komunika\u010dn\u00edho kan\u00e1lu. Stejn\u011b jako p\u0159i DNS tunelov\u00e1n\u00ed hacker skr\u00fdv\u00e1 sv\u00e1 data, av\u0161ak v tomto p\u0159\u00edpad\u011b vypadaj\u00ed jako provoz b\u011b\u017en\u00e9ho webov\u00e9ho prohl\u00ed\u017ee\u010de, kter\u00fd se p\u0159ipojuje na vzd\u00e1lenou str\u00e1nku (ovl\u00e1danou \u00fato\u010dn\u00edkem). To m\u016f\u017ee z\u016fstat nezpozorov\u00e1no monitorovac\u00edmi programy, pokud nejsou nastaveny, aby rozpozn\u00e1valy <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/tactics\/TA0011\/\">hrozbu <\/a><\/noindex>zneu\u017eit\u00ed protokolu HTTP k hackersk\u00fdm \u00fa\u010del\u016fm.<\/p>\n<p>Chcete, abychom v\u00e1m pomohli s odhalen\u00edm DNS tunelov\u00e1n\u00ed? Seznamte se s na\u0161\u00edm modulem <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/products-edge\/\"> Varonis Edge <\/a><\/noindex>a vyzkou\u0161ejte bezplatnou <noindex><a rel=\"nofollow\" href=\"https:\/\/info.varonis.com\/demo\/ru\"> demo<\/a><\/noindex>!<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0451\u043d \u0432 \u043e\u0440\u0443\u0436\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u043e\u0432. DNS \u2013 \u044d\u0442\u043e, \u043f\u043e \u0441\u0443\u0442\u0438, \u043e\u0433\u0440\u043e\u043c\u043d\u0430\u044f \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043d\u0430\u044f \u043a\u043d\u0438\u0433\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430. \u0410 \u0435\u0449\u0451 DNS \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0430\u0437\u043e\u0432\u044b\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0434\u0435\u043b\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0432 \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041f\u043e\u043a\u0430 \u0432\u0440\u043e\u0434\u0435 \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e. \u041d\u043e \u0445\u0438\u0442\u0440\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0441\u043e\u0437\u043d\u0430\u043b\u0438, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c-\u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u043f\u0443\u0442\u0451\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b DNS. \u042d\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90407,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435? \u0418\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-31T23:41:57+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-31T23:41:57+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Co je to DNS tunelov\u00e1n\u00ed? N\u00e1vod na odhalen\u00ed | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435? \u0418\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044e | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-31T23:41:57+00:00","article:modified_time":"2020-07-31T23:41:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90406","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:52:33","updated":"2022-09-29 17:04:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/90406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=90406"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/90406\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/90407"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=90406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=90406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=90406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}