{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Ma skaneerisin Ukrainat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Veebruaris avaldas austraallane Christian Haschek oma blogis huvitava artikli pealkirjaga \u201eMa skanneerisin kogu Austria\u201c<\/a><\/noindex>. Muidugi tekitas minus huvi, mis juhtuks, kui seda uurimist\u00f6\u00f6d korrata, kuid Ukrainaga. Paari n\u00e4dala jooksul kogusin \u00f6\u00f6p\u00e4evaringselt teavet, veel paar p\u00e4eva artikli vormistamiseks ja selle uurimise k\u00e4igus vestlusi erinevate meie \u00fchiskonna esindajatega, et selgitada ja rohkem teada saada. Palun lugege edasi\u2026
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nTeabe kogumiseks ei kasutatud mingeid spetsiaalseid vahendeid (kuigi m\u00f5ned inimesed soovitasid kasutada sama OpenVAS-i, et uurimist\u00f6\u00f6d p\u00f5hjalikumaks ja informatiivsemaks muuta). Minu arvates on IP-de turvalisus, mis kuuluvad Ukrainale (allpool sellest, kuidas neid m\u00e4\u00e4rati), k\u00fcllaltki kehv (ja kindlasti halvem kui see, mis toimub Austrias). Mingit katset avastatud haavatavate serverite kasutamiseks ei ole tehtud ega plaanitud.<\/p>\n

Esiteks: kuidas saab leida k\u00f5ik IP-aadressid, mis kuuluvad konkreetsele riigile?<\/h2>\n

\nSee on tegelikult v\u00e4ga lihtne. IP-aadresse ei genereeri riik ise, vaid need jagatakse sellele. Seet\u00f5ttu on olemas nimekiri (ja see on avalik) k\u00f5igist riikidest ja k\u00f5igist IP-dest, mis neile kuuluvad.<\/p>\n

Iga\u00fcks v\u00f5ib selle alla laadida<\/a><\/noindex>, ja seej\u00e4rel filtreerida selle grep Ukraine IP2LOCATION-LITE-DB1.CSV> ukraine.csv<\/p>\n

Lihtne skript, mille on loonud Christian<\/a><\/noindex>, v\u00f5imaldab muuta nimekirja kasutatavaks.<\/p>\n

Ukrainale kuulub peaaegu sama palju IPv4-aadresse kui Austriasse, \u00fcle 11 miljoni. 11 640 409, t\u00e4pselt \u00f6eldes (v\u00f5rdluseks Austrias - 11 170 487).<\/p>\n

Kui te ei soovi ise IP-aadressidega katsetada (ja seda ei tasu teha!), siis v\u00f5ite kasutada teenust Shodan.io<\/a><\/noindex>.<\/p>\n

Kas Ukrainas on pat\u0161imata Windowsi masinaid, millel on otsene juurdep\u00e4\u00e4s internetile?<\/h2>\n

\nMuidugi ei avaks \u00fckski teadlik ukrainlane oma arvutitele sellist juurdep\u00e4\u00e4su. V\u00f5i siiski?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\n5669 Windowsi masinat on leitud, millel on otsene juurdep\u00e4\u00e4s v\u00f5rgule (Austrias on neid ainult 1273, kuid ka see on palju).<\/p>\n
Ups. Are there any among them that could be attacked using the ETHERNALBLUE exploits, which have been known since 2017? There were no such machines in Austria, and I hoped there wouldn't be any found in Ukraine either. Unfortunately, it's pointless. 198 IP addresses were found that have not closed this \"hole\".<\/p>\n
DNS, DDoS and the depth of the rabbit hole<\/h2>\n
\nThat's enough about Windows. Let's see what we have with the DNS servers that are open resolvers and can be used for DDoS attacks.<\/p>\n
It works something like this. The attacker sends a small DNS request, and the vulnerable server replies to the victim with a packet that is 100 times larger. Boom! Corporate networks can crash quite quickly from such data volumes, and for the attack, a bandwidth provided by a modern smartphone is enough. And such attacks have been not uncommon<\/a><\/noindex> even on GitHub.<\/p>\n
Let's see if there are such servers in Ukraine.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nThe first step is to find those that have an open port 53. As a result, we have a list of 58,730 IP addresses, but this does not mean they can all be used for DDoS attacks. They need to meet the second requirement, namely, they must be open resolvers.<\/p>\n
\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 dig \u0438 \u0443\u0432\u0438\u0434\u0435\u0442\u044c, \u0447\u0442\u043e \u043c\u044b \u0441\u043c\u043e\u0436\u0435\u043c \u00ab\u043d\u0430\u043a\u043e\u043f\u0430\u0442\u044c\u00bb dig + short test.openresolver.com TXT @ip.of.dns.server. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0442\u0432\u0435\u0447\u0430\u043b open-resolver-detected, \u0442\u043e \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0438. Open resolver’\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 25%, \u0447\u0442\u043e \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u043c\u043e \u0441 \u0410\u0432\u0441\u0442\u0440\u0438\u0435\u0439. \u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043e\u0431\u0449\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430, \u0442\u043e \u044d\u0442\u043e \u043e\u043a\u043e\u043b\u043e 0,02% \u0432\u0441\u0435\u0445 \u0443\u043a\u0440\u0430\u0438\u043d\u0441\u043a\u0438\u0445 IP.<\/p>\n
What else can be found in Ukraine?<\/h2>\n
\nGlad you asked. It's easier (and the most interesting for me personally) to look for IPs with an open port 80 and see what\u2019s \"running\" on it.<\/p>\n
web servers<\/h3>\n
\n260,849 Ukrainian IPs respond on port 80 (http). 125,444 addresses answered positively (status 200) to a simple GET request that your browser can send. The rest returned various errors. Interestingly, 853 servers returned status 500, and the rarest statuses were 407 (proxy authorization request) and the absolutely non-standard 602 (IP not in the \"whitelist\") with one response each.<\/p>\n
Apache absolutely dominates \u2014 114,544 servers are using it. The oldest version I found in Ukraine is 1.3.29, released on October 29, 2003 (!!!). Nginx is in second place with 61,659 servers.<\/p>\n
11 serverit kasutavad WinCE-d, mis ilmus 1996. aastal ja l\u00f5petati 2013. aastal (Austria puhul on neid vaid 4).<\/p>\n
Protokoll HTTP\/2 kasutab 5 144 serverit, HTTP\/1.1 \u2013 256 836, HTTP\/1 \u2013 13 491.<\/p>\n
Printerid\u2026 sest\u2026 miks mitte?<\/h3>\n
\n2 HP, 5 Epson ja 4 Canon, mis on v\u00f5rgu kaudu saadaval, m\u00f5ned neist ilma igasuguse autentimiseta.<\/p>\n
\"Ma
\n <\/p>\n
veebikaamerad<\/h3>\n
\nEi ole \u00fcllatus, et Ukrainas on \u00dcLI PALJU veebikaameraid, mis edastavad ennast internetis, kogutud erinevatesse ressurssidesse. V\u00e4hemalt 75 kaamerat edastavad ennast internetis ilma igasuguse kaitseta. Vaadata neid saab siin<\/a><\/noindex>.<\/p>\n
\"Ma
\n <\/p>\n
Mis edasi?<\/h2>\n
\nUkraina on v\u00e4ike riik, nagu Austria, kuid tal on samad probleemid IT valdkonnas, mis suurtel maadel. Me peame leidma parema arusaamise, mis on turvaline ja mis ohtlik, samuti peavad seadmete tootjad pakkuma oma seadmete turvalist algkonfiguratsiooni.<\/p>\n
Lisaks kogun ma partnerettev\u00f5tteid (saada partneriks<\/a><\/noindex>), mis v\u00f5ivad teid aidata tagada teie IT infrastruktuuri puutumatust. J\u00e4rgmine samm on plaanida Ukraina veebisaitide turva\u00fclevaade. P\u00fcsige lainel!
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ma skannisin Ukrainat | ProHoster","description":"Veebruaris avaldas austrialane Christian Haschek oma blogis huvitava artikli pealkirjaga \u201eMa skannisin kogu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}