{"id":90406,"date":"2020-08-01T01:41:57","date_gmt":"2020-07-31T23:41:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu"},"modified":"2020-08-01T01:41:57","modified_gmt":"2020-07-31T23:41:57","slug":"chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","title":{"rendered":"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.\" src=\"\/wp-content\/uploads\/2020\/07\/f2bfcb839356ceed6ff0c8d47cec3497.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA DNS-alag\u00fat az internet domain neveinek rendszer\u00e9t a hackerek fegyver\u00e9v\u00e9 v\u00e1ltoztatja. A DNS l\u00e9nyeg\u00e9ben az internet hatalmas telefonk\u00f6nyve. Ezen fel\u00fcl a DNS egy alap protokoll, amely lehet\u0151v\u00e9 teszi az rendszergazd\u00e1k sz\u00e1m\u00e1ra, hogy lek\u00e9rdez\u00e9seket ind\u00edtsanak a DNS-szerver adatb\u00e1zis\u00e1ba. Eddig minden vil\u00e1gos. De az \u00fcgyes hackerek r\u00e1j\u00f6ttek, hogy titkos kommunik\u00e1ci\u00f3t folytathatnak a c\u00e9lsz\u00e1m\u00edt\u00f3g\u00e9ppel \u00fagy, hogy vez\u00e9rl\u0151 parancsokat \u00e9s adatokat \u00e1gyaznak bele a DNS protokollba. Ez az \u00f6tlet k\u00e9pezi a DNS-alag\u00fat alapj\u00e1t.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Hogyan m\u0171k\u00f6dik a DNS-alag\u00fat<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.\" src=\"\/wp-content\/uploads\/2020\/07\/f19bf65f1c0eba1326b5eaa4363b7c94.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMinden dolognak az interneten van egy k\u00fcl\u00f6n protokollja. A DNS viszonylag egyszer\u0171t t\u00e1mogat, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.verisign.com\/en_US\/website-presence\/online\/how-dns-works\/index.xhtml\">protokoll <\/a><\/noindex>azaz k\u00e9r\u00e9s-v\u00e1lasz t\u00edpust. Ha l\u00e1tni szeretn\u00e9, hogyan m\u0171k\u00f6dik, futtathatja az nslookup-ot \u2013 a DNS-lek\u00e9rdez\u00e9sek ind\u00edt\u00e1s\u00e1ra szolg\u00e1l\u00f3 alapvet\u0151 eszk\u00f6zt. K\u00e9rheti az IP-c\u00edmet, egyszer\u0171en megadva a k\u00edv\u00e1nt domain nevet, p\u00e9ld\u00e1ul:<\/p>\n<p><img decoding=\"async\" alt=\"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.\" src=\"\/wp-content\/uploads\/2020\/07\/0125acad0c2431eccbc0ea21b9b854fe.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEset\u00fcnkben a protokoll a domain IP-c\u00edm\u00e9vel v\u00e1laszolt. A DNS protokoll szempontj\u00e1b\u00f3l k\u00e9rtem az c\u00edmet, vagyis egy \u00fagynevezett \"A\"-t\u00edpus\u00fa lek\u00e9rdez\u00e9st. L\u00e9teznek m\u00e1s t\u00edpus\u00fa lek\u00e9rdez\u00e9sek is, amelyeket a DNS protokoll k\u00fcl\u00f6nb\u00f6z\u0151 adathalmazzal v\u00e1laszol, amivel, mint k\u00e9s\u0151bb l\u00e1tni fogjuk, a hackerek is vissza\u00e9lhetnek.<\/p>\n<p>Ak\u00e1rhogy is n\u00e9zz\u00fck, a DNS protokoll l\u00e9nyeg\u00e9ben a k\u00e9r\u00e9s tov\u00e1bb\u00edt\u00e1s\u00e1val foglalkozik a szerverre \u00e9s annak v\u00e1lasz\u00e1val vissza az \u00fcgyf\u00e9lhez. De mi lenne, ha a t\u00e1mad\u00f3 rejtett \u00fczenetet adna hozz\u00e1 a domain n\u00e9v k\u00e9r\u00e9s\u00e9hez? P\u00e9ld\u00e1ul ahelyett, hogy megadna egy teljesen leg\u00e1lis URL-t, olyan adatokat adna meg, amelyeket \u00e1t szeretne adni:<\/p>\n<p><img decoding=\"async\" alt=\"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.\" src=\"\/wp-content\/uploads\/2020\/07\/676fc6d7878912b590e315b1664565ce.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTegy\u00fck fel, hogy a t\u00e1mad\u00f3 ir\u00e1ny\u00edtja a DNS szervert. Ekkor adatokat tud \u00e1tadni \u2013 p\u00e9ld\u00e1ul szem\u00e9lyes adatokat \u2013 an\u00e9lk\u00fcl, hogy felt\u00e9tlen\u00fcl \u00e9szleln\u00e9k. V\u00e9g\u00fcl is, mi\u00e9rt lenne a DNS lek\u00e9rdez\u00e9s hirtelen illegitim? <\/p>\n<p>A szerver ir\u00e1ny\u00edt\u00e1s\u00e1val a hackerek hamis v\u00e1laszokat adhatnak, \u00e9s adatokat k\u00fcldhetnek vissza a c\u00e9lrendszernek. Ez lehet\u0151v\u00e9 teszi, hogy \u00fczeneteket tov\u00e1bb\u00edtsanak, amelyek elrejtve vannak a DNS-v\u00e1lasz k\u00fcl\u00f6nb\u00f6z\u0151 mez\u0151iben, p\u00e9ld\u00e1ul utas\u00edt\u00e1sokkal, hogy keressenek egy adott mapp\u00e1ban.<\/p>\n<p>A t\u00e1mad\u00e1s \"alag\u00fat\" r\u00e9sze abban rejlik, hogy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/powershell-obfuscation-stealth-through-confusion-part-i\/\">elrejtik <\/a><\/noindex> az adatokat \u00e9s parancsokat a megfigyel\u0151 rendszerek el\u0151l. A hackerek a base32, base64 stb. karakterk\u00e9szleteket haszn\u00e1lhatj\u00e1k, vagy ak\u00e1r titkos\u00edthatj\u00e1k az adatokat. Az ilyen k\u00f3dol\u00e1s \u00e9szrev\u00e9tlen\u00fcl elker\u00fcli az alapvet\u0151 fenyeget\u00e9s\u00e9szlel\u0151 eszk\u00f6z\u00f6ket, amelyek ny\u00edlt sz\u00f6veg alapj\u00e1n keresnek.<\/p>\n<p>\u00c9s ez a DNS-alag\u00fat!<\/p>\n<h2> A DNS-alag\u00fat t\u00e1mad\u00e1sok t\u00f6rt\u00e9nete<\/h2>\n<p>\nMindennek van egy kezdete, bele\u00e9rtve a DNS-protokoll elrabl\u00e1s\u00e1nak \u00f6tlet\u00e9t hackel\u00e9si c\u00e9lokra. Amennyire tudom, az els\u0151 ilyen t\u00e1mad\u00e1st Oskar Pearson hajtotta v\u00e9gre a Bugtraq h\u00edrlev\u00e9lben 1998 \u00e1prilis\u00e1ban. <noindex><a rel=\"nofollow\" href=\"https:\/\/groups.google.com\/forum\/#!msg\/muc.lists.bugtraq\/Myj1gKWzCAY\/QI6BrCtG7cgJ\">vita <\/a><\/noindex>2004-re a DNS-alag\u00fat bemutatt\u00e1k a Black Hat-en hackel\u00e9si m\u00f3dk\u00e9nt Dan Kaminsky el\u0151ad\u00e1s\u00e1ban. \u00cdgy az \u00f6tlet nagyon gyorsan val\u00f3di t\u00e1mad\u00e1si eszk\u00f6zz\u00e9 n\u0151tte ki mag\u00e1t.<\/p>\n<p>Ma a DNS-alag\u00fat biztos helyet foglal el a potenci\u00e1lis fenyeget\u00e9sek t\u00e9rk\u00e9p\u00e9n,<\/p>\n<p>\u00e9s az inform\u00e1ci\u00f3biztons\u00e1gi bloggerek gyakran k\u00e9rik, hogy magyar\u00e1zzuk el. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.securityweek.com\/iranian-hackers-heavily-reliant-dns-tunneling\">Hallott\u00e1l m\u00e1r a <\/a><\/noindex>Sea Turtle<\/p>\n<p>DNS-alag\u00fat fenyeget\u00e9sek <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.talosintelligence.com\/2019\/04\/seaturtle.html\">A DNS-alag\u00fat olyan, mint egy mutat\u00f3 a rossz h\u00edrek kezdet\u00e9nek szakasz\u00e1ban. Milyen h\u00edrek ezek? M\u00e1r eml\u00edtett\u00fcnk n\u00e9h\u00e1nyat, de n\u00e9zz\u00fck meg \u0151ket strukt\u00far\u00e1ltan: <\/a><\/noindex>? \u042d\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a \u2014 \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u2014 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0437\u0430\u0445\u0432\u0430\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u0446\u0435\u043b\u044c\u044e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f DNS-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u00ab\u043f\u043b\u043e\u0445\u0438\u0435\u00bb IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Google \u0438\u043b\u0438 FedEx. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0435 \u043d\u0435\u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e \u0432\u0432\u0435\u0434\u0443\u0442 \u0438\u0445 \u043d\u0430 \u0442\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445. \u042d\u0442\u043e \u043d\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e \u0441\u043a\u0432\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438.<\/p>\n<h2> Adatok ki\u00e1raml\u00e1sa (exfiltr\u00e1ci\u00f3)<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.\" src=\"\/wp-content\/uploads\/2020\/07\/368dcf4cbd442f994cb3385788f0bbd2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u2013 a hacker titokban kritikus adatokat tov\u00e1bb\u00edt a DNS-en kereszt\u00fcl. Ez ugyan nem a leghat\u00e9konyabb m\u00f3dja az inform\u00e1ci\u00f3k \u00e1tvitel\u00e9nek a c\u00e9lg\u00e9pr\u0151l, figyelembe v\u00e9ve a k\u00f6lts\u00e9geket \u00e9s a k\u00f3dol\u00e1sokat, de m\u0171k\u00f6dik, \u00e9s r\u00e1ad\u00e1sul rejtett m\u00f3don!<\/p>\n<ul>\n<li><strong>Ir\u00e1ny\u00edt\u00e1s \u00e9s kontroll (Command and Control, r\u00f6vid\u00edtve C2)<\/strong> \u2013 a hackerek a DNS-protokollt haszn\u00e1lj\u00e1k egyszer\u0171 vez\u00e9rl\u0151 parancsok k\u00fcld\u00e9s\u00e9re, mondjuk, egy<\/li>\n<li><strong>t\u00e1voli hozz\u00e1f\u00e9r\u00e9s\u0171 tr\u00f3jai program<\/strong> (Remote Access Trojan, r\u00f6vid\u00edtve RAT). <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/koadic-lol-malware-meets-python-based-command-and-control-c2-server-part-i\/\">IP-alag\u00fat DNS-en kereszt\u00fcl <\/a><\/noindex>\u2013 ez tal\u00e1n \u0151r\u00fclten hangzik, de l\u00e9teznek olyan eszk\u00f6z\u00f6k, amelyek az IP-verem megval\u00f3s\u00edt\u00e1s\u00e1t DNS-k\u00e9r\u00e9sek \u00e9s v\u00e1laszok felett hajtj\u00e1k v\u00e9gre. Ez megk\u00f6nny\u00edti az adatok \u00e1tvitel\u00e9t FTP, Netcat, ssh stb. haszn\u00e1lat\u00e1val. Rendk\u00edv\u00fcl fenyeget\u0151!<\/li>\n<li><strong>A DNS-alag\u00fat \u00e9szlel\u00e9se <\/strong>K\u00e9t f\u0151 m\u00f3dszer l\u00e9tezik a DNS vissza\u00e9l\u00e9s\u00e9nek \u00e9szlel\u00e9s\u00e9re: terhel\u00e9selemz\u00e9s \u00e9s forgalomelemz\u00e9s.<\/li>\n<\/ul>\n<p><\/p>\n<h2>terhel\u00e9selemz\u00e9s<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3.\" src=\"\/wp-content\/uploads\/2020\/07\/8e182ef5a3d5be38b27f79317008ca0f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nalkalmas f\u00e9l keres anom\u00e1li\u00e1kat az adatforgalomban, amelyek statisztikai m\u00f3dszerekkel kimutathat\u00f3k: szokatlanul kin\u00e9z\u0151 hosztnevek, DNS-rekordt\u00edpus, amelyet nem haszn\u00e1lnak t\u00fals\u00e1gosan gyakran, vagy szokatlan k\u00f3dol\u00e1s.<\/p>\n<p>Mikor <strong>forgalomelemz\u00e9s <\/strong> \u00e9rt\u00e9keli a DNS-k\u00e9r\u00e9sek sz\u00e1m\u00e1t minden domainre vonatkoz\u00f3an az \u00e1tlagos szinthez viszony\u00edtva. A DNS-alagutat haszn\u00e1l\u00f3 t\u00e1mad\u00f3k nagy mennyis\u00e9g\u0171 forgalmat fognak gener\u00e1lni a szerverre. Elm\u00e9letileg ez jelent\u0151sen meghaladhatja a norm\u00e1l DNS-\u00fczenetek cser\u00e9j\u00e9t. Ezt sz\u00fcks\u00e9ges nyomon k\u00f6vetni!<\/p>\n<p>Mikor <strong>forgalom elemz\u00e9se <\/strong>az egyes domainekhez \u00e9rkez\u0151 DNS-lek\u00e9rdez\u00e9sek sz\u00e1ma az \u00e1tlagos szinthez viszony\u00edtva. A DNS-alag\u00fatk\u00e9nt m\u0171k\u00f6d\u0151 t\u00e1mad\u00f3k jelent\u0151s forgalmat gener\u00e1lnak a szerverre, amely elm\u00e9letileg jelent\u0151sen meghaladja a norm\u00e1l DNS-\u00fczenetforgalmat. Ezt nyomon kell k\u00f6vetni! <\/p>\n<h3>DNS-alag\u00fa eszk\u00f6z\u00f6k<\/h3>\n<p>\nHa saj\u00e1t penetr\u00e1ci\u00f3s tesztet szeretne v\u00e9gezni, \u00e9s ellen\u0151rizni, hogy c\u00e9ge mennyire tudja \u00e9szlelni \u00e9s reag\u00e1lni az ilyen aktivit\u00e1sokra, t\u00f6bb eszk\u00f6z is rendelkez\u00e9sre \u00e1ll. Mindegyik\u00fck k\u00e9pes alag\u00fatozni... <em>IP-Over-DNS<\/em>:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/code.kryo.se\/iodine\/\">Iodine <\/a><\/noindex>\u2013 el\u00e9rhet\u0151 sok platformon (Linux, Mac OS, FreeBSD \u00e9s Windows). SSH-shellt hoz l\u00e9tre a c\u00e9l- \u00e9s vez\u00e9rl\u0151 sz\u00e1m\u00edt\u00f3g\u00e9p k\u00f6z\u00f6tt. \u00cdme egy j\u00f3... <noindex><a rel=\"nofollow\" href=\"https:\/\/calebmadrigal.com\/dns-tunneling-with-iodine\/\">\u00fatmutat\u00f3 <\/a><\/noindex>be\u00e1ll\u00edt\u00e1si \u00e9s haszn\u00e1lati \u00fatmutat\u00f3 Iodine-hoz.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/dankaminsky.com\/?s=ozymandns\">OzymanDNS<\/a><\/noindex> \u2013 Dan Kaminsky DNS-alag\u00fa projektje, Perl-ben \u00edrva. Ezzel SSH-n kereszt\u00fcl lehet csatlakozni.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/iagox86\/dnscat2\">DNSCat2 <\/a><\/noindex>\u2013 \"DNS-alag\u00fat, amir\u0151l nem h\u00e1nyingere van az embernek\". Titkos\u00edtott C2-csatorn\u00e1t hoz l\u00e9tre f\u00e1jlok k\u00fcld\u00e9s\u00e9re\/t\u00f6lt\u00e9s\u00e9re, shell ind\u00edt\u00e1s\u00e1ra stb.<\/li>\n<\/ul>\n<p><\/p>\n<h3>DNS-megfigyel\u0151 eszk\u00f6z\u00f6k<\/h3>\n<p>\nAz al\u00e1bbiakban n\u00e9h\u00e1ny hasznos eszk\u00f6z list\u00e1ja tal\u00e1lhat\u00f3, amelyek seg\u00edthetnek a tunel\u00e1l\u00e1si t\u00e1mad\u00e1sok \u00e9szlel\u00e9s\u00e9ben:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/hunttools.gitbooks.io\/mercenary-linux\/content\/dnshunter_module.html\">dnsHunter<\/a><\/noindex> \u2013 Python-modul, amely a MercenaryHuntFramework \u00e9s Mercenary-Linux sz\u00e1m\u00e1ra k\u00e9sz\u00fclt. .pcap f\u00e1jlokat olvas, DNS-k\u00e9relmeket von ki \u00e9s geolok\u00e1ci\u00f3t v\u00e9gez, ami seg\u00edt az elemz\u00e9sben.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.vs.uni-due.de\/wander\/reassemble_dns\/\">reassemble_dns <\/a><\/noindex>\u2013 Python-alap\u00fa eszk\u00f6z, amely .pcap f\u00e1jlokat olvas \u00e9s DNS-\u00fczeneteket elemez.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Mikro FAQ a DNS-alag\u00fat haszn\u00e1latr\u00f3l<\/h2>\n<p>\nHasznos inform\u00e1ci\u00f3k k\u00e9rd\u00e9sek \u00e9s v\u00e1laszok form\u00e1j\u00e1ban!<\/p>\n<p><strong>K: Mi az alag\u00fatoz\u00e1s?<\/strong><br \/>\n<strong>V:<\/strong> Ez egyszer\u0171en egy m\u00f3dszer az adatok megl\u00e9v\u0151 protokollon kereszt\u00fcli tov\u00e1bb\u00edt\u00e1s\u00e1ra. Az alapul szolg\u00e1l\u00f3 protokoll egy dedik\u00e1lt csatorn\u00e1t vagy alagutat biztos\u00edt, amelyet azt\u00e1n az inform\u00e1ci\u00f3 elrejt\u00e9s\u00e9re haszn\u00e1lnak, amit val\u00f3j\u00e1ban tov\u00e1bb\u00edtanak.<\/p>\n<p><strong>K: Mikor t\u00f6rt\u00e9nt az els\u0151 DNS-alag\u00fattal v\u00e9grehajtott t\u00e1mad\u00e1s?<\/strong><br \/>\n<strong>V: <\/strong> Nem tudjuk! Ha tudja, k\u00e9rj\u00fck, tudassa vel\u00fcnk. Amennyire tudom\u00e1sunk van, az els\u0151 t\u00e1mad\u00e1ssal kapcsolatos diskurzus Oscar Pirsan \u00e1ltal indult a Bugtraq levelez\u0151list\u00e1n 1998 \u00e1prilis\u00e1ban.<\/p>\n<p><strong>K: Milyen t\u00e1mad\u00e1sok hasonl\u00edtanak a DNS-alag\u00fathoz?<\/strong><br \/>\n<strong>V: <\/strong>A DNS nem az egyetlen protokoll, amelyet alag\u00fatoz\u00e1sra lehet haszn\u00e1lni. P\u00e9ld\u00e1ul a k\u00e1rt\u00e9kony programok (C2) gyakran haszn\u00e1lnak HTTP-t az interakci\u00f3s csatorna \u00e1lc\u00e1z\u00e1s\u00e1ra. A DNS-alag\u00fathoz hasonl\u00f3an a hacker elrejti az adatait, de ebben az esetben azok a web b\u00f6ng\u00e9sz\u0151 forgalm\u00e1nak t\u0171nnek, amelyek t\u00e1voli oldalra (a t\u00e1mad\u00f3 \u00e1ltal ir\u00e1ny\u00edtott) k\u00f6zel\u00edtenek. Ez \u00e9szrev\u00e9tlen maradhat a megfigyel\u0151 programok sz\u00e1m\u00e1ra, ha nem \u00e1ll\u00edtj\u00e1k be \u0151ket az... <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/tactics\/TA0011\/\">fenyeget\u00e9s \u00e9rz\u00e9kel\u00e9s\u00e9re <\/a><\/noindex>HTTP-protokollal val\u00f3 vissza\u00e9l\u00e9s hacker c\u00e9lokra.<\/p>\n<p>Szeretn\u00e9, ha seg\u00edten\u00e9nk a DNS-alag\u00fat felfedez\u00e9s\u00e9ben? Ismerkedjen meg a modulunkkal, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/products-edge\/\"> Varonis Edge <\/a><\/noindex>\u00e9s pr\u00f3b\u00e1lja ki ingyenesen <noindex><a rel=\"nofollow\" href=\"https:\/\/info.varonis.com\/demo\/ru\"> dem\u00f3b\u00f3l<\/a><\/noindex>!<br \/>\n<br \/>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0451\u043d \u0432 \u043e\u0440\u0443\u0436\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u043e\u0432. DNS \u2013 \u044d\u0442\u043e, \u043f\u043e \u0441\u0443\u0442\u0438, \u043e\u0433\u0440\u043e\u043c\u043d\u0430\u044f \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043d\u0430\u044f \u043a\u043d\u0438\u0433\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430. \u0410 \u0435\u0449\u0451 DNS \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0430\u0437\u043e\u0432\u044b\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0434\u0435\u043b\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0432 \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041f\u043e\u043a\u0430 \u0432\u0440\u043e\u0434\u0435 \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e. \u041d\u043e \u0445\u0438\u0442\u0440\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0441\u043e\u0437\u043d\u0430\u043b\u0438, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c-\u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u043f\u0443\u0442\u0451\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b DNS. \u042d\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90407,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435? \u0418\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-31T23:41:57+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-31T23:41:57+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mi az a DNS-alag\u00fat? Felfedez\u00e9si \u00fatmutat\u00f3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435? \u0418\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044e | ProHoster","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-31T23:41:57+00:00","article:modified_time":"2020-07-31T23:41:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90406","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:52:33","updated":"2022-09-29 17:04:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/90406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=90406"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/90406\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/90407"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=90406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=90406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=90406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}