{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Skanowa\u0142em Ukrain\u0119","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W lutym austriacki Christian Haschek opublikowa\u0142 na swoim blogu interesuj\u0105cy artyku\u0142 zatytu\u0142owany \u201eSkanowa\u0142em ca\u0142\u0105 Austri\u0119\u201d<\/a><\/noindex>. Oczywi\u015bcie by\u0142em ciekaw, co si\u0119 stanie, je\u015bli powt\u00f3rz\u0119 to badanie, ale z Ukrain\u0105. Kilka tygodni intensywnego zbierania informacji, jeszcze kilka dni na opracowanie artyku\u0142u, a w trakcie tego badania rozmowy z r\u00f3\u017cnymi przedstawicielami naszego spo\u0142ecze\u0144stwa, aby wyja\u015bni\u0107 pewne w\u0105tpliwo\u015bci lub dowiedzie\u0107 si\u0119 wi\u0119cej. Prosz\u0119 o przeczytanie poni\u017cej\u2026
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nDo zbierania informacji nie u\u017cywano \u017cadnych specjalnych narz\u0119dzi (cho\u0107 kilka os\u00f3b sugerowa\u0142o u\u017cycie OpenVAS, aby badanie by\u0142o bardziej kompleksowe i informacyjne). Moim zdaniem sytuacja z bezpiecze\u0144stwem IP zwi\u0105zanych z Ukrain\u0105 (o tym, jak je okre\u015blano, pisz\u0119 poni\u017cej) wygl\u0105da do\u015b\u0107 \u017ale (i na pewno gorzej ni\u017c w Austrii). \u017badne pr\u00f3by wykorzystania wykrytych podatnych serwer\u00f3w nie zosta\u0142y przeprowadzone ani nie s\u0105 planowane.<\/p>\n

Przede wszystkim: jak mo\u017cna uzyska\u0107 wszystkie adresy IP, kt\u00f3re nale\u017c\u0105 do danego kraju?<\/h2>\n

\nTo w rzeczywisto\u015bci bardzo proste. Adresy IP nie s\u0105 generowane przez sam kraj, ale przydzielane mu. Dlatego istnieje lista (i jest ona publiczna) wszystkich kraj\u00f3w i wszystkich adres\u00f3w IP, kt\u00f3re do nich nale\u017c\u0105.<\/p>\n

Ka\u017cdy mo\u017ce pobra\u0107 j\u0105<\/a><\/noindex>, a nast\u0119pnie przefiltrowa\u0107 j\u0105 grep Ukraine IP2LOCATION-LITE-DB1.CSV> ukraine.csv<\/p>\n

Prosty skrypt stworzony przez Christiana<\/a><\/noindex>, pozwala przekszta\u0142ci\u0107 list\u0119 w bardziej u\u017cyteczn\u0105 form\u0119.<\/p>\n

Ukraina ma prawie tyle samo adres\u00f3w IPv4, co Austria, ponad 11 mln. 11 640 409, je\u015bli by\u0107 dok\u0142adnym (dla por\u00f3wnania w Austrii \u2014 11 170 487).<\/p>\n

Je\u015bli nie chcesz bawi\u0107 si\u0119 w adresy IP samodzielnie (i nie ma sensu tego robi\u0107!), mo\u017cesz skorzysta\u0107 z us\u0142ugi Shodan.io<\/a><\/noindex>.<\/p>\n

Czy w Ukrainie s\u0105 niepoprawnie zabezpieczone maszyny z systemem Windows maj\u0105ce bezpo\u015bredni dost\u0119p do Internetu?<\/h2>\n

\nOczywi\u015bcie \u017caden \u015bwiadomy Ukrainiec nie otworzy\u0142by takiego dost\u0119pu dla swoich komputer\u00f3w. A mo\u017ce jednak?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\nZnaleziono 5669 maszyn z systemem Windows z bezpo\u015brednim dost\u0119pem do sieci (w Austrii by\u0142o tylko 1273, ale to r\u00f3wnie\u017c du\u017co).<\/p>\n
Ups. Are there any among them that could be attacked using ETHERNALBLUE exploits, known since 2017? There weren't any such machines in Austria, and I was hoping none would be found in Ukraine either. Unfortunately, that's pointless. 198 IP addresses were found that haven't closed this \"hole\" on their end.<\/p>\n
DNS, DDoS, and the rabbit hole depth<\/h2>\n
\nEnough about Windows. Let's see what we have with the DNS servers that are open resolvers and can be used for DDoS attacks.<\/p>\n
It works something like this. The attacker sends a small DNS request, and the vulnerable server responds to the victim with a packet that is 100 times larger. Boom! Corporate networks can crash fairly quickly from such data volume, and modern smartphones can provide the necessary bandwidth for the attack. And such attacks have been not uncommon<\/a><\/noindex> even on GitHub.<\/p>\n
Let's see if there are such servers in Ukraine.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nThe first step is to find those that have an open port 53. We end up with a list of 58,730 IP addresses, but that doesn't mean they can all be used for DDoS attacks. The second requirement is that they need to be open resolvers.<\/p>\n
Mo\u017cna to zrobi\u0107 za pomoc\u0105 prostego polecenia dig, aby zobaczy\u0107, co mo\u017cemy \"wykopa\u0107\": dig + short test.openresolver.com TXT @ip.of.dns.server. Je\u015bli serwer odpowiedzia\u0142 open-resolver-detected, mo\u017cna go uzna\u0107 za potencjalny cel ataku. Open resolvery stanowi\u0105 oko\u0142o 25%, co por\u00f3wnywalne jest z Austri\u0105. Pod wzgl\u0119dem og\u00f3lnej liczby to oko\u0142o 0,02% wszystkich ukrai\u0144skich adres\u00f3w IP.<\/p>\n
What else can be found in Ukraine?<\/h2>\n
\nGlad you asked. It\u2019s easier (and personally most interesting for me) to look for IPs with an open port 80 and see what\u2019s \"running\" on it.<\/p>\n
web servers<\/h3>\n
\n260,849 Ukrainian IPs respond on port 80 (http). 125,444 addresses responded positively (200 status) to a simple GET request that your browser can make. The rest returned various errors. Interestingly, 853 servers returned a 500 status, and the rarest statuses were 407 (proxy authorization request) and an absolutely non-standard 602 (IP not in the \"whitelist\") with one response.<\/p>\n
Apache absolutely dominates \u2014 114,544 servers use it. The oldest version I found in Ukraine is 1.3.29, released on October 29, 2003 (!!!). Nginx is in second place with 61,659 servers.<\/p>\n
11 serwer\u00f3w u\u017cywa WinCE, kt\u00f3ra wysz\u0142a w 1996 roku, a ostatnie poprawki wprowadzono w 2013 roku (w Austrii takich jest tylko 4).<\/p>\n
Protok\u00f3\u0142 HTTP\/2 wykorzystuje 5 144 serwery, HTTP\/1.1 \u2014 256 836, HTTP\/1 \u2014 13 491.<\/p>\n
Drukarki\u2026 bo\u2026 czemu nie?<\/h3>\n
\n2 HP, 5 Epson i 4 Canon, kt\u00f3re s\u0105 dost\u0119pne w sieci, niekt\u00f3re z nich bez \u017cadnej autoryzacji.<\/p>\n
\"Skanowa\u0142em
\n <\/p>\n
kamery internetowe<\/h3>\n
\nTo nie nowo\u015b\u0107, \u017ce na Ukrainie jest BARDZO du\u017co kamer internetowych, kt\u00f3re transmituj\u0105 na \u017cywo, zebranych z r\u00f3\u017cnych \u017ar\u00f3de\u0142. Co najmniej 75 kamer transmituje w internecie bez \u017cadnej ochrony. Mo\u017cna je obejrze\u0107 tutaj<\/a><\/noindex>.<\/p>\n
\"Skanowa\u0142em
\n <\/p>\n
Co dalej?<\/h2>\n
\nUkraina to ma\u0142y kraj, podobnie jak Austria, ale ma te same problemy w dziedzinie IT, co du\u017ce kraje. Musimy wypracowa\u0107 lepsze zrozumienie tego, co jest bezpieczne, a co niebezpieczne, a tak\u017ce producenci sprz\u0119tu powinni dostarcza\u0107 bezpieczn\u0105 konfiguracj\u0119 wst\u0119pn\u0105 swojego sprz\u0119tu.<\/p>\n
Ponadto zbieram firmy partnerskie (zosta\u0144 partnerem<\/a><\/noindex>), kt\u00f3re mog\u0105 pom\u00f3c zapewni\u0107 bezpiecze\u0144stwo Twojej infrastruktury IT. Nast\u0119pnym krokiem planuj\u0119 przegl\u0105d bezpiecze\u0144stwa ukrai\u0144skich stron internetowych. Nie prze\u0142\u0105czaj si\u0119!
\n
\u0179r\u00f3d\u0142o: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skanowa\u0142em Ukrain\u0119 | ProHoster","description":"W lutym austriacki Christian Haschek opublikowa\u0142 na swoim blogu interesuj\u0105cy artyku\u0142 zatytu\u0142owany \u201eSkanowa\u0142em ca\u0142\u0105.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/pl\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}