{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Un\u00eb skanoj Ukrain\u00ebn","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb shkurt, avstriaku Christian Haschek publikoi n\u00eb blogun e tij nj\u00eb artikull interesant me titullin \u00abUn\u00eb skenova t\u00eb gjith\u00eb Austrin\u00eb\u00bb<\/a><\/noindex>. Sigurisht, m\u00eb interesoi se \u00e7far\u00eb do ndodhte po ta p\u00ebrs\u00ebrisja k\u00ebt\u00eb hulumtim, por tani me Ukrain\u00ebn. Disa jav\u00eb p\u00ebr mbledhjen e informacionit 24 or\u00eb n\u00eb dit\u00eb, disa dit\u00eb p\u00ebr t\u00eb shkruar artikullin, dhe gjat\u00eb k\u00ebtij hulumtimi biseda me p\u00ebrfaq\u00ebsues t\u00eb ndrysh\u00ebm t\u00eb shoq\u00ebris\u00eb son\u00eb p\u00ebr t\u00eb sqaruar ose p\u00ebr t\u00eb m\u00ebsuar m\u00eb shum\u00eb. Ju lutem, p\u00ebr m\u00eb tep\u00ebr...
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nP\u00ebr mbledhjen e informacionit nuk jan\u00eb p\u00ebrdorur mjete t\u00eb ve\u00e7anta (megjith\u00ebse disa njer\u00ebz sugjeruan p\u00ebrdorimin e OpenVAS p\u00ebr ta b\u00ebr\u00eb hulumtimin m\u00eb t\u00eb plot\u00eb dhe informues). N\u00eb lidhje me sigurin\u00eb e IP-ve q\u00eb i p\u00ebrkasin Ukrain\u00ebs (m\u00eb posht\u00eb do t\u00eb shpjegoj m\u00ebnyr\u00ebn e p\u00ebrcaktimit), situata, sipas mendimit tim, \u00ebsht\u00eb mjaft e keqe (dhe me siguri m\u00eb e keqe se ajo q\u00eb ndodh n\u00eb Austri). Nuk jan\u00eb b\u00ebr\u00eb dhe nuk planifikohen p\u00ebrpjekje p\u00ebr t\u00eb shfryt\u00ebzuar server\u00ebt e vulneruesh\u00ebm t\u00eb zbuluar.<\/p>\n

S\u00eb pari: si mund t\u00eb merrni t\u00eb gjith\u00eb adresat IP q\u00eb i p\u00ebrkasin nj\u00eb vendi t\u00eb caktuar?<\/h2>\n

\nN\u00eb t\u00eb v\u00ebrtet\u00eb, \u00ebsht\u00eb shum\u00eb e thjesht\u00eb. Adresat IP nuk jan\u00eb t\u00eb gjeneruara nga vet\u00eb vendi, por i jepen atij. Prandaj, ekziston nj\u00eb list\u00eb (dhe \u00ebsht\u00eb publike) e t\u00eb gjitha vendeve dhe t\u00eb gjitha IP-ve q\u00eb i p\u00ebrkasin atyre.<\/p>\n

\u00c7dokush mund ta shkarkoj\u00eb at\u00eb<\/a><\/noindex>, dhe pastaj ta filtroj\u00eb grep Ukraine IP2LOCATION-LITE-DB1.CSV> ukraine.csv<\/p>\n

Nj\u00eb skenar i thjesht\u00eb, t\u00eb cilin e krijoi Christian<\/a><\/noindex>, lejon q\u00eb lista t\u00eb jet\u00eb n\u00eb nj\u00eb format m\u00eb t\u00eb p\u00ebrdorsh\u00ebm.<\/p>\n

Ukrain\u00ebs i p\u00ebrkasin pothuajse aq IPv4 adresash sa Austris\u00eb, m\u00eb shum\u00eb se 11 milion. 11 640 409, n\u00ebse jemi t\u00eb sakt\u00eb (p\u00ebr krahasim, n\u00eb Austri jan\u00eb 11 170 487).<\/p>\n

N\u00ebse nuk d\u00ebshironi t\u00eb luani vet\u00eb me adresat IP (dhe nuk ia vlen ta b\u00ebni k\u00ebt\u00eb!), mund t\u00eb p\u00ebrdorni sh\u00ebrbimin Shodan.io<\/a><\/noindex>.<\/p>\n

A ka n\u00eb Ukrain\u00eb makina Windows t\u00eb papatchuara q\u00eb kan\u00eb qasje t\u00eb drejtp\u00ebrdrejt\u00eb n\u00eb internet?<\/h2>\n

\nSigurisht, asnj\u00eb ukrainas i vet\u00ebdijsh\u00ebm nuk do t\u00eb hap\u00eb nj\u00eb qasje t\u00eb till\u00eb p\u00ebr kompjuter\u00ebt e tij. Apo ndoshta do?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\nJan\u00eb gjetur 5669 makina Windows me qasje t\u00eb drejtp\u00ebrdrejt\u00eb n\u00eb rrjet (n\u00eb Austri ka vet\u00ebm 1273, por edhe kjo \u00ebsht\u00eb shum\u00eb).<\/p>\n
Ups. Are there any among them that could be attacked using ETHERNALBLUE exploits, known since 2017? There were no such machines in Austria, and I hoped that none would be found in Ukraine either. Unfortunately, it\u2019s useless. 198 IP addresses have been found that did not close this \"hole\".<\/p>\n
DNS, DDoS, and the depth of the rabbit hole<\/h2>\n
\nEnough about Windows. Let's see what we have with DNS servers that are open resolvers and can be used for DDoS attacks.<\/p>\n
It works something like this. The attacker sends a small DNS request, and the vulnerable server responds to the victim with a packet that is 100 times larger. Boom! Corporate networks can go down pretty quickly from such a data volume, and for the attack, a bandwidth that a modern smartphone can provide is sufficient. And such attacks have been not uncommon<\/a><\/noindex> even on GitHub.<\/p>\n
Let's see if there are such servers in Ukraine.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nThe first step is to find those that have the open port 53. As a result, we have a list of 58,730 IP addresses, but that doesn\u2019t mean they can all be used for DDoS attacks. The second requirement must be met; they must be open resolvers.<\/p>\n
\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 dig \u0438 \u0443\u0432\u0438\u0434\u0435\u0442\u044c, \u0447\u0442\u043e \u043c\u044b \u0441\u043c\u043e\u0436\u0435\u043c \u00ab\u043d\u0430\u043a\u043e\u043f\u0430\u0442\u044c\u00bb dig + short test.openresolver.com TXT @ip.of.dns.server. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0442\u0432\u0435\u0447\u0430\u043b open-resolver-detected, \u0442\u043e \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0438. Open resolver’\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 25%, \u0447\u0442\u043e \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u043c\u043e \u0441 \u0410\u0432\u0441\u0442\u0440\u0438\u0435\u0439. \u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043e\u0431\u0449\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430, \u0442\u043e \u044d\u0442\u043e \u043e\u043a\u043e\u043b\u043e 0,02% \u0432\u0441\u0435\u0445 \u0443\u043a\u0440\u0430\u0438\u043d\u0441\u043a\u0438\u0445 IP.<\/p>\n
What else can be found in Ukraine?<\/h2>\n
\nI'm glad you asked. It's simpler (and most interesting for me personally) to look at IPs with open port 80 and what is \"running\" on them.<\/p>\n
web servers<\/h3>\n
\n260,849 Ukrainian IPs respond on port 80 (http). 125,444 addresses responded positively (200 status) to a simple GET request that your browser can send. The rest returned various errors. Interestingly, 853 servers returned a 500 status, while the rarest statuses were 407 (proxy authorization request) and the absolutely non-standard 602 (IP not in the \"whitelist\") with one response each.<\/p>\n
Apache absolutely dominates \u2014 114,544 servers use it. The oldest version I found in Ukraine is 1.3.29, released on October 29, 2003 (!!!). nginx is in second place with 61,659 servers.<\/p>\n
11 servera p\u00ebrdorin WinCE, e cila doli n\u00eb vitin 1996 dhe e pat\u00e7oi at\u00eb n\u00eb vitin 2013 (n\u00eb Austri ka vet\u00ebm 4 t\u00eb till\u00eb).<\/p>\n
Protokolli HTTP\/2 p\u00ebrdor 5,144 servera, HTTP\/1.1 \u2014 256,836, HTTP\/1 \u2014 13,491.<\/p>\n
Printerat\u2026 sepse\u2026 pse jo?<\/h3>\n
\n2 HP, 5 Epson dhe 4 Canon, t\u00eb cil\u00ebt jan\u00eb t\u00eb disponuesh\u00ebm nga rrjeti, disa prej tyre pa asnj\u00eb autorizim.<\/p>\n
\"Un\u00eb
\n <\/p>\n
kamera web<\/h3>\n
\nNuk \u00ebsht\u00eb nj\u00eb lajm q\u00eb n\u00eb Ukrain\u00eb ka SHUM\u00cb kamera web q\u00eb transmetojn\u00eb veten n\u00eb internet, t\u00eb mbledhura n\u00eb burime t\u00eb ndryshme. T\u00eb pakt\u00ebn 75 kamera transmetojn\u00eb veten n\u00eb internet pa asnj\u00eb mbrojtje. Mund t'i shikoni k\u00ebtu<\/a><\/noindex>.<\/p>\n
\"Un\u00eb
\n <\/p>\n
\u00c7far\u00eb ndodh m\u00eb tej?<\/h2>\n
\nUkraina \u00ebsht\u00eb nj\u00eb vend i vog\u00ebl, ashtu si Austria, por ka t\u00eb nj\u00ebjtat probleme si vendet e m\u00ebdha n\u00eb fush\u00ebn e IT. Ne kemi nevoj\u00eb p\u00ebr nj\u00eb kuptim m\u00eb t\u00eb mir\u00eb t\u00eb asaj q\u00eb \u00ebsht\u00eb e sigurt dhe \u00e7far\u00eb \u00ebsht\u00eb e rrezikshme, dhe prodhuesit e pajisjeve duhet t\u00eb ofrojn\u00eb nj\u00eb konfigurim fillestar t\u00eb sigurt t\u00eb pajisjeve t\u00eb tyre.<\/p>\n
P\u00ebr m\u00eb tep\u00ebr, un\u00eb po mbledh kompanit\u00eb partnere (b\u00ebhu partner<\/a><\/noindex>), t\u00eb cilat mund t'ju ndihmojn\u00eb t\u00eb siguroheni p\u00ebr integritetin e infrastruktur\u00ebs suaj IT. Hapi tjet\u00ebr do t\u00eb jet\u00eb t\u00eb b\u00ebj nj\u00eb rishikim t\u00eb siguris\u00eb s\u00eb faqeve ukrainase. Mos e humbni!
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Un\u00eb skanoj Ukrain\u00ebn | ProHoster","description":"N\u00eb shkurt, austriaku Christian Haschek publikoi n\u00eb blogun e tij nj\u00eb artikull interesant me titull \"Un\u00eb skanova t\u00eb gjith\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}