{"id":37112,"date":"2019-10-31T22:15:49","date_gmt":"2019-10-31T19:15:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/http-zagolovok-alt-svc-mozhet-primenyatsya-dlya-skanirovaniya-portov-vnutrennej-seti\/"},"modified":"2019-10-31T22:15:49","modified_gmt":"2019-10-31T19:15:49","slug":"http-zagolovok-alt-svc-mozhet-primenyatsya-dlya-skanirovaniya-portov-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/http-zagolovok-alt-svc-mozhet-primenyatsya-dlya-skanirovaniya-portov-vnutrennej-seti","title":{"rendered":"HTTP header Alt-Svc can be used for scanning internal network ports","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from Boston University krijuan<\/a><\/noindex> attack method
\n(CVE-2019-11728), q\u00eb lejon<\/a><\/noindex> scan IP addresses and open network ports in the user's internal network, isolated from the external network by a firewall, or on the current system (localhost). The attack can be executed when a specially crafted page is opened in the browser. The proposed technique is based on using the HTTP header Alt-Svc<\/a><\/noindex> (HTTP Alternate Services, RFC-7838<\/a><\/noindex>). The issue manifests in Firefox, Chrome, and browsers based on their engines, including Tor Browser and Brave.<\/p>\n

Kreu i Alt-Svc-i i lejon serverit t\u00eb p\u00ebrcaktoj\u00eb nj\u00eb metod\u00eb alternative p\u00ebr t'u drejtuar n\u00eb nj\u00eb faqe dhe t'i jap\u00eb udh\u00ebzime shfletuesit p\u00ebr t\u00eb drejtuar k\u00ebrkes\u00ebn n\u00eb nj\u00eb host t\u00eb ri, p\u00ebr shembull, p\u00ebr balancimin e ngarkes\u00ebs. Po ashtu, \u00ebsht\u00eb e mundur t\u00eb specifikohet porti rrjetit p\u00ebr p\u00ebr\u00e7imin, p\u00ebr shembull, specifikimi 'Alt-Svc: http\/1.1=\"other.example.com:443\";ma=200' i thot\u00eb klientit t\u00eb lidhet me hostin other.example.org p\u00ebr t\u00eb marr\u00eb faqen e k\u00ebrkuar duke p\u00ebrdorur portin rrjet 443 dhe protokollin HTTP\/1.1. Parametri 'ma' p\u00ebrcakton koh\u00ebn maksimale t\u00eb vlefshm\u00ebris\u00eb s\u00eb ridrejtimit. P\u00ebrve\u00e7 HTTP\/1.1, protokollet e mb\u00ebshtetura p\u00ebrfshijn\u00eb HTTP\/2-over-TLS (h2), HTTP\/2-over plain text (h2c), SPDY(spdy) dhe QUIC (quic), i cili p\u00ebrdor UDP.<\/p>\n

\"HTTP<\/center><\/p>\n

To scan addresses, the attacker's site can sequentially iterate through the interesting addresses of the internal network and network ports, using the delay between repeated requests as a signature.
\nIf the redirected resource is unavailable, the browser instantly receives an RST packet in response and immediately marks the alternative service as unavailable and resets the lifetime specified in the request.
\nIf the network port is open, it takes longer to complete the connection (an attempt will be made to establish a connection with the corresponding packet exchange), and the browser will not respond instantly. <\/p>\n

P\u00ebr t\u00eb marr\u00eb informacion rreth kontrollit, sulmuesi mund menj\u00ebher\u00eb t\u00eb ridrejtoj\u00eb p\u00ebrdoruesin n\u00eb nj\u00eb faqe t\u00eb dyt\u00eb, e cila n\u00eb titullin Alt-Svc referohet n\u00eb nj\u00eb host funksional t\u00eb sulmuesit. N\u00ebse shfletuesi i klientit d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb n\u00eb k\u00ebt\u00eb faqe, at\u00ebher\u00eb mund t\u00eb mendohet se ridrejtimi i k\u00ebrkes\u00ebs s\u00eb par\u00eb t\u00eb Alt-Svc \u00ebsht\u00eb anuluar dhe hosti dhe porta e kontrolluar jan\u00eb t\u00eb paarritshme. N\u00ebse nuk ka pasur nj\u00eb k\u00ebrkes\u00eb, at\u00ebher\u00eb t\u00eb dh\u00ebnat p\u00ebr ridrejtimin e par\u00eb nuk jan\u00eb skaduar ende dhe lidhja \u00ebsht\u00eb krijuar. <\/p>\n

Metoda e specificuar gjithashtu lejon kontrollin e porteve rrjet\u00ebsore, t\u00eb cilat jan\u00eb t\u00eb listuara n\u00eb blacklistin e shfletuesit, si\u00e7 jan\u00eb portat e server\u00ebve t\u00eb post\u00ebs. Sulmi q\u00eb funksionon \u00ebsht\u00eb p\u00ebrgatitur duke p\u00ebrdorur iframe-in e vendosur n\u00eb trafik t\u00eb viktim\u00ebs dhe duke aplikuar protokollin HTTP\/2 n\u00eb Alt-Svc p\u00ebr Firefox dhe QUIC p\u00ebr skanimin e porteve UDP n\u00eb Chrome. N\u00eb Tor Browser, sulmi nuk mund t\u00eb p\u00ebrdoret n\u00eb kontekstin e rrjetit t\u00eb brendsh\u00ebm dhe localhostit, por \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr organizimin e skanimit t\u00eb fsheht\u00eb t\u00eb hosteve t\u00eb jasht\u00ebm p\u00ebrmes nyj\u00ebs dal\u00ebse t\u00eb Tor. Problemi me skanimin e porteve tashm\u00eb \u00ebsht\u00eb eliminuar<\/a><\/noindex> n\u00eb Firefox 68.<\/p>\n

Titulli Alt-Svc gjithashtu mund t\u00eb aplikohet:<\/p>\n