{"id":90406,"date":"2020-08-01T01:41:57","date_gmt":"2020-07-31T23:41:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu"},"modified":"2020-08-01T01:41:57","modified_gmt":"2020-07-31T23:41:57","slug":"chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","title":{"rendered":"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij\" src=\"\/wp-content\/uploads\/2020\/07\/f2bfcb839356ceed6ff0c8d47cec3497.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNS-tunelimi e shnd\u00ebrron sistemin e emrave t\u00eb domainit n\u00eb nj\u00eb arm\u00eb p\u00ebr hakerat. DNS \u00ebsht\u00eb, n\u00eb thelb, nj\u00eb lib\u00ebr telefonik i pafund i internetit. Gjithashtu, DNS \u00ebsht\u00eb protokolli themelor q\u00eb u lejon administrator\u00ebve t\u00eb d\u00ebrgojn\u00eb k\u00ebrkesa n\u00eb baz\u00ebn e dh\u00ebnave t\u00eb serverit DNS. Deri tani duket e qart\u00eb. Por hackerat e zgjuar kuptuan se mund t\u00eb komunikojn\u00eb fshehurazi me kompjuterin e viktim\u00ebs duke vendosur komanda dhe t\u00eb dh\u00ebna n\u00eb protokollin DNS. Kjo ide q\u00ebndron n\u00eb themel t\u00eb DNS-tunelimit.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Si funksionon DNS-tunelimi<\/h2>\n<p>\n<img decoding=\"async\" alt=\"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij\" src=\"\/wp-content\/uploads\/2020\/07\/f19bf65f1c0eba1326b5eaa4363b7c94.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00c7do gj\u00eb n\u00eb internet ka protokollin e saj t\u00eb ve\u00e7ant\u00eb. Dhe DNS mb\u00ebshtet nj\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.verisign.com\/en_US\/website-presence\/online\/how-dns-works\/index.xhtml\">protokolli <\/a><\/noindex>tip k\u00ebrkes\u00eb-p\u00ebrgjigje t\u00eb relativisht thjesht\u00eb. N\u00ebse d\u00ebshironi t\u00eb shihni si funksionon, mund t\u00eb p\u00ebrdorni nslookup - mjeti kryesor p\u00ebr d\u00ebrgimin e k\u00ebrkesave DNS. Mund t\u00eb k\u00ebrkoni nj\u00eb adres\u00eb thjesht duke treguar emrin e domeneve q\u00eb ju intereson, p\u00ebr shembull:<\/p>\n<p><img decoding=\"async\" alt=\"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij\" src=\"\/wp-content\/uploads\/2020\/07\/0125acad0c2431eccbc0ea21b9b854fe.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb rastin ton\u00eb, protokolli iu p\u00ebrgjigj me adres\u00ebn IP t\u00eb domenit. N\u00eb terma t\u00eb protokollit DNS, un\u00eb b\u00ebra nj\u00eb k\u00ebrkes\u00eb p\u00ebr adres\u00ebn ose k\u00ebrkes\u00eb t\u00eb ashtuquajtur \"A\"-tipi. Ekzistojn\u00eb edhe lloje t\u00eb tjera k\u00ebrkesash, ku protokolli DNS do t\u00eb p\u00ebrgjigjej me nj\u00eb grup t\u00eb ndrysh\u00ebm fushash q\u00eb, si\u00e7 do ta shohim m\u00eb von\u00eb, mund t\u00eb p\u00ebrfitojn\u00eb hackerat.<\/p>\n<p>N\u00eb nj\u00eb form\u00eb, protokolli DNS merret me transmetimin e k\u00ebrkes\u00ebs n\u00eb server dhe p\u00ebrgjigjen e saj p\u00ebrs\u00ebri te klienti. Por, \u00e7far\u00eb ndodh n\u00ebse nj\u00eb sulmues shton nj\u00eb mesazh t\u00eb fsheht\u00eb brenda k\u00ebrkes\u00ebs p\u00ebr emrin e domainit? P\u00ebr shembull, n\u00eb vend q\u00eb t\u00eb vendosni nj\u00eb URL krejt t\u00eb ligjshme, ai do t\u00eb fus\u00eb t\u00eb dh\u00ebnat q\u00eb d\u00ebshiron t\u00eb d\u00ebrgoj\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij\" src=\"\/wp-content\/uploads\/2020\/07\/676fc6d7878912b590e315b1664565ce.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSupozoni se sulmuesi kontrollon serverin DNS. At\u00ebher\u00eb ai mund t\u00eb d\u00ebrgoj\u00eb t\u00eb dh\u00ebna \u2013 p.sh., t\u00eb dh\u00ebnat personale \u2013 dhe nuk \u00ebsht\u00eb e nevojshme t\u00eb zbulohet. N\u00eb fund t\u00eb fundit, pse nj\u00eb k\u00ebrkes\u00eb DNS mund t\u00eb b\u00ebhet di\u00e7ka t\u00eb paligjshme? <\/p>\n<p>Duke menaxhuar serverin, hackerat mund t\u00eb falsifikojn\u00eb p\u00ebrgjigjet dhe t\u00eb d\u00ebrgojn\u00eb t\u00eb dh\u00ebna p\u00ebrs\u00ebri n\u00eb sistemin e synuar. Kjo u lejon atyre t\u00eb d\u00ebrgojn\u00eb mesazhe t\u00eb fshehura n\u00ebp\u00ebrmjet fushave t\u00eb ndryshme t\u00eb p\u00ebrgjigjeve DNS n\u00eb nj\u00eb software t\u00eb keq t\u00eb infektuar, me udh\u00ebzime si p\u00ebr t\u00eb k\u00ebrkuar brenda nj\u00eb dosjeje t\u00eb caktuar.<\/p>\n<p>\"Tunelimi\" i k\u00ebsaj sulmi ka t\u00eb b\u00ebj\u00eb me <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/powershell-obfuscation-stealth-through-confusion-part-i\/\">fshehjen <\/a><\/noindex> e t\u00eb dh\u00ebnave dhe komandave nga sistemet monitoruese. Hackerat mund t\u00eb p\u00ebrdorin grupe karakteresh base32, base64 etj., ose madje t\u00eb enkriptojn\u00eb t\u00eb dh\u00ebnat. Ky kodim do t\u00eb kaloj\u00eb pa u v\u00ebn\u00eb re nga mjetet e thjeshta t\u00eb zbuloj t\u00eb dh\u00ebnat, t\u00eb cilat k\u00ebrkojn\u00eb n\u00eb tekst t\u00eb hapur.<\/p>\n<p>Dhe kjo \u00ebsht\u00eb DNS-tunelimi!<\/p>\n<h2> Historia e sulmeve p\u00ebrmes DNS-tunelimit<\/h2>\n<p>\n\u00c7do gj\u00eb ka nj\u00eb fillim, p\u00ebrfshir\u00eb iden\u00eb e kapjes s\u00eb protokollit DNS p\u00ebr q\u00ebllime haker\u00ebsh. Sa kemi arritur t\u00eb gjykojm\u00eb, sulmi i par\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/groups.google.com\/forum\/#!msg\/muc.lists.bugtraq\/Myj1gKWzCAY\/QI6BrCtG7cgJ\">diskutimi <\/a><\/noindex>i till\u00eb u krye nga Oskar Pearson n\u00eb list\u00ebn e post\u00ebs Bugtraq n\u00eb prill t\u00eb vitit 1998.<\/p>\n<p>Deri n\u00eb vitin 2004, DNS-tunelimi u prezantua n\u00eb Black Hat si nj\u00eb metod\u00eb hackeri n\u00eb prezantimin e Dan Kaminsky. K\u00ebshtu, ideja shpejt u transformua n\u00eb nj\u00eb instrument t\u00eb v\u00ebrtet\u00eb sulmi.<\/p>\n<p>Sot, DNS-tunelimi mban nj\u00eb pozit\u00eb t\u00eb sigurt n\u00eb hart\u00ebn e <noindex><a rel=\"nofollow\" href=\"https:\/\/www.securityweek.com\/iranian-hackers-heavily-reliant-dns-tunneling\">k\u00ebrc\u00ebnimeve potenciale <\/a><\/noindex>(dhe bloger\u00ebt n\u00eb fush\u00ebn e siguris\u00eb informatike shpesh k\u00ebrkojn\u00eb q\u00eb ta sqarojn\u00eb at\u00eb).<\/p>\n<p>A keni d\u00ebgjuar p\u00ebr <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.talosintelligence.com\/2019\/04\/seaturtle.html\">Sea Turtle <\/a><\/noindex>? \u042d\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a \u2014 \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u2014 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0437\u0430\u0445\u0432\u0430\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u0446\u0435\u043b\u044c\u044e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f DNS-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u00ab\u043f\u043b\u043e\u0445\u0438\u0435\u00bb IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Google \u0438\u043b\u0438 FedEx. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0435 \u043d\u0435\u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e \u0432\u0432\u0435\u0434\u0443\u0442 \u0438\u0445 \u043d\u0430 \u0442\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445. \u042d\u0442\u043e \u043d\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e \u0441\u043a\u0432\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438.<\/p>\n<h2> K\u00ebrc\u00ebnimet e DNS-tunelimit<\/h2>\n<p>\n<img decoding=\"async\" alt=\"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij\" src=\"\/wp-content\/uploads\/2020\/07\/368dcf4cbd442f994cb3385788f0bbd2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNS-tunelimi \u00ebsht\u00eb si nj\u00eb tregues i fillimit t\u00eb nj\u00eb faze t\u00eb keqe lajmesh. \u00c7far\u00eb ndodhi? Ne tashm\u00eb kemi treguar disa, por le t\u00eb i strukturojm\u00eb ato:<\/p>\n<ul>\n<li><strong>Nxjerrja e t\u00eb dh\u00ebnave (ekstraksioni)<\/strong> \u2013 hacker p\u00ebr\u00e7mon n\u00ebn z\u00eb t\u00eb dh\u00ebna kritike p\u00ebrmes DNS. Ky \u00ebsht\u00eb padyshim nj\u00eb m\u00ebnyr\u00eb e pap\u00ebrshtatshme p\u00ebr t\u00eb d\u00ebrguar informacion nga kompjuteri i viktim\u00ebs \u2014 duke pasur parasysh t\u00eb gjitha kostot dhe kodimet \u2014 por funksionon, dhe mbi t\u00eb gjitha, fshehur!<\/li>\n<li><strong>Menaxhimi dhe kontrolli (Command and Control, e shkurtuar C2)<\/strong> \u2013 hackerat p\u00ebrdorin protokollin DNS p\u00ebr t\u00eb d\u00ebrguar komanda t\u00eb thjeshta, p\u00ebr shembull, p\u00ebrmes <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/koadic-lol-malware-meets-python-based-command-and-control-c2-server-part-i\/\">trojanit t\u00eb qasjes nga distanca <\/a><\/noindex>(Remote Access Trojan, e shkurtuar RAT).<\/li>\n<li><strong>Tunelimi IP-Over-DNS <\/strong>\u2013 mund t\u00eb ting\u00eblloj\u00eb e \u00e7mendur, por ekzistojn\u00eb mjete q\u00eb zbatojn\u00eb stakun IP mbi k\u00ebrkesat dhe p\u00ebrgjigjet e protokollit DNS. Kjo e b\u00ebn d\u00ebrgimin e t\u00eb dh\u00ebnave p\u00ebrmes FTP, Netcat, ssh etj. nj\u00eb veprim relativisht t\u00eb thjesht\u00eb. Jasht\u00ebzakonisht e frikshme!<\/li>\n<\/ul>\n<p><\/p>\n<h2>Identifikimi i DNS-tunelimit<\/h2>\n<p>\n<img decoding=\"async\" alt=\"\u00c7far\u00eb \u00ebsht\u00eb tunelimi DNS? Udh\u00ebzues p\u00ebr zb\u00ebrthimin e tij\" src=\"\/wp-content\/uploads\/2020\/07\/8e182ef5a3d5be38b27f79317008ca0f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEkzistojn\u00eb dy metoda kryesore p\u00ebr zbuluar abuzimin e DNS: analiza e ngarkes\u00ebs dhe analiza e trafikut.<\/p>\n<p>N\u00eb <strong>n\u00eb analiz\u00ebn e ngarkes\u00ebs <\/strong> an\u00ebtari mbrojt\u00ebs k\u00ebrkon anomali n\u00eb t\u00eb dh\u00ebnat e transmetuara n\u00eb t\u00eb dyja drejtimet, t\u00eb cilat mund t\u00eb zbulohen me metoda statistikore: emra hostesh q\u00eb duken \u00e7uditsh\u00ebm, lloji i regjistrimit DNS, i cili nuk p\u00ebrdoret aq shpesh, ose kodimi jo standard.<\/p>\n<p>N\u00eb <strong>n\u00eb analiz\u00ebn e trafikut <\/strong>vler\u00ebsohet numri i k\u00ebrkesave DNS p\u00ebr \u00e7do domain n\u00eb krahasim me nivelin mesatarisht normal. Sulmuesit q\u00eb p\u00ebrdorin DNS-tunelimin do t\u00eb gjenerojn\u00eb nj\u00eb volum t\u00eb madh trafiku n\u00eb server. N\u00eb teori, duksh\u00ebm me m\u00eb shum\u00eb se shk\u00ebmbimi normal t\u00eb mesazheve DNS. Dhe kjo duhet t\u00eb monitorohet! <\/p>\n<h3>Mjetet p\u00ebr DNS-tunelimin<\/h3>\n<p>\nN\u00ebse d\u00ebshironi t\u00eb kryeni nj\u00eb testim t\u00eb pavarur t\u00eb siguris\u00eb dhe t\u00eb verifikoni se sa mir\u00eb kompania juaj mund t\u00eb zbuloj\u00eb dhe t\u00eb reagoj\u00eb ndaj aktiviteteve t\u00eb tilla, ka disa mjete p\u00ebr k\u00ebt\u00eb. T\u00eb gjitha ato din\u00eb t\u00eb tunelohen n\u00eb m\u00ebnyr\u00eb <em>IP-Over-DNS<\/em>:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/code.kryo.se\/iodine\/\">Iodine <\/a><\/noindex>\u2013 e disponueshme n\u00eb shum\u00eb platforma (Linux, Mac OS, FreeBSD dhe Windows). Lejon t\u00eb vendosni nj\u00eb shell SSH midis kompjuterit objektiv dhe atij t\u00eb komand\u00ebs. Ja nj\u00eb udh\u00ebzues mjaft i mir\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/calebmadrigal.com\/dns-tunneling-with-iodine\/\">udh\u00ebzues <\/a><\/noindex>p\u00ebr konfigurimin dhe p\u00ebrdorimin e Iodine.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/dankaminsky.com\/?s=ozymandns\">OzymanDNS<\/a><\/noindex> \u2013 nj\u00eb projekt DNS-tunelimi nga Dan Kaminsky, i shkruar n\u00eb Perl. Me t\u00eb mund t\u00eb lidheni p\u00ebrmes SSH.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/iagox86\/dnscat2\">DNSCat2 <\/a><\/noindex>\u2013 \"DNS-tuneli, q\u00eb nuk b\u00ebn t\u00eb vjell\u00ebsh\". Krijon nj\u00eb kanal C2 t\u00eb enkriptuar p\u00ebr d\u00ebrgimin\/shkarkimin e skedar\u00ebve, ekzekutimin e shell-ve etj.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Mjetet e monitorimit DNS<\/h3>\n<p>\nM\u00eb posht\u00eb \u00ebsht\u00eb nj\u00eb list\u00eb e disa mjeteve, q\u00eb do t\u00eb jen\u00eb t\u00eb dobishme p\u00ebr zbulimin e sulmeve me tunelim:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/hunttools.gitbooks.io\/mercenary-linux\/content\/dnshunter_module.html\">dnsHunter<\/a><\/noindex> \u2013 nj\u00eb modul Python, i shkruar p\u00ebr MercenaryHuntFramework dhe Mercenary-Linux. Lexon skedar\u00ebt .pcap, nxjerr k\u00ebrkesat DNS dhe b\u00ebn p\u00ebrputhje t\u00eb gjeolokacionit, q\u00eb ndihmon n\u00eb analiz\u00eb.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.vs.uni-due.de\/wander\/reassemble_dns\/\">reassemble_dns <\/a><\/noindex>\u2013 nj\u00eb mjet n\u00eb Python, q\u00eb lexon skedar\u00ebt .pcap dhe analizon mesazhet DNS.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Mikro FAQ p\u00ebr DNS-tunelimin<\/h2>\n<p>\nInformacione t\u00eb dobishme n\u00eb form\u00ebn e pyetjeve dhe p\u00ebrgjigjeve!<\/p>\n<p><strong>Pyetje: \u00c7far\u00eb \u00ebsht\u00eb tunelimi?<\/strong><br \/>\n<strong>O:<\/strong> Thjesht \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb transferuar t\u00eb dh\u00ebna mbi nj\u00eb protokoll ekzistues. Protokolli n\u00eb thelb siguron nj\u00eb kanal t\u00eb dedikuar ose tunel, q\u00eb pastaj p\u00ebrdoret p\u00ebr t\u00eb fshehur informacionin q\u00eb transferohet n\u00eb t\u00eb v\u00ebrtet\u00eb.<\/p>\n<p><strong>Pyetje: Kur u realizua sulmi i par\u00eb me DNS-tunelimin?<\/strong><br \/>\n<strong>O: <\/strong> Nuk e dim\u00eb! N\u00ebse e dini \u2013 ju lutemi na njoftoni. Sipas informacionit ton\u00eb, diskutimi i par\u00eb p\u00ebr sulmin u iniciua nga Oskar Pirsan n\u00eb list\u00ebn e postimeve Bugtraq n\u00eb prill 1998.<\/p>\n<p><strong>Pyetje: Cilat sulme jan\u00eb t\u00eb ngjashme me DNS-tunelimin?<\/strong><br \/>\n<strong>O: <\/strong>DNS nuk \u00ebsht\u00eb protokolli i vet\u00ebm q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr tunelimin. P\u00ebr shembull, malware p\u00ebr menaxhim dhe kontroll (C2) shpesh p\u00ebrdorin HTTP p\u00ebr t\u00eb maskuar kanalin e komunikimit. Ashtu si n\u00eb DNS-tunelimin, hacker i fsheh t\u00eb dh\u00ebnat e tij, por n\u00eb k\u00ebt\u00eb rast ato duken si trafik i zakonsh\u00ebm i nj\u00eb shfletuesi web q\u00eb i drejtohet nj\u00eb faqeje t\u00eb larg\u00ebt (t\u00eb kontrolluar nga keqb\u00ebr\u00ebsi). Kjo mund t\u00eb mbetet e padukshme p\u00ebr programet e monitorimit n\u00ebse ato nuk jan\u00eb t\u00eb konfigurura p\u00ebr t\u00eb perceptuar <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/tactics\/TA0011\/\">k\u00ebrcimin <\/a><\/noindex>shfryt\u00ebzimi i protokollit HTTP n\u00eb q\u00ebllime hakimi.<\/p>\n<p>Doni q\u00eb ne t\u00eb ndihmojm\u00eb n\u00eb zbulimin e DNS-tunelimit? Shikoni moduline ton\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/products-edge\/\"> Varonis Edge <\/a><\/noindex>dhe provoni falas <noindex><a rel=\"nofollow\" href=\"https:\/\/info.varonis.com\/demo\/ru\"> demo<\/a><\/noindex>!<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0451\u043d \u0432 \u043e\u0440\u0443\u0436\u0438\u0435 \u0445\u0430\u043a\u0435\u0440\u043e\u0432. DNS \u2013 \u044d\u0442\u043e, \u043f\u043e \u0441\u0443\u0442\u0438, \u043e\u0433\u0440\u043e\u043c\u043d\u0430\u044f \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043d\u0430\u044f \u043a\u043d\u0438\u0433\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430. \u0410 \u0435\u0449\u0451 DNS \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0430\u0437\u043e\u0432\u044b\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0434\u0435\u043b\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0432 \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041f\u043e\u043a\u0430 \u0432\u0440\u043e\u0434\u0435 \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e. \u041d\u043e \u0445\u0438\u0442\u0440\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u043e\u0441\u043e\u0437\u043d\u0430\u043b\u0438, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c-\u0436\u0435\u0440\u0442\u0432\u043e\u0439 \u043f\u0443\u0442\u0451\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b DNS. \u042d\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90407,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435? \u0418\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044e | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-31T23:41:57+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-31T23:41:57+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00c7far\u00eb \u00ebsht\u00eb DNS-tunelimi? Udh\u00ebzues p\u00ebr zbulimin | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435? \u0418\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044e | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-31T23:41:57+00:00","article:modified_time":"2020-07-31T23:41:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90406","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:52:33","updated":"2022-09-29 17:04:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=90406"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90406\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/90407"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=90406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=90406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=90406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}