Ukuthi i-backend yegeyimu ye-hacker mayelana nokucekela phansi iseva idalwe kanjani

Ukuthi i-backend yegeyimu ye-hacker mayelana nokucekela phansi iseva idalwe kanjani
Siyaqhubeka nokukutshela ukuthi isicelo sethu se-laser ngokucekelwa phansi kweseva sahlelwa kanjani. Qala kokudlule isihloko mayelana nokuxazulula imfuno.

Sekukonke, ingemuva lomdlalo linamayunithi ezakhiwo ayi-6, esizowahlaziya kulesi sihloko:

  1. Ingemuva lamabhizinisi egeyimu abenesibopho sezinqubo zegeyimu
  2. Ibhasi lokushintshana nge-backend nesayithi ku-VPS
  3. Umhumushi osuka ezicelweni zangemuva (izakhi zegeyimu) ukuya ku-Arduino nezingxenyekazi zekhompuyutha esizeni
  4. U-Arduino, owayenomthwalo wemfanelo wokulawula ukudluliselwa, wathola imiyalo kumhumushi futhi wenza umsebenzi wangempela
  5. Amadivayisi angempela: ifeni, ama-garlands, amalambu aphansi, njll.
  6. I-Frontend - iwebhusayithi ye-Falcon ngokwayo, lapho abadlali belawula amadivayisi

Ake sidlule kuzo zonke.

Ingemuva lezinhlangano zegeyimu

I-backend yasetshenziswa njengohlelo lokusebenza lwe-spring boot: yayinezilawuli ezimbalwa zokuphumula, indawo yokugcina ye-websocket kanye nezinsizakalo ezinomqondo wegeyimu.

Kwakukhona abalawuli abathathu kuphela:

  • I-Megatron. Ikhasi lamanje le-Megatron lithunyelwe ngezicelo ze-GET: ngaphambi nangemuva kokuvula amandla. I-laser idubule ngesicelo se-POST.
  • Ukwenza imephu ye-tilde amakhasi ukuze anikezwe ngegama lekhasi. I-Tilde ikhiqiza amakhasi ukuze athekeliswe hhayi ngamagama angempela, kodwa ane-ID yangaphakathi nolwazi lokuhambisana.
  • Isilawuli se-Captcha ukuze sinikeze i-captcha yeseva engu-pseudo-high-load.

I-Websocket endpoint yayisetshenziselwa ukulawula amagajethi: amalambu, i-garland nezinhlamvu. Kukhethwe ukubonisa ngokuvumelanisa kubo bonke abadlali isimo samanje sedivayisi: noma ivuliwe noma ivaliwe, iyasebenza noma cha, imuphi umbala wohlamvu olukhanyisiwe okwamanje odongeni. Ukuze senze umsebenzi wokuvula i-laser ube nzima nakakhulu, sengeze ukugunyazwa ku-garland kanye ne-laser ngokungena ngemvume okufanayo nephasiwedi admin/admin.

Abadlali bangayivivinya ngokuvula i-garland bese bephinda okufanayo nge-laser.

Sikhethe ukubhanqwa kwephasiwedi yokungena okuncane kangako ukuze singahlukumezi abadlali ngokukhetha okungadingekile.

Ukuze wenze umsebenzi uthakazelise kancane, ama-ID ento asuka ku-mongodb asetshenziswe njengezihlonzi zedivayisi egumbini.

I-ObjectId iqukethe isitembu sesikhathi: amanani amabili angahleliwe, elilodwa lawo lithathwa ngokusekelwe kusihlonzi sedivayisi, kanti elesibili lisuselwa ku-pid yenqubo eyikhiqizayo kanye nenani eliphikisayo. Bengifuna ukwenza izihlonzi ezikhiqizwa ngezikhathi ezithile nangezinqubo ezahlukene ze-pid, kodwa ngekhawunta evamile, ukuze ukukhethwa kwesihlonzi sedivayisi ye-laser kuzothakazelisa kakhulu. Kodwa-ke, ekugcineni, wonke umuntu waqala ngezihlonzi ezazihluke kuphela ngenani eliphikisayo. Lokhu kungenzeka kwenze isinyathelo saba lula kakhulu futhi singadingi ukuhlaziywa kwesakhiwo se- objectId.

Umhumushi ovela ezicelweni ezingemuva

Isikripthi sePython, osebenze ngezibali sikhathi futhi wazihumusha zisuka ezintweni ezifushanisiwe zemidlalo zaba imodeli ebonakalayo. Isibonelo, "vula isibani saphansi" β†’ "vula i-relay N2."

Umbhalo oxhunywe kulayini we-RabbitMQ futhi wadlulisela izicelo ezisuka kulayini ziye ku-Arduino. Iphinde yasebenzisa umqondo wokushintshwa kokukhanya okuhambisanayo: kanye namanye amadivaysi, ukukhanya kuwo kwakhanyiswa, isibonelo, lapho amandla enikezwa iMegatron ekuqaleni, ayekhanyiswa ngokukhanya kwesiteji. Idizayini yokukhanyisa ye-cinematography yendawo yonke iyindaba ehlukile mayelana nomsebenzi omkhulu womdidiyeli wethu wephrojekthi kanye nomklami wokukhiqiza u-Ilya Serov, futhi sizokutshela ngakho kokuthunyelwe okuhlukile.

Umhumushi uphinde waba nesibopho somqondo wokwethula i-shredder esebenzisa isibali sikhathi futhi adlulisele isithombe ku-TV: isibali sikhathi sokuqalisa i-shredder, i-capybara ekhalayo, intengiso ekupheleni komdlalo.

Indlela enengqondo yokukhiqiza ithokheni ye-Megatron yakhiwe kanjani

Isibhamu sokuhlola

Njalo kumasekhondi angu-25 ithokheni entsha yayikhiqizwa futhi yayingasetshenziswa ukuvula i-laser imizuzwana engu-10 ngamandla angu-10/255. Xhumanisa ne github ngekhodi ye-Megatron.

Ilaser ibe isipholile iminithi elingu-1 - ngalesi sikhathi ibingatholakali futhi ayizange yamukele izicelo zokudutshulwa.

Lawa mandla ayenganele ukuthi ashise ngentambo, kodwa noma yimuphi umdlali wayengadubula iMegatron futhi abone ugongolo lwe-laser lusebenza.

I-algorithm ye-MD5 hashing yasetshenziswa ukwenza ithokheni. Laphumelela ke iqhinga I-MD5 evela ku-MD5 + counter + imfihlo ukuze uthole ithokheni yokulwa futhi ngaphandle kwemfihlo yethokheni yokuhlola.

I-MD5 iyireferensi yephrojekthi yezohwebo eyenziwa nguPavel, umsizi wethu ongemuva. Eminyakeni embalwa edlule le phrojekthi yasebenzisa i-MD5, futhi lapho etshela umakhi wephrojekthi ukuthi i-algorithm yokubethela ephelelwe yisikhathi, baqala ukusebenzisa i-MD5 evela ku-MD5. Njengoba sinqume ukwenza iphrojekthi ye-noob kakhulu ibe nokwenzeka, wakhumbula yonke into futhi wanquma ukwenza inkomba encane.

Isibhamu sokulwa

Imodi yokulwa ye-Megatron ingamandla e-laser angu-100% kuma-watts angu-3. Lokhu kwanele imizuzu emi-2 ukushisa ngentambo ebambe isisindo, ukuphula i-aquarium futhi ukhukhule iseva ngamanzi.

Sishiye amacebo ambalwa ku-Github yephrojekthi: okungukuthi, ikhodi yokukhiqiza amathokheni, lapho umuntu angaqonda khona ukuthi amathokheni okuhlola nokulwa akhiqizwa ngokusekelwe kunkomba efanayo yokubala. Endabeni yethokheni yokulwa, ngaphezu kwenani le-counter value, usawoti ubuye usetshenziswe, cishe oshiywe ngokuphelele emlandweni wokushintsha le ngqikithi, ngaphandle kwezinhlamvu ezimbili zokugcina.

Ukwazi le datha, bekungenzeka ukuhlunga ngezimpawu zokugcina ezi-2 zikasawoti futhi empeleni uthole ukuthi izinombolo ezisuka ku-Lost, eziguqulelwe ohlelweni lwe-hexadecimal, zasetshenziselwa yona.

Bese-ke abadlali bekumele babambe inani eliphikisayo (ngokuhlaziya ithokheni yokuhlola) futhi bakhiqize ithokheni yokulwa besebenzisa inani eliphikisayo elilandelayo nosawoti okhethwe esinyathelweni sangaphambilini.

Ikhawunta imane ikhule ngokudutshulwa ngakunye kanye njalo ngemizuzwana engama-25. Asizange sibhale ngalokhu ndawo, bekufanele kube isimanga somdlalo omncane.

Isevisi yokusebenzisana ye-Captcha

Emhlabeni wokudlala, lena bekuyi-captcha efanayo obekumele ilayishwe ukuze kuvulwe ifeni futhi uvule ishadi lephepha ngophawu. Eduze kwekhamera kwakukhona ikhompuyutha ephathekayo eqapha ukulayisha.

Ukuthi i-backend yegeyimu ye-hacker mayelana nokucekela phansi iseva idalwe kanjani

service Ngibale ukuthi yini engizoyibonisa ekuqapheni njengomthwalo wamanje: izinga lokushisa kanye ne-CPU Fan. Amamethrikhi adluliselwe kusizindalwazi sesikhathi futhi adwetshwa ama-grafana.

Uma kumasekhondi angu-5 wokugcina bekunezicelo ezingaphezu kuka-50 zokubonisa i-captcha, khona-ke umthwalo ukhuphuka ngenani elimisiwe + lezinyathelo ezingahleliwe. Isibalo sasiwukuthi umthwalo ongu-100% ungafinyelelwa emizuzwini emibili.

Eqinisweni, kwakunomqondo omningi enkonzweni kunalowo owawukhonjiswe emdlalweni wokugcina: sibeke umqapha ngendlela yokuthi kubonakale ukujikeleza kwe-CPU Fan kuphela.

Ekuqaleni kwesicelo babefuna ukushiya i-Grafan ifinyeleleka kuwebhusayithi ye-Falcon. Kodwa futhi ibiqukethe amamethrikhi e-springboot avela embikweni wesicelo esingemuva, esingabanga naso isikhathi sokuwusula, ngakho-ke sinqume ukuvimba ukufinyelela kuwo. Futhi kufanele - ngisho nasekuqaleni kwesicelo, abanye abadlali baqagela ukuthi uhlelo lokusebenza lubhalwe kuhlaka lwe-springboot futhi bemba namagama ezinye izinkonzo.

Ukubamba kanye nebhasi ledatha

Ithuluzi lokudlulisa ulwazi kusuka ku-backend kuya kusayithi, iseva ye-VPS lapho i-RabbitMQ yayisebenza khona.

I-backend nebhasi yedatha yayigcinwe VPS yethu. Amandla ayo ayeqhathaniswa nekhompyutha oyibone esikrinini: i-VPS engu-2-core enamagigabhayithi amabili e-RAM. Izindleko zakhokhiswa izinsiza, njengoba umthwalo ophezulu wawuhlelelwe izinsuku ezimbalwa kuphela - yilokhu amakhasimende ethu akwenzayo ahlela ukulayisha i-VPS isikhathi esifushane. Kwabe sekuvela ukuthi umthwalo wawungaphezu kwalokho esasikulindele, futhi intela engaguquki izoba nenzuzo enkulu. Uma wenza imfuno, khetha amanani entengo turbo.

Ukuvikela iseva ku-DDoSa, sisebenzise i-Cloudflare.

Kuyafaneleka ukusho ukuthi i-VPS imelana nayo yonke into ngokuhlonishwa.

U-Arduino, owayenomthwalo wemfanelo wokulawula ukudluliselwa, wathola imiyalo kumhumushi futhi wenza umsebenzi wangempela

Lesi esinye isihloko se-athikili elandelayo mayelana nengxenye yehadiwe yephrojekthi: i-backend ivele yathumela izicelo zokuvula i-relay ethile. Kwenzekile ukuthi i-backend yazi cishe zonke izinhlangano nezicelo ezivela kuyo kubukeke njengokuthi "vula leli bhizinisi." Senze lokhu ukuze kuhlolwe isiza kusenesikhathi (sasingakahlanganisi yonke i-Arduino nama-relay), ekugcineni sashiya konke kanjalo.

Ingaphambili

Ngokushesha sakha isayithi ku-tilde, kwathatha usuku olulodwa lokusebenza futhi sasindisa izinkulungwane ezingama-30 kusabelomali sethu.

Ekuqaleni, sicabange ukuvele sikhiphe isayithi bese sengeza umqondo ebesiwushodayo, kodwa sahlangabezana nemibandela engasenqabela ukwenza lokhu.

Sasingakakulungeli ukwephula ilayisensi, ngakho-ke kwakukhona izinketho ezimbili: ukwenza konke ngokwethu noma ukuxhumana noTilda ngokuqondile, khuluma ngephrojekthi futhi ucele imvume yokuguqula ikhodi.

Sikhethe inketho yesibili futhi abahlangananga nathi nje kuphela, kodwa baze basinika unyaka we-akhawunti yebhizinisi yamahhala, esibabonga kakhulu ngayo. Kwakunzima kakhulu ukubabonisa idizayini yewebhusayithi ye-Sokol.

Ngenxa yalokho, sinamathisele i-js logic endaweni engaphambili yokuthumela izicelo kumadivayisi ayisisekelo, futhi sashintsha kancane izitayela zezinkinobho zokuvula nokuvala izici zegeyimu.

Idizayini yewebhusayithi

Umlando wokusesha, ofanele isahluko esihlukile.

Besifuna ukudala hhayi nje isiza esidala, kodwa esinyanyeka ngokuphelele esiphula yonke imithetho eyisisekelo yokuklama. Ngesikhathi esifanayo, kwakubalulekile ukugcina ukukholeka: kwakungamelwe iphule indaba ye-ENT, ibonise ukuzenzisa kombhali, futhi abadlali kwakuzodingeka bakholelwe ukuthi indawo enjalo ingaba khona futhi ilethe namakhasimende. Futhi wayiletha! Ngesikhathi umdlalo uqhubeka, sithintwe kabili ukuze sakhe amawebhusayithi.

Ekuqaleni ngenza umklamo ngokwami, ngizama ukufaka ama-gifs amaningi kanye nezakhi ezicwebezelayo. Kodwa umyeni wami ongumklami engishade naye iminyaka eyi-10 wabheka ehlombe lakhe futhi wakuchitha ngokuthi β€œkuhle kakhulu.” Ukuze uphule imithetho yokuklama, udinga ukwazi.

Ukuthi i-backend yegeyimu ye-hacker mayelana nokucekela phansi iseva idalwe kanjani

Kunenhlanganisela yemibala eminingana evusa umuzwa ongapheli wokunengeka: okuluhlaza nokubomvu kokunotha okulinganayo, okumpunga nokubomvana, okuluhlaza okwesibhakabhaka kanye nonsundu. Ekugcineni, sazinza ekuhlanganiseni okubomvu nokuluhlaza njengemibala eyisisekelo, sengeza ama-gif anekati futhi sakhetha izithombe ezingu-3-4 zikaSokolov ngokwakhe esithombeni sesitoko. Nganginezidingo ezimbalwa kuphela: indoda eneminyaka ephakathi, egqoke isudi engabambi osayizi abambalwa abakhulu kakhulu kanye nesithombe β€œsesithombe sestudiyo sochwepheshe”. Ukuze kuhlolwe, babonise abangani futhi babuze "uthanda kanjani?"

Phakathi nenqubo yokuthuthukisa umklamo, umyeni wami kwakudingeka alale phansi njalo ngemva kwesigamu sehora; indiza enophephela emhlane yaqala ukundiza. U-Pasha uzame ukuvula ikhonsoli yonjiniyela engxenyeni enkulu yesikrini ngenkathi eqeda ukuqeda i-frontend - ukuvikela amehlo akhe.

Amadivayisi angempela

Amafeni namalambu afakwe ngokusebenzisa i-solid-state relays ukuze angavuleki ngamandla aphelele ngokushesha - ukuze amandla anyuke ngokuhambisana nokuqapha.

Kodwa sizokhuluma ngalokhu kokuthunyelwe okulandelayo, mayelana nengxenye ye-hardware yomdlalo kanye nokwakhiwa kwangempela kwesayithi.

Hlala ubukele!

Ezinye iziqephu zendatshana ezimayelana nesicelo sokucekela phansi iseva

Ukuthi i-backend yegeyimu ye-hacker mayelana nokucekela phansi iseva idalwe kanjani

Source: www.habr.com

Engeza amazwana