DIY Electronic projects › IT › Sigurnost i zaštita v
Alat za pronalaženje zaraženih web sajtova

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Alat za pronalaženje zaraženih web sajtova
1van Offline
..-. .-. . . -.. --- --
*****
Posts: 952
Threads: 111
Joined: Apr 2014
Reputation: 882
#1
Lightbulb  03-18-2022, 10:27 AM
Zdravo svima,

Povremeno, pustim svoje skripte da pretraže "naš" internet i identifikuju zaražene sajtove, servere koji šalju spam ili komandne centre automatizovanih botova. Kako nema puno odziva odgovornih institucija i CERT-ova, a ja sam za manje od 24h identifikovao preko 20 kompromitovanih lokacija, rešio sam da podelim mali skript koji može da posluži kao početni primer svima koji žele da se bave ovim poslom.

Između ostalog skript je otkrio sajtove sa: malicioznim iframe, malicioznim javascriptom, izmenjenim i/ili sakrivenim malicioznim sadržajem, curenjem privatnih podataka, itd. Neke primere možete naći na mom Twitteru sa tagovima #Malware #Bezbednost.

Kod možete preuzeti ovde:

https://github.com/Ivan-Markovic/lovac

Detalji inicijalne ideje su ovde:

https://twitter.com/ivanmarkovicsec/stat...6296949767


Happy Hunting Smile
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
1van Offline
..-. .-. . . -.. --- --
*****
Posts: 952
Threads: 111
Joined: Apr 2014
Reputation: 882
#2
03-18-2022, 10:30 AM (This post was last modified: 03-18-2022, 10:32 AM by 1van.)
Nekoliko primera pronađenih web sajtova:


Attached Files Thumbnail(s)


“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
1van Offline
..-. .-. . . -.. --- --
*****
Posts: 952
Threads: 111
Joined: Apr 2014
Reputation: 882
#3
03-18-2022, 10:38 AM (This post was last modified: 03-18-2022, 10:51 AM by 1van.)
Ono što je bitno da se spomene je da:
- Neki zaraženi sajtovi stoje tako godinama (šta radi davalac usluge? potrebna je samo jedna linija u cron-u da besplatni ClamAV otkrije pola...)
- Neki od njih su na serverima koji imaju i podatke drugih klijenata (većinom je shared hosting bez nekih posebnih restrikcija)
- Neki od njih mogu da zaraze korisnike koji ih posete (serviranjem lažnog sadržaja, exploatacijom browsera)
- Neki vlasnici zarazenih web sajtova su verovatno zarazeni takodje i svi njihovi podaci su iscureli (i njihovi passwordi preuzeti za dalje napade)
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
1van Offline
..-. .-. . . -.. --- --
*****
Posts: 952
Threads: 111
Joined: Apr 2014
Reputation: 882
#4
03-22-2022, 11:01 AM
Ko su relevanti kontakti koje možete da kontaktirate kada naiđete na kompromitovani web sajt:

[Image: attachment.php?aid=37301]


Attached Files Thumbnail(s)

“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
1van Offline
..-. .-. . . -.. --- --
*****
Posts: 952
Threads: 111
Joined: Apr 2014
Reputation: 882
#5
03-22-2022, 11:03 AM
Lista CERT-ova u Srbiji:

[Image: attachment.php?aid=37302]


Attached Files Thumbnail(s)

“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
1van Offline
..-. .-. . . -.. --- --
*****
Posts: 952
Threads: 111
Joined: Apr 2014
Reputation: 882
#6
03-22-2022, 11:03 AM (This post was last modified: 03-22-2022, 11:05 AM by 1van.)
Šta je bitno da zapamtimo:

[Image: attachment.php?aid=37303]


Attached Files Thumbnail(s)

“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply


Forum Jump:


Users browsing this thread: 3 Guest(s)