【安全牛學習筆記】流量操控技術、重定向
流量操作技術 Traffic manipulation technique 滲透測試中經常遇到訪問受限的網絡環境 使用隱蔽的手段逃避安全監測措施和溯源追蹤 證明看似嚴格的訪問控制仍然存在弱點 在非受信任的網絡中實現安全的數據傳輸 部分概念的實現過程略有燒腦 |
流量操作技術 重定向（Redirection） - IP、Port 隧道（Tunneling） - 在不受信任的網絡環境中實現安全的通信 - 通常使用多種加密技術建立通信隧道 - 點到點（IP2IP）、端到端（Port2Port）隧道 - VPN: pptp、12tp、IPSec、SSL vpn 封裝（encapsulation） - 通常結合在隧道中使用，使用一種協議封裝一種協議（RPC o http、VoIP） - 使用網關設備實現不同類型網絡的互聯互通 |
重定向 Rinetd - 安裝：apt-get install rinetd - 配置：/etc/rinetd.conf bindadd bindport connectadd connectport - 運行：rinetd 應用場景 - 重定向web流量，圖片上網限制 - 遠程桌面重定向 - Nc重定向獲得shell - 不兼容FTP等二次連接的協議 安裝monowall防火墻 |
**** This is mOnOwall, version 1.8.1
built on Web Jan 15 13:32:38 GET 2014 for generic-pc
Copyright (C) 2002-2014 by Manuel Kasper. All rights reserved.
Visit http://mOnO.ch/wall for updates.
LAN IP address: 192.168.1.1
WAN IP address: (unknown)
Port configuration:
LAN -> em0
WLAn -> em1
mOnOwall console setup
*********************
1) Interfaces: assign network ports
2) Set up LAN IP address
3) Reset webGUI password
4) Reset to factory defaults
5) Reboot system
6) Ping host
7) Install on Hard Drive
Enter a number: 7
Enter disks are:
ad0 VBOX HARDDISK 1.0 8.00 GB
Enter the device name you wish to install onto: ad0
************************************************************************************
* WARNING! *
* m0n0wall is about to be installed onto the ad0 device. *
* - everything on this device will be erased! *
* - this cannot be undone! *
************************************************************************************
The firewall will reboot after installation.
Do you want to proceed? (y/n) y
Installing... done
Copying configuration... done
------------------------------------------------------------------------------------
*** This is mOnOwall, version 1.8.1
built on Web Jan 15 13:32:38 GET 2014 for generic-pc
Copyright (C) 2002-2014 by Manuel Kasper. All rights reserved.
Visit http://mOnO.ch/wall for updates.
LAN IP address: 192.168.1.1
WAN IP address: (unknown)
Port configuration:
LAN -> em0
WLAn -> em1
mOnOwall console setup
*********************
1) Interfaces: assign network ports
2) Set up LAN IP address
3) Reset webGUI password
4) Reset to factory defaults
5) Reboot system
6) Ping host
7) Install on Hard Drive
Enter a number: 1
Valid interfaces are:
em0 08:00:27:ed:e5:3c (up) Intel(R) PRO/1000 Legacy Network Connect...
em1 08:00:27:2c:11:c8 (up) Intel(R) PRO/1000 Legacy Network Connect...
Note that wireless LAN interfaces are not included in the list above:
they can be set up through the webGUI Later on.
Do you want to set up VLANS first?
If you‘re not going to use VLANs, or only for optional interfaces, you
should say no here and use the webGUI to configure VLANs later, if required.
Do you want to set up VLANs now? (y/n）n
If you don‘t know the names of your interfaces, you may choose the use
auto-detection. In that case, disconnect all interfaces before you begin,
and reconnect each one when prompted to do so.
Enter the LAN interface name or ‘a‘ for auto-detection: em0
Enter the LAN interface name or ‘a‘ for auto-detection: em1
Enter the Optional 1 interface name ‘a‘ for auto-detection
(or nothing if finished):
The interfaces will be assigned as follows:
LAN -> em0
WAN -> em1
The firewall will reboot after sving the changes.
Do you want to proceed? (y/n) y
The firewall is rebooting now.
------------------------------------------------------------------------------------
*** This is mOnOwall, version 1.8.1
built on Web Jan 15 13:32:38 GET 2014 for generic-pc
Copyright (C) 2002-2014 by Manuel Kasper. All rights reserved.
Visit http://mOnO.ch/wall for updates.
LAN IP address: 192.168.1.1
WAN IP address: (unknown)
Port configuration:
LAN -> em0
WLAn -> em1
mOnOwall console setup
*********************
1) Interfaces: assign network ports
2) Set up LAN IP address
3) Reset webGUI password
4) Reset to factory defaults
5) Reboot system
6) Ping host
7) Install on Hard Drive
Enter a number: 2
Enter the new LAN IP address: 1.1.1.1
Subnet masks are entered as bit counts (as in CIDR notation) in mOnOwall.
e.g. 255.255.255.0 = 24
255.255.0.0 = 16
255.0.0.0 = 8
Enter the new LAN subnet bit count: 24
Do you want to enable the DHCP server on LAN? (y/n) y
Enter the star address of the client address range: 1.1.1.10
Enter the end address of the client address range: 1.1.1.100
The LAN IP address has been set to 1.1.1.1/24
You can now access the webGUI by opening the following URL
in you browser:
http://1.1.1.1/
Press ENTER to continue.
------------------------------------------------------------------------------------
*** This is mOnOwall, version 1.8.1
built on Web Jan 15 13:32:38 GET 2014 for generic-pc
Copyright (C) 2002-2014 by Manuel Kasper. All rights reserved.
Visit http://mOnO.ch/wall for updates.
LAN IP address: 192.168.1.1
WAN IP address: (unknown)
Port configuration:
LAN -> em0
WLAn -> em1
mOnOwall console setup
*********************
1) Interfaces: assign network ports
2) Set up LAN IP address
3) Reset webGUI password
4) Reset to factory defaults
5) Reboot system
6) Ping host
7) Install on Hard Drive
Enter a number: 3
The webGUI password will be reset to the default (which is ‘mono‘).
Do you want to proceed? (y/n) y
The password for the webGUI has been reset.
Remember to set the password to something else than
the default as soon as you have logged into the webGUI
Press ENTER to continue.
------------------------------------------------------------------------------------
*** This is mOnOwall, version 1.8.1
built on Web Jan 15 13:32:38 GET 2014 for generic-pc
Copyright (C) 2002-2014 by Manuel Kasper. All rights reserved.
Visit http://mOnO.ch/wall for updates.
LAN IP address: 192.168.1.1
WAN IP address: (unknown)
Port configuration:
LAN -> em0
WLAn -> em1
mOnOwall console setup
*********************
1) Interfaces: assign network ports
2) Set up LAN IP address
3) Reset webGUI password
4) Reset to factory defaults
5) Reboot system
6) Ping host
7) Install on Hard Drive
Enter a number: 5
The firewal will reboot. This may take one minute.
Do you want to proceed? (y/n) y
The firewall is rebooting now.
------------------------------------------------------------------------------------
http://1.1.1.1/
admin
mono
[email protected]:~# apt-get instal rinetd
[email protected]:~# cat /etc/rinetd.conf
[email protected]:~# vi /etc/rinetd.conf
# bindadress bindport connectaddress connectport
192.168.1.110 53 192.168.1.124 80
[email protected]:~# rinetd //啟動
[email protected]:~# ps aux | grep rinetd
root 3205 0.0 0.0 4208 1328 ? Ss 20:59 0:00 /usr/sbin/rinetd
root 3645 0.0 0.0 6328 1656 ? Ss 21:02 0:00 rinetd
root 3648 0.0 0.0 12680 1736 pts/0 Ss 21:02 0:00 grep rinetd
[email protected]:~# netstat -pantu | grep :53
tcp 0 0 192.168.1.111:53 0.0.0.0:* LISTEN 3645/rinetd
[email protected]:~# vi /etc/rinetd.conf
# bindadress bindport connectaddress connectport
192.168.1.110 53 192.168.1.124 3389
[email protected]:~# pkill rinetd
[email protected]:~# rinetd
[email protected]:~# netstat -pantu | grep :53
tcp 0 0 192.168.1.111:53 0.0.0.0:* LISTEN 3706/rinetd
開始----->運行----->mstsc(打開遠程桌面連接工具)
[email protected]:~# cp /usr/share/windows.binaries/nc.exe /media/sf_D_DRIVE/
C:\Documents and Settings/Administrator>cd\
C:\dir
C:\nc -nvlp 333
listening on [any] 333 ...
[email protected]:~# vi /etc/rinetd.conf
# bindadress bindport connectaddress connectport
192.168.1.110 53 192.168.1.124 333
[email protected]:~# pkill rinetd
[email protected]:~# rinetd
該筆記為安全牛課堂學員筆記，想看此課程或者信息安全類幹貨可以移步到安全牛課堂
Security+認證為什麽是互聯網+時代最火爆的認證？
牛妹先給大家介紹一下Security+
Security+ 認證是一種中立第三方認證，其發證機構為美國計算機行業協會CompTIA ；是和CISSP、ITIL 等共同包含在內的國際 IT 業 10 大熱門認證之一，和CISSP偏重信息安全管理相比，Security+ 認證更偏重信息安全技術和操作。
通過該認證證明了您具備網絡安全，合規性和操作安全，威脅和漏洞，應用程序、數據和主機安全，訪問控制和身份管理以及加密技術等方面的能力。因其考試難度不易，含金量較高，目前已被全球企業和安全專業人士所普遍采納。
Security+認證如此火爆的原因？
原因一：在所有信息安全認證當中，偏重信息安全技術的認證是空白的， Security+認證正好可以彌補信息安全技術領域的空白 。
目前行業內受認可的信息安全認證主要有CISP和CISSP，但是無論CISP還是CISSP都是偏重信息安全管理的，技術知識講的寬泛且淺顯，考試都是一帶而過。而且CISSP要求持證人員的信息安全工作經驗都要5年以上，CISP也要求大專學歷4年以上工作經驗，這些要求無疑把有能力且上進的年輕人的持證之路堵住。在現實社會中，無論是找工作還是升職加薪，或是投標時候報人員，認證都是必不可少的，這給年輕人帶來了很多不公平。而Security+的出現可以掃清這些年輕人職業發展中的障礙，由於Security+偏重信息安全技術，所以對工作經驗沒有特別的要求。只要你有IT相關背景，追求進步就可以學習和考試。
原因二： IT運維人員工作與翻身的利器。
在銀行、證券、保險、信息通訊等行業，IT運維人員非常多，IT運維涉及的工作面也非常廣。是一個集網絡、系統、安全、應用架構、存儲為一體的綜合性技術崗。雖然沒有程序猿們“生當做光棍，死亦寫代碼”的悲壯，但也有著“鋤禾日當午，不如運維苦“的感慨。天天對著電腦和機器，時間長了難免有對於職業發展的迷茫和困惑。Security+國際認證的出現可以讓有追求的IT運維人員學習網絡安全知識，掌握網絡安全實踐。職業發展朝著網絡安全的方向發展，解決國內信息安全人才的匱乏問題。另外，即使不轉型，要做好運維工作，學習安全知識取得安全認證也是必不可少的。
原因三：接地氣、國際範兒、考試方便、費用適中！
CompTIA作為全球ICT領域最具影響力的全球領先機構,在信息安全人才認證方面是專業、公平、公正的。Security+認證偏重操作且和一線工程師的日常工作息息相關。適合銀行、證券、保險、互聯網公司等IT相關人員學習。作為國際認證在全球147個國家受到廣泛的認可。
在目前的信息安全大潮之下，人才是信息安全發展的關鍵。而目前國內的信息安全人才是非常匱乏的，相信Security+認證一定會成為最火爆的信息安全認證。
本文出自 “11662938” 博客，請務必保留此出處http://11672938.blog.51cto.com/11662938/1971496
【安全牛學習筆記】流量操控技術、重定向