=Start=<\/p>\n\n\n\n
\u6536\u96c6\u3001\u6574\u7406\u4e00\u4e0b\u9996\u5c4aDataCon\u5927\u6570\u636e\u5b89\u5168\u5206\u6790\u6bd4\u8d5b\u7684writeup\u548c\u76f8\u5173\u8d44\u6599\uff0c\u5b66\u4e60\u4e00\u4e0b\u8fd9\u4e9b\u83b7\u5956\u9009\u624b\u7684\u89e3\u9898\u601d\u8def\u548c\u65b9\u6cd5\uff0c\u65b9\u4fbf\u4ee5\u540e\u8981\u7528\u7684\u65f6\u5019\u5feb\u901f\u53c2\u8003\u3002<\/p>\n\n\n\n
\u4e3a\u79ef\u6781\u63a2\u7d22\u7f51\u7edc\u5b89\u5168\u4eba\u624d\u9009\u62d4\u548c\u57f9\u517b\u673a\u5236\uff0c\u7f51\u7edc\u5b89\u5168\u76f8\u5173\u6bd4\u8d5b\u6b63\u5982\u706b\u5982\u837c\u5730\u5f00\u5c55\u3002\u7136\u800c\uff0c\u76ee\u524d\u56fd\u5185\u7684\u6bd4\u8d5b\u5927\u591a\u4ee5CTF\uff08\u593a\u65d7\u8d5b\uff09\u7c7b\u6bd4\u8d5b\u4e3a\u4e3b\uff0c\u504f\u91cd\u6f0f\u6d1e\u6316\u6398\uff0c\u540c\u8d28\u5316\u8f83\u4e3a\u4e25\u91cd\uff0c\u5927\u6570\u636e\u5b89\u5168\u5206\u6790\u5728\u5374\u9c9c\u88ab\u63d0\u53ca\u3002\u636e\u76f8\u5173\u7edf\u8ba1\u6570\u636e\u663e\u793a\uff0c\u4e0e\u5927\u6570\u636e\u5b89\u5168\u5206\u6790\u76f8\u5173\u7684\u6bd4\u8d5b\u4ec5\u53601%\u5de6\u53f3\uff0c<\/strong>\u5b58\u5728\u6781\u5927\u7a7a\u767d\u3002<\/p>\n\n\n\n \u4e3a\u586b\u8865\u8fd9\u4e00\u7a7a\u767d\uff0c\u63a8\u52a8\u7f51\u7edc\u5b89\u5168\u4ea7\u4e1a\u5065\u5eb7\u53d1\u5c55\uff0c\u7531<\/strong>360\u4f01\u4e1a\u5b89\u5168\u96c6\u56e2\u548c\u6e05\u534e\u5927\u5b66\u4e3b\u529e\u3001\u8d35\u5dde\u5e08\u8303\u5927\u5b66\u534f\u529e\uff0c\u5e76\u4e14\u8054\u5408\u5317\u4eac\u5927\u5b66\u3001\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u3001\u590d\u65e6\u5927\u5b66\u3001\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u3001\u5409\u6797\u5927\u5b66\u7b4920\u4f59\u6240\u5168\u56fd\u77e5\u540d\u9ad8\u6821\u5171\u540c\u4e3e\u529e\u7684DataCon\u5927\u6570\u636e\u5b89\u5168\u5206\u6790\u6bd4\u8d5b\u5373\u5c06\u53ec\u5f00\uff0c\u7ebf\u4e0a\u62a5\u540d\u4e8e3\u670811\u65e5\u6b63\u5f0f\u5f00\u542f\u3002<\/strong><\/p>\n\n\n\n \u65b9\u54111\uff1aDNS\u6076\u610f\u6d41\u91cf\u68c0\u6d4b<\/strong><\/p>\n\n\n\n \u653b\u9632\u6f14\u7ec3\u8fc7\u7a0b\u4e2d\u53d1\u73b0\u5927\u6570\u636e\u4f1a\u8bae\u5b98\u7f51\u65e0\u6cd5\u6b63\u5e38\u8bbf\u95ee\u3001\u65e0\u6cd5\u6ce8\u518c\u3001\u53d1\u5e03\u4f1a\u8bae\u53ca\u6d3b\u52a8\u4fe1\u606f\u3002\u4e3b\u529e\u5355\u4f4d\u5df2\u91c7\u96c6\u5230\u5927\u4f1aDNS\u6d41\u91cf\uff0c\u8bf7\u4ece\u4e2d\u5206\u6790\u51fa\u6076\u610f\u6d41\u91cf\u3002<\/strong><\/p>\n\n\n\n \u65b9\u54112\uff1a\u6076\u610f\u4ee3\u7801\u884c\u4e3a\u68c0\u6d4b<\/strong><\/p>\n\n\n\n \u653b\u9632\u6f14\u7ec3\u8fc7\u7a0b\u4e2d\u53d1\u73b0\u4f1a\u8bae\u4e3b\u529e\u5355\u4f4d\u90e8\u5206\u7535\u8111\u906d\u9047\u6076\u610f\u4ee3\u7801\u653b\u51fb\uff0c\u5e76\u611f\u67d3\u4f1a\u8bae\u73b0\u573a\u7684\u7528\u4e8e\u6f14\u8bb2\u548c\u5c55\u533a\u5c55\u793a\u7684\u7535\u8111\uff0c\u5f71\u54cd\u4f1a\u8bae\u8fd0\u884c\u3002\u4e3b\u529e\u5355\u4f4d\u5df2\u901a\u8fc7\u6c99\u7bb1\u5206\u6790\u51fa\u6240\u6709\u8f6f\u4ef6\u7684\u884c\u4e3a\u6570\u636e\uff0c\u5e76\u5df2\u5bf9\u5176\u4e2d\u90e8\u5206\u5df2\u77e5\u6076\u610f\u6837\u672c\u8fdb\u884c\u4e86\u6807\u6ce8\u3002\u8bf7\u5206\u6790\u5df2\u6807\u6ce8\u7684\u8bad\u7ec3\u6837\u672c\uff0c\u4ece\u6d4b\u8bd5\u6837\u672c\u4e2d\u8bc6\u522b\u51fa\u6240\u6709\u6076\u610f\u4ee3\u7801\u53ca\u5176\u5bb6\u65cf\u3002<\/strong><\/p>\n\n\n\n \u65b9\u54113\uff1a\u653b\u51fb\u6e90\u4e0e\u653b\u51fb\u8005\u5206\u6790<\/strong><\/p>\n\n\n\n \u5728\u5927\u6570\u636e\u4f1a\u8bae\u4e3e\u529e\u671f\u95f4\uff0c\u91cd\u4fdd\u5c0f\u7ec4\u53d1\u73b0\u4e86\u5927\u91cf\u9488\u5bf9\u653f\u5e9c\u3001\u5927\u578b\u4f01\u4e1a\u7f51\u7ad9\u3001\u6570\u636e\u5e93\u53d1\u8d77\u653b\u51fb\u7684\u53ef\u80fd\u653b\u51fb\u6e90\u3002\u91cd\u4fdd\u5c0f\u7ec4\u901a\u8fc7\u5927\u7f51\u4e0a\u7684\u591a\u7ef4\u5ea6\u6570\u636e\uff0c\u628a\u4e0e\u8fd9\u4e9b\u653b\u51fb\u6e90\u76f8\u5173\u7684\u7ebf\u7d22\u5168\u90e8\u4e32\u8054\u8d77\u6765\u3002\u5c1d\u8bd5\u5bf9\u6240\u6709\u53ef\u80fd\u7684\u653b\u51fb\u6e90\u8fdb\u884c\u5206\u6790\u3002<\/strong><\/p>\n\n\n\n 1\u3001DNS\u6076\u610f\u6d41\u91cf\u68c0\u6d4b\u65b9\u5411\u7684\u9898\u76ee\u8bc4\u5ba1\u4ee580%\u5ba2\u89c2\u5f97\u5206<\/strong>\u548c20%WriteUp\u5f97\u5206<\/strong>\u8ba1\u7b97\u4e24\u9053\u9898\u76ee\u7684\u603b\u5f97\u5206\u5e76\u8fdb\u884c\u6392\u540d\uff0c\u5176\u4e2d\u9898\u76ee\u4e00\u5f97\u5206\u5360\u603b\u5206\u768460%\uff0c\u9898\u76ee\u4e8c\u5f97\u5206\u5360\u603b\u5206\u768440%\u3002<\/p>\n\n\n\n 2\u3001\u6076\u610f\u4ee3\u7801\u884c\u4e3a\u68c0\u6d4b\u65b9\u5411\u7684\u9898\u76ee\u8bc4\u5ba1\u4ee580%\u5ba2\u89c2\u5f97\u5206\u548c20%WriteUp\u5f97\u5206\u8ba1\u7b97\u4e24\u9053\u9898\u76ee\u7684\u603b\u5f97\u5206\u5e76\u8fdb\u884c\u6392\u540d\uff0c\u5176\u4e2d\u9898\u76ee\u4e00\u5f97\u5206\u5360\u603b\u5206\u768450%\uff0c\u9898\u76ee\u4e8c\u5f97\u5206\u5360\u603b\u5206\u768450%\u3002<\/p>\n\n\n\n 3\u3001\u653b\u51fb\u6e90\u4e0e\u653b\u51fb\u8005\u5206\u6790\u65b9\u5411\u7684\u9898\u76ee\u8bc4\u5ba1\u7efc\u5408\u4e86\u4e09\u9053\u9898\u76ee\u7684\u603b\u5f97\u5206\u5e76\u8fdb\u884c\u6392\u540d\uff0c\u5176\u4e2d\u9898\u76ee\u4e00\u5f97\u5206\u5360\u603b\u5206\u768420%\uff0c\u9898\u76ee\u4e8c\u5f97\u5206\u5360\u603b\u5206\u768440%\uff0c\u9898\u76ee\u4e09\u5f97\u5206\u5360\u603b\u5206\u768440%\u3002\u5f97\u5206\u8981\u70b9\u4e3b\u8981\u8003\u5bdf\u9009\u624b\u4eec\u5bf9\u65e5\u5fd7\u4e2d\u653b\u51fb\u7684\u8bc6\u522b\u7684\u51c6\u786e\u6027<\/strong>\u4ee5\u53ca\u8bc6\u522b\u7684\u653b\u51fb\u79cd\u7c7b\u6570<\/strong>\uff1b\u9009\u624b\u4eec\u5bf9\u6570\u636e\u7684\u654f\u611f\u7a0b\u5ea6\u3001\u6570\u636e\u89c6\u91ce\u4ee5\u53ca\u540c\u6e90\u5206\u6790\u80fd\u529b\u548c\u601d\u8def<\/strong>\uff0c\u80fd\u5426\u4ece\u591a\u4e2a\u7ef4\u5ea6<\/strong>\u6765\u4f53\u7cfb\u5316<\/strong>\u7684\u5bf9\u653b\u51fb\u8005\/\u7ec4\u7ec7\u8fdb\u884c\u540c\u6e90\u5206\u6790\uff1b\u4ee5\u53ca\u9009\u624b\u4eec\u7684\u6570\u636e\u5206\u6790\u80fd\u529b\uff0c\u9009\u624b\u4eec\u662f\u5426\u901a\u8fc7\u6bd4\u8d5b\u63d0\u4f9b\u7684\u6570\u636e\u5168\u9762\u7684\uff0c\u4ece\u66f4\u591a\u7ef4\u5ea6\u6765\u7efc\u5408\u8bc4\u4ef7\u4e00\u4e2a\u653b\u51fb\u8005\/\u7ec4\u7ec7\u7684\u7f51\u7edc\u653b\u51fb\u80fd\u529b\u3002<\/p>\n\n\n\n \u4ee5\u4e0a\u662f\u6bd4\u8d5b\u7684\u80cc\u666f\u3001\u9898\u76ee\u7c7b\u578b\u7684\u76f8\u5173\u8bf4\u660e\uff0c\u4e0b\u9762\u6458\u5f55\u4e00\u4e9b\u9009\u624b\u7684\u90e8\u5206\u89e3\u9898\u7b56\u7565\u548c\u601d\u8def\uff0c\u65b9\u4fbf\u5feb\u901f\u67e5\u9605\u548c\u5b66\u4e60\uff1a<\/p>\n\n\n\n \u901a\u8fc7\u5bf9\u6570\u636e\u7684\u521d\u6b65\u4eba\u5de5\u6d4f\u89c8\u548c\u7b80\u5355\u53ef\u89c6\u5316\u5206\u6790\u53d1\u73b0\uff1a \u636e\u6b64\uff0c\u6211\u7684\u89e3\u9898\u7b56\u7565\u4e3a\uff1a \u63a5\u4e0b\u6765\u5f00\u59cb\u601d\u8003\u672c\u9898\u7684\u7279\u5f81\u7ef4\u5ea6\u3002\u6839\u636e\u6211\u7684\u5b89\u5168\u7ecf\u9a8c\uff0c\u5c06DNS\u653b\u51fb\u5206\u4e3a\u4e09\u79cd\u5efa\u6a21\uff1a<\/strong> \u5c06DNS\u65e5\u5fd7\u7684Request\u548cResponse join\u5230\u4e00\u8d77\uff0c\u7136\u540e\u505a\u7edf\u8ba1\u7279\u5f81\u548c\u6587\u672c\u7279\u5f81\uff1a<\/p>\n\n\n\n \u5f02\u5e38\u68c0\u6d4b \u603b\u7ed3\uff1a \u5206\u6790\u65b9\u6cd5\u53ea\u7528\u4e863sigma\u5f02\u5e38\u57fa\u7ebf\u4e00\u79cd\uff0c\u4eba\u5de5\u6392\u5e8f\u89c2\u5bdfTop\u7684\u5f02\u5e38\u7ed3\u679c\uff0c\u786e\u8ba4\u653b\u51fb\u540e\u5199\u89c4\u5219\u635e\u51fa\u5168\u90e8\u540c\u7c7b\u653b\u51fb\u3002<\/p>\n\n\n\n =<\/p>\n\n\n\n =END=<\/p>\n","protected":false},"excerpt":{"rendered":" =Start= \u7f18\u7531\uff1a \u6536\u96c6\u3001\u6574\u7406\u4e00\u4e0b\u9996\u5c4aDataCon\u5927\u6570\u636e\u5b89\u5168\u5206\u6790\u6bd4\u8d5b\u7684writeup\u548c\u76f8\u5173\u8d44\u6599\uff0c\u5b66\u4e60\u4e00\u4e0b […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,25,12,1275],"tags":[1436,205,1437,1438,1428],"class_list":["post-4473","post","type-post","status-publish","format-standard","hentry","category-knowledgebase-2","category-security","category-tools","category-1275","tag-datacon","tag-dns","tag-writeup","tag-1438","tag-1428"],"views":10108,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/4473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=4473"}],"version-history":[{"count":1,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/4473\/revisions"}],"predecessor-version":[{"id":4492,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/4473\/revisions\/4492"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=4473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=4473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=4473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\u6bd4\u8d5b\u9898\u76ee\u65b9\u5411\uff1a<\/h6>\n\n\n\n
DataCon\u6392\u884c\u699c\u8bf4\u660e\uff1a<\/strong><\/h6>\n\n\n\n
\n\n\n\nQ1 DNS\u6076\u610f\u6d41\u91cf\u68c0\u6d4b<\/a><\/h2>\n\n\n\n
\u2026\u2026<\/p>\n\n\n\n
\u539f\u59cb\u65e5\u5fd7->\u7279\u5f81\u5de5\u7a0b->\u5f02\u5e38\u68c0\u6d4b->\u4eba\u5de5\u9a8c\u8bc1(\u5f97\u5230\u90e8\u5206\u7b54\u6848)->pattern\u63d0\u53d6->\u89c4\u5219\u5339\u914d->\u5168\u90e8\u7b54\u6848\u3002<\/strong><\/p>\n\n\n\n
1\u3001\u5bc6\u96c6\u8bf7\u6c42\u578b<\/strong>\uff1a\u4f8b\u5982\u968f\u673a\u5b50\u57df\u540dDDoS\u3001\u53cd\u5c04\u578bDDoS\u3002\u5176\u7279\u5f81\u4e3aQPS\u9ad8\u3001\u65f6\u5e8f\u7279\u5f81\u5f3a\uff0c\u4e00\u822c\u80fd\u591f\u53ef\u89c6\u5316\u89c2\u5bdf\u5230\u6ce2\u5cf0\u3002
2\u3001\u6f0f\u6d1e\u653b\u51fb\u578b<\/strong>\uff1a\u4f8b\u5982\u9488\u5bf9DNS server\u7684\u5df2\u77e5\u6f0f\u6d1e\u653b\u51fb\u3002\u5176\u7279\u5f81\u4e3a\u6570\u91cf\u5c11\u3001\u53d7DNS type\u5f71\u54cd\uff0c\u9002\u5408\u5206\u7c7b\u7edf\u8ba1\u3002\u5982\u679c\u6279\u91cfPoC\u7684\u8bdd\uff0c\u5219\u7279\u5f81\u540c1\u3002
3\u3001\u6570\u636e\u4f20\u8f93\u578b<\/strong>\uff1a\u4f8b\u5982DNS Tunnel\u3001Malware DGA\u3001PoC\u4e2d\u7684DNS\u56de\u663e\u3001SSRF\u91cd\u7ed1\u5b9a\u7b49\u3002\u5176\u7279\u5f81\u5728\u4e8e\u57df\u540d\u6587\u672c\u7279\u5f81\u660e\u663e\u3001\u9002\u7528\u4e8e\u89c4\u5219\u5339\u914d\u3002<\/p>\n\n\n\n
\u5c06\u4ee5\u4e0a\u7edf\u8ba1\u7279\u5f81\u901a\u8fc7\u5168\u91cf\u6570\u636e\u5efa\u7acb\u57fa\u7ebf\uff0c\u7136\u540e\u5728\u6bcf\u4e2a\u7279\u5f81\u7ef4\u5ea6\u6ee4\u51fa\u8d85\u8d8a3sigma\u7684\u5f02\u5e38\u503c\u3002<\/p>\n\n\n\n
\u4ece\u7ed3\u679c\u6765\u770b\uff0c\u672c\u9898\u6700\u9ad8\u6548\u7684\u7279\u5f81\u5982\u4e0b\uff1a
1\u3001DNS type\u3002
2\u3001src_ip\u7ef4\u5ea6\u7684\u7edf\u8ba1\u5206\u6790\u7279\u5f81\uff08QPS\u3001\u57df\u540d\u6570\u91cf\u3001\u8bf7\u6c42\u54cd\u5e94\u6570\uff09\uff0c\u56e0\u4e3a\u51fa\u9898\u4eba\u5c06src_ip\u7684\u884c\u4e3a\u505a\u7684\u975e\u5e38\u5e72\u51c0\uff0c\u627e\u5230\u4e86IP\u5c31\u627e\u5230\u4e86\u653b\u51fb\u3002<\/p>\n\n\n\n
\n\n\n\nQ2 DGA\u57df\u540d\u68c0\u6d4b\u4e0e\u5bb6\u65cf\u805a\u7c7b<\/a><\/h2>\n\n\n\n
\u4e3b\u8981\u95ee\u9898\u548c\u5f85\u63d0\u9ad8\u7684\u5730\u65b9<\/h3>\n\n\n\n
\u53c2\u8003\u94fe\u63a5\uff1a<\/h5>\n\n\n\n
https:\/\/github.com\/ReAbout\/datacon<\/a><\/li>
https:\/\/bithack.io\/forum\/258<\/a><\/li>
https:\/\/www.butian.net\/datacon<\/a><\/li>
https:\/\/blog.csdn.net\/xushao_Movens\/article\/details\/53844013<\/a><\/li>
https:\/\/my.oschina.net\/bluefly\/blog\/626132<\/a><\/li>
https:\/\/www.anquanke.com\/post\/id\/107124<\/a><\/li>
http:\/\/tanjiti.lofter.com\/post\/1cc6c85b_10c4e356<\/a><\/li>
https:\/\/xz.aliyun.com\/t\/2136<\/a><\/li>
https:\/\/xz.aliyun.com\/t\/1121<\/a><\/li>
https:\/\/tech.marksblogg.com\/detect-bots-apache-nginx-logs.html<\/a><\/li>
https:\/\/xz.aliyun.com\/t\/4607<\/a><\/li>
http:\/\/zhuanlan.51cto.com\/art\/201702\/531001.htm<\/a><\/li>
https:\/\/www.zhihu.com\/question\/23042131<\/a><\/li>
https:\/\/www.cnblogs.com\/cobbliu\/p\/3383135.html<\/a><\/li>
https:\/\/www.freebuf.com\/column\/138163.html<\/a><\/li>
https:\/\/www.anquanke.com\/post\/id\/83245<\/a><\/li>
https:\/\/www.cnblogs.com\/549294286\/p\/5172448.html<\/a><\/li><\/ul>\n\n\n\n