Ostatnio: 26.09.2018

Darmowe galerie dla serwisów aukcyjnych

Pomysłowi admini w obronie przed hackerami.

Aby uchronić się przed "banner grabbingiem", administrator serwera DNS - BIND, może ukryć wersję oprogramowania zastępując ją własnym tekstem. Zobaczcie jakie "wiadomości" zostawiają ciekawskim co bardziej pomysłowi/wyluzowani. (+ krótkie wyjaśnienie o co chodzi)

Wprowadzenie (TL;DR zapraszam na koniec po to co było w opisie znaleziska)

Sytuacja: ktoś chce się włamać na dany serwer (albo tylko sprawdzić czy jest podatny :P). Na dobry początek, poza popularnym (Matrix i nmap) skanowaniem portów, może też dokonać banner grabbingu, czyli pobrania bannerów zwracanych przez uruchomione na maszynie usługi. Jak to wygląda? Najczęściej wystarczy połączyć się poprzez telnet z danym serwerem na odpowiednim porcie.

Przykłady:

Banner SSH:

:~$ nc localhost 22
SSH-2.0-OpenSSH_6.0p1 Debian-2



Banner serwera www:

:~$ telnet localhost 80
Trying localhost...
Connected tolocalhost.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 200 OK
X-Powered-By: Servlet 2.4; Tomcat-5.0.28/JBoss-3.2.6 (build: CVSTag=JBoss_3_2_6 date=200410140106)
ETag: W/"53-1327426768000"
Last-Modified: Tue, 24 Jan 2012 17:39:28 GMT
Content-Type: text/html
Content-Length: 53
Date: Thu, 26 Jul 2012 23:26:35 GMT
Server: Apache-Coyote/1.1
Connection: close



I to o czym mowa w znalezisku czyli serwer DNS:

:~$ nslookup -type=txt -class=chaos version.bind localhost
Server:         localhost
Address:        127.0.0.1#53

version.bind    text = "9.9.1"



Jak widać, zainstalowany jest BIND w wersji 9.9.1 Po co to komu wiedzieć? A no po to, żeby sobie wyszukać w czeluściach internetu jakieś eksplojty (np. emacsem przez sendmail).

Żeby serwer nie zdradzał informacji o sobie, administrator może zmienić ten wpis. Oczywiście nie jest to żadne zabezpieczenie ( p. security through obscurity ), ale zawsze coś, a i bez tego nie byłoby tego znaleziska.

Wreszcie po moim wprowadzeniu, wspomniana lista przeróżnych tekstów jakie admini wpisują zamiast wersji serwera. Wtedy ciekawska osoba, zamiast poznać wersję oprogramowania, dowie się, że ma spadać ;)

Jest tego sporo, dlatego najpierw najciekawsze:

A version so current that it would make your eyes hurt if I really showed you

A census taker once tried to test me. He ran bind as root. I ate his liver with some fava beans and a nice chianti.

ALL YOUR BASE ARE BELONG TO US

*maniacal laughter*

Bind Something.Something.Whatever.9

Bind 0.2Alpha on a Commodore Amiga

Duct tape, coat hangers, and bubble-gum V3.1.

Duh.. what's bind ?

Go recurse yourself (TM) v 0.91

Hyper MixMaster Smack-Fu 'Can you smell what the Rock is cookin' BIND

I find your lack of a clue disturbing

I'm not sure, check back laster.

If it works, it does not matter

My You're Nosy!

NOTICE! YOUR ACCESS ATTEMPTS HAVE BEEN LOGGED.The system you are connecting with is part of the CRITICALINFRASTRUCTURE of the United States as described in EXECUTIVE ORDERNUMBER 13010

Name's BIND...James BIND...

One Ring to rule them all, One Ring to find them, One Ring to bring them all and in the darkness bind them In the Land of Mordor, where the Shadows lie.

Pay no attention to the man behind the curtain!

Pick a number between 1.1.1 and 10.10.10.

Pooh was a bear of very little brain who frequently fell for a honeypot.

Powered by Oreo's. Go away now.

Recent

Ripley's Believe it or Not

Rock Hard Bind – Ultra Beta

Stop touching me there

Sure I might tell you someday

Surely you must be joking, don't call me Shirley.

Turkey, Go Away and Gobble

Up to date

Victorias secret

We already got one.

Why do you ask, curious cat?

Windows NT mit der SHEEP FLAVOUR. Achtung!

You hope that there is a 4.9.1 :-)

an awsome one

eleventy-billion and threeve

for me to know and you to find out

go fly a kite

has been owned like a bitch

if you can see this - YOU NEED TO GET A LIFE!

let me check my records and get back to you on this

what version would you like me to be?

why do they call it CHAOS, anyway???

with ISC's track record, this'll change in a week, so lets just say BIND.

yes, it has one

why this question !!

All your zone are belong to us

Bind 0.9Alpha-Beta-Gamma

Curiosity.Killed.The.Cat

DNS, we aint got no stinkin DNS!

Do not know my version..Mom, what is my version?

Go exploit some other DNS

Hacker! Repent! Read John 3:16 in the Bible before it is too late.

In doing good, avoid notoriety. In doing evil, avoid self-awareness.

My mommy told me never to tell strangers my name...

NOTICE! YOUR ACCESS ATTEMPTS HAVE BEEN LOGGED. This is a PROPRIETARY SYSTEM restricted to OFFICIAL BUSINESS ONLY. The SYSTEM you are connecting with is part of the CRITICAL INFRASTRUCTURE of the United States as described in EXECUTIVE ORDER# 13010

Negative, I am a meat popsicle.

Of all the things I've lost, I miss my mind the most.

Off With Your HEAD!

Read carefully and you will see, it's nine point two point two rc (1)

Redirecting request to DNSAUTH1.SYS.GTEI.NET (whitehouse.gov)

Smile, you are on candid camera. Your query has been logged and reported

Some secure version

Symantec's DNS version of course! Doh!

That's a little too personal... Don't you think?

These are not the droids you're looking for.

This is where the version goes.

We run the good verison

What ever version you want it to be

Why the hell are you scanning this server....

Yes I know what version this is...

You didn't say Please

You show me yours and I'll show you mine.

another step toward chaos

bind of unknown vintage

chas-o-matic 0.1

this space for rent. contact hostmaster.

greater than 1.0

AmigaOS 2.x

Big Sky Net Name Server

Error formatting drive C: Retry, Ignore, Abort?

Move along, there's nothing to see here.

This Version

Version? I have no version control.

pretty recent

Knock twice to gain access.

Not tonight dear, I have a headache.

We didn't know you cared!

Life's gonna suck and then you'll die (and then you'll die and then you'll die), life's gonna suck and then you'll die - and it sucks pretty bad right now.

http://www.amazon.com/exec/obidos/ASIN/0596001584/

This is not the port you're looking for.

Dalej już nie musicie czytać.

==Kompletna lista (z usuniętymi niektórymi duplami i badziewiami)==

surely you must be joking

permission denied

None of your business

Unknown

[Secured]

DNS server

0.0.0

This is not the port you're looking for.

Not Available

yeah right

Not available

Sorry, not today.

No Thank you

I don't think so

Go away!

666

Unavailable

N/A

http://www.amazon.com/exec/obidos/ASIN/0596001584/

Life's gonna suck and then you'll die (and then you'll die and then you'll die), life's gonna suck and then you'll die - and it sucks pretty bad right now.

DNS Server

?

0.0

none of your business

no version

hello

Nice try, now go away !!!

I'm watching you.

you must be kidding

unknown version

i really don't think so

We didn't know you cared!

Surely, you must be joking...

Secured

Not tonight dear, I have a headache.

Nortel Networks - What do you want the Internet to be?

Information not available

9.something

purple

no_version

inconnue

You must be joking

Yeah, right!

What do you need that for?

Um, it's the latest one.

Not for public disclosure.

Not available.

None of your business.

NOYB

Knock twice to gain access.

Access Denied

x.x.x

x

wanadoo

surely you jest

pretty recent

none

logged

happy-bunny 4.9.1

Yow!

You are joking?

Yeah, right. Like I would tell you.

Why?

Who wants to know?

Version? I have no version control.

Undisclosed

Uncle Bud's DNS, Coon-dog revision

Unavailable.

Unauthorized

Not today guacomole boy!

Not Reported

None of Your Buisness

6.6.6

100.100.100

10.0.0

you've got to be kidding

undisclosed

the phantom menace

string

secret

null

information not available

blah blah blah

Your IP has been traced and logged.

You show me your version, I'll show you mine.

X

Why do you ask, Curious Cat?

Who cares?

VERSION 9999, 2001

UNKNOWN

This space intentionally left blank

This information is restricted, Your query has been logged.

This Version

Surely, you must be joking.

Special Build

Permission Denied

Off with your head!

Not-Implemented

Not Available.

None of your business!

No need to know

Move along, there's nothing to see here.

La bonne version de BIND ...

Hmm...

Guess!

Go away lamer!

Go Away!

Error formatting drive C: Retry, Ignore, Abort?

Cyber World Leader Kornet!

Big Sky Net Name Server

Are you joking?

AmigaOS 2.x

0.0.7

you gotta be kidding...

x.x.x.x

who is asking?

vquery-logged

version unavailable

version shmersion

version id withheld

version

unknow version

try harder than that...

this space for rent. contact hostmaster.

suppressed

secured

request logged and reported to abuse!

not your business

not allowed.

not allowed in this server

noneofyourbusiness

nocando

noViA

no version 0.0.0

no thanks

no

must be joking

like we'd tell you!!

klaatu barada nikto

its a secret

invalid-command

info not available

greater than 1.0

go away!

get a life

foo

depends on who you listen to

denied

chas-o-matic 0.1

bind of unknown vintage

are you joking?

another step toward chaos

access denied

[unknown]

[secure]

[Unavailable]

[Secured...]

You think I should tell you?

You show me yours and I'll show you mine.

You have to be kidding

You have been logged and reported.

You don't need to know this

You didn't say Please

You are too curious

Yes I know what version this is...

Yeah Right!

YES

Wouldn't you like to know

Would you like to know?

Why would you like to know ?

Why the hell are you scanning this server....

Why dont you just buzz off

Whatever you like!

What, me worry?

What ever version you want it to be

What do you care?

Welcome

We run the good verison

We don't like you. Go away!

Version information unavailable

Version Request Denied

Unwilling to comply

Unsupported

Unpublished.

This is where the version goes.

This information is not for you. Your attempted query has been logged.

Thffffftp!

These are not the droids you're looking for.

There is no version.

The latest! - Please call 763-784-2800 for service.

The information you have requested is unavailable

That's a little too personal... Don't you think?

Take a guess..

Symantec's DNS version of course! Doh!

Surely you're joking, Mr. Feynman

Surely you must be joking...

Surely you must be joking!

Surely you jest

Surely You Must Be Joking

Supah-dupah DNS v1.0

Suitably Adequate

Stupid Named

Sorry, that information is not publicly available.

Sorry, but I am not going to say !

Song Networks' DNS Server

Some secure version

Smile, you are on candid camera. Your query has been logged and reported

Segmentation Error

SeCuReD

STB

SI-DNS

Running BIND

Rosemary

Redirecting request to DNSAUTH1.SYS.GTEI.NET (whitehouse.gov)

Read carefully and you will see, it's nine point two point two rc (1)

Query not allowed

QUA?

Priviled Information. Alerting sysadmin! Actions logged!

PooPoo 666

Pack sand Buckwheet!

Off With Your HEAD!

Of all the things I've lost, I miss my mind the most.

OcUlTa!!!

Numero de version no disponible

Null

Now go away or I shall be forced to taunt you again!

Not your business.

Not today, and not tomorrow either.

Not telling

Not That One.

Nosy, nosy!

None of your business swimmer

None

No way!

Nick off! 8.1.2

Negative, I am a meat popsicle.

NOTICE! YOUR ACCESS ATTEMPTS HAVE BEEN LOGGED. This is a PROPRIETARY SYSTEM restricted to OFFICIAL BUSINESS ONLY. The SYSTEM you are connecting with is part of the CRITICAL INFRASTRUCTURE of the United States as described in EXECUTIVE ORDER# 13010

MyDNS 0.1 beta

My mommy told me never to tell strangers my name...

Maybe next time!

Maybe another time

Is it important?

Intekom (Pty) Ltd DNS - Why are you looking at this? ;)

In doing good, avoid notoriety. In doing evil, avoid self-awareness.

ICONZ funky DNS servers

I'm not going to tell you

I know not what you ask for.

I forget...

I don't know too.

I am not telling.

I am not going to tell you

I ain't tellin'

Hmmm ... ?

Hi Mom

Have some sand

Hacker! Repent! Read John 3:16 in the Bible before it is too late.

Guess

Good Bye

Go exploit some other DNS

Go away.

Get outta here with that thing!

Do not know my version..Mom, what is my version?

Denied

DNS, we aint got no stinkin DNS!

CuriousCat

Curiosity.Killed.The.Cat

C'est la meilleure des versions

Bugger Off DNS v. 666

Bob's big burger bar bingo bash

Bind Version 2020.4a

Bind 1.1 AmigaDOS 1.0a WorkBench 3.0

Bind 0.9Alpha-Beta-Gamma

Ask Administrator

Answer hazy. Ask again later.

All your zone are belong to us

A certain name server

666, btw we will consider finger print attempts malicious attempts

13eT h4x0r a13Rt!

1 billion

1 - get outta here

'Tis enough

why this question !!

Universidad de los Andes

your joking

you wish...

you wish

you should know ;-)

yes, it has one

yeah, right

ybox XP 5.41 color

x.y.z

wouldn't you like to know...

with ISC's track record, this'll change in a week, so lets just say BIND.

why do they call it CHAOS, anyway???

who wants to know?

who cares?

whatchew talking 'bout, willis?

what version would you like me to be?

whackerdoodle

versionless

version query failed

version 0

unknown version detected

unauthorized use prohibited

uhm??

try somewere else

tron.us.impsat.net

timmmmaayyy

surley you must be joking

surely you must be kidding

sunrise

sshg

si, seguro te la voy a decir asi de facil

si seguro...que gracioso!!

rentec dns server

querying version not allowed

platinum

penguin

pants

noway

not_allowed_to_look

not today

not supported

not implement

not found

not announced

nope

none specified

nobody is jailed, so sad

no disponible

my version string

mmm... gerbils!

m-i-c-k-e-y m-o-u-s-e

let me check my records and get back to you on this

if you can see this - YOU NEED TO GET A LIFE!

i.am.not.a.number

hmmm...

hmmm, have a nice day...

hide_the_version

hidden

has been owned like a bitch

guess something

gold

goaway

go fly a kite

for me to know, and you not to find out

for me to know and you to find out

errm go away

eleventy-billion and threeve

dont know

don't you wish?

dilbert

compiled by strong

cnone of your business

buzz off

arse

anything

an awsome one

a.b.c

[Secured !!! Please Go away idiot lamer ! ]

[Pourquoi faire ???]

Zero Cool 1.0

Your question is logged. Be careful.

Your guess is as good as mine

Your IP has been logged

You've gotta be kiddin' me!

You're kidding, right?

You must be kidding.

You must be kidding

You must be joking, right?

You hope that there is a 4.9.1 :-)

You don't need to know

You are not welcome here

You are not cleared for that information

Yeah right!!

Windows5.0

Windows NT mit der SHEEP FLAVOUR. Achtung!

Whyyaneedtaknow v 0.01

Why do you want to know?

Why do you ask?

Why do you ask, curious cat?

Why do You Need to Know?

Why did the chicken cross the road? Because Javier wanted to eat him!

Why are you wondering?

Who is John Galt?

Where?

Whatcha looking at Jonny

What do you want to know for?

What do you need to know for?

We already got one.

WTF?

Victorias secret

Version query not allowed

Version queries not supported.

Version not for public consumption

Version 000

Up to date

Unknown version and software

Turkey, Go Away and Gobble

To err is human, to fix is divine - hostmaster@nuri.net

This information isn't available.

This information is not for you baby. Please go away!!!

That information is not available

That I cannot say

Surely_you_must_be_joking

Surely you're joking..

Surely you must be kidding.

Surely you must be joking, don't call me Shirley.

Surely you must be joking, Mr. Feyman.

Surely you jest.

Sure I might tell you someday

Stop touching me there

Stop Probing. Go Away!

Sorry...

Secure :-(

Running BIND!

Rocky and Bullwinkle

Rock Hard Bind – Ultra Beta

Ripley's Believe it or Not

Right

Rick&Dave Inc.

Restricted to Authorized Personnel Only

Restricted Information. Unauthorized Access Prohibited.

Recent

Query Not Allowed.

Powered by Oreo's. Go away now.

Pooh was a bear of very little brain who frequently fell for a honeypot.

Pick a number between 1.1.1 and 10.10.10.

Permiso denegado...

PepBoys

Pay no attention to the man behind the curtain!

Pants

One Ring to rule them all, One Ring to find them, One Ring to bring them all and in the darkness bind them In the Land of Mordor, where the Shadows lie.

Nunya Damn Business

Not sure

Not so lucky, bozo!

Not authorized question!

Not allowed

Not a chance

Not Published

Not Avaliable

Nope

None of your damn business.

None of your DAMMNED Business

None of you business

NoInfo

No!!

No way

No version !

No thanks.

No information

No Answer

Nipa

Nice try, but go away now.

Nice try

Never you mind!

Name's BIND...James BIND...

NOVERSIONHERE

NOTICE! YOUR ACCESS ATTEMPTS HAVE BEEN LOGGED.The system you are connecting with is part of the CRITICALINFRASTRUCTURE of the United States as described in EXECUTIVE ORDERNUMBER 13010

NEW Version

NCC-1701. No bloody A, B, C or D!

My own version :-)

My You're Nosy!

Mind your own business

Meow! Meow!

Klaatu, Barada, Nikto.

Just send your damn query already

Juntos pero no Revueltos

It's a secret!

Intrusion attempt. This activity has been logged.

In your dreams

Illegal Operation

If you needed to know you would

If you need to know, just ask the hostmaster

If it works, it does not matter

I`m not here....

INS-6.6.6

I'm not sure, check back laster.

I like hamsters

I find your lack of a clue disturbing

I don't think so :(

I don't know

I am not Advertising my Version

Hyper MixMaster Smack-Fu 'Can you smell what the Rock is cookin' BIND

Hum...m

Hum....m

Huh?

Hey kiddie, do you think I'll give you this information that easily.

Happy Day!

Hallo, ich bin das neueste.

Hack Attack

Guess WHAT ?

Good!

Good Question

Go to Hell!

Go recurse yourself (TM) v 0.91

Go away, dude!

Go Pound Sand

Go Away, Friend ;)

Get Lost

Fresh Meat

Este no es el acceso que buscs. ;-))

Duh.. what's bind ?

Duct tape, coat hangers, and bubble-gum V3.1.

Don't you have something better to do with yer time?

Don't touch this, go away

Do not even try it

Dios Es Misericordioso, Bind Iddeo!

Damonized Named Internet Burp

DaNcE_BoY Va Da La Muie DacA Mai Incercatzi Cu Bindu` !!!

D2R2

Curious, eh? ;-)))

Connections Logged

Charmed, but Bye Bye

Can not locate ;)

Buzzoff 3000

Bug Off!

Bite Me!

Bind Something.Something.Whatever.9

Bind 0.2Alpha on a Commodore Amiga

Beanie and Cecil

Batman Stealth Ver 0.1a

BIND something

BIND Vpatched with eight billion severed connections

Ask the administrator.

As if I'd tell you ...

Apache server 3.2.22

ALL YOUR BASE ARE BELONG TO US

A version so current that it would make your eyes hurt if I really showed you

A version of BIND 9

A census taker once tried to test me. He ran bind as root. I ate his liver with some fava beans and a nice chianti.

:o)

:-P

---.. Go ...-- Away ....-

---.. Go ...-- Away .----

*maniacal laughter*

(Not telling)

A teraz trochę linków:

*Źródło listy "wersji" BINDa - http://packetfactory.openwall.net/

*Więcej o banner grabbingu - http://nfsec.pl/ai/2892

*Co to jest ten cały BIND - http://pl.wikipedia.org/wiki/BIND

Korzystanie z serwisu oznacza akceptację Regulaminu. Prywatność. Copyright – 1999-2018 INTERIA.PL, wszystkie prawa zastrzeżone.