https://www.clearsec.org/wikis/ise/ises/02_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB/Recent content in 网络攻击 on ClearSec WikiHugozh-cnFri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/02_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB/2_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/02_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB/2_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/<p>§02.1 基础</p> <h3 id="攻击原理表">攻击原理表</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/8cdbf969c5ced599bcbdf67b4cebdd6f_MD5.png" alt=""></p> <h3 id="网络攻击模型">网络攻击模型</h3> <p>自治主体：黑客自己写的工具来实行攻击。</p> <p>攻击效果——与CIA三性对应——重点。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/9698fc33b4161618e5395fbac3318831_MD5.jpg" alt="画板"></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/d385245cd11b15ad433f5ffb6ce5d5f6_MD5.png" alt=""></p> <h3 id="网络攻击发展趋势">网络攻击发展趋势</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/717455befdc99a236bfc9a059b480915_MD5.png" alt=""></p> <h3 id="网络攻击流程">网络攻击流程</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/77eecdbaf1afd22551c54d2d338a3994_MD5.png" alt=""></p> <h2 id="s22网络攻击常见技术方法">S2.2网络攻击常见技术方法</h2> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/dcf67f91487596ae6bdf69b6698797fc_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/a3bc2bc47032175ba9137c01730f2948_MD5.png" alt=""></p> <p>SYN 同步</p> <p>ACK 确认</p> <h3 id="端口扫描">端口扫描</h3> <p>开放的端口（监听状态）才能返回ACK确认信息</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/eff7dc1b684eb54e7f06d275208b9ef4_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/0c942d5ff5467c98d3b9cd0e36e75c7f_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/202a6e61a073b07235d89f8cc4ba268d_MD5.png" alt=""></p> <p>ID头扫描，假冒哑主机探测其他机器的端口。</p> <h3 id="口令破解">口令破解</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/0c4f3196fb4a06d129fcf4a45e0d8336_MD5.png" alt=""></p> <h3 id="缓冲区溢出攻击">缓冲区溢出攻击</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/2d0c94c5c3e469dd35dc13e3b9d8f626_MD5.png" alt=""></p> <p>缓冲区溢出 是 重点 案例题可能考察。涉及到C语言代码分析。</p> <h3 id="恶意代码">恶意代码</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/4789c54a3f603fa7fcb4384e228b649b_MD5.png" alt=""></p> <h3 id="拒绝服务攻击dos">拒绝服务攻击DOS</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/6bdde669fdcf3f821b07b4c1038e152a_MD5.png" alt=""></p> <p>其中，ICMP报文比较小，一般很难造成故障。例如 ping报文。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/c6db0f661e7a1ceaabeb4908b08776ac_MD5.png" alt=""></p> <p>ping of death利用了早期操作系统的漏洞。（又叫畸形报文攻击）</p> <p>泪滴攻击，也是畸形的，目标主机收到后无法正确组合报文。</p> <h3 id="网络钓鱼网络窃听sql注入攻击">网络钓鱼、网络窃听、SQL注入攻击</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/a5d85fd5791bf8195fe168df2479002b_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/4f1fefc4a13502b47072adbcd69a7152_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/d5d231aa066a7b4eb5506c526bac4966_MD5.png" alt=""></p> <h2 id="s23-黑客常用工具">S2.3 黑客常用工具</h2> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/4b2f395e77a49a074d211122ec386791_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86%E4%B8%8E%E5%B8%B8%E7%94%A8%E6%96%B9%E6%B3%95/de84dff3f71f451cbadf073e038fc626_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/02_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB/2.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/02_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB/2.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/<h3 id="ddos">DDOS</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/76a67562c9e000c1af2f6db406929561_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/016d49793c9eae2b9dcf9b69b2561a76_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/2a880a2ded62afd21f32f1e58528567f_MD5.png" alt=""></p> <h3 id="w32blasterworm">W32.Blaster.worm</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/81ef6f55e79e4031af15b097feb0544b_MD5.png" alt=""></p> <p>封堵135端口即可。</p> <h3 id="乌克兰电力攻击事件">乌克兰电力攻击事件</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/a6a512237d7d1fd619d539a1ca0d66fc_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/5ffc9de7c3701de0cd0885dba079d07e_MD5.png" alt=""></p> <h3 id="apt">APT</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/c817fcaa93c8f391f13f11b4e1d7d567_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A72.4_%E7%BD%91%E7%BB%9C%E6%94%BB%E5%87%BB%E6%A1%88%E4%BE%8B%E5%88%86%E6%9E%90/9e987add5c8edaf0a6d441a0f643f845_MD5.png" alt=""></p>