【电子数据取证】APK背面服务器的真实IP位置挖掘
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">文案</span>关键词：电子数据取证、手机取证、介质取证、电脑取证</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">1、</span>前言</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">想必<span style="color: black;">大众</span>对APK进行分析的时候会经常遇到<span style="color: black;">非常多</span>IP<span style="color: black;">位置</span>，而这些IP对<span style="color: black;">咱们</span><span style="color: black;">来讲</span>都要去进行分析和研判，<span style="color: black;">那样</span>面临的问题来了，<span style="color: black;">咱们</span>该<span style="color: black;">怎样</span>快速找到跟案件<span style="color: black;">关联</span>的真实IP呢，下面<span style="color: black;">起始</span><span style="color: black;">咱们</span><span style="color: black;">这次</span>的分享。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">2、</span>案件背景</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">在诈骗<span style="color: black;">或</span>赌博类的案件中都是<span style="color: black;">经过</span>APP<span style="color: black;">或</span>某个网站的方式进行诱骗<span style="color: black;">行径</span>，而在<span style="color: black;">咱们</span>的工作中就需要对这几类的APK<span style="color: black;">或</span>网站进行分析以及溯源的操作，<span style="color: black;">经过</span>分析拿取到<span style="color: black;">非常多</span>的IP以及部分数据后，<span style="color: black;">怎样</span>去确认这些IP及溯源信息就<span style="color: black;">显现</span>了以下问题。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">问题一：无效IP调证回来的服务器镜像。后果：后台数据<span style="color: black;">显现</span>缺失，<span style="color: black;">原由</span>：大部分进行诱骗的服务器或网站是存在不<span style="color: black;">定时</span>进行跟换原服务器。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">问题二：时间的浪费。后果：调证过程时间问题，服务器数据更换；</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">原由</span>：大部分进行诱骗的服务器或网站是存在不<span style="color: black;">定时</span>进行跟换原服务器。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">3、</span>CDN是什么</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">CDN即内容分发网络，<span style="color: black;">重点</span><span style="color: black;">处理</span>传输距离和<span style="color: black;">区别</span>运营商节点<span style="color: black;">导致</span>网路速度性能底下的问题。<span style="color: black;">能够</span>理解为节点缓存服务器，把用户经常<span style="color: black;">拜访</span>的资源直接缓存节点服务器，每当用户发送请求时，会直接发送得到距离用户<span style="color: black;">近期</span>的节点服务器响应给用户，当用户有<span style="color: black;">实质</span>数据交互时才会从远程WEB服务器响应，<span style="color: black;">这般</span><span style="color: black;">能够</span>大大<span style="color: black;">加强</span>响应时间（类似网络中继设备<span style="color: black;">功效</span>）<span style="color: black;">因此</span><span style="color: black;">目的</span>采用了CDN服务，<span style="color: black;">咱们</span>ping通的域名，仅是离<span style="color: black;">咱们</span><span style="color: black;">近期</span>的节点服务器，<span style="color: black;">这般</span>，<span style="color: black;">咱们</span><span style="color: black;">没法</span>确认真实的ip<span style="color: black;">位置</span>；</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">4、</span>真实IP寻找<span style="color: black;">办法</span></strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;">4.1、<span style="color: black;">首要</span>判断<span style="color: black;">目的</span>服务器<span style="color: black;">是不是</span><span style="color: black;">运用</span>了CDN：</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">咱们</span><span style="color: black;">能够</span>在站长之家的Whois中找到多地ping中进行操作，在多个地区进行ping通服务器的操作；看返回ip<span style="color: black;">是不是</span>一致，若一致则<span style="color: black;">无</span><span style="color: black;">运用</span>CDN，若<span style="color: black;">显现</span>有规律或ip不一致则，<span style="color: black;">运用</span>了CDN。如下图：</p>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-axegupay5k/0f4d51f3e44c4f6889862afbc9bf1a21~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=UbtuVwB9HgT7eOTWMmftFQu9MgI%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/297d5c5f81464a4290dc15dd242505ff~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=lg0gXEyzk1MHAr1uhrj5P3C85zU%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;">4.2、<span style="color: black;">查询</span>真实IP<span style="color: black;">办法</span></strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>1：<span style="color: black;">运用</span><span style="color: black;">nslookup</span>进行检测。</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">原理同上，<span style="color: black;">倘若</span>返回域名解析对应多个IP<span style="color: black;">位置</span>多半是<span style="color: black;">运用</span>了 CDN。</p>有CDN示例，如下图：
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p26-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/8a8d4f2ccbcc4090abdf74b0fc97153e~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=6bo8ifXWGspnR9BhGoUEIYn6z10%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/bdc843e7056f4d93a0a3c5357f4e6aeb~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=f%2Fb0Zzx0xJvuJAiiWm4nSlLNRyM%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">无CDN示例，如下图：：</p>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p26-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/40bc329f5f554355b504ba411fc8b02f~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=W%2B3H%2BorRPr8D4IphYRljBZQlSyM%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/9f287f19ed5140d9a48cdb900e1ddbfe~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=ynKUdOt5gs3N5syLeTWHKxQz37U%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>2：<span style="color: black;">查找</span>子域名</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">其实CDN 还是比较贵的，<span style="color: black;">因此</span><span style="color: black;">非常多</span>站长可能只会对主站<span style="color: black;">或</span>流量<span style="color: black;">很强</span>的子网站点做了<strong style="color: blue;"><span style="color: black;">CDN</span></strong>加速，而<span style="color: black;">非常多</span>小网站的站点又跟主站在同一台服务器<span style="color: black;">或</span>在同一个C段网络内，<span style="color: black;">因此呢</span>就可以<span style="color: black;">经过</span><span style="color: black;">查找</span>子域名来<span style="color: black;">查询</span>对应的IP来辅助<span style="color: black;">查询</span>网站的真实IP。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">运用</span>网站有：微步在线（<strong style="color: blue;"><span style="color: black;">https://x.threatbook.com/</span></strong>）。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">微步网站在线功能很强大，有<span style="color: black;">有些</span>黑客只需输入要<span style="color: black;">查询</span>的域名(如baidu.com)，点击子域名选项就<span style="color: black;">能够</span><span style="color: black;">查询</span>它的子域名了，<span style="color: black;">然则</span>免<span style="color: black;">花费</span>户每月<span style="color: black;">仅有</span>5次免费<span style="color: black;">查找</span>机会，<span style="color: black;">然则</span>貌似会员<span style="color: black;">能够</span><span style="color: black;">始终</span><span style="color: black;">运用</span>，有钱的大哥<span style="color: black;">能够</span>冲个会员。如下图：</p>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/2ac8fae859fa47a5a9c6a02020ca0a9f~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=SuKKfQZJdwLtMRpYm9J3WC%2BWJoU%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/0abdd50b3a76495298d72b0f68b3b664~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=WMrqGlARB149qY%2BgDsQ6LDDAjfM%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>3：Dnsdb<span style="color: black;">查找</span>法。(</strong>https://dnsdb.io/zh-cn/<strong style="color: blue;">)</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">这个网站应该是需要到外网<span style="color: black;">才可</span>进行<span style="color: black;">查找</span>，只需输入baidu.com type:A就能收集百度的子域名和ip了。如下图：</p>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/d7ec3040c02242c2b538c09fa8ee3860~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=0J1AZqzRIBKdCmaxozE1SVBbG1E%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/cf3b6b51e5634257b122461395fb4349~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=njYZmjq3jtZG3%2BsSCmhvGtF6IZ8%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>4：网络空间引擎搜索法</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">fofa相比于其他的类似的引擎搜索法网站<span style="color: black;">运用</span>率是比较高的，<span style="color: black;">平常</span>的有以前的钟馗之眼，shodan，fofa（<strong style="color: blue;"><span style="color: black;">https://fofa.info/</span></strong>）搜索。<span style="color: black;">咱们</span><span style="color: black;">这儿</span>以fofa为例，只需输入：<strong style="color: blue;"><span style="color: black;">title:“网站的title关键字”<span style="color: black;">或</span>body：“网站的body特征</span></strong>”就<span style="color: black;">能够</span>找出fofa收录的有这些关键字的ip域名，<span style="color: black;">非常多</span>时候能获取网站的真实ip。如下图：</p>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/cf8e8678a35c41109ea342c50d92b84d~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=ZBltbKlQOo%2B5d%2Bw6oB3X%2Fsr9flQ%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/02d94e95e5fb417bb1954aa252663b32~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=L3rspwJ%2BOFI4m73fezz7uWXefZU%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>5：SSL证书</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"> 假如在www.baidu.com上托管了一个服务,原始服务器IP是136.23.62.11，而网速会为你<span style="color: black;">供给</span>DDoS<span style="color: black;">守护</span>，Web应用程序防火墙等服务，以<span style="color: black;">守护</span>你的服务免受攻击。为此，你的Web服务器就必须支持SSL并<span style="color: black;">拥有</span>证书，<span style="color: black;">才可</span>进行正常的<span style="color: black;">运用</span>。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">Censys（<strong style="color: blue;"><span style="color: black;">https://censys.io/ipv4</span></strong>）工具就能实现对<span style="color: black;">全部</span>互联网的扫描，Censys是一款用以搜索联网设备信息的新型搜索引擎，能够扫描<span style="color: black;">全部</span>互联网，Censys会将互联网所有的<strong style="color: blue;"><span style="color: black;">ip</span></strong>进行扫面和连接，以及证书探测。若<span style="color: black;">目的</span>站点有https证书，并且默认虚拟主机配了https证书，<span style="color: black;">咱们</span>就<span style="color: black;">能够</span>找所有目标站点是该https证书的站点。如下图：</p>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/8154509ea07c4dcf806ce39ed1a327a1~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=An1Pfem1%2FF%2BmWEFlUvUidi86soI%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p26-sign.toutiaoimg.com/tos-cn-i-6w9my0ksvp/9fe3dd39a85f4491b46413926acea312~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1727804099&x-signature=L%2Bcz4QKMe4RNjlqZ%2FrQvjwiRqS0%3D" style="width: 50%; margin-bottom: 20px;"></div>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">编辑</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>6：DNS解析</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"> <span style="color: black;">通常</span>网站从<span style="color: black;">安排</span><span style="color: black;">起始</span>到<span style="color: black;">运用</span>CDN都有一个过程，周期<span style="color: black;">倘若</span>较长的话 则<span style="color: black;">能够</span><span style="color: black;">经过</span>这类历史解析记录<span style="color: black;">查找</span>等方式获取<strong style="color: blue;"><span style="color: black;">源站IP</span></strong>，查看<strong style="color: blue;"><span style="color: black;">IP与域名</span></strong>绑定的历史记录，可能会存在<span style="color: black;">运用</span>CDN前的记录。找国外的比较偏僻的DNS解析服务器进行DNS<span style="color: black;">查找</span>，<span style="color: black;">由于</span>大部分CDN<span style="color: black;">供给</span>商只针对国内市场，而对<strong style="color: blue;"><span style="color: black;">国外</span></strong>市场几乎是不做CDN，<span style="color: black;">因此</span>有很大的几率会直接解析到<strong style="color: blue;"><span style="color: black;">真实IP</span></strong> 。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">全国DNS<span style="color: black;">查找</span><span style="color: black;">位置</span>（仅供参考）：</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">https://dnshistory.org/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://whoisrequest.com/history/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">https://completedns.com/dns-history/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://dnstrails.com/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">https://who.is/domain-history/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://research.domaintools.com/research/hosting-history/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://site.ip138.com/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://viewdns.info/iphistory/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">https://dnsdb.io/zh-cn/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">https://www.virustotal.com/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">https://x.threatbook.cn/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://viewdns.info/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://www.17ce.com/</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">http://toolbar.netcraft.com/site_report?url=</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">全世界</span> CDN 服务商<span style="color: black;">查找</span>_专业<span style="color: black;">精细</span>的IP库服务商_IPIP</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">办法</span>7：网站邮件头信息</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">邮箱注册，邮箱找回<span style="color: black;">秘码</span>、RSS邮件订阅等功能场景，<span style="color: black;">经过</span>网站给自己发送邮件，从而让<span style="color: black;">目的</span>主动暴露<span style="color: black;">她们</span>的<strong style="color: blue;"><span style="color: black;">真实的IP</span></strong>，查看邮件头信息，获取到网站的真实IP。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><strong style="color: blue;"><span style="color: black;">3、</span>总结</strong></p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">上面<span style="color: black;">便是</span><span style="color: black;">咱们</span><span style="color: black;">这次</span>对<span style="color: black;">怎样</span>绕过CDN找到真实IP的分享，<span style="color: black;">大众</span><span style="color: black;">能够</span>在测试<span style="color: black;">或</span>案件中进行分析尝试，<span style="color: black;">亦</span><span style="color: black;">包含</span><span style="color: black;">此刻</span>网络上<span style="color: black;">亦</span>存在其他<span style="color: black;">办法</span><span style="color: black;">能够</span>绕过CND，<span style="color: black;">大众</span><span style="color: black;">亦</span><span style="color: black;">能够</span>进行“度娘”<span style="color: black;">查找</span>。</p>
<p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"> </p>
期待你更多的精彩评论，一起交流学习。 外贸B2B平台有哪些？
页:
[1]