{"id":20839,"date":"2024-10-28T16:14:02","date_gmt":"2024-10-28T09:14:02","guid":{"rendered":"https:\/\/thegioifirewall.com\/?p=20839"},"modified":"2025-03-24T07:27:21","modified_gmt":"2025-03-24T07:27:21","slug":"mo-phong-cuoc-tan-cong-dos-trong-mang-noi-bo-va-cach-phong-chong-bang-sophos-firewall","status":"publish","type":"post","link":"https:\/\/vacif.com\/en\/mo-phong-cuoc-tan-cong-dos-trong-mang-noi-bo-va-cach-phong-chong-bang-sophos-firewall\/","title":{"rendered":"M\u00f4 ph\u1ecfng cu\u1ed9c t\u1ea5n c\u00f4ng DoS trong m\u1ea1ng n\u1ed9i b\u1ed9 v\u00e0 c\u00e1ch ph\u00f2ng ch\u1ed1ng b\u1eb1ng sophos firewall"},"content":{"rendered":"\n

Gi\u1edbi thi\u1ec7u<\/strong><\/p>\n\n\n\n

DoS (Denial of Service) l\u00e0 m\u1ed9t lo\u1ea1i t\u1ea5n c\u00f4ng m\u1ea1ng nh\u1eb1m l\u00e0m gi\u00e1n \u0111o\u1ea1n ho\u1eb7c ng\u0103n ch\u1eb7n d\u1ecbch v\u1ee5 c\u1ee7a m\u1ed9t h\u1ec7 th\u1ed1ng, m\u00e1y ch\u1ee7 ho\u1eb7c m\u1ea1ng. T\u1ea5n c\u00f4ng DoS th\u01b0\u1eddng \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng c\u00e1ch g\u1eedi m\u1ed9t l\u01b0\u1ee3ng l\u1edbn y\u00eau c\u1ea7u gi\u1ea3 m\u1ea1o \u0111\u1ebfn m\u1ee5c ti\u00eau, khi\u1ebfn cho n\u00f3 kh\u00f4ng th\u1ec3 x\u1eed l\u00fd c\u00e1c y\u00eau c\u1ea7u h\u1ee3p l\u1ec7 t\u1eeb ng\u01b0\u1eddi d\u00f9ng kh\u00e1c.<\/p>\n\n\n\n

C\u00f3 hai lo\u1ea1i t\u1ea5n c\u00f4ng DoS ch\u00ednh:<\/p>\n\n\n\n

    \n
  1. T\u1ea5n c\u00f4ng DoS \u0111\u01a1n l\u1ebb:<\/strong> Th\u1ef1c hi\u1ec7n b\u1edfi m\u1ed9t ngu\u1ed3n duy nh\u1ea5t, th\u01b0\u1eddng l\u00e0 m\u1ed9t m\u00e1y t\u00ednh ho\u1eb7c m\u1ed9t thi\u1ebft b\u1ecb.<\/li>\n\n\n\n
  2. T\u1ea5n c\u00f4ng DDoS (Distributed Denial of Service):<\/strong> S\u1eed d\u1ee5ng nhi\u1ec1u ngu\u1ed3n kh\u00e1c nhau (th\u01b0\u1eddng t\u1eeb m\u1ed9t m\u1ea1ng botnet) \u0111\u1ec3 t\u1ea5n c\u00f4ng c\u00f9ng m\u1ed9t l\u00fac, g\u00e2y kh\u00f3 kh\u0103n h\u01a1n trong vi\u1ec7c ch\u1ed1ng \u0111\u1ee1.<\/li>\n<\/ol>\n\n\n\n

    Overview<\/strong><\/p>\n\n\n\n

    B\u00e0i vi\u1ebft n\u00e0y m\u00f4 t\u1ea3 c\u00e1ch b\u1ea1n c\u00f3 th\u1ec3 b\u1ea3o v\u1ec7 m\u1ea1ng c\u1ee7a m\u00ecnh tr\u01b0\u1edbc c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng DoS v\u00e0 DDoS b\u1eb1ng T\u01b0\u1eddng l\u1eeda Sophos XGS. N\u00f3 \u0111\u01b0\u1ee3c chia th\u00e0nh ba ph\u1ea7n:<\/p>\n\n\n\n

      \n
    • C\u00e1ch T\u1ea5n c\u00f4ng DoS\/DDoS v\u00e0o firewall<\/li>\n\n\n\n
    • C\u00e1ch b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n kh\u1ecfi cu\u1ed9c t\u1ea5n c\u00f4ng DoS.<\/li>\n\n\n\n
    • C\u00e1ch b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n kh\u1ecfi m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng DDoS.<\/li>\n<\/ul>\n\n\n\n

      S\u01a1 \u0111\u1ed3 m\u1ea1ng<\/strong><\/p>\n\n\n\n

      \"\"\/<\/figure>\n\n\n\n

      Trong m\u00f4 h\u00ecnh ph\u00eda tr\u00ean, ta c\u00f3 2 m\u00e1y t\u00ednh \u0111\u01b0\u1ee3c c\u1ea5p dhcp t\u1eeb l\u1edbp m\u1ea1ng c\u00f3 IP l\u00e0 172.17.17.0\/24. M\u00e1y ch\u1ee7 server \u0111\u01b0\u1ee3c c\u1ea5p dhcp t\u1eeb l\u1edbp m\u1ea1ng c\u00f3 IP l\u00e0 172.17.18.0\/24. <\/p>\n\n\n\n

      Hacker x\u00e2m nh\u1eadp v\u00e0o \u0111\u01b0\u1ee3c m\u00e1y t\u00ednh c\u00f3 IP l\u00e0 172.17.17.13\/24 n\u1ed9i b\u1ed9 v\u00e0 g\u1eedi h\u00e0ng tri\u1ec7u g\u00f3i tin SYN \u0111\u1ebfn m\u00e1y ch\u1ee7 n\u1ed9i b\u1ed9 v\u1edbi c\u00e1c c\u1ed5ng ng\u1eabu nhi\u00ean g\u00e2y qu\u00e1 t\u1ea3i khi\u1ebfn trang web b\u1ecb s\u1eadp.<\/p>\n\n\n\n

      M\u00e1y t\u00ednh c\u1ee7a user c\u00f3 IP l\u00e0 172.17.17.11\/24 kh\u00f4ng th\u1ec3 truy c\u1eadp v\u00e0o server v\u00ec \u0111\u00e3 b\u1ecb s\u1eadp.<\/p>\n\n\n\n

      C\u00e1c b\u01b0\u1edbc c\u1ea5u h\u00ecnh<\/strong><\/p>\n\n\n\n

        \n
      1. C\u00e0i \u0111\u1eb7t m\u00f4i tr\u01b0\u1eddng t\u1ea5n c\u00f4ng DoS\/DDoS<\/li>\n<\/ol>\n\n\n\n

        + C\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m hack tr\u00ean m\u00f4i tr\u01b0\u1eddng Kali Linux trong Vmware Workstation<\/p>\n\n\n\n

        2.  C\u1ea5u h\u00ecnh ch\u1ed1ng DoS & spoof protection tr\u00ean Sophos FirewalFirewall<\/p>\n\n\n\n

        3. Ki\u1ec3m tra Log<\/p>\n\n\n\n

        H\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh<\/strong><\/p>\n\n\n\n

          \n
        1. C\u00e0i \u0111\u1eb7t m\u00f4i tr\u01b0\u1eddng t\u1ea5n c\u00f4ng DoS\/DDoS\u00a0<\/li>\n<\/ol>\n\n\n\n

          + C\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m hack tr\u00ean m\u00f4i tr\u01b0\u1eddng Kali Linux trong Vmware Workstation Tr\u00ean m\u00e1y m\u00ecnh \u0111\u1eb7t l\u00e0m m\u00e1y t\u1ea5n c\u00f4ng DoS <\/p>\n\n\n\n

          Kh\u1edfi ch\u1ea1y Kali Linux b\u1eb1ng file iso<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          T\u1ea3i pentmenu t\u1eeb github<\/strong> v\u1ec1 kali > V\u00e0o terminal ><\/strong> g\u00f5 l\u1ec7nh git clone https:\/\/github.com\/GinjaChris\/pentmenu.git  > cd pentmenu > sudo chmod +x pentmenu > nh\u1eadp password kali<\/strong><\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ping youtube.com \u0111\u1ec3 l\u1ea5y ip, \u1edf \u0111\u00e2y m\u00ecnh c\u00f3 ip l\u00e0 74.125.200.136<\/strong><\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          G\u00f5 l\u1ec7nh .\/pentmenu<\/strong> \u0111\u1ec3 v\u00e0o th\u01b0 m\u1ee5c pentmenu<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Sau khi v\u00e0o th\u01b0 m\u1ee5c pentmenu ><\/strong> Ch\u1ecdn h\u00ecnh th\u1ee9c t\u1ea5n c\u00f4ng l\u00e0 DOS > pentmenu: 2 > enter target IP\/hostname: 74.125.200.136 > enter source IP , or [r]andom or [i]nterface IP (default): Nh\u1eadp enter ><\/strong> c\u00e1c g\u00f3i ICMP \u0111\u00e3 \u0111\u01b0\u1ee3c g\u1eedi \u0111i<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          2.  C\u1ea5u h\u00ecnh ch\u1ed1ng DoS & spoof protection tr\u00ean Sophos FirewalFirewall<\/p>\n\n\n\n

          Ti\u1ebfp theo, v\u00e0o sophos firewall v\u00e0 b\u1eadt t\u00ednh n\u0103ng ch\u1eb7n t\u1ea5n c\u00f4ng ICMP > Intrusion prevention > DoS & spoof protection > \u1edf m\u1ee5c ICMP\/ICMPv6 flood > Source: Tick ch\u1ecdn Apply Flag > Destination: Tick ch\u1ecdn Apply Flag.<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ch\u00fang ta c\u00f3 th\u1ec3 th\u1ea5y sau khi t\u1ea5n c\u00f4ng ICMP th\u00ec tr\u00ean sophos firewall s\u1ebd ch\u1eb7n c\u00e1c g\u00f3i tin ICMP b\u1eb1ng c\u00e1ch dropped g\u00f3i.<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ngo\u00e0i ra c\u00f3 th\u1ec3 ki\u1ec3m tra t\u1ed1c \u0111\u1ed9 m\u1ea1ng  tr\u00ean m\u00e1y t\u00ednh c\u1ee7a user ch\u01b0a b\u1ecb hack v\u00e0 \u1edf trong m\u1ea1ng n\u1ed9i b\u1ed9 b\u1eb1ng c\u00e1ch d\u00f9ng speedtest tr\u00ean google<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n
          \"\"\/<\/figure>\n\n\n\n

          T\u01b0\u01a1ng t\u1ef1 nh\u01b0 v\u1eady, ch\u00fang ta t\u1ea5n c\u00f4ng b\u1eb1ng h\u00ecnh th\u1ee9c SYN flood > Pentmenu: 2 > Enter target: 142.250.197.14 > Enter target port (defaults to 80): 80 > Enter Source IP, or [r]andom or [i]nterface IP (default): Nh\u1eadp Enter > Enter number of data bytes to send (default 3000): 4000 ><\/strong> t\u1ea5n c\u00f4ng SYN flood s\u1ebd b\u1eaft \u0111\u1ea7u v\u1edbi t\u1ed1c \u0111\u1ed9 g\u1eedi 4000 g\u00f3i data<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          V\u00e0o Sophos Firewall v\u00e0 b\u1eadt t\u00ednh n\u0103ng ch\u1ed1ng DoS > Intrusion prevention > DoS & spoof protection > SYN flood ><\/strong> Source: <\/strong>tick ch\u1ecdn apply <\/strong>flag > Destination: Tick ch\u1ecdn apply flag<\/strong><\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          \u0110\u1ec3 ki\u1ec3m tra t\u1ea5n c\u00f4ng DoS th\u00ec v\u00e0o m\u1ee5c DoS attacks<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          T\u1ea5n c\u00f4ng UDP<\/strong><\/p>\n\n\n\n

          Pentmenu: 7 > Enter target: 142.250.198.46 > Enter random string (data to send): 1000 > Enter Source IP, or [r]andom or [i]nterface IP (default): Enter > <\/strong>T\u1ea5n c\u00f4ng UDP Flood b\u1eaft \u0111\u1ea7u ch\u1ea1y.<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ti\u1ebfp theo tr\u00ean Sophos Firewall > V\u00e0o m\u1ee5c Intrusion prevention > DoS & spoof protection > UDP flood > Source: Tick ch\u1ecdn Apply Flag > Destination: Tick ch\u1ecdn Apply Flag<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Sau \u0111\u00f3 v\u00e0o m\u1ee5c DoS attacks \u0111\u1ec3 ki\u1ec3m tra t\u1ea5n c\u00f4ng UDP flood<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ngo\u00e0i ra \u0111\u1ec3 xem log ><\/strong> v\u00e0o m\u1ee5c System services > Log settings ><\/strong> Tick ch\u1ecdn DoS attack<\/strong> \u0111\u1ec3 hi\u1ec3n th\u1ecb log DoS t\u1ea5n c\u00f4ng <\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          3. Ki\u1ec3m tra Log<\/p>\n\n\n\n

          Sau \u0111\u00f3 v\u00e0o m\u1ee5c Log viewer ><\/strong> firewall sophos s\u1ebd hi\u1ec3n th\u1ecb t\u1ea5n c\u00f4ng DoS v\u00e0 denied <\/strong>ch\u00fang<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n
          \"\"\/<\/figure>\n\n\n\n

          T\u1ea5n c\u00f4ng TCP flood<\/strong>
          <\/strong>Pentmenu: 4 > Enter target: 142.250.71.17 > Enter Source IP, or [r]andom or [i]nterface IP (default): Enter > Send data with ACK packet: y > Enter number of data bytes to send (default 3000): 10000 > <\/strong>T\u1ea5n c\u00f4ng TCP flood b\u1eaft \u0111\u1ea7u ch\u1ea1y<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Tr\u00ean Sophos Firewall > v\u00e0o m\u1ee5c Intrusion prevention > DoS & spoof protection > TCP flood > Source:<\/strong> tick ch\u1ecdn Apply Flag > Destination:<\/strong> Tick ch\u1ecdn Apply Flag<\/strong><\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Sau \u0111\u00f3 v\u00e0o m\u1ee5c DoS attacks \u0111\u1ec3 xem c\u00e1c g\u00f3i traffic c\u1ee7a DoS <\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ki\u1ec3m tra log c\u1ee7a DoS b\u1ecb denied<\/p>\n\n\n\n

          \"\"\/<\/figure>\n\n\n\n

          Ngo\u00e0i ra ch\u00fang ta c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng speedtest \u0111\u1ec3 ki\u1ec3m tra t\u1ed1c \u0111\u1ed9 m\u1ea1ng c\u1ee7a user ch\u01b0a b\u1ecb hack, c\u00e1c users trong l\u1edbp m\u1ea1ng n\u1ed9i b\u1ed9 b\u1ecb t\u1ea5n c\u00f4ng s\u1ebd y\u1ebfu \u0111i.<\/p>\n\n\n\n

          \"\"\/<\/figure>\n","protected":false},"excerpt":{"rendered":"

          Gi\u1edbi thi\u1ec7u DoS (Denial of Service) l\u00e0 m\u1ed9t lo\u1ea1i t\u1ea5n c\u00f4ng m\u1ea1ng nh\u1eb1m l\u00e0m gi\u00e1n \u0111o\u1ea1n ho\u1eb7c ng\u0103n ch\u1eb7n d\u1ecbch v\u1ee5 c\u1ee7a m\u1ed9t h\u1ec7 th\u1ed1ng, m\u00e1y ch\u1ee7 ho\u1eb7c m\u1ea1ng. T\u1ea5n c\u00f4ng DoS th\u01b0\u1eddng \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1eb1ng c\u00e1ch g\u1eedi m\u1ed9t l\u01b0\u1ee3ng l\u1edbn y\u00eau c\u1ea7u gi\u1ea3 m\u1ea1o \u0111\u1ebfn m\u1ee5c ti\u00eau, khi\u1ebfn cho n\u00f3 kh\u00f4ng th\u1ec3 x\u1eed […]<\/p>\n","protected":false},"author":8,"featured_media":20373,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[80],"tags":[510,193],"class_list":["post-20839","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-huong-dan-tai-lieu","tag-dos","tag-sophos","entry","has-media"],"_links":{"self":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/20839","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/comments?post=20839"}],"version-history":[{"count":1,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/20839\/revisions"}],"predecessor-version":[{"id":21104,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/20839\/revisions\/21104"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media\/20373"}],"wp:attachment":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media?parent=20839"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/categories?post=20839"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/tags?post=20839"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}