浅谈Mysql蜜罐识别

Info:
Protocol：10
Version：5.5.53
ThreadId：1
Language：utf8_general_ci
Salt：uQsoT6Ppd&+Gb95<l0EJ
Authentication_Plugin：mysql_native_password
TypeName:ServerCapabilities
????new?more?secure?passwords:Set
????Found?instead?of?affected?rows:Set
????Get?all?column?flags:Set
????One?can?specify?db?on?connect:Set
????Do?not?allow?database.table.column:Set
????Can?use?compression?protocol:Set
????Odbc?client:Set
????Can?use?LOAD?DATA?LOCAL:Set
????Ignore?spaces?before?'(':Set
????new?more?secure?passwords:Set
????This?is?an?interactive?client:Set
????Switch?to?SSL?after?handshake:NoSet
????IGNORE?sigpipes:Set
????Client?knows?about?transactions:Set
????Old?flag?for?4.1?protocol:Set
????New?4.1?authentication:Set
TypeName:ServerStatus
????In?transaction:NoSet
????AUTO_COMMIT:Set
????Multi?query?/?Unused:NoSet
????More?results:NoSet
????Bad?index?used:NoSet
????No?index?used:NoSet
????No?index?used:NoSet
????Last?row?sent:NoSet
????Database?dropped:NoSet
????No?backslash?escapes:NoSet
????Metadata?changed:NoSet
????Query?was?slow:NoSet
????PS?Out?Params:NoSet
????In?Trans?Readonly:NoSet
????Session?state?changed:NoSet
TypeName:ExtendedServerCapabilities
????Multiple?statements:Set
????Multiple?results:Set
????PS?Multiple?results:Set
????Plugin?Auth:Set
????Connect?attrs:NoSet
????Plugin?Auth?LENENC?Client?Data:NoSet
????Client?can?handle?expired?passwords:NoSet
????Session?variable?tracking:NoSet
????Deprecate?EOF:NoSet

通过ThreadId 识别蜜罐

通过Salt(盐) 识别蜜罐

通过Mysql拉黑机制来判断目标是否为蜜罐

通过登录验证识别蜜罐

常见的有，Mysql读取客户端任意文件并且没有实现认证的如下：

https://github.com/Gifts/Rogue-MySql-Server

https://gitee.com/lauix/HFish

特点就是输入任意用户名和密码都会显示登录成功。

准确率：百分之百。

通过认证成功后第一条命令返回包识别

登陆成功后通过sql命令识别

查看重要的数据库以及表

#?统计所有访问过的表次数:库名,表名,访问次数
select?table_schema,table_name,sum(io_read_requests+io_write_requests)?io?from?sys.schema_table_statistics?group?by?table_schema,table_name?order?by?io?desc;

查看当前正在登录的用户

#?查看所有正在连接的用户详细信息:连接的用户(连接的用户名,连接的ip),当前库,用户状态(Sleep就是空闲),现在在执行的sql语句,上一次执行的sql语句,已经建立连接的时间(秒)
SELECT?user,db,command,current_statement,last_statement,time?FROM?sys.session;

通过数据库历史连接记录

#?查看所有曾连接数据库的IP,总连接次数
SELECT?host,total_connections?FROM?sys.host_summary

总结