# 🕵️ Tor Ovi: NorthLine Logistika Tarmoq Forensikasi > ⚠️ **Live muhit yo'q.** Bu — to'liq statik tarmoq-forensika topshirig'i. Pastda keltirilgan barcha jurnal fayllari (Zeek `conn.log`/`dns.log`/`ssl.log`), paket namunasi, aktivlar jadvali va ThreatIntel ma'lumotlari — ushbu topshiriq uchun tayyorlangan **to'liq va yetarli** dalillar to'plami. Hech qanday tashqi serverga ulanish, skan qilish yoki qo'shimcha ma'lumot yig'ish shart emas va imkonsiz — javob faqat quyidagi matndan hisoblab chiqariladi. > > 📌 **Diqqat:** quyidagi barcha tashqi (internal bo'lmagan) IP-manzillar — `192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24` — RFC 5737 bo'yicha rasmiy ravishda **hujjatlashtirish uchun ajratilgan** diapazonlar. Ular hech qanday real serverga tegishli emas, faqat shu ta'lim topshirig'i uchun to'qilgan. --- ## 🏢 Ssenariy Siz **NorthLine Logistika** MChJ xavfsizlik bo'limida ishlaydigan tarmoq forensika tahlilchisisiz. Bugun ertalab DLP (Data Loss Prevention) tizimi "siyosatga zid tashqi ulanish" turkumida ogohlantirish berdi: kompaniya siyosatiga ko'ra **barcha tashqi (internet) trafik faqat korporativ proksi-server orqali o'tishi shart**, biroq monitoring sensori (Zeek) bir nechta ish stansiyasidan proksini chetlab o'tgan to'g'ridan-to'g'ri tashqi ulanishlarni qayd etdi. IT xavfsizlik bo'limi voqea vaqtidagi (2026-06-18, soat 13:00–13:42, mahalliy vaqt, Asia/Tashkent) barcha tegishli statik eksportlarni sizga uzatdi. Sizning vazifangiz ikkita savolga aniq dalillar bilan javob berish: 1. Qaysi ish stansiyasi shaxsiy **VPN/proksi xizmati** orqali siyosatni buzgan (bu — jiddiy, lekin "oddiyroq" buzilish)? 2. Qaysi ish stansiyasi haqiqatan **Tor tarmog'i** orqali ulangan (bu — eng jiddiy topilma, chunki Tor orqali o'tgan trafikning **mazmuni butunlay ko'rinmay qoladi**)? To'rtta shubhali (yoki nazorat uchun bazaviy) ish stansiyasi bor. Ularning orasida **faqat bittasi** — haqiqiy Tor foydalanuvchisi. Qolganlari — turli darajadagi "yem" (decoy): biri butunlay begunoh (CDN'ga to'g'ridan-to'g'ri chiqish), biri siyosatni buzgan-u lekin Tor emas (shaxsiy VPN/SOCKS-proksi), biri esa nazorat tizimining o'zi (bazaviy shovqin). --- ## 🌐 1. Tarmoq topologiyasi va xavfsizlik siyosati ```text Ichki VLAN45 (10.40.12.0/24, ish stansiyalari) | +--> 10.40.0.9:3128 [corp-proxy] Squid — YAGONA rasman ruxsat etilgan chiqish yo'li +--> 10.40.0.2:53 [dns-int] Ichki DNS resolver (barcha workstation shu yerga so'rov yuboradi) +--> 10.40.0.5:514 [siem] Markazlashgan log yig'uvchi (syslog) | === TRUST BOUNDARY: VLAN45 -> Internet (faqat corp-proxy orqali ruxsat berilishi kerak) === | [Internet — tashqi IP-manzillar] ``` **Xavfsizlik siyosati (ichki hujjat, SEC-POL-11, 3-band):** > "Barcha xodim ish stansiyalaridan tashqi tarmoqqa chiqish faqat `corp-proxy` (10.40.0.9:3128) orqali amalga oshiriladi. To'g'ridan-to'g'ri tashqi ulanish (proksi'ni chetlab o'tish), shaxsiy VPN/proksi xizmatlaridan foydalanish va Tor/anonimlashtiruvchi tarmoqlardan foydalanish — barchasi qat'iyan taqiqlanadi." **Nega to'g'ridan-to'g'ri ulanishlar umuman FIREWALL loglarida "ALLOW" bo'lib qolgan? (ichki ticket IT-4482, 2026-06-15):** > "VLAN45 uchun 443/9001/1080 portlariga to'g'ridan-to'g'ri chiquvchi trafikni bloklovchi qoida hamkor-integratsiyani debug qilish maqsadida vaqtincha o'chirilgan edi ('faqat 2 soatga' deb rejalashtirilgan). Qoidani qayta yoqish unutilib qolgan — bu holat 2026-06-18 kuni ham davom etmoqda." Bu shuni anglatadiki: quyidagi jurnallarda ko'ringan **to'g'ridan-to'g'ri tashqi ulanishlar hammasi ham buzilish emas** — ba'zilari shunchaki (endi ochiq qolgan teshikdan foydalanib) benign CDN-ga chiqish bo'lishi mumkin. Har birini alohida dalillar bilan baholash kerak. --- ## 💻 2. Aktivlar jadvali (DHCP static lease / AD inventar) | IP-manzil | MAC-manzil | Hostname | Foydalanuvchi | Bo'lim | |---|---|---|---|---| | 10.40.12.11 | 3C:EA:9F:AA:11:04 | `WKST-ACCT-04` | B. Raximova | Buxgalteriya | | 10.40.12.23 | 3C:EA:9F:AA:23:09 | `WKST-DEV-09` | J. Tashkentov | IT / Dasturlash | | 10.40.12.37 | 3C:EA:9F:AA:37:02 | `WKST-HR-02` | M. Yusupova | HR | | 10.40.12.51 | 3C:EA:9F:AA:51:06 | `WKST-FIN-06` | F. Qodirova | Moliya | | 10.40.12.45 | 3C:EA:9F:AA:45:01 | `WKST-SOC-01` | (xizmat hisobi) | Xavfsizlik — Zeek sensori/SIEM agenti ishlaydigan monitoring stansiyasi | --- ## 📄 3. Zeek `conn.log` — ulanish jurnali (JSON, 2026-06-18, 13:00:00–13:42:00) > Qisqacha lug'at: `id.orig_h/p` — boshlovchi (ichki host/port); `id.resp_h/p` — qabul qiluvchi; `duration` — soniyalarda; `orig_bytes`/`resp_bytes` — yuborilgan/qaytgan baytlar; `conn_state` — `SF` (to'liq boshlanib, to'liq yopilgan), `S1` (ulanish ochilgan, kuzatuv oynasi tugaganda hali yopilmagan holda davom etayotgan edi); `service` — Zeek aniqlagan ilova protokoli (`-` = aniqlanmagan/oddiy TCP oqimi). ```json {"ts": "2026-06-18T13:02:11.104", "uid": "CHhV0a3s02qzX8pTja", "id.orig_h": "10.40.12.11", "id.orig_p": 50521, "id.resp_h": "10.40.0.9", "id.resp_p": 3128, "proto": "tcp", "service": "http", "duration": 4.21, "orig_bytes": 812, "resp_bytes": 15234, "conn_state": "SF"} {"ts": "2026-06-18T13:19:47.501", "uid": "CN2mQd1kLp9fZ7hRac", "id.orig_h": "10.40.12.11", "id.orig_p": 50890, "id.resp_h": "10.40.0.9", "id.resp_p": 3128, "proto": "tcp", "service": "http", "duration": 2.07, "orig_bytes": 640, "resp_bytes": 9021, "conn_state": "SF"} {"ts": "2026-06-18T13:00:00.000", "uid": "C8jYtR3mNb1qWv5Ldx", "id.orig_h": "10.40.12.45", "id.orig_p": 51000, "id.resp_h": "10.40.0.5", "id.resp_p": 514, "proto": "tcp", "service": "syslog", "duration": 2520.0, "orig_bytes": 512000, "resp_bytes": 2048, "conn_state": "S1"} {"ts": "2026-06-18T13:05:01.220", "uid": "CqjK2s7YxLm0Tn4Rpz", "id.orig_h": "10.40.12.37", "id.orig_p": 52110, "id.resp_h": "203.0.113.10", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 3.81, "orig_bytes": 2100, "resp_bytes": 88400, "conn_state": "SF"} {"ts": "2026-06-18T13:22:41.330", "uid": "CrX93bWq1oNs6Yh2Ac", "id.orig_h": "10.40.12.37", "id.orig_p": 52390, "id.resp_h": "203.0.113.11", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 5.14, "orig_bytes": 3050, "resp_bytes": 152300, "conn_state": "SF"} {"ts": "2026-06-18T13:00:44.812", "uid": "CfV71pLk9RmZ3sQd0j", "id.orig_h": "10.40.12.51", "id.orig_p": 53012, "id.resp_h": "198.51.100.50", "id.resp_p": 1080, "proto": "tcp", "service": "-", "duration": 2510.6, "orig_bytes": 118500000, "resp_bytes": 512300000, "conn_state": "S1"} {"ts": "2026-06-18T13:01:02.900", "uid": "CbP4t8Kx0YqL2mRj5s", "id.orig_h": "10.40.12.23", "id.orig_p": 54011, "id.resp_h": "203.0.113.45", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 1.92, "orig_bytes": 1400, "resp_bytes": 60200, "conn_state": "SF"} {"ts": "2026-06-18T13:07:16.410", "uid": "CjM6y2Vb8QpXd0Rn3z", "id.orig_h": "10.40.12.23", "id.orig_p": 54390, "id.resp_h": "203.0.113.46", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 1.24, "orig_bytes": 900, "resp_bytes": 21000, "conn_state": "SF"} {"ts": "2026-06-18T13:00:05.117", "uid": "CxT0q5Zm3WkP7bVy1d", "id.orig_h": "10.40.12.23", "id.orig_p": 54500, "id.resp_h": "198.51.100.202", "id.resp_p": 9001, "proto": "tcp", "service": "ssl", "duration": 2.83, "orig_bytes": 620, "resp_bytes": 4360, "conn_state": "SF"} {"ts": "2026-06-18T13:00:11.008", "uid": "CpN8b1Xy6LqR4mTz2f", "id.orig_h": "10.40.12.23", "id.orig_p": 54502, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 240.5, "orig_bytes": 48210, "resp_bytes": 397640, "conn_state": "SF"} {"ts": "2026-06-18T13:14:20.339", "uid": "CzK3d9Wp0MvB7sXq4h", "id.orig_h": "10.40.12.23", "id.orig_p": 54780, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 310.2, "orig_bytes": 61200, "resp_bytes": 455900, "conn_state": "SF"} {"ts": "2026-06-18T13:27:05.774", "uid": "CmR5f2Yt8NcD1oLw9k", "id.orig_h": "10.40.12.23", "id.orig_p": 55021, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 295.7, "orig_bytes": 58900, "resp_bytes": 402100, "conn_state": "SF"} {"ts": "2026-06-18T13:39:02.615", "uid": "CwQ7g4Ur2PbE5nZx8m", "id.orig_h": "10.40.12.23", "id.orig_p": 55290, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "proto": "tcp", "service": "ssl", "duration": 165.0, "orig_bytes": 30200, "resp_bytes": 210500, "conn_state": "S1"} ``` --- ## 📄 4. Zeek `dns.log` — ichki resolver (10.40.0.2) so'rovlari ```json {"ts": "2026-06-18T13:02:10.850", "uid": "CHhV0a3s02qzX8pTja", "id.orig_h": "10.40.12.11", "id.orig_p": 50520, "id.resp_h": "10.40.0.2", "id.resp_p": 53, "query": "proxy.corp.local", "qtype_name": "A", "answers": ["10.40.0.9"], "TTLs": [3600]} {"ts": "2026-06-18T13:05:00.710", "uid": "Ca1Nb6Jk2QpZ9RmWtx", "id.orig_h": "10.40.12.37", "id.orig_p": 52109, "id.resp_h": "10.40.0.2", "id.resp_p": 53, "query": "cdn-a.updatehub-example.net", "qtype_name": "A", "answers": ["203.0.113.10"], "TTLs": [300]} {"ts": "2026-06-18T13:22:40.510", "uid": "Cb2Pc7Kl3RqA0SnXuy", "id.orig_h": "10.40.12.37", "id.orig_p": 52389, "id.resp_h": "10.40.0.2", "id.resp_p": 53, "query": "cdn-b.updatehub-example.net", "qtype_name": "A", "answers": ["203.0.113.11"], "TTLs": [300]} {"ts": "2026-06-18T13:00:42.203", "uid": "Cc3Qd8Lm4StB1ToYvz", "id.orig_h": "10.40.12.51", "id.orig_p": 53011, "id.resp_h": "10.40.0.2", "id.resp_p": 53, "query": "gateway2.secureline-vpn-example.net", "qtype_name": "A", "answers": ["198.51.100.50"], "TTLs": [60]} {"ts": "2026-06-18T13:01:00.415", "uid": "Cd4Re9Mn5TuC2UpZwa", "id.orig_h": "10.40.12.23", "id.orig_p": 54010, "id.resp_h": "10.40.0.2", "id.resp_p": 53, "query": "github.com", "qtype_name": "A", "answers": ["203.0.113.45"], "TTLs": [300]} {"ts": "2026-06-18T13:07:15.660", "uid": "Ce5Sf0No6UvD3VqAxb", "id.orig_h": "10.40.12.23", "id.orig_p": 54389, "id.resp_h": "10.40.0.2", "id.resp_p": 53, "query": "pypi.org", "qtype_name": "A", "answers": ["203.0.113.46"], "TTLs": [300]} ``` > Diqqat: yuqoridagi ro'yxat **to'liq** — ushbu vaqt oynasida ichki resolver qabul qilgan barcha DNS so'rovlari shu 6 tasi. Agar biror `conn.log` yozuvidagi tashqi IP uchun bu yerda mos A-record topolmasangiz, bu — o'sha ulanish DNS orqali emas, boshqa yo'l bilan (masalan, qattiq kodlangan IP yoki tashqi resolver mexanizmi) o'rnatilgan degani. --- ## 📄 5. Zeek `ssl.log` — TLS handshake va JA3 barmoq izi > Lug'at: `server_name` — TLS ClientHello'dagi SNI (server nomi); `ja3` — **mijoz** tomonidan yuborilgan ClientHello asosida hisoblangan barmoq izi (qaysi dastur/kutubxona TLS ulanishni boshlaganini ko'rsatadi — server tomon bilan bog'liq emas); `subject` — server sertifikatining Subject (CN) maydoni. ```json {"ts": "2026-06-18T13:05:01.244", "uid": "CqjK2s7YxLm0Tn4Rpz", "id.orig_h": "10.40.12.37", "id.orig_p": 52110, "id.resp_h": "203.0.113.10", "id.resp_p": 443, "version": "TLSv13", "cipher": "TLS_AES_128_GCM_SHA256", "server_name": "cdn-a.updatehub-example.net", "ja3": "cd08e31494f9531f560d64c695473da9", "subject": "CN=cdn-a.updatehub-example.net"} {"ts": "2026-06-18T13:22:41.355", "uid": "CrX93bWq1oNs6Yh2Ac", "id.orig_h": "10.40.12.37", "id.orig_p": 52390, "id.resp_h": "203.0.113.11", "id.resp_p": 443, "version": "TLSv13", "cipher": "TLS_AES_128_GCM_SHA256", "server_name": "cdn-b.updatehub-example.net", "ja3": "cd08e31494f9531f560d64c695473da9", "subject": "CN=cdn-b.updatehub-example.net"} {"ts": "2026-06-18T13:01:02.918", "uid": "CbP4t8Kx0YqL2mRj5s", "id.orig_h": "10.40.12.23", "id.orig_p": 54011, "id.resp_h": "203.0.113.45", "id.resp_p": 443, "version": "TLSv13", "cipher": "TLS_AES_128_GCM_SHA256", "server_name": "github.com", "ja3": "cd08e31494f9531f560d64c695473da9", "subject": "CN=github.com"} {"ts": "2026-06-18T13:07:16.427", "uid": "CjM6y2Vb8QpXd0Rn3z", "id.orig_h": "10.40.12.23", "id.orig_p": 54390, "id.resp_h": "203.0.113.46", "id.resp_p": 443, "version": "TLSv13", "cipher": "TLS_AES_128_GCM_SHA256", "server_name": "pypi.org", "ja3": "cd08e31494f9531f560d64c695473da9", "subject": "CN=pypi.org"} {"ts": "2026-06-18T13:00:05.140", "uid": "CxT0q5Zm3WkP7bVy1d", "id.orig_h": "10.40.12.23", "id.orig_p": 54500, "id.resp_h": "198.51.100.202", "id.resp_p": 9001, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "server_name": "-", "ja3": "e7d705a3286e19ea42f587b344ee6865", "subject": "CN=www.kd824jfhqlaop2.com"} {"ts": "2026-06-18T13:00:11.033", "uid": "CpN8b1Xy6LqR4mTz2f", "id.orig_h": "10.40.12.23", "id.orig_p": 54502, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "server_name": "-", "ja3": "e7d705a3286e19ea42f587b344ee6865", "subject": "CN=www.wjh3kx92nrqlpo.com"} {"ts": "2026-06-18T13:14:20.361", "uid": "CzK3d9Wp0MvB7sXq4h", "id.orig_h": "10.40.12.23", "id.orig_p": 54780, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "server_name": "-", "ja3": "e7d705a3286e19ea42f587b344ee6865", "subject": "CN=www.z9ttmvbek3nsqrx.com"} {"ts": "2026-06-18T13:27:05.799", "uid": "CmR5f2Yt8NcD1oLw9k", "id.orig_h": "10.40.12.23", "id.orig_p": 55021, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "server_name": "-", "ja3": "e7d705a3286e19ea42f587b344ee6865", "subject": "CN=www.plq0dfy7wgzhskc.com"} {"ts": "2026-06-18T13:39:02.640", "uid": "CwQ7g4Ur2PbE5nZx8m", "id.orig_h": "10.40.12.23", "id.orig_p": 55290, "id.resp_h": "203.0.113.66", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "server_name": "-", "ja3": "e7d705a3286e19ea42f587b344ee6865", "subject": "CN=www.9fbqltynzr3wxej.com"} ``` --- ## 🧬 6. Qo'shimcha dalil — `WKST-FIN-06` uchun xom paket namunasi Ulanish boshlanishi paytida qo'lga olingan paketlarning soddalashtirilgan (faqat TCP payload) hex-dump'i: ```text 13:00:44.812345 IP 10.40.12.51.53012 > 198.51.100.50.1080: Flags [P.], length 3 payload: 05 01 00 |...| 13:00:44.868921 IP 198.51.100.50.1080 > 10.40.12.51.53012: Flags [P.], length 2 payload: 05 00 |..| (davomida: shifrlangan tunnel boshlanadi, keyingi baytlar ushbu topshiriq uchun ahamiyatsiz) ``` --- ## 🧾 7. ThreatIntel: Tor tarmog'i konsensus snapshoti (2026-06-18, 08:00 da yig'ilgan) ThreatIntel jamoasi voqea kuni ertalab Tor tarmog'i konsensus hujjatidan (`r`/`s` qatorlari, standart dir-spec formatida) quyidagi relaylar bo'yicha qism-yozuvni saqlab qolgan: ```text r RelayNode7749 AAoQ1DAR6kkoo19hBAX5K0QztNw H2f6vQpLxTn9ZkRm3sYb0oCwAe4 2026-06-18 08:00:00 203.0.113.66 443 0 s Fast Guard Running Stable V2Dir Valid r RelayNode3391 B7pR2FnK9dWmZq4LxTcVjS81eHo J4kNc0vXqLd7RySb2mTz9AoWfE1 2026-06-18 08:00:00 198.51.100.202 9001 0 s Fast Guard Running Valid r ExitNodeCrimson D9mT5GpQ1eXnJv3RkWc7YbZo0Hs K6qLd3wYrNe8TzPb1oVc4AmXfG2 2026-06-18 08:00:00 192.0.2.150 443 0 s Exit Fast Running Valid r MiddleHopBeta E2nV8HqR4fYoKw6LtXd0ZbSp9Ju M8rNf5xZtPg0VaQc3pWe6BoYhI4 2026-06-18 08:00:00 198.51.100.88 443 0 s Fast Running Valid r ExitNodeAzure F5oW1JsT7gZpLx9MvYe2AcTq0Kv N1sPg7yAvQh2WbRd5qXf8CpZiJ6 2026-06-18 08:00:00 192.0.2.155 9001 0 s Exit Fast Running Stable Valid ``` **`r` qatori formati:** `r

` **`s` qatori:** ushbu relayga direktoriya avtoritetlari tomonidan berilgan **bayroqlar (flags)** ro'yxati. **Bayroqlarning ma'nosi (Tor dir-spec bo'yicha, ma'lumot uchun):** - **Guard** — relay birinchi (kirish) hop sifatida ishlatilishga yaroqli deb topilgan. **Tor arxitekturasi shunday qurilganki, mijoz (client) o'z tarmog'idan HECH QACHON middle yoki exit relayga to'g'ridan-to'g'ri ulanmaydi** — u faqat va faqat o'zining Guard relayiga to'g'ridan-to'g'ri ulanadi; qolgan hoplar (middle, exit) allaqachon shifrlangan tunnel ichida, Guard'dan keyin, mijoz tarmog'idan ko'rinmaydigan joyda amalga oshadi. - **Exit** — relay tashqi internetga "chiqish" (oxirgi hop) sifatida ishlashga ruxsat etilgan. Bunday relayni mijoz hech qachon to'g'ridan-to'g'ri "ko'rmaydi". - **Stable** — relay uzoq ishlash vaqti (uptime)ga ega, uzoq muddatli sxemalar (circuit) va doimiy Guard sifatida ishlatilishga mos deb baholangan. Amalda mijozlar o'zlarining **doimiy** Guard'i sifatida odatda `Stable` bayrog'iga ega relayni tanlaydi va uni haftalar/oylar davomida qayta-qayta ishlatadi; `Stable`siz Guard-nomzod ko'pincha faqat qisqa muddatli sinov yoki muvaffaqiyatsiz ulanish urinishida ko'rinadi. - **Fast / Running / Valid / V2Dir** — texnik holat bayroqlari (ishlayapti, tezligi yetarli, avtoritet tomonidan tasdiqlangan va h.k.), ushbu topshiriq uchun alohida ahamiyatga ega emas. --- ## 🔎 8. ThreatIntel: JA3 TLS-mijoz barmoq izi bazasi | JA3 xesh | Mos keladigan dastur/mijoz | |---|---| | `cd08e31494f9531f560d64c695473da9` | Google Chrome / Chromium 120–127 (Windows 10/11) — standart korporativ brauzer | | `e7d705a3286e19ea42f587b344ee6865` | Tor Browser 13.x (Firefox ESR 115 asosida) | | `6734f37431670b3ab4292b8f60f29984` | Mozilla Firefox 128 ESR (Tor bilan bog'liq emas, oddiy Firefox) | | `51c64c77e60f3980eea90869b68c58a8` | curl / libcurl 8.x (skript/avtomatlashtirilgan so'rov) | --- ## 🎯 Vazifa (3 bosqich) ### Bosqich 1 — Yolg'on iz: proksi/VPN foydalanuvchisini aniqlash (100 ball) To'rtta ish stansiyasidan (`ACCT-04`, `DEV-09`, `HR-02`, `FIN-06`) **bittasi** — siyosatni buzib, shaxsiy **VPN/SOCKS-proksi xizmatidan** foydalangan (Tor emas). Uni quyidagi belgilar bo'yicha aniqlang: - Butun kuzatuv oynasi davomida **bitta va faqat bitta** tashqi IP-manzil bilan **uzluksiz, davomiy** aloqada bo'lgan (bir martalik uzun sessiya, ko'p marta qayta ulanish emas); - Bu IP-manzil uchun `dns.log`da **mos DNS so'rovi bor** (ya'ni ulanishdan oldin domen nomi oddiy tarzda hal qilingan); - Bu IP-manzil Tor konsensus snapshotida (7-bo'lim) **umuman uchramaydi**; - Xom paket namunasida (6-bo'lim) ulanish protokoli sifatida **SOCKS5** ekanligi ko'rinadi (`0x05 0x01 0x00` — versiya 5, no-auth so'rovi). Ushbu ish stansiyasining **hostname**'ini quyidagicha normalizatsiya qiling va flag tuzing: 1. Barcha harflarni kichik harfga o'tkazing. 2. Har bir `-` belgisini `_` ga almashtiring (boshqa hech narsa o'zgarmaydi). Flag: `HN{normalizatsiya_qilingan_hostname}` ### Bosqich 2 — Asosiy topilma: Tor foydalanuvchisini aniqlash (100 ball) Qolgan ish stansiyalari orasidan **haqiqiy Tor foydalanuvchisi**ni toping. Uning barcha "shubhali" tashqi ulanishlari quyidagi UCHALA belgiga BIRDANIGA mos kelishi kerak: - Tashqi IP-manzil Tor konsensus snapshotida (7-bo'lim) **`Guard` bayrog'i bilan** qayd etilgan; - Ushbu IP-manzil uchun `dns.log`da **hech qanday mos so'rov yo'q** (DNS "sukunati"); - `ssl.log`da ushbu ulanishning JA3 qiymati JA3 bazasida (8-bo'lim) **Tor Browser** deb belgilangan xeshga mos keladi. (Diqqat: shu bir xil ish stansiyasi kunning boshqa daqiqalarida oddiy brauzer bilan ham (masalan, ish uchun) internetga chiqqan bo'lishi mumkin — bunday ulanishlar normal DNS+JA3 ko'rsatadi va tahlilga aralashmaydi.) Xuddi 1-bosqichdagi kabi normalizatsiya qilib, flag tuzing: Flag: `HN{normalizatsiya_qilingan_hostname}` ### Bosqich 3 — Tasdiqlash: doimiy Guard relayni aniqlash (100 ball, asosiy) 2-bosqichda aniqlagan ish stansiyasi, aslida **ikkita** turli tashqi IP-manzil bilan gaplashgan — ikkalasi ham Tor konsensusida `Guard` bayrog'iga ega, ikkalasida ham JA3 Tor Browser'ga mos keladi. Ammo ular orasida faqat **BITTASI** — haqiqiy, doimiy ishlatilayotgan (production) Guard: - `conn.log`dagi timestamp'larni solishtiring: qaysi IP butun kuzatuv oynasi (13:00–13:42) davomida **bir necha marta** qayta ko'ringan, qaysi biri esa faqat **bir marta, juda qisqa** muddatga ko'ringan? - Buni Tor konsensus snapshotidagi bayroqlar bilan ham tasdiqlang (7-bo'limdagi bayroqlar ma'nosiga qarang). Ikkala tekshiruv usuli ham **bir xil** javobga olib kelishi kerak — agar ikkitasi mos kelmasa, tahlilingizni qayta ko'ring. Endi quyidagi qatorni tuzing (ish stansiyasi hostname'i **original holatda**, ya'ni katta harflar va chiziqcha bilan, asset jadvalida yozilganidek; ikkovi orasida bitta `:` belgisi, boshqa bo'shliq yo'q): ``` flag_input = ":" ``` Ushbu qatorning **SHA256** xeshini hisoblang va hex ko'rinishining **birinchi 24 ta belgisini** oling: ``` flag = HN{ SHA256(flag_input) ning birinchi 24 hex belgisi } ``` **Tekshirish uchun namuna (bu real javob emas, faqat usulni tasdiqlash uchun):** agar hostname `WKST-EXAMPLE-00` va guard IP `198.51.100.1` bo'lganda edi: ```python import hashlib flag_input = "WKST-EXAMPLE-00:198.51.100.1" hashlib.sha256(flag_input.encode()).hexdigest()[:24] # natija: abe9acf79a0e2d362dbee377 ``` ```bash printf '%s' "WKST-EXAMPLE-00:198.51.100.1" | sha256sum ``` Avval shu namunani o'z muhitingizda ishga tushirib, xuddi shu natijani (`abe9acf79a0e2d362dbee377`) olishingizni tekshiring (`echo` emas, `printf '%s'` yoki `echo -n` ishlating — oxirida yangi qator belgisi bo'lmasligi kerak). Shundan so'ng, xuddi shu usulni haqiqiy (2- va 3-bosqichda topilgan) qiymatlarga qo'llang. --- ## 🚩 Flag topshirish Bu **ko'p bosqichli (multi-flag)** topshiriq. Har bosqich alohida `HN{...}` formatidagi flag talab qiladi va mustaqil baholanadi. 2-bosqich flagini topish uchun 1-bosqichni, 3-bosqich uchun esa 2-bosqichni yechish shart. --- ## 💡 Maslahatlar

Maslahat 1 — metodologiya

Har bir ish stansiyasi uchun bitta jadval tuzing: ustunlar — "tashqi IP", "necha marta ko'ringan", "DNS mos keladimi (Ha/Yo'q)", "Tor konsensusida bormi (Ha/Yo'q, qanday bayroq bilan)", "JA3 nimaga mos keladi". `ACCT-04` va `SOC-01`ni birinchi qarashda chetlab qo'yishingiz mumkin — nega ekanini logdan tekshiring.

Maslahat 2 — Guard tamoyili

Tor arxitekturasida mijoz hech qachon o'z tarmog'idan middle yoki exit relayga to'g'ridan-to'g'ri ulanmaydi — faqat Guard'ga. Shu sababli: agar biror IP Tor konsensusida umuman yo'q, yoki bor-u lekin faqat `Exit`/oddiy `Fast Running Valid` bayrog'iga ega (Guard'siz), u holda bu IP hech qachon "mijoz to'g'ridan-to'g'ri Tor orqali gaplashyapti" degan xulosaga asos bo'la olmaydi.

Maslahat 3 — ikkita Guard-nomzod orasidan tanlash

Ikkala nomzod ham `Guard` bayrog'iga ega bo'lishi mumkin — bu ularning ikkovi ham nazariy jihatdan Guard bo'la olishini bildiradi, lekin ikkovi ham AYNAN SHU seansda haqiqatan foydalanilgan degani emas. `conn.log`da har bir nomzod nechta marta va qanday vaqt oralig'ida ko'ringanini son bilan sanab chiqing; natijani konsensusdagi `Stable` bayrog'i borligi/yo'qligi bilan solishtiring.

--- ## 📚 Foydali manbalar - Tor Project, "Tor Directory Protocol" (dir-spec) — konsensus va router-status formatlari - Tor Project, "Path Selection" (path-spec) — Guard/Middle/Exit relay tanlash qoidalari - JA3 — TLS Client Fingerprinting (Salesforce Engineering, ochiq kodli loyiha) — `ja3` va `ja3s` xeshlarining hisoblanish tamoyili - Zeek (avvalgi nomi Bro) hujjatlari — `conn.log`, `dns.log`, `ssl.log` standart maydonlari

Tor Ovi: NorthLine Logistika Tarmoq Forensikasi

Bosqichlar

Yolg'on iz: proksi/VPN foydalanuvchisini aniqlash

Asosiy topilma: Tor foydalanuvchisini aniqlash

Tasdiqlash: doimiy Guard relayni aniqlash