Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
zeek-spicy-stun — Spicy 기반의 Zeek STUN 프로토콜 분석기입니다. | Kitploit
도구/GitHubGitHub/corelight/zeek-spicy-stun
Packet Sniffing & AnalysisNetwork ForensicsForensicsInformation GatheringNetwork Security
GitHubcorelight/zeek-spicy-stun

zeek-spicy-stun

Spicy 기반의 Zeek STUN 프로토콜 분석기입니다.

저장소 보기
531년 전아직 검토되지 않음

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

STUN

NAT용 세션 탐색 유틸리티 (STUN)

이것은 Spicy 기반 STUN을 탐지하는 Zeek 프로토콜 분석기입니다. 이 패키지를 사용하려면 Spicy를 설치해야 합니다.

이 패키지는 두 개의 로그를 생성합니다:

  • stun.log - 이 로그에는 모든 STUN 메시지가 포함됩니다.
  • stun_nat.log - 이 로그에는 매핑된 주소에서 얻은 NAT 탐지 결과가 포함됩니다.

여기 있는 원래 로직에 추가 로직이 더해졌습니다:

  • https://github.com/r-franke/spicy_stun (원본 코드와 PCAP에 대한 BSD 라이선스는 여기.)
  • https://github.com/r-franke/spicy_stun/issues/1 (이 작업을 spicy-analyzers로 옮기는 허가는 여기.)

STUN에 대한 추가 정보:

  • https://datatracker.ietf.org/doc/html/rfc5389
  • https://www.iana.org/assignments/stun-parameters/stun-parameters.xhtml
  • https://datatracker.ietf.org/doc/html/rfc8489

예제

root@kitploit:~
$ zeek -Cr stun-ice-testcall.pcap packages

$ head -n 20 stun.log
#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	stun
#open	2021-11-23-19-48-14
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	is_orig	trans_id	method	class	attr_types	attr_vals
#types	time	string	addr	port	addr	port	enum	bool	string	string	string	vector[string]	vector[string]
1377211115.029606	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	T	SOpCii5Jfc1z	BINDING	REQUEST	(empty)	(empty)
1377211115.073291	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	F	SOpCii5Jfc1z	BINDING	RESPONSE_SUCCESS	MAPPED_ADDRESS	70.199.128.46:4604
1377211125.073812	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	T	KIkrzjV7Aan8	BINDING	REQUEST	(empty)	(empty)
1377211125.173831	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	T	KIkrzjV7Aan8	BINDING	REQUEST	(empty)	(empty)
1377211125.183611	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	F	KIkrzjV7Aan8	BINDING	RESPONSE_SUCCESS	MAPPED_ADDRESS	70.199.128.46:4604
1377211125.210098	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	F	KIkrzjV7Aan8	BINDING	RESPONSE_SUCCESS	MAPPED_ADDRESS	70.199.128.46:4604
1377211128.184058	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	T	5YSnBqpVwa9O	BINDING	REQUEST	USERNAME,ICE_CONTROLLING,USE_CANDIDATE,PRIORITY,MESSAGE_INTEGRITY,FINGERPRINT	pLyZHR:GwL3AHBovubLvCqn,\x18\x8b\x10Li{\xf6[,(empty),1845501695,`+\xc7\xfc\x0d\x10c\xaa\xc58\x1c\xcb\x96\xa9s\x08s\x9a\x96\x0c,3512920677
1377211128.184433	C4J4Th3PJpwUYZZ6gc	192.168.43.155	59977	155.212.214.188	23131	udp	T	mPEXdyYbuuQm	BINDING	REQUEST	USERNAME,ICE_CONTROLLING,USE_CANDIDATE,PRIORITY,MESSAGE_INTEGRITY,FINGERPRINT	pLyZHR:GwL3AHBovubLvCqn,\x18\x8b\x10Li{\xf6[,(empty),1845501695,\xed<\x90\xdaN+2\xd5\xd3\xe4\x8b&\xdc\xcd\xddv\xbakc\xe9,3908864856
1377211128.232201	CtPZjS20MLrsMUOJi2	192.168.43.155	60020	155.212.214.188	23130	udp	T	akReei85OatV	BINDING	REQUEST	USERNAME,ICE_CONTROLLING,USE_CANDIDATE,PRIORITY,MESSAGE_INTEGRITY,FINGERPRINT	pLyZHR:GwL3AHBovubLvCqn,\x18\x8b\x10Li{\xf6[,(empty),1845501695,x\xb7\x14\xa9\x9fi\xf9+\xcc;\\\xe0\x0f\xee\x911\x02\xb9\x83a,2846465274
1377211128.232522	CUM0KZ3MLUfNB0cl11	192.168.43.155	60020	155.212.214.188	23131	udp	T	K32zssmQHem3	BINDING	REQUEST	USERNAME,ICE_CONTROLLING,USE_CANDIDATE,PRIORITY,MESSAGE_INTEGRITY,FINGERPRINT	pLyZHR:GwL3AHBovubLvCqn,\x18\x8b\x10Li{\xf6[,(empty),1845501695,\xdb\xae\x92\x92\xba\xb9\xaao\xf7\x95\x98\xde\x2c\xd4\x9a\xdae\xc9\x2c\x08,1949326560
1377211128.280083	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	T	VPPyM5LqxI7r	BINDING	REQUEST	USERNAME,ICE_CONTROLLING,USE_CANDIDATE,PRIORITY,MESSAGE_INTEGRITY,FINGERPRINT	pLyZHR:GwL3AHBovubLvCqn,\x18\x8b\x10Li{\xf6[,(empty),1845501695, \x01\x0e\x94\xea\x90\x07F\xa1\x18\x87\x85\x10{q5\x9c\x92)},2756207482
1377211128.280402	C4J4Th3PJpwUYZZ6gc	192.168.43.155	59977	155.212.214.188	23131	udp	T	jDsAa/4ATcQN	BINDING	REQUEST	USERNAME,ICE_CONTROLLING,USE_CANDIDATE,PRIORITY,MESSAGE_INTEGRITY,FINGERPRINT	pLyZHR:GwL3AHBovubLvCqn,\x18\x8b\x10Li{\xf6[,(empty),1845501695,\xf8\x98-!\x0bG\xa6\x85\xcc \xcf^\x0b`\xe6\xcd::\xae5,3444520530

$ head -n 20 stun_nat.log
#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	stun_nat
#open	2021-11-23-19-48-14
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	is_orig	wan_addrs	wan_ports	lan_addrs
#types	time	string	addr	port	addr	port	enum	bool	vector[addr]	vector[count]	vector[addr]
1377211115.073291	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	F	70.199.128.46	4604	192.168.43.155
1377211125.183611	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	F	70.199.128.46	4604	192.168.43.155
1377211125.210098	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	F	70.199.128.46	4604	192.168.43.155
1377211128.309676	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	F	70.199.128.46	4587	192.168.43.155
1377211128.309677	C4J4Th3PJpwUYZZ6gc	192.168.43.155	59977	155.212.214.188	23131	udp	F	70.199.128.46	4587	192.168.43.155
1377211128.358745	CUM0KZ3MLUfNB0cl11	192.168.43.155	60020	155.212.214.188	23131	udp	F	70.199.128.46	4604	192.168.43.155
1377211128.359514	CtPZjS20MLrsMUOJi2	192.168.43.155	60020	155.212.214.188	23130	udp	F	70.199.128.46	4604	192.168.43.155
1377211128.394673	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	F	70.199.128.46	4587	192.168.43.155
1377211128.405706	C4J4Th3PJpwUYZZ6gc	192.168.43.155	59977	155.212.214.188	23131	udp	F	70.199.128.46	4587	192.168.43.155
1377211128.458800	C4J4Th3PJpwUYZZ6gc	192.168.43.155	59977	155.212.214.188	23131	udp	F	70.199.128.46	4587	192.168.43.155
1377211128.459477	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	F	70.199.128.46	4587	192.168.43.155
1377211128.940537	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	F	70.199.128.46	4587	192.168.43.155

$ cat conn.log
#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	conn
#open	2021-11-23-19-48-14
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	local_resp	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents
#types	time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	bool	count	string	count	count	count	count	set[string]
1377211115.029606	CHhAvVGS1DHFjwGM9	192.168.43.155	60020	74.125.141.127	19302	udp	spicy_stun	20.187972	80	128	SF	-	-	0	Dd	4	192	4	240	-
1377211128.184058	ClEkJM2Vm5giqnMf4h	192.168.43.155	59977	155.212.214.188	23130	udp	spicy_stun	7.955804	2136	1972	SF	-	-	0	Dd	22	2752	22	2588	-
1377211128.232201	CtPZjS20MLrsMUOJi2	192.168.43.155	60020	155.212.214.188	23130	udp	spicy_stun	0.274303	288	288	SF	-	-	0	Dd	4	400	3	372	-
1377211128.184433	C4J4Th3PJpwUYZZ6gc	192.168.43.155	59977	155.212.214.188	23131	udp	spicy_stun	7.955427	2088	1872	SF	-	-	0	Dd	21	2676	21	2460	-
1377211128.232522	CUM0KZ3MLUfNB0cl11	192.168.43.155	60020	155.212.214.188	23131	udp	spicy_stun	0.242014	288	288	SF	-	-	0	Dd	4	400	3	372	-
#close	2021-11-23-19-48-14

테스트 PCAP:

  • stun-ice-testcall.pcap
  • stun-attribute-length-ffff.pcap (직접 제작)
  • stun-malformed-error.pcap (직접 제작)
도구 다운로드