How to detect LOAD BALANCE System? (如何偵測網站是屬於Load Balance架構?)

如何偵測網站是屬於Load Balance架構?

一般來說，大型網站大多設計有"Load Balance"架構，藉以應付\大量的網路存取並可分擔網路流量，但是對"滲透測試"來講，就必須先搞清楚，免得做了一堆無用測試。

下面介紹幾種偵測方法：

1.  Dig 指令：

     $ dig www.google.com

; <<>> DiG 9.8.1-P1 <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18625
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
\
;; QUESTION SECTION:
;www.google.com. IN A

;; ANSWER SECTION:
www.google.com. 5 IN A 173.194.72.147
www.google.com. 5 IN A 173.194.72.99
www.google.com. 5 IN A 173.194.72.103
www.google.com. 5 IN A 173.194.72.104
www.google.com. 5 IN A 173.194.72.105
www.google.com. 5 IN A 173.194.72.106

;; Query time: 19 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu May 23 13:50:49 2013
;; MSG SIZE  rcvd: 128

2. halberd


$ halberd -v www.yyy.yyy.cn
halberd 0.2.4 (14-Aug-2010)

INFO looking up host www.yyy.yyy.cn...
INFO host lookup done.
211.88.yyy.151    [##########]  clues:  30 | replies: 286 | missed:   0

======================================================================
http://www.yyy.yyy.cn (211.88.yyy.151): 2 real server(s)
======================================================================

server 1: Apache/1.3.29 (Unix) PHP/4.3.6
----------------------------------------------------------------------

difference: 1369288820 seconds
successful requests: 118 hits (41.26%)
header fingerprint: 2d400052972048f733d653df965c209396fa5901
different headers:
  1. X-Cache-Debug: TCP_MISS/NIP-CNVR/-

server 2: Apache/1.3.29 (Unix) PHP/4.3.6
----------------------------------------------------------------------

difference: 1369288820 seconds
successful requests: 168 hits (58.74%)
header fingerprint: 29cfb7ec75f8372af0ade98cdb9959a191248940
different headers:
  1. X-Cache-Debug: TCP_CNC_MISS/CNC-NIP-CNVR/-



$ halberd -v www.xxx.xxx.cn
halberd 0.2.4 (14-Aug-2010)

INFO looking up host www.xxx.xxx.cn...
INFO host lookup done.
INFO www.xxx.xxx.cn resolves to 58.68.xxx.250
INFO www.xxx.xxx.cn resolves to 65.255.xxx.2
58.68.168.250    [##########]  clues:  15 | replies: 160 | missed:   0

======================================================================
http://www.xxx.xxx.cn (58.68.xxx.250): 2 real server(s)
======================================================================

server 1: IBM_HTTP_Server/6.0.1 Apache/2.0.47 (Unix) mod_jk/1.2.26
----------------------------------------------------------------------

difference: 28800 seconds
successful requests: 156 hits (97.50%)
header fingerprint: c4d1afcc03570ffdaea39a17c7da23282b4c8b89
different headers:
  1. Date: Thu, 23 May 2013 06:10:09 GMT
  2. Powered-By-ChinaCache: HIT from 0600224355
  3. Expires: Thu, 23 May 2013 06:11:09 GMT
  4. Powered-By-ChinaCache: HIT from 26071413iA

server 2: IBM_HTTP_Server/6.0.1 Apache/2.0.47 (Unix) mod_jk/1.2.26
----------------------------------------------------------------------

difference: 30943 seconds
successful requests: 4 hits (2.50%)
header fingerprint: 576c78d99c688843ec355def953046e59556e2c5
different headers:
  1. Date: Thu, 23 May 2013 05:34:26 GMT
  2. Powered-By-ChinaCache: MISS from 0603517354
  3. Powered-By-ChinaCache: HIT from 26071413iA
65.255.44.2      [##########]  clues:  14 | replies: 112 | missed:   0

======================================================================
http://www.xxx.xxx.cn (65.255.xxx.2): 2 real server(s)
======================================================================

server 1: IBM_HTTP_Server/6.0.1 Apache/2.0.47 (Unix) mod_jk/1.2.26
----------------------------------------------------------------------

difference: 28815 seconds
successful requests: 4 hits (3.57%)
header fingerprint: 7f2729977dc32a8b0d81570e226a315103ca17c8
different headers:
  1. Server: IBM_HTTP_Server/6.0.1 Apache/2.0.47 (Unix) mod_jk/1.2.26
  2. Date: Thu, 23 May 2013 06:10:09 GMT
  3. Content-Type: text/html
  4. Expires: Thu, 23 May 2013 06:11:09 GMT
  5. Last-Modified: Mon, 31 Dec 2012 16:52:48 GMT
  6. ETag: "9c240d2-f3-d7ce7800"
  7. Powered-By-ChinaCache: HIT from 0603517354
  8. Powered-By-ChinaCache: HIT from 26030513b1

server 2: IBM_HTTP_Server/6.0.1 Apache/2.0.47 (Unix) mod_jk/1.2.26
----------------------------------------------------------------------

difference: 28816 seconds
successful requests: 108 hits (96.43%)
header fingerprint: b8232b9e68039605b79a69c51e1bd32c464e523f
different headers:
  1. Last-Modified: Mon, 31 Dec 2012 16:52:48 GMT
  2. Content-Type: text/html
  3. Date: Thu, 23 May 2013 06:10:09 GMT
  4. Server: IBM_HTTP_Server/6.0.1 Apache/2.0.47 (Unix) mod_jk/1.2.26
  5. ETag: "9c240d2-f3-d7ce7800"
  6. Powered-By-ChinaCache: HIT from 060531B35y
  7. Expires: Thu, 23 May 2013 06:11:09 GMT
  8. Powered-By-ChinaCache: HIT from 26030513b1

上述兩種就可以看出，www.gooogle.com 運用多個不同IP位置來提供網路分流，另外www.yyy.yyy.cn 雖然只有一個對外IP，但實際上有兩部Web Server在提供服務，
www.xxx.xxx.cn 有2組不同的IP。