Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 17 guests and 5 members online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow need a complt tutorial about designing botnets
Ethical Hacker Community Forums
January 07, 2009, 10:26:09 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1] 2 3   Go Down
  Print  
Author Topic: need a complt tutorial about designing botnets  (Read 12223 times)
0 Members and 1 Guest are viewing this topic.
proudindian
Newbie
*
Offline Offline

Posts: 32


View Profile
« on: December 10, 2007, 02:16:57 PM »

helloo..i need a good tutorial 2 design botnets which can perform denial service attack.like icmp flood,syn attack..etc etc
please help.........

and a good undetecteble troajn.attached keylogger please help me....
Logged
slimjim100
EH-Net Columnist
Sr. Member
*****
Offline Offline

Posts: 365



View Profile WWW
« Reply #1 on: December 10, 2007, 02:48:58 PM »

You are in the wrong place and might want to not post here.... This is Ethical Hackers Network.... We do not assist in any illegal activity.

Brian
Logged

CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP
Kev
Sr. Member
****
Offline Offline

Posts: 359


View Profile
« Reply #2 on: December 10, 2007, 03:14:30 PM »

I think some people must believe we assume everyone that comes here is ethical so we are more than happy to give up information like what was requested. 
Logged
ChrisG
EH-Net Columnist
Hero Member
*****
Offline Offline

Posts: 1049


View Profile WWW
« Reply #3 on: December 10, 2007, 05:32:49 PM »

there are some writeups on agobot (sp--think thats it) that would be a good place to start
« Last Edit: December 10, 2007, 07:15:11 PM by ChrisG » Logged

...tests i took go here...

http://carnal0wnage.blogspot.com/
dean
Full Member
***
Offline Offline

Posts: 130


View Profile
« Reply #4 on: December 10, 2007, 07:12:39 PM »

It seems to me that most people are assumed to be unethical when posting about topics like this here. The request does seem a little suspect though.

Anyway, bonets are a valid field of research. I do a substantial amount of work within this field myself.

So, proudindian, you might want to look into how botnets work first off. From traditional IRC based, Single Command & Control Server types to more advanced Peer-to-Peer and Hybrid-P2P botnets. Look into fast-flux and DNS round robin techinques (The Storm Worm is a nice example). As for a bot with keylogging activities, here is a C&C server that sends just that command (.keylog) to each client. (205.234.132.29 port:53) Perhaps you can figure out how to retrieve the bot and reverse it.

http://www.usenix.org/events/hotbots07/tech/full_papers/wang/wang.pdf - A nice article about advanced botnet design. It's not a HOWTO but hey, if you're planning on building a botnet you had better learn how to write them first.

dean
Logged

<script>alert('%52%54%46%4D')</script>
proudindian
Newbie
*
Offline Offline

Posts: 32


View Profile
« Reply #5 on: December 10, 2007, 11:55:41 PM »

thanx dean,and no,i just wanna clear my concept here about botnets,i am not telling you people to xplain de mechanism of ur bots nd algo of dere source so dat i can atleast hex edit dem if i want to do some amendments,i will do it myself...i am a lerner here.

and no.sorry if you think that its illegal,and for keylogger iasked because i was having problem with winsock based smtp..for keylog.txt

but its okk now....its such a good site with loads of infos....i am thankfull to you people...

and with irc it connects via 6667..infact it connects from 6660 to 6669..depends on admin programms,
and another thing can sum1 design his bots those which can do icmp flood,syn attack as well as tsunami....dis is possible??

please clear my concept or give me any tutorial link where from i can get all descriptions and alogo or source code of botnets..dat i can study it ....thanx in advance
Logged
dean
Full Member
***
Offline Offline

Posts: 130


View Profile
« Reply #6 on: December 11, 2007, 09:27:54 AM »

proudindian, you can run an ircd over any port you choose. the ip address i posted previously used tcp/53 as most firewalls will allow tcp/udp 53 outbound for DNS.

Yes, you can have your bot do pretty much anything you want. DoS attacks, etc...

Look into how packets need to be crafted for the various attacks. Not that this would be the best language for a bot but it's what I'm playing with at the moment so... using python and scapy you can build a Ping of Death attack in one line.

send( fragment(IP(dst="IPADDR")/ICMP()/("X"*100000)) )

There are many case studies and sites with bot source code. Google.

dean

Logged

<script>alert('%52%54%46%4D')</script>
EmanoN
Newbie
*
Offline Offline

Posts: 41


View Profile
« Reply #7 on: December 11, 2007, 02:24:53 PM »

The request does seem a little suspect though.
dean
A little?  Your joking right? I am glad you are not in charge of security where I do my banking, ha ha. Sorry, I just could not resist. But hey, thats cool if you are going to help anyone that comes here build botnets and undetectable trojans.
« Last Edit: December 11, 2007, 02:28:29 PM by EmanoN » Logged
ChrisG
EH-Net Columnist
Hero Member
*****
Offline Offline

Posts: 1049


View Profile WWW
« Reply #8 on: December 11, 2007, 04:05:34 PM »

i would have thought the guy who's picture was next to the word hacker would be more than ready to help someone build a bot

here are some vids to watch to help you out:
http://video.reverse-engineering.net/index.php?cat=7
« Last Edit: December 11, 2007, 07:49:40 PM by ChrisG » Logged

...tests i took go here...

http://carnal0wnage.blogspot.com/
dean
Full Member
***
Offline Offline

Posts: 130


View Profile
« Reply #9 on: December 11, 2007, 09:33:12 PM »

Really? I'm helping him to build a botnet? All the information I've posted is available through this thing called a search engine. You might want to try one sometime.

How is it when someone posts a question about virii, botnets, anything considered by the individuals on this site to be the "dark side" and not part of "ethical hacking" they feel the need to immediately post something to that effect. What right do you or anyone on this site have to make the judgement that the person is intending to do something illegal. As proudindian posted, he is looking to learn. Whether or not this is the truth, I don't really care and neither should anyone else. Who are we to infer that he is lying and attempting to gather information for illegal purposes? He can easily google for anything he needs.

If all the people who post about how unethical some questions are, are so concerned about people using this information for anything but the ethical purposes, then perhaps they should take a different route and actually attempt to find out what person is looking to learn/do rather and explain the legal ramifications of such activites. Additionally, the information posted might enlighten some of the readers about the inner workings of that field/technology. Botnets in this instance.

Would it make a difference if proudindian had started his post with "I want to be an 'ethical' hacker and I'm interested in botnets, detecting and tracking them"? Also, perhaps english is not his first language. The reality is that whatever his motivations are we don't have the right to tell him otherwise. Perhaps if there is such a standard of ethics on this site then those persons who feel strongly enough should attempt to guide this person accordingly rather than making presumptions and accusations? Perhaps keeping them on this site is the first step rather than driving them away. I have yet to see anyone reference anything explaining the dangers of running a botnet.

here are a few examples:

http://www.sans.org/newsletters/newsbites/newsbites.php?vol=9&issue=47#sID200 - The FBI's Botroast.
http://www.securityfocus.com/brief/567 - Germany's 202(c) anti hacking law.

So I will continue to post on topics that people here consider unethical. Perhaps someone might learn something.

proudindian you seem to have the hang of winsock so perhaps this is too simple but here is a snippet of an IRC bot in perl. It will perform Google searches in the channel. It's not all the code but it gives you an idea. I wrote it using IO::Socket rather than POE::Component::IRC and Bot::BasicBot::Pluggable modules.

Code:
use strict;
use warnings;
use IO::Socket::INET;
use Switch;

my $server = $ARGV[0];
my $chan = $ARGV[1];
my $port = '6667';
my $nick = 'google-bot';
my $user = 'bot dbot bot bot';
my $owner = 'name';
my $pass = '***';

my $socket = IO::Socket::INET -> new ( PeerAddr => $server,
PeerPort => $port,
Proto => 'tcp',
Type => SOCK_STREAM,
Timeout => '10') || print "I died.\n";

print $socket "User $user\r\n";
print $socket "NICK $nick\r\n";
print $socket "privmsg nickserv IDENTIFY $pass\r\n";
print $socket "JOIN $chan\r\n";
print $ARGV[1];

my $a;
while ($a = <$socket>) {
if ($a =~ m/^\:(.*?)\!(.*?)\@(.*?) PRIVMSG (.*?) :(.*?)$/) {
my $unick = $1;
my $uident= $2;
my $uchost =$3;
my $uchannel =$4;
my $utxt = $5;

# String is parsed for the valid query.
if ($a =~ m/\!google/) {
if ($unick =~ $owner) {
my @query = split (" ", $utxt);
my $n = 1;
my $google_query;
my $query;
while ($query[$n]) {
$google_query .= $query[$n];
$google_query .= "%20";
$n++;
}

# Open socket to www.google.com.
my $result = IO::Socket::INET -> new ( PeerAddr => 'www.google.com',
   PeerPort => '80',
   Proto => 'tcp',
   Type => SOCK_STREAM,
   Timeout => '5') || print "An error occured.\n";

#Submit the search terms for the google query.
print $result "GET /search?num=5&hl=en&lr=lang=en&q=$google_query&btnG=SEARCH HTTP/1.0\n";
print $result "Host: www.google.com\n\n";

#Get the results from the search term and parse for valid urls. Also remove %20 from the search string when displaying it to the user.
my $get;
my @search = split ("%20", $google_query);
my $term = join (" ", @search);
while ($get = <$result>) {
$get =~ m!(<div class=g><h2 class=r><a href=\")((http\://|https\://|ftp\://)|(www.))+(([a-zA-Z0-9\.-]+\.[a-zA-Z]{2,4})|([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}))(/[a-zA-Z0-9%:/-_\?\.'~]*)?\"!;
print $get;
print $socket "privmsg $uchannel : Search Term: $term || Result : $3$4$5$8\n";
}
}
}
# basic check to see if port is listening on remote address. A simple connect scan.
if ($a =~ m/\!scan/) {
my ($ip, $tport, $res, $scan);

if ($unick =~ $owner) {

my @target = split (" ", $utxt);
$ip = $target[1];
$tport = $target [2];

$scan = IO::Socket::INET -> new ( PeerAddr => $ip,
  PeerPort => $tport,
  Proto => 'tcp',
  Type => SOCK_STREAM,
  Timeout => '3') || print " An error occurred. Die!\n";

if ($scan) {
$res .= "Open";
close ($scan);
}
else {
$res .= "Closed";
}
$res .="\n";
}

print $socket "privmsg $uchannel : Target: $ip : $tport || Result: $res\n";
}

if ($a =~ m/\!owner/) {
my @says = split (" ", $utxt);
my $say = $says[1];

if ($unick) {
print $socket "privmsg $uchannel :$owner is my master!\n";
}
}
Logged

<script>alert('%52%54%46%4D')</script>
sedated
Newbie
*
Offline Offline

Posts: 37



View Profile
« Reply #10 on: December 11, 2007, 09:58:53 PM »

  Unfortunately it sometimes hard to tell if someone plans on using any information here in a unethical manner there is no easy way to tell unless its one of those obvious post like tell me how to hack into my school.I do believe
though we should be careful and scrutinize post if unsure of the users intentions we can simply ask them granted any body who can use Google will eventually find what they need with a little perseverance.I myself would rather play on the safe side when i am unclear of a posters intentions.
Logged
proudindian
Newbie
*
Offline Offline

Posts: 32


View Profile
« Reply #11 on: December 12, 2007, 12:31:16 AM »

thanx everyone,believe me i am tring to learn these things,but i thought i posted it on wronge way,my intention was not this to harm any1 or doing something illegal,sorry for that again.  Cry
Logged
dean
Full Member
***
Offline Offline

Posts: 130


View Profile
« Reply #12 on: December 12, 2007, 07:07:03 AM »

Don't worry about it and keep asking questions.  Smiley

-dean
Logged

<script>alert('%52%54%46%4D')</script>
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2434


Editor-In-Chief


View Profile WWW
« Reply #13 on: December 12, 2007, 08:15:08 AM »

By all means, keep asking questions. I'm sure you can understand the community being a little gun shy, but their intentions are good. I try my best to keep this a community for security professionals, and they've all got my back. For that I am grateful.

Soo keep it going on both sides. Keep the quality of information high and look out for the integrity of the site. This can sometimes be a tough balance, but I think we do pretty well.

Thanks everyone,
Don
Logged

CISSP, MCSE, CEH, Security+ SME
proudindian
Newbie
*
Offline Offline

Posts: 32


View Profile
« Reply #14 on: December 12, 2007, 12:10:12 PM »

yes,thanx for support everyone.....i feel proud for being a member here in this community. Smiley
Logged
Pages: [1] 2 3   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.096 seconds with 24 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
How many security events including conferences and training do you attend a year:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics