Botnet
Posizione globale: 20
Punteggio totale: 427874
Posts : 40
Grazie: 36
Voti+: 22
Registrato: 17a 263gg
L'utente è Offline
Botnet
30 Gen 2013 - 19:31:38 (13a 276gg)
30 Gen 2013 - 19:31:38 (13a 276gg)
Assuming I run a server which hosts ~200 websites. I know for sure that one is infected with a botnet. Can any of you think of a suitable way of detecting that particular site without having to analyze each website's source code ?
Posizione globale: 215
Punteggio totale: 101829
Posts : 65
Grazie: 67
Voti+: 44
Registrato: 17a 285gg
L'utente è Offline
RE: Botnet
31 Gen 2013 - 00:04:35 (13a 276gg)
31 Gen 2013 - 00:04:35 (13a 276gg)
"infected with a botnet" could you expand on this more?
do you mean the website is running as part of the botnet,,,,
or it propagates the malware to spread the botnet?
if as part then could you listen for patterns with input/output? e.g. botnet C&C sends instructions and address/ip range, the site then acts on that.
do you mean the website is running as part of the botnet,,,,
or it propagates the malware to spread the botnet?
if as part then could you listen for patterns with input/output? e.g. botnet C&C sends instructions and address/ip range, the site then acts on that.
Posizione globale: 566
Punteggio totale: 46996
Posts : 37
Grazie: 21
Voti+: 24
Registrato: 14a 26gg
Ultima visita: 9a 136gg
L'utente è Offline
RE: Botnet
31 Gen 2013 - 00:31:12 (13a 276gg)
31 Gen 2013 - 00:31:12 (13a 276gg)
yeah, "infected by botnet" needs further explenation.
anywhy, if it's a script, you can find /home/*/public_html -type f -exec grep -H <something> {} \;
or if it's actualy connecting to the net, using lsof you can cross reference ports with full path names of files.
anywhy, if it's a script, you can find /home/*/public_html -type f -exec grep -H <something> {} \;
or if it's actualy connecting to the net, using lsof you can cross reference ports with full path names of files.
stormsurfer, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq utenti hanno sottoscritto il thread e ricevo le E-Mail di notifica.
1 persone stanno visualizzando il thread.
Questo thread è stato visualizzato 4458 volte.
1 persone stanno visualizzando il thread.
Questo thread è stato visualizzato 4458 volte.