Botnet
Global Rank: 12
Totalscore: 431060
Posts: 40
Thanks: 36
UpVotes: 21
Registered: 15y 68d
The User is Offline
Botnet
Jan 30, 2013 - 19:31:38 (11y 81d)
Jan 30, 2013 - 19:31:38 (11y 81d)
Assuming I run a server which hosts ~200 websites. I know for sure that one is infected with a botnet. Can any of you think of a suitable way of detecting that particular site without having to analyze each website's source code ?
Global Rank: 204
Totalscore: 101881
Posts: 65
Thanks: 66
UpVotes: 43
Registered: 15y 90d
The User is Offline
RE: Botnet
Jan 31, 2013 - 00:04:35 (11y 81d)
Jan 31, 2013 - 00:04:35 (11y 81d)
"infected with a botnet" could you expand on this more?
do you mean the website is running as part of the botnet,,,,
or it propagates the malware to spread the botnet?
if as part then could you listen for patterns with input/output? e.g. botnet C&C sends instructions and address/ip range, the site then acts on that.
do you mean the website is running as part of the botnet,,,,
or it propagates the malware to spread the botnet?
if as part then could you listen for patterns with input/output? e.g. botnet C&C sends instructions and address/ip range, the site then acts on that.
Global Rank: 536
Totalscore: 47146
Posts: 37
Thanks: 21
UpVotes: 24
Registered: 11y 196d
Last Seen: 6y 306d
The User is Offline
RE: Botnet
Jan 31, 2013 - 00:31:12 (11y 81d)
Jan 31, 2013 - 00:31:12 (11y 81d)
yeah, "infected by botnet" needs further explenation.
anywhy, if it's a script, you can find /home/*/public_html -type f -exec grep -H <something> {} \;
or if it's actualy connecting to the net, using lsof you can cross reference ports with full path names of files.
anywhy, if it's a script, you can find /home/*/public_html -type f -exec grep -H <something> {} \;
or if it's actualy connecting to the net, using lsof you can cross reference ports with full path names of files.
tunelko, stormsurfer, quangntenemy, TheHiveMind, Z, balicocat, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, JanLitwin17, SwolloW, dangarbri have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 3805 times.
1 people are watching the thread at the moment.
This thread has been viewed 3805 times.