Botnet
Globaler Rang: 12
Gesamtpunkte: 431057
Nachrichten: 40
Dank: 36
+Votes: 21
Registriert : 15y 77d
Der Benutzer ist Offline
Botnet
30. Jan 2013 19:31:38 (11y 90d)
30. Jan 2013 19:31:38 (11y 90d)
Assuming I run a server which hosts ~200 websites. I know for sure that one is infected with a botnet. Can any of you think of a suitable way of detecting that particular site without having to analyze each website's source code ?
Globaler Rang: 204
Gesamtpunkte: 101882
Nachrichten: 65
Dank: 66
+Votes: 43
Registriert : 15y 99d
Der Benutzer ist Offline
RE: Botnet
31. Jan 2013 00:04:35 (11y 89d)
31. Jan 2013 00:04:35 (11y 89d)
"infected with a botnet" could you expand on this more?
do you mean the website is running as part of the botnet,,,,
or it propagates the malware to spread the botnet?
if as part then could you listen for patterns with input/output? e.g. botnet C&C sends instructions and address/ip range, the site then acts on that.
do you mean the website is running as part of the botnet,,,,
or it propagates the malware to spread the botnet?
if as part then could you listen for patterns with input/output? e.g. botnet C&C sends instructions and address/ip range, the site then acts on that.
Globaler Rang: 537
Gesamtpunkte: 47146
Nachrichten: 37
Dank: 21
+Votes: 24
Registriert : 11y 204d
Zuletzt gesehen am: 6y 315d
Der Benutzer ist Offline
RE: Botnet
31. Jan 2013 00:31:12 (11y 89d)
31. Jan 2013 00:31:12 (11y 89d)
yeah, "infected by botnet" needs further explenation.
anywhy, if it's a script, you can find /home/*/public_html -type f -exec grep -H <something> {} \;
or if it's actualy connecting to the net, using lsof you can cross reference ports with full path names of files.
anywhy, if it's a script, you can find /home/*/public_html -type f -exec grep -H <something> {} \;
or if it's actualy connecting to the net, using lsof you can cross reference ports with full path names of files.
tunelko, stormsurfer, quangntenemy, TheHiveMind, Z, balicocat, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, JanLitwin17, SwolloW, dangarbri haben dieses Thema abonniert und erhalten EMails bei einer neuen Nachricht.
1 Personen sehen sich diese Thema gerade an.
Dieses Thema wurde 3816 mal angesehen.
1 Personen sehen sich diese Thema gerade an.
Dieses Thema wurde 3816 mal angesehen.