Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I'm interested in searching for botnets out in the wild. Besides Google dorking for a phrase or code used on the control panel backend for web based interfaces. What other ways are there to search for a botnet?

share|improve this question
1  
Have a read through this website (The Honeynet Project). – Hammo Oct 3 '12 at 22:42
are you willing to share why you'd like to find botnets? are you looking for a particular one or just anyone? Generally networks/victims aren't that willing to share info they know about particular botnets but they might make exceptions if interests co-incide. – Duncan Oct 14 '12 at 12:31

3 Answers

up vote 6 down vote accepted

Set up a honeypot, let it get infected with some malware and log where this malware connects to.

Pros:

  • You might discover some interesting botnets.
  • You'll uncover more than google will. I guess that their control pages are not indexed!

Cons:

  • You need to get a machine infected with malware.
  • You might have to get a lot of infections before you find a botnet.
  • You need to be able to spot what might be a botnet in the network traffic.
share|improve this answer
Some honeypots will capture the botnet binaries, without allowing them to be installed. The info from the source code will direct you to the botnet C&C. I've done this very thing. – schroeder Oct 3 '12 at 21:18
2  
For a demonstration of just how easy it is to get infected, see this awesome live map of honeypot events. – Polynomial Oct 4 '12 at 7:35
up vote 3 down vote

You might wanna try to look into Dionaea (http://dionaea.carnivore.it/) as it will help emulate as vulnerable machine to copy the malware sample from already infected machine.

It will also capture machine IP attacking your dionaea honeypot and be surprise how much attack you'll get once your honeypot listen to public IP. Just for reminder, it takes time to get a varieties of unique samples

share|improve this answer
up vote 0 down vote

if by 'searching' you mean you want information about a particular one, see What is known about the sirefef/zeroaccess malware/botnet?

If you mean you want info on know locations of it's dropservers, controllers, and bots then that is probably not info that is appropriate to share on a forum like this. It would be nice if there was a forum where that info could be shared.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.