New answers tagged reverse-engineering
I guess you are referring to ssltest.py that is circulating in the wild. The Client Hello was probably just copied from another packet capture. It is part of the SSL handshake: Client Server ClientHello --------> ServerHello ...
When you attempt to take over control of a botnet, you are committing an act which is just as criminal as what the original owner of the botnet was doing. No matter how good your intentions are, you are taking control of other peoples IT systems, which is illegal in most parts of the world. Report the botnet to the authorities. When you don't believe that ...
If the httpd file was replaced, what ELSE was replaced? This looks like a 'nuke from orbit' scenario. As for taking over a botnet, that isn't a good idea. Whatever that botnet does can be attributed to you because you became one of the controllers in its network. Report to the authorities in your area.
Top 50 recent answers are included