5

I'm interested in searching for botnets out in the wild. Besides Google dorking for a phrase or code used on the control panel backend for web based interfaces. What other ways are there to search for a botnet?

  • 1
    Have a read through this website (The Honeynet Project). – Hammo Oct 3 '12 at 22:42
  • are you willing to share why you'd like to find botnets? are you looking for a particular one or just anyone? Generally networks/victims aren't that willing to share info they know about particular botnets but they might make exceptions if interests co-incide. – Duncan Oct 14 '12 at 12:31
8

Set up a honeypot, let it get infected with some malware and log where this malware connects to.

Pros:

  • You might discover some interesting botnets.
  • You'll uncover more than google will. I guess that their control pages are not indexed!

Cons:

  • You need to get a machine infected with malware.
  • You might have to get a lot of infections before you find a botnet.
  • You need to be able to spot what might be a botnet in the network traffic.
  • Some honeypots will capture the botnet binaries, without allowing them to be installed. The info from the source code will direct you to the botnet C&C. I've done this very thing. – schroeder Oct 3 '12 at 21:18
  • 3
    For a demonstration of just how easy it is to get infected, see this awesome live map of honeypot events. – Polynomial Oct 4 '12 at 7:35
  • @Polynomial: heres another good one map.ipviking.com – bic Feb 23 '15 at 15:59
3

You might wanna try to look into Dionaea (http://dionaea.carnivore.it/) as it will help emulate as vulnerable machine to copy the malware sample from already infected machine.

It will also capture machine IP attacking your dionaea honeypot and be surprise how much attack you'll get once your honeypot listen to public IP. Just for reminder, it takes time to get a varieties of unique samples

0

if by 'searching' you mean you want information about a particular one, see What is known about the sirefef/zeroaccess malware/botnet?

If you mean you want info on know locations of it's dropservers, controllers, and bots then that is probably not info that is appropriate to share on a forum like this. It would be nice if there was a forum where that info could be shared.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.