5

I'm interested in searching for botnets out in the wild. Besides Google dorking for a phrase or code used on the control panel backend for web based interfaces. What other ways are there to search for a botnet?

Improve this question
2
  • 1
    Have a read through this website (The Honeynet Project).
    – Hammo
    Oct 3, 2012 at 22:42
  • are you willing to share why you'd like to find botnets? are you looking for a particular one or just anyone? Generally networks/victims aren't that willing to share info they know about particular botnets but they might make exceptions if interests co-incide.
    – Duncan
    Oct 14, 2012 at 12:31

3 Answers 3

Reset to default
8

Set up a honeypot, let it get infected with some malware and log where this malware connects to.

Pros:

  • You might discover some interesting botnets.
  • You'll uncover more than google will. I guess that their control pages are not indexed!

Cons:

  • You need to get a machine infected with malware.
  • You might have to get a lot of infections before you find a botnet.
  • You need to be able to spot what might be a botnet in the network traffic.
Improve this answer
3
  • Some honeypots will capture the botnet binaries, without allowing them to be installed. The info from the source code will direct you to the botnet C&C. I've done this very thing.
    – schroeder ♦
    Oct 3, 2012 at 21:18
  • 3
    For a demonstration of just how easy it is to get infected, see this awesome live map of honeypot events.
    – Polynomial
    Oct 4, 2012 at 7:35
  • @Polynomial: heres another good one map.ipviking.com
    – bic
    Feb 23, 2015 at 15:59
3

You might wanna try to look into Dionaea (http://dionaea.carnivore.it/) as it will help emulate as vulnerable machine to copy the malware sample from already infected machine.

It will also capture machine IP attacking your dionaea honeypot and be surprise how much attack you'll get once your honeypot listen to public IP. Just for reminder, it takes time to get a varieties of unique samples

Improve this answer
0

if by 'searching' you mean you want information about a particular one, see What is known about the sirefef/zeroaccess malware/botnet?

If you mean you want info on know locations of it's dropservers, controllers, and bots then that is probably not info that is appropriate to share on a forum like this. It would be nice if there was a forum where that info could be shared.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .