And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python script the host gets. Just cant get myself to find the C&C server to mess around with it.

  • You could try using Wireshark to sniff the packets heading back to the C&C server. – John Deters Jan 3 '14 at 16:42

Using a packet sniffer (like wireshark or tcpdump) you would monitor the traffic between your machine and the internet. You'll want to restart all your connections so the bot needs to reconnect. Figure out where its going and you can follow it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.