We all know what botnets are (think so), but anyway let’s see a proper definition of botnets taken from shadowserver… and I quote:

A botnet is a collection of computers, connected to the internet, that interact to accomplish some distributed task. Although such a collection of computers can be used for useful and constructive applications, the term botnet typically refers to such a system designed and used for illegal purposes. Such systems are composed of compromised machines that are assimilated without their owner’s knowlege.

Among the DDoS usage of botnets there are also know usages like:

Keylogging

Keylogging is perhaps the most threatening botnet feature to an individual’s privacy. Many bots listen for keyboard activity and report the keystrokes upstream to the bot herder. Some bots have builtin triggers to look for web visits to particular websites where passwords or bank account information is entered. This gives the herder unprecendented ability to gain access to personal information and accounts belonging to thousands of people.

Warez

Botnets can be used to steal, store, or propogate warez. Warez constitutes any illegally obtained and/or pirated software. Bots can search hard drives for software and licenses installed on a victims machine, and the herder can easily transfer it off for duplication and distribution. Furthermore, drones are used to archive copies of warez found from other sources. As a whole, a botnet has a great deal of storage capacity.

Spam

Botnets often are used as a mechanism of propogating spam. Compromised drones can forward spam emails or phish scams to many 3rd party victims. Furthermore, instant messaging accounts can be utilized to forward malicious links or advertisements to every contact in the victim’s address book. By spreading spam-related materials through a botnet, a herder can mitigate the threat of being caught as it is thousands of individual computers that are taking on the brunt of the dirty work.

and the one I’m gonna focus on (well, something derived from it) -> Click Fraud

Botnets can be used to engage in Click Fraud, where the bot software is used to visit web pages and automatically “click” on advertisement banners. Herders have been using this mechanism to steal large sums of money from online advertising firms that pay a small reward for each page visit. With a botnet of thousands of drones, each clicking only a few times, the returns can be quite large. Since the clicks are each coming from seperate machines scattered accross the globe, it looks like legitimate traffic to the untrained investigator.

My point is that many herders (botnet organizers) use a pretty raw Click Fraud mechanism, mainly just issue the command to the bot to retrieve the page and it’s advertisement and rebuild a query string to the advertisers website with the referer header set… as mentioned in the definition this may seem sometimes legitimate traffic to some, but big advertising companies would notice that something isn’t right, stuff like hundreds of clicks at (almost) the same time and similar scenario’s…

The new approach (better) would be to generate only website traffic at random hours because highly visited websites use pay-per-post campaigns (more info about pay-per-post)… and there are also other advertising systems like simple banner/ad placement on the website/blog and via the traffic stats you get paid…

How could botnets help? Well botnets would act as general users/viewers of the blog/website thus making legitimate traffic… masked by a randomized visit system… a general scenario:

• the herder issues the command to visit a website
• each bot receives the command, enters a random delay before executing it (in minutes) (ex: rand(60))
• the bot finally executes the visit and resets the delay time before revisit adding a day to it also

A very raw implementation could be easily implemented but varying from botnets to botnets, because some botnets are simple IRC based while others not…

So many live hits and no subscribers? Nooooo, I think that netvibes got the solution to this issue…

It’s unethical… to whom?! to advertising companies only…

Everybody has a favorite shell; not so many under Windows as there are under Linux, but anyway…

As most will tell you there favorite shell under Linux would be bash, as under Windows not really having what to chose from they would say cmd.exe (ok, bash can be used under Windows via cygwin, if I remember well).

But if you remeber well I wrote an article a while back about PowerShell, and so it seems that nowadays Windows users have a brand new shell which at some points can be quite impresive…

Anyway this article was ment to compare bash – PowerShell, but rather than doing that I would advice you to take a look on Wikipedia Comparison of computer Shells; this way you can decide which shell is the best (suitable) for you…

P.S. PowerShell being a freshly developed shell may have some glitches, as I found one some time ago NetCat & PowerShell -> disaster

Skavenger? Yes, because scavenger is already used?!?

What is skavenger? Skavenger is a source code auditing tool, firstly though for php, but also used for any kind of source code file; as long as you know what to look for…

Yes I thought is as a replacement tool for egrep/sed under Windows! because not everybody installs cygwin (for example) under there windows boxes to perform source code auditing. I’ve seen people who most of the time used notepad to audit source code!

And more…
Skavenger is more than a replacement for egrep/sed because it has the ability to parse conforming to a regular expression or a series of regular expressions more than one file; even a directory; and prints out line number… isn’t that sup4 l33t?

Anyway… for download and more info check out http://code.google.com/p/skavenger/, because you can have a lot of fun with it; did I mention it was a console application?

P.S. You need php in order to use this script. Default values in regex.def check for primordial sql injection and XSS….
P.P.S. For more things to search for under php, check my article at http://insanesecurity.wordpress.com/2007/10/30/source-code-audit-php/

Happy auditing!

Wanna work on a web reconnaissance tool?
Want to have your name in readme file?
Got bored and want to help somebody?

Well then darknet readers this is your chance, because I need people to help me on a project I started a while ago called Website Anatomy, to find out what it is about check out the link… That is what the initial idea I had about it, since then it changed radically.

Anyway arriving to the important part of this article… I need a regEx guy (many regular expressions will be needed) and a php-guru (to tidy up and improve my code), till next weekend drop me mails at: backbone46 [at] gmail dot com

Heard about the recent server crash, and I also fell a bit alerted by this incident, because I as the web hosting providers don’t do regular backup…. anyway what am I going to talk about now? Bookmarklets, we all know them, there new, hip, and full of color ….

What are bookmarklets? Little javascript snippets that you bookmark and use them on any website… sounds fun? Check out wikipedia for more info about them….

Why? Because they are useful, free, and sexy… (Sounds like cheap porn to me)

An example bookmarklets: cookie

The example above doesn’t work because I used an encoded javascript, and not the clear text javascript in the url because wordpress filters it out…. but you can bookmart it and remove the http://www.darknet.org.uk out of it…

short article on short scripts… a list of websites that contain bookmarklets:
http://yaisb.blogspot.com/2006/08/new-bookmarklets.html
www.bookmarklets.com
https://www.squarefree.com/bookmarklets/
http://ostermiller.org/bookmarklets/

p.s. thinking to develop a bookmarklet? Keep it under 500 characters…

What is open music?

Open Music is music that is shareable, available in “source code” form, allows derivative works and is free of cost for non-commercial use. It is the concept of “open source” computer software applied to music.

And it has a license as source code programs have too. Even more it comes under 2 licenses: Green and Yellow.

Who seems to promote open source music? -> Magnatune

Don’t know where to start with open music? Try at LinuxTAG as a start, and after that move to Open Music Archive.

Why did I post the article? Because I liked the idea and to inform you that from now on we’ll have “secure” music. Just kidding… The truth is that many firms have tried to shutdown P2P servers due to piracy (in this case music).

I’m thinking in perspective, first open source software, then open source music… what next? Open source movies? Could be.

Listening to: Magic Mushrooms :: Open Source

There is a virus on the net from a long time, the damage inflicted by it is unstoppable, or at least that was though, check it out yourself

…just kidding, it does not exist but such a virus would be something great =)

For this article you should thank Patrick Ogenstad and his comment on my post , because I did not know about PowerShell until he mentioned about it… so a white point for him =)
The parts that will follow are snippets from the Getting Started document that comes with it…

Abstract

Windows PowerShell™ is a new Windows command-line shell designed especially for system administrators. The shell includes an interactive prompt and a scripting environment that can be used independently or in combination.

Introducing Windows PowerShell

Most shells, including Cmd.exe and the SH, KSH, CSH, and BASH Unix shells, operate by executing a command or utility in a new process, and presenting the results to the user as text. Over the years, many text processing utilities, such as sed, AWK, and PERL, have evolved to support this interaction.
These shells also have commands that are built into the shell and run in the shell process, such as the typeset command in KSH and the dir command in Cmd.exe. In most shells, because there are few built-in commands.many utilities have been created.
Windows PowerShell is very different.

• Windows PowerShell does not process text. Instead, it processes objects based on the .NET platform.
• Windows PowerShell comes with a large set of built-in commands with a consistent interface.
• All shell commands use the same command parser, instead of different parsers for each tool. This makes it much easier to learn how to use each command.

Best of all, you don’t have to give up the tools that you have become accustomed to using. You can still use the traditional Windows tools, such as Net, SC, and Reg.exe in Windows PowerShell.

Windows PowerShell Cmdlets

A cmdlet (pronounced “command-let”) is a single-feature command that manipulates objects in Windows PowerShell. You can recognize cmdlets by their name format — a verb and noun separated by a dash (-), such as Get-Help, Get-Process, and Start-Service.

In traditional shells, the commands are executable programs that range from the very simple (such as attrib.exe) to the very complex (such as netsh.exe).

In Windows PowerShell, most cmdlets are very simple, and they are designed to be used in combination with other cmdlets. For example, the “get” cmdlets only retrieve data, the “set” cmdlets only establish or change data, the “format” cmdlets only format data, and the “out” cmdlets only direct the output to a specified destination.
Each cmdlet has a help file that you can access by typing:

get-help -detailed

The detailed view of the cmdlet help file includes a description of the cmdlet, the command syntax, descriptions of the parameters, and example that demonstrate use of the cmdlet.

…and more

Besides the above mentioned things, powerShell also includes: a new scripting language (not the lame-ass batch), processes objects, object pipelines, interaction, etc. If you are interested take a look at microsoft.com/powershell

Once again thanks to Patrick….

Well this is my last week of exams, and today I got a free day, tomorrow it will be maths… Anyway while waiting for somebody I got bored and decided to make a small (tiny) video about piping data under windows, you know | …

In Unix-like computer operating systems, a pipeline is the original software pipeline: a set of processes chained by their standard streams, so that the output of each process (stdout) feeds directly as input (stdin) of the next one.

More at Wikipedia – Pipeline (UNIX)

As always a link on youtube (better quality than the last 2 videos): Tips&Tricks About Piping Data
A download link: Piping_data.wmv
My youtube channel =)

Another video in 2-3 days… I think i this becoming like a mania for me… Anyway in this video i played around with netstat so that for those who do not play with it could see the possibilities it offers to us… no more tutorials like:

netstat -a
to view all you connections
the end

… because I have seen to many of this of tuts when they speak about netstat… anyway check it out and tell me your opinion… you know it… youtube for lame quality mediafire for good quality (i got a channel)

Video: netstat revealed
Channel: my youtube channel
Download: netstat.avi