GlasBlog

I found an interesting blog entry about monitoring IRC Botnets.

Summary:

I wrote a little script called “infiltrator” to monitor IRC based botnets, which we detect using Rishi.

On 15 of November 2007 Jan Gerrit Goebel published the code and I could take a look at it: Infiltrator v0.1

For those of you interested in little helpful tools, i uploaded my infiltrator script for quick and dirty botnet monitoring. There is no documentation available right now but usually a questionmark in front of a command gives some hints (e.g. ? show all). Have fun: infiltrator.tar.gz

The Script is written in Python and consists of an rudimentary IRC Client with some special functions. At the moment I’m playing around with it. As soon as I am collected some more experience with it, I will publish a short report here.