[The Empire] [Tutorial] How To Steal Amp Lists From Popular Stressers

Requirements

Hardware:

a dedi or VPS with some form of Linux installed (I'll be using my dedi with Debian Squeeze)

Software:

a network monitor (I'll be using iptraf)
a text editor (nano is fine)
screen
grep
sort
uniq
cat (maybe)

Idea

DNS reflection attacks utilize small, spoofed DNS queries for large amounts of information from open recursive name servers that return this large response to a target. These attacks rely on a fairly large list of these open recursive name servers to query, which, in reality, are fairly easy to scan for and compile into a list. Some users decide to sell these lists and profit off of them though. Naughty naughty. Now there are plenty of guides and utilities online to gather this data yourself but why not just steal tried and tested lists from existing stressers that are using them?

Like I mentioned above, the attack utilizes open recursive name servers to do its dirty work. These servers are sending large amounts of UDP traffic right at a target. Who's to say I can't just log the traffic hitting my server and parse that data to find every single open recursive name server utilized by the attack? Why can't I just SE stressers or use accounts to hit my server for a few minutes to gather this information quickly?

Process

1. SSH into the dedi/VPS and start up iptraf in screen (you don't want your SSH socket to close and have your iptraf process killed! You can just reattach to the detached session in the case of a disconnect)

[Image: 24Xau]

2. Go into Configure... and make sure Logging is set to On

[Image: 24X8B]

3. Start up an IP traffic monitor session on all interfaces (or eth0 if you want to keep the list a little less bulky) and specify a location for the log to be saved

[Image: 24XtA]

4. Hit your server. I suggest hitting the server for 5-10 minutes (most 100Mb dedis will get completely assfucked by most attacks so you'll see your SSH session freeze or even disconnect for the duration). Stop logging after the attack completes (you'll know when your server starts responding again). It's time to parse the logs.

5. I have some logs from previous attacks which I can go ahead and show you some data from. I'll be using Formality Stresser as an example

[Image: 24XGq]

So you have your log... but none of this data is usable... yet. "There are words and duplicates and OH MY GOD REGEXKS WHAT DO I DO WITH THIS LOG?" We'll have to pass it through some stuff to get the data we need. This is easy with some piping!

Code 
grep -Eo "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:53" formalitystresser1.log | sort -n | uniq | grep -Eo "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" > finaldnslist.txt

Using some simple regular expressions, sort and uniq you've managed to pull only the IP address ending in port 53 (the port name servers use), list them all in numerical order (mostly to get all the duplicates right next to each other) and merge all the duplicates! You're a god!

[Image: 24XUt]

ENJOY YOUR FREE AMP LISTS

Oh and you can use cat to merge lists if you ever need to.