+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: [Tutorial] NTP scanning and filtering (UPDATED) (/showthread.php?tid=5122672)
[Tutorial] NTP scanning and filtering (UPDATED) - mans - Jan 5, 2016
NTP scanning and filtering tutorial*
*All the scripts used arent coded by me and I didnt invent any of this. Im just sharing it with you guys because sharing is caring.
Why I made this tutorial
I just do this to help other people that dont know how to do this. And I couldnt really find any other HQ thread that covers NTP scanning and filtering.
Requirements
1. A VPS / Dedicated server that you can scan on (see 'Hosting' for some hosts). (I use centos 6.x)
2. Alot of bandwith
3. ntpchecker: http://www.mediafire.com/download/69htm0oaubbi78k/ntpchecker
4. ntp_123_monlist.pkt: http://www.mediafire.com/download/2c369nfl2c4momz/ntp_123_monlist.pkt
5. A brain (jk you wont need one)
Hosting for scanning
Here are some hosting that I think are good for scanning:
http://ecatel.co.uk/
http://www.ovh.com/ca/en/
http://www.soyoustart.com/ca/en/
https://www.kimsufi.com/en/
http://colocrossing.com/
https://www.datashack.net/ (This is the one that I used and I had pretty good results 😉)
How to scan
Spoiler (Click to View)
Extra info
- If you have any issues post them below. -
- NTP attack script: http://pastebin.com/raw/PJeYk4Bc (Thanks for the amazing script: https://hackforums.net/member.php?action=profile&uid=2623266).
- I usually type screen first and when it opens the screen I type the command. -
This is for educational purposes only.
Thanks to:
All of hackforums
https://hackforums.net/member.php?action=profile&uid=2350472 for the dstat
This was my first tutorial. Please leave a thanks if you have enjoyed this tutorial. 🤝
I didnt really know in what section to post this so please tell me if i posted it in the wrong section.
* - Tirentz - Jan 5, 2016
When i scan with zmap it never outputs the results.
i use this command
zmap -M udp -p 123 --probe-args=file:ntp_123_monlist.pkt -o monlist_fingerprint.txt
* - mans - Jan 5, 2016
(Jan 5, 2016 01:24 PM)Tirentz Wrote: When i scan with zmap it never outputs the results.
i use this command
zmap -M udp -p 123 --probe-args=file:ntp_123_monlist.pkt -o monlist_fingerprint.txt
I forgot to put it in the thread look at it now :D
* - Knowledgeable - Jan 5, 2016
so why use zmap and monlist method as opposed to an ntp c scanner?
* - OGSkypeThug - Jan 5, 2016
(Jan 5, 2016 05:30 PM)Knowledgeable Wrote: so why use zmap and monlist method as opposed to an ntp c scanner?
so why use a ntp c scanner opposed to zmap and monlist method
* - mans - Jan 5, 2016
(Jan 5, 2016 05:41 PM)OGSkypeThug Wrote: so why use a ntp c scanner opposed to zmap and monlist method
You, I like you
(Jan 5, 2016 05:30 PM)Knowledgeable Wrote: so why use zmap and monlist method as opposed to an ntp c scanner?Because I simlpy get better results doing it this way, but on the other hand it takes way longer. If you want it to be done faster you can also use the ntpscanner and filter that but I got way better results with this.
* - Knowledgeable - Jan 6, 2016
(Jan 5, 2016 11:52 PM)Foxxi_ Wrote: You, I like you
Because I simlpy get better results doing it this way, but on the other hand it takes way longer. If you want it to be done faster you can also use the ntpscanner and filter that but I got way better results with this.
thanks for the reply
when you say better results, are you meaning bigger lists or stronger lists?
* - OGSkypeThug - Jan 6, 2016
(Jan 6, 2016 12:00 AM)Knowledgeable Wrote: thanks for the reply
when you say better results, are you meaning bigger lists or stronger lists?
You also got to note, if your host filters NTP you won't get good lists.
* - mans - Jan 6, 2016
(Jan 6, 2016 12:03 AM)OGSkypeThug Wrote: You also got to note, if your host filters NTP you won't get good lists.
Ill put it in the thread.
(Jan 6, 2016 12:00 AM)Knowledgeable Wrote: thanks for the reply
when you say better results, are you meaning bigger lists or stronger lists?
Im getting a bigger amp factor and the lists are also about 2x as big.
* - Jаson - Jan 6, 2016
It's a known fact that zmap works better than the C scripts. 👍
* - OGSkypeThug - Jan 6, 2016
(Jan 6, 2016 03:16 AM)jаson Wrote: It's a known fact that zmap works better than the C scripts. 👍
It's a known fact you suffer from the intellectual disability
* - mans - Jan 6, 2016
(Jan 6, 2016 03:18 AM)OGSkypeThug Wrote: It's a known fact you suffer from the intellectual disability
It's a known fact that this post is useless.
* - Proxseas - Jan 6, 2016
That's around 45x? Where the hell did you pull 350x from
* - mans - Jan 6, 2016
(Jan 6, 2016 06:06 AM)Proxseas Wrote: That's around 45x? Where the hell did you pull 350x from
My server outputted 10 mbps and in the dstat it hit 3.5gbps Im not the smartest guy but I calculated that to be around 350x amp
* - Knowledgeable - Jan 6, 2016
(Jan 6, 2016 12:20 AM)Foxxi_ Wrote: Ill put it in the thread.
Im getting a bigger amp factor and the lists are also about 2x as big.
hm, ill take note and run a new scan tonight or tomorrow with your method and see how it goes and post back. thanks