[.Satan]

Epic thread, thanks for the lulz.. .sucks for the people who bought that

[Sky]

I can vouch this is a good bot, But I can also vouch that it has major security flaws. Would be amazing if these got fixed.

Simple fix for now: Don't give any fucker your URL? Derp... Also create a custom login script on a fake hosting to hide your URL.

~Arcane 🤝

[_Stoner]

Nice find, why does the bot send the targets ip via php get. When it could have just be retrieved by the server using "$_SERVER['REMOTE_ADDR'];" ?

He actually uses wipmania and dyndns APIs to determine the bot IP. That's a bad thing to depend on even in an IRC bot.

Thanks for referencing my post, OP, I spent some time on that

[betamonkey]

I can vouch this is a good bot, But I can also vouch that it has major security flaws. Would be amazing if these got fixed.

Simple fix for now: Don't give any fucker your URL? Derp... Also create a custom login script on a fake hosting to hide your URL.

~Arcane 🤝

1. DDoS attacks don't work (except for maybe UDP..? This opinion is shared by people other than myself)

2. Wipmania for an HTTP bot? What the..? Also it appears that the bot itself tells the panel its IP, when in fact this only allows spoofing and is stupid as fuck since the server obviously knows the bot's IP

3. No encryption of bot comms? XSS'able? This guy is coding something security researchers will actively try to exploit to disrupt the botnet, and he puts no effort into protecting his own customers. I hope you realize that this vulnerability can allow researchers to identify the botnet owner by his IP and even login under his control panel account.

This bot sucks dude. If you think this is good, your standards need to be raised quite a bit.

Regards,
Beta Monkey

[Shiroyasha]

Time to move away from Baraccuda it seems

First time I lost 8k bots to 0 by uninstall/update and shit logins and commands from God-who-knows-whom
Second time since a week, my bots decreased from 20k to 1k now

[rvltr]

taking a note of the numerous flaws exposed by this. what is not to say that the developers of this are just playing stupid and they are exploiting vulnerabilities left by themselves intentionally?

this is an epic way for them to troll and scam unsuspecting users while pretending they know nothing about it or why it is happening

[betamonkey]

taking a note of the numerous flaws exposed by this. what is not to say that the developers of this are just playing stupid and they are exploiting vulnerabilities left by themselves intentionally?

this is an epic way for them to troll and scam unsuspecting users while pretending they know nothing about it or why it is happening

You know, I wouldn't be surprised. These "mistakes" are so dumb that it's hard not to think that.

Beta Monkey

[Shiroyasha]

Lmao I have my own dedicated servers and they are housed and secured by serveroutes :P
Nothing breached the servers at all, first time it was some session exploit and this time I dont know what it was but my guess is it was this XSS exploit

Not worried about bots though since I can get to that number and quality again, just that I lost almost 1 week of Highquality BTC mining time xD

[RyanC]

Lmao I have my own dedicated servers and they are housed and secured by serveroutes :P
Nothing breached the servers at all, first time it was some session exploit and this time I dont know what it was but my guess is it was this XSS exploit

Not worried about bots though since I can get to that number and quality again, just that I lost almost 1 week of Highquality BTC mining time xD

>secured by serveroutes

You use managed hosting for bots? Are you retarded?

[Shiroyasha]

no I dont use managed services as they charge $200 extra for management
I am a old client there with servers worth $700+ monthly for my personal sites etc. so I got free nginx server setup and security of server with a firewall

It was all before setting baraccuda up, I aint such a kid to ask them to secure it for my botney :|

PS: I am also a Server Administrator and a Network Administrator (not pro yet)

[Sky]

1. DDoS attacks don't work (except for maybe UDP..? This opinion is shared by people other than myself)

2. Wipmania for an HTTP bot? What the..? Also it appears that the bot itself tells the panel its IP, when in fact this only allows spoofing and is stupid as fuck since the server obviously knows the bot's IP

3. No encryption of bot comms? XSS'able? This guy is coding something security researchers will actively try to exploit to disrupt the botnet, and he puts no effort into protecting his own customers. I hope you realize that this vulnerability can allow researchers to identify the botnet owner by his IP and even login under his control panel account.

This bot sucks dude. If you think this is good, your standards need to be raised quite a bit.

Regards,
Beta Monkey

You think I login to that with my real IP? So the police can track me after my years of blackhat activity? Sure, Here are my login logs, If this is my real IP have fun booting me :)

Also I was talking about the botkill, Filezilla & Bitcoin miner, I Use IPKiller for DDoS

[img]http://img547.imageshack.us/img547/9615/derpec.png[/img]

~Arcane 🤝

[_Stoner]

You think I login to that with my real IP? So the police can track me after my years of blackhat activity? Sure, Here are my login logs, If this is my real IP have fun booting me :)

Also I was talking about the botkill, Filezilla & Bitcoin miner, I Use IPKiller for DDoS

[img]http://img547.imageshack.us/img547/9615/derpec.png[/img]

~Arcane 🤝

What do you have to prove to anybody?

--

Anyways, looks to be no word from TP or Organized. Is this the end of Barracuda?

[rcvrcv]

Thanks, nice tool. Good work sir, very appreciative

---

I Use IPKiller for DDoS

~Arcane 🤝

what's IPKiller, a booter? Or your custom bot? never heard of it.

[RyanC]

no I dont use managed services as they charge $200 extra for management
I am a old client there with servers worth $700+ monthly for my personal sites etc. so I got free nginx server setup and security of server with a firewall

It was all before setting baraccuda up, I aint such a kid to ask them to secure it for my botney :|

PS: I am also a Server Administrator and a Network Administrator (not pro yet)

So, you consider your setup secured as you have some firewall in place? Are you serious?

[_Stoner]

The exploits listed in this thread are still active and vulnerable.

https://hackforums.net/showthread.php?tid=3083740