[Jake91082]

Hi, i know this was asked before but from my understanding RATs are more targeted and give you more control over PCs where as botnets are used for controlling thousands if not tens of thousands of machines but with reduced features.

I know RAT works similar to metasploit meterpreter with a reverse tcp connection from victims but how do botnets work? Are they controlled from a web panel? How do they connect back to you? Can you upload and execute files on botnet slaves? Is it harder to catch someone that owns a botnet than someone whos ratting pcs from his home network?

Also I'm assuming you would need bulletproof hosting to host a botnet panel and it would need to be able to handle thousands of connections right?

What are some pros and cons of each? Which is cheaper/simpler to set up?

I heard botnets dont need portforwarding which makes sense if the connection from victims isnt trying to connect back to your network.

[Ph4n70M Phr34K]

First of, a botnet can be defined as a network of infected devices. With that being said, a RAT that has infected few devices and is controlling them, technically it is a botnet.

Are they controlled from a web panel?

Botnet c2(command and control), can be literally anything - GUI(graphical interface), webpanel, discord server, irc server, a simple command line app or anything else.

Most of the botnets that are being sold publicly are using http protocol and a webpanel to control the bots and send tasks.

Can you upload and execute files on botnet slaves? I

Yes and that funcion is usually called "botnet loader". In most cases it is a "base function", the core of the botnet, that is used to deploy other malware per exact needs.

Is it harder to catch someone that owns a botnet than someone whos ratting pcs from his home network?

"catching" a botnet operator(called threat actor) mostly depends on his OPSEC, it has nothing to do with the malware being used.
So your question itself is wrong. No way to specify if its harder to catch someone who is using a botnet, rat or other type of malware.

Also I'm assuming you would need bulletproof hosting to host a botnet panel and it would need to be able to handle thousands of connections right?

Yes, bulletproof and offshore preferably. Keep in mind the server or domain can be always taken down, no matter what. In most cases it is just a matter of spamhaus complains.

The more bots you have in your botnet, the better VPS you would need.

What are some pros and cons of each? Which is cheaper/simpler to set up?

Both can be expensive, cheap, simpler or harder. It is totally subjective.

Generally botnets are used to hold bots and rats to perform specified administrative tasks on bots.
Also to start a botnet you always need to invest a lot of money and time, no matter what. Using free/cracked shit is totally useless nowadays.
Same as being lazy in any area. If you really want to have a good botnet then you need to dedicate to it much effort, time and money.

I heard botnets dont need portforwarding which makes sense if the connection from victims isnt trying to connect back to your network.

"victims" are always connecting back to the c2 somehow, no matter which malware is being used.

Port forwarding is only the issue for the newbies that are very resistant to knowledge. Port forwarding can always be done in a matter of seconds and its done on server side to accept the connection.

[whoisthisss]

It took me a long time to understand this question too but I know botnets are just bigger