egghelp.org community

[3rdBAR]

I have a botnet comprising multiple eggs on multiple networks. When I use gseen to find out when and where a particular nick was last seen, gseen wants to stop at the first bot it queries who has seen the particular nick. It does this regardless of whether the instance it finds is much older than instances of the same nick on other bots in the net. And it even stops like this when it finds an instance of a nick on the first bot it checks when the queried nick (the same person being sought) is in fact present on one of the other botnet bot's networks in one of its channels.

Can gseen be effectively used in the way I want? I want it to find the most recent occurrence of a nick's presence across the botnet. I currently have one hub and 12 leafs. Is this stop-on-first-hit a configuration issue?

TIA

[3rdBAR]

No replies, eh? Two days ago I wrote to the author of gseen about this as well. He hasn't replied either (or at least he hasn't replied yet).

One thing about this problem that puzzles me a bit is this: If a botnet were on a single IRC network, but its individual bots were on separate channels (no common channels among them), I'm guessing the same stop-on-first-hit problem would occur. Here's the scenario: The botnet bots are linked, someone initiates a gseen query for a nick, gseen checks the bots one at a time until it finds an instance of the entered nick. When it finds this first instance in one of the bot's gseen.dat files, it checks no further. So if this first bot who replies that the nick has visited one of its channels reports that the nick had been there, say, 2 weeks ago, but yesterday the same nick had joined a channel monitored exclusively by one of the other not yet queried botnet bots, the person initiating the query will never learn of this nick's recent join to that channel.

So is this how it works? If not, why does gseen stop on the first hit and check no further on my multi-network botnet? If this is simply how gseen works, I'm surprised that it doesn't get more complaints from people using it with botnets. If I'm missing something, please tell me.

[Callisto]

dont know if you checked this in the gseen.conf file or not

[3rdBAR]

[Sir_Fz]

If that's the case then I guess this is a bug in the module and should be fixed. Unfortunately, the author has stopped developing the module long time ago. I'm not sure if bseen has this feature, but you can try it (search the tcl archive for bseen).
_________________
Follow me on GitHub

- Opposing

Public Tcl scripts

[3rdBAR]

Okay, here's the bottom line. I've just received a response from the author of gseen and this is what he said:

[Alchera]

[3rdBAR]