From 72e0b6d5d0f54a0e6115c0a78eb560ce7f1b5e89 Mon Sep 17 00:00:00 2001 From: CPunch Date: Wed, 2 Mar 2022 10:54:31 -0600 Subject: [PATCH] updated readme --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b34aecd..18f4fd0 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Laika -Laika is a simple botnet stack for red teaming. It allows authenticated communication across a custom protocol with generated key pairs which are embedded into the executable (only the public key is embedded in the bot client ofc). +Laika is a simple Remote Access Toolkit stack for red teaming. It allows authenticated communication across a custom protocol with generated key pairs which are embedded into the executable (only the public key is embedded in the bot client ofc). Some notable features thus far: - [X] Lightweight, the bot alone is 270kb (22kb if not statically linked with LibSodium) and uses very little resources. @@ -11,7 +11,7 @@ Some notable features thus far: ## Would this work in real world scenarios? -My hope is that this becomes complete enough to be accurate to real botnet sources seen in the wild. However since Laika uses a binary protocol, the traffic the bot/CNC create would look very suspect and scream to sysadmins. This is why most botnets nowadays use an HTTP-based protocol, not only to 'blend in' with traffic, but it also scales well with large networks of bots where the CNC can be deployed across multiple servers and have a generic HTTP load balancer. +My hope is that this becomes complete enough to be accurate to real RAT sources seen in the wild. However since Laika uses a binary protocol, the traffic the bot/CNC create would look very suspect and scream to sysadmins. This is why most RATs/botnets nowadays use an HTTP-based protocol, not only to 'blend in' with traffic, but it also scales well with large networks of bots where the CNC can be deployed across multiple servers and have a generic HTTP load balancer. I could add some padding to each packet to make it look pseudo-HTTP-like, however I haven't given much thought to this.