CPunch/Laika
1
0
Fork 0
mirror of https://github.com/CPunch/Laika.git synced 2024-11-21 20:40:05 +00:00
Code Issues Projects Releases Wiki Activity

updated readme

Browse Source
This commit is contained in:
CPunch 2022-03-02 10:54:31 -06:00
parent 8ab3033bf3
commit 72e0b6d5d0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -1,6 +1,6 @@
# Laika # Laika
Laika is a simple botnet stack for red teaming. It allows authenticated communication across a custom protocol with generated key pairs which are embedded into the executable (only the public key is embedded in the bot client ofc). Laika is a simple Remote Access Toolkit stack for red teaming. It allows authenticated communication across a custom protocol with generated key pairs which are embedded into the executable (only the public key is embedded in the bot client ofc).
Some notable features thus far: Some notable features thus far:
- [X] Lightweight, the bot alone is 270kb (22kb if not statically linked with LibSodium) and uses very little resources. - [X] Lightweight, the bot alone is 270kb (22kb if not statically linked with LibSodium) and uses very little resources.
@ -11,7 +11,7 @@ Some notable features thus far:
## Would this work in real world scenarios? ## Would this work in real world scenarios?
My hope is that this becomes complete enough to be accurate to real botnet sources seen in the wild. However since Laika uses a binary protocol, the traffic the bot/CNC create would look very suspect and scream to sysadmins. This is why most botnets nowadays use an HTTP-based protocol, not only to 'blend in' with traffic, but it also scales well with large networks of bots where the CNC can be deployed across multiple servers and have a generic HTTP load balancer. My hope is that this becomes complete enough to be accurate to real RAT sources seen in the wild. However since Laika uses a binary protocol, the traffic the bot/CNC create would look very suspect and scream to sysadmins. This is why most RATs/botnets nowadays use an HTTP-based protocol, not only to 'blend in' with traffic, but it also scales well with large networks of bots where the CNC can be deployed across multiple servers and have a generic HTTP load balancer.
I could add some padding to each packet to make it look pseudo-HTTP-like, however I haven't given much thought to this. I could add some padding to each packet to make it look pseudo-HTTP-like, however I haven't given much thought to this.