Script irc-botnet-channels

Script types: portrule
Categories: discovery, vuln, safe
Download: https://svn.nmap.org/nmap/scripts/irc-botnet-channels.nse

Script Summary

Checks an IRC server for channels that are commonly used by malicious botnets.

Control the list of channel names with the irc-botnet-channels.channels script argument. The default list of channels is

  • loic
  • Agobot
  • Slackbot
  • Mytob
  • Rbot
  • SdBot
  • poebot
  • IRCBot
  • VanBot
  • MPack
  • Storm
  • GTbot
  • Spybot
  • Phatbot
  • Wargbot
  • RxBot

Script Arguments

irc-botnet-channels.channels

a list of channel names to check for.

Example Usage

  • nmap -p 6667 --script=irc-botnet-channels <target>
  • nmap -p 6667 --script=irc-botnet-channels --script-args 'irc-botnet-channels.channels={chan1,chan2,chan3}' <target>

Script Output 

| irc-botnet-channels:
|   #loic
|_  #RxBot

Requires

Authors:

  • David Fifield
  • Ange Gutek

License: Same as Nmap--See https://nmap.org/book/man-legal.html