Finding out if your backdoored or trojaned

re4per · Post by **re4per** » 02 Apr 2009, 10:59

How can you find out if you have IP addressed connected to you.
cmd >netstat brings up all of the connections but, how can i figure out what is normal and what isn't this is were im stuck.

any help would be greatfull thank you!

Post by **computathug** » 02 Apr 2009, 11:05

Well if you are just looking for a quick fix without understanding any protol, then go to the download section and look for tcpview.

If you want to delve further then take a look at wireshark, this can also be found in the download section.

Hope this helps

Post by **DNR** » 02 Apr 2009, 11:05

you want to run a packetsniffer on yourself. Wireshark, and monitor the connections and view what is being transmitted. Some of this stuff can be just browser toolbars, IM idling in the background, etc - if you got windows, use Process Explorer instead of Taskman - click on properties to view what is running, TCP/IP, and called dlls/processes.

Make sure you have a firewall installed on your computer.

DNR

re4per · Post by **re4per** » 03 Apr 2009, 05:22

Big thanks to you guys i understand the tcp/ip protocol as i have learnt that. im gonna download some of these tools and actually find out, i view my ports to see what was going on etc honestly thank you very much will write back with my findings!

also im running sygate as my firewall, from my research i figure this one is the best i know you cant ever be secure but this helps hit me back

Post by **computathug** » 03 Apr 2009, 05:25

If you also want to scan your ports to see which are open/closed etc then download 'nmap' too.

If you need any help with any just keep posting xD

Before i forget "dont try and scan suck-o with any scanners"

You have been warned. You will get banned automatically and will have to email b_b to have your ip un-banned.

Thought i better let you know before you wonder why you cant get on site

l0ngb1t · Post by **l0ngb1t** » 16 Apr 2009, 13:02

guys i want to learn more abt this stuff and i don't have problem to do it manually without any software and i don't care abt easy solution i just want to understand it more any help

ebrizzlez · Post by **ebrizzlez** » 16 Apr 2009, 14:08

l0ngb1t wrote:guys i want to learn more abt this stuff and i don't have problem to do it manually without any software and i don't care abt easy solution i just want to understand it more any help

The biggest tip to learn manually is by installing or duel-booting with Linux. You will find Linux has all the tools you will ever need for anything. I recommend Debian cause its pretty damn awesome.

and btw, you can nmap yourself, you can goto nmap's online site:

Code: Select all

http://nmap-online.com/

and do an nmap scan on yourself for free.

Post by **bad_brain** » 16 Apr 2009, 14:18

well, you can do it without external software too, for example with the netstat command, to show all connections use:

Code: Select all

netstat -a

and/or

Code: Select all

netstat -an

the -n switch of the latter one will give an numeric output (IP address), the first one the hostname.
to get more info, like what application opened the port you can use:

Code: Select all

netstat -anb

in Windows you are pretty limited compared to Linux, that's why it's better to use the TCPview application computathug mentioned, you can find it in our downloads. it is much more userfriendly than the netstat command on Windows, the output is much like netstat -tulpn on Linux systems.

once you have found a suspicious connection you can use a packetsniffer like Wireshark to capture the outgoing packets, this way you can see what data is sent from your system to the target host. but Wireshark is a tool that demands some background knowledge about the TCP/IP protocol family, else it'll be hard to understand what all the displayed data means.

if you are really interested in it I recommend to get "TCP/IP Illustrated" from our downloads, it's a very good e-book, you'll find all background knowledge you will need in it...

MrRod · Post by **MrRod** » 02 Aug 2009, 02:01

Is Debian the same as Ubantu?

skip · Post by **skip** » 09 Aug 2009, 00:18

MrRod wrote:Is Debian the same as Ubantu?

Ubuntu is a computer operating system based on Debian GNU/Linux.

-thats from wikipedia

http://en.wikipedia.org/wiki/Ubuntu_(operating_system)

Post by **bad_brain** » 09 Aug 2009, 04:50

Ubuntu is based on Debian, right, but it follows a different philosophy....
Debian is a "strictly open source" distro, while Ubuntu also has non-open source apps on board, especially hardware drivers.