{"action":"opened","issue":{"url":"https://api.github.com/repos/pepper-jk/ID2T-toolkitIII/issues/260","repository_url":"https://api.github.com/repos/pepper-jk/ID2T-toolkitIII","labels_url":"https://api.github.com/repos/pepper-jk/ID2T-toolkitIII/issues/260/labels{/name}","comments_url":"https://api.github.com/repos/pepper-jk/ID2T-toolkitIII/issues/260/comments","events_url":"https://api.github.com/repos/pepper-jk/ID2T-toolkitIII/issues/260/events","html_url":"https://github.com/pepper-jk/ID2T-toolkitIII/issues/260","id":382830399,"node_id":"MDU6SXNzdWUzODI4MzAzOTk=","number":260,"title":"[MembersMgmtCommAttack] - Presence of external IPs among the bots injected","user":{"login":"pepper-jk","id":19859589,"node_id":"MDQ6VXNlcjE5ODU5NTg5","avatar_url":"https://avatars1.githubusercontent.com/u/19859589?v=4","gravatar_id":"","url":"https://api.github.com/users/pepper-jk","html_url":"https://github.com/pepper-jk","followers_url":"https://api.github.com/users/pepper-jk/followers","following_url":"https://api.github.com/users/pepper-jk/following{/other_user}","gists_url":"https://api.github.com/users/pepper-jk/gists{/gist_id}","starred_url":"https://api.github.com/users/pepper-jk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pepper-jk/subscriptions","organizations_url":"https://api.github.com/users/pepper-jk/orgs","repos_url":"https://api.github.com/users/pepper-jk/repos","events_url":"https://api.github.com/users/pepper-jk/events{/privacy}","received_events_url":"https://api.github.com/users/pepper-jk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-20T20:13:05Z","updated_at":"2018-11-20T20:13:05Z","closed_at":null,"author_association":"OWNER","body":"**Issue by [giorgio.bertagnolli](https://git.tk.informatik.tu-darmstadt.de/giorgio.bertagnolli)**\n_Thursday Aug 16, 2018 at 17:34 GMT_\n_Originally opened as https://git.tk.informatik.tu-darmstadt.de/SPIN/ID2T-toolkit/issues/156_\n\n----\n\nAfter doing some injections using the members management communication attack, more precisely using the following command: \"./id2t -I inputname.pcap -o outputname.pcap -a MembersCommMgmtAttack file.csv=botnetTrace.csv bots.count=4 ip.reuse.local=0 ip.reuse.external=0 ip.reuse.total=0 hidden_mark=true\"\r\nI noticed that in the pcap file were injected 4 new bots, both with external (public) and internal (private) IP addresses, while I expect the bots to have just internal IPs.\r\nRunning the following filter in Wireshark \"ip.opt.sec_prot_auth_nsa==1 && (ip.src==192.168.0.0/16 || ip.src==172.16.0.0/12 || ip.src==10.0.0.0/8)\", should reveal the conversations corresponding only to Bots with private IPs.\r\nBelow an example of a conversation where the Bot's IP is external.\n"}}
{"actor":{"display_login":"pepper-jk"}}