“This post is educational only , i dont recommend implementing the system described here since that could be considered a crime in most countries, but its not a crime to share information so here it is”
Hi
i was thinking how hacking bots work and i could imagine that it would be somehow easy to create one by myself.
Here is the idea , using google alerts (google system that sends you an email when founds something in the web matching your alert criteria) i could create an alert for content wich contains the string “roundcube/bin/” and could use a email in my server to receive those alerts, and then create a CRON job to check for new email and parse the contents of those emails to extract URL’s to the sites found by google.
Then the cron job will execute a PHP script or a perl script to scan each of the URL’s servers to find the version of the “roundcube” webmail system installed by visiting common installation dirs, then if the version matchs the version i was looking (a vulnerable one) i could send me an email so i can manually hack that server using www.metasploit.com or i could let it do by itself executing as a batch script.
And finally after hacking 2 or 3 servers i could use them to do the entire process without using my server anymore all i need would be install a php/perl script own an account email in one of the servers and create a CRON Job.
Now think about it, i was only talking about hacking roundcube webmail system but it could work for any system with knowns xploits , imagine creating google alerts for every single system listed in http://www.milw0rm.com/ thats scary !!
Really, i scared myself !! haha
