CnCHunter - An MITM-Approach to Identify Live CnC Servers

YouTube·Black Hat

Explore a systematic approach to identifying active Command and Control (CnC) servers in this 34-minute Black Hat conference talk. Learn about CnCHunter, an efficient tool designed to discover live CnC servers without relying on protocol reverse engineering. Understand the challenges of detecting CnC servers, including their mobility, proprietary communication protocols, and end-to-end encryption. Dive into the MITM-based solution, examining its components such as active probing, traffic analysis algorithms, and CnCScore. Discover how this method overcomes limitations of previous approaches and see real-world demonstrations of its effectiveness in combating botnets.