internetrelaychat/IRCP
internetrelaychat/IRCP
1
Fork 0
mirror of git://git.acid.vegas/IRCP.git synced 2024-11-22 16:06:41 +00:00
Code Issues Activity
d7950e3ee4
IRCP/README.md

145 lines
6.6 KiB
Markdown
Raw Normal View History

Initial commit
2023-05-25 20:03:39 +00:00
# Internet Relay Chat Probe (IRCP)
![](.screens/ircp.png)
A robust information gathering tool for large scale reconnaissance on [Internet Relay Chat](https://en.wikipedia.org/wiki/Internet_Relay_Chat) servers, made for future usage with [internetrelaychat.org](https://internetrelaychat.org) for public statistics on the protocol.
Meant to be used in combination with [masscan](https://github.com/robertdavidgraham/masscan) checking **0.0.0.0/0** *(the entire IPv4 range)* for port **6667**.
The idea is to create a *proof-of-concept* documenting how large-scale information gathering on the IRC protocol can be malicious & invasive to privacy.
## Order of Operations
First, an attempt to connect using SSL/TLS on port 6697 is made, which if it fails, will fall back to a standard connection on port 6667.
Added CAP, MODULE, INFO, CREDITS, IRCOPS, STATS p, & MODULE replies stored in the snapshot
2023-05-30 06:35:57 +00:00
Once connected, server information is gathered from `ADMIN`, `CAP LS`, `MODULES -all`, `VERSION`, `IRCOPS`, `MAP`, `INFO`, `LINKS`, `STATS p`, & `LIST` replies.
Initial commit
2023-05-25 20:03:39 +00:00
An attempt to register a nickname is then made by trying to contact NickServ.
Next, every channel is joined with a `WHO` command sent & every new nick found gets a `WHOIS`.
Updated README
2023-05-28 03:00:51 +00:00
Everything is done in a heavily throttled manner for stealth to avoid detection.
Added opt-out disclaimer
2023-05-28 04:43:17 +00:00
## Opt-out
The IRC networks we scanned are PUBLIC networks...any person can freely connect & parse the same information. Send your hate mail to [scan@internetrelaychat.org](mailto://scan@internetrelaychat.org)
8,7\;.\;08,08 15,0||||||||||||||||||||4,14▄▀8,01▄▀14-\;
2023-05-29 05:54:23 +00:00
## Config
###### Settings
Added multi-logs & memory management has been improved for performance
2023-05-30 00:59:17 +00:00
| Setting | Default Value | Description |
| ------------- | ------------------------------ | ----------------------------------------------------- |
| `errors` | `True` | Show errors in console |
| `errors_conn` | `False` | Show connection errors in console |
| `log_max` | `5000000` | Maximum log size *(in bytes)* before starting another |
| `nickname` | `"IRCP"` | IRC nickname *(`None` = random)* |
| `username` | `"ircp"` | IRC username *(`None` = random)* |
| `realname` | `"internetrelaychat.org"` | IRC realname *(`None` = random)* |
| `ns_mail` | `"scan@internetrelaychat.org"` | NickServ email address *(`None` = random)* |
| `ns_pass` | `"changeme"` | NickServ password *(None = random)* |
| `vhost` | `None` | Bind to a specific IP address |
8,7\;.\;08,08 15,0||||||||||||||||||||4,14▄▀8,01▄▀14-\;
2023-05-29 05:54:23 +00:00
###### Throttle
8,7\-:.`-,:.`-:08,08 15,0 4,14▄▀8,01▄▀14--:`,--:`
2023-05-29 06:08:29 +00:00
| Setting | Default Value | Description |
| ---------- | ------------- | ------------------------------------------------------------- |
| `channels` | `3` | Maximum number of channels to scan at once |
Added detection for 439 numeric (ERR_TARGETTOOFAST) with the ability to parse the delay seconds until we can retry
2023-05-29 20:25:38 +00:00
| `delay` | `300` | Delay before registering nick *(if enabled)* & sending `LIST` |
8,7\-:.`-,:.`-:08,08 15,0 4,14▄▀8,01▄▀14--:`,--:`
2023-05-29 06:08:29 +00:00
| `join` | `10` | Delay between channel `JOIN` |
| `nick` | `300` | Delay between every random `NICK` change |
Added detection for 439 numeric (ERR_TARGETTOOFAST) with the ability to parse the delay seconds until we can retry
2023-05-29 20:25:38 +00:00
| `part` | `10` | Delay before `PART` from channel |
| `seconds` | `300` | Maximum seconds to wait when throttled for `JOIN` |
8,7\-:.`-,:.`-:08,08 15,0 4,14▄▀8,01▄▀14--:`,--:`
2023-05-29 06:08:29 +00:00
| `threads` | `100` | Maximum number of threads running |
Added detection for 439 numeric (ERR_TARGETTOOFAST) with the ability to parse the delay seconds until we can retry
2023-05-29 20:25:38 +00:00
| `timeout` | `30` | Timeout for all sockets |
| `whois` | `5` | Delay between `WHOIS` requests |
8,7\-:.`-,:.`-:08,08 15,0 4,14▄▀8,01▄▀14--:`,--:`
2023-05-29 06:08:29 +00:00
| `ztimeout` | `200` | Timeout for zero data from server |
8,7\;.\;08,08 15,0||||||||||||||||||||4,14▄▀8,01▄▀14-\;
2023-05-29 05:54:23 +00:00
Initial commit
2023-05-25 20:03:39 +00:00
## Collected Information
All of the raw data from a server is logged & stored. The categories below are stored seperately & hilight the key information we are after:
###### Server Information
| Numeric | Title |
| ------- | -------------- |
| 001 | RPL_WELCOME |
| 002 | RPL_YOURHOST |
| 003 | RPL_CREATED |
| 004 | RPL_MYINFO |
| 005 | RPL_ISUPPORT |
| 006 | RPL_MAP |
| 018 | RPL_MAPUSERS |
| 257 | RPL_ADMINLOC1 |
| 258 | RPL_ADMINLOC2 |
| 259 | RPL_ADMINEMAIL |
Added CAP, MODULE, INFO, CREDITS, IRCOPS, STATS p, & MODULE replies stored in the snapshot
2023-05-30 06:35:57 +00:00
| 351 | RPL_VERSION |
| 364 | RPL_LINKS |
| 371 | RPL_INFO |
| 372 | RPL_MOTD |
| 304 | RPL_TEXT |
Initial commit
2023-05-25 20:03:39 +00:00
###### Statistics Information (LUSERS)
| Numeric | Title |
| ------- | ----------------- |
| 250 | RPL_STATSCONN |
| 251 | RPL_LUSERCLIENT |
| 252 | RPL_LUSEROP |
| 254 | RPL_LUSERCHANNELS |
| 255 | RPL_LUSERME |
| 265 | RPL_LOCALUSERS |
| 266 | RPL_GLOBALUSERS |
###### Channel Information
| Numeric | Title |
| ------- | ------------ |
| 332 | RPL_TOPIC |
| 353 | RPL_NAMREPLY |
| 322 | RPL_LIST |
###### User Information (WHOIS/WHO)
| Numeric | Title |
| ------- | ----------------- |
| 311 | RPL_WHOISUSER |
| 307 | RPL_WHOISREGNICK |
| 312 | RPL_WHOISSERVER |
| 671 | RPL_WHOISSECURE |
| 319 | RPL_WHOISCHANNELS |
| 320 | RPL_WHOISSPECIAL |
| 276 | RPL_WHOISCERTFP |
| 330 | RPL_WHOISACCOUNT |
| 338 | RPL_WHOISACTUALLY |
| 352 | RPL_WHOREPLY |
Added CAP, MODULE, INFO, CREDITS, IRCOPS, STATS p, & MODULE replies stored in the snapshot
2023-05-30 06:35:57 +00:00
###### Bad Numerics (channel)
| Numeric | Title |
| ------- | ------------------ |
| 439 | ERR_TARGETTOOFAST |
| 470 | ERR_LINKCHANNEL |
| 471 | ERR_CHANNELISFULL |
| 473 | ERR_INVITEONLYCHAN |
| 474 | ERR_BANNEDFROMCHAN |
| 475 | ERR_BADCHANNELKEY |
| 477 | ERR_NEEDREGGEDNICK |
| 489 | ERR_SECUREONLYCHAN |
| 519 | ERR_TOOMANYUSERS |
| 520 | ERR_OPERONLY |
###### Bad Numerics (server)
Initial commit
2023-05-25 20:03:39 +00:00
| Numeric | Title |
| ------- | -------------------- |
| 464 | ERR_PASSWDMISMATCH |
| 465 | ERR_YOUREBANNEDCREEP |
| 466 | ERR_YOUWILLBEBANNED |
| 421 | ERR_UNKNOWNCOMMAND |
Added preview
2023-05-28 02:34:24 +00:00
## Preview
![](.screens/preview.png)
Initial commit
2023-05-25 20:03:39 +00:00
## Todo
CTCP replies
2023-05-26 01:22:42 +00:00
* Built in identd
Added a parser for searching logs with ease
2023-05-26 21:57:53 +00:00
* Checking for IPv6 availability *(SSL= in 005 responses may help verify IPv6)*
Added todo: support for outdated ssl servers
2023-05-27 23:20:45 +00:00
* Support for IRC servers using old versions of SSL
Added TODO for making a seperate log of failed/banned connections
2023-05-30 06:53:47 +00:00
* Create a seperate log for failed connections *(Sync to file every hour maybe)*
Added TODO for colored output option
2023-05-30 07:11:18 +00:00
* Colored output option
Added TODO for daemon mode (24/7 throttled scanning) & log overlapping (updating existing logs )
2023-05-30 07:22:44 +00:00
* Added daemon mode *(24/7 scanning heavily throttled in this mode)*
* Add overlapping logs option *(Do not skip networks we already have logs for,just update them with new changes)*
Initial commit
2023-05-25 20:03:39 +00:00
## Mirrors
- [acid.vegas](https://git.acid.vegas/ircp)
- [GitHub](https://github.com/acidvegas/ircp)
- [GitLab](https://gitlab.com/acidvegas/ircp)
- [SuperNETs](https://git.supernets.org/acidvegas/ircp)
Reference in New Issue Copy Permalink