#!/usr/bin/perl
#
# bin/ddos.saint
# Look for distributed denial-of-service tools
#
$running_under_saint = 1;

require 'config/saint.cf';
require 'config/paths.pl';
require 'perl/misc.pl';
require 'perl/get_host.pl';

print "BEGIN\n";
$usage = "usage $0 target";
 
die $usage unless ($#ARGV < 2);
$target = $ARGV[0];

$status = "a";
$service = "backdoor";
$severity = "ht";
$trusted = "ANY\@$target";
$trustee = "ANY\@$target";
$service_output = "distributed denial of service";

$addr = &get_host_addr($target);
$args = "-S 15 $addr/32";

die "Cannot open ddos_scan\n" unless (open(DDOS, "$DDOS $args|"));

while(<DDOS>) {
	if (/probable (\S+ agent)/) {
		$text = "$1 detected";
		&saint_print();
	}
}
