‘Scraping’ our time servers

This blog post demonstrates that the NTP 'monlist' command can be queried to retrieve lists of recent client IPs (up to ~600), enabling footprinting and exposing internal/private addresses; it also explains how spoofed monlist queries can be leveraged for large DDoS amplification (authors cite a possible ~30 Gbps attack), and includes a Python tool and Maltego transforms used to enumerate South African NTP servers and their clients.