Okay, so once again we find ourselves here in Kali Linux, and today I'm gonna
do something a bit different with you. Today, I'm gonna actually perform a boss
attack a demo of a DoS attack, a demo of a DoS attack should I say. Now since we can't actually just go
and DoS random sites, primarily because we don't have permission to do so, and
that's illegal, you do have an option, of course, to set up your own virtual
environment, and then you can do whatever you want to it. It doesn't matter, it's yours.
Or, you can use a pre-existing web server which you can actually practice a DoS
attack on. Now this
pre-existing web server is actually your own home router. Your home routers they
do have web servers, you can access their interfaces via port 80. Pretty much all
the ones that I know unless it's disabled by default by your ISP provider,
or something of a kind. I don't know, but they usually leave the port 80 open. So,
the additional corrections and modifications can be made on demand.
Anyway, if the router is yours you can pretty much do whatever
you want to it, and today I will actually use that particular web server on my
home router, which I'm using for this pentesting exercise, in order to practice
this sort of an attack on. To demonstrate it, actually. Anyway, in the very beginning
I have spoken a little bit about DoS attacks, I've explained what
DoS is and what DDoS is. But, in addition those two, you also have two
subcategories for each of them. You have logical attacks and brute-forcing
attacks. Now logic basically relies on logic errors on the other side, on the
web server, and in a way it handles requests. So, there were
some problems with apache where it just kept on stacking incomplete requests
and waiting for responses on end. It was pretty easy to DoS that. Just keep
on sending requests, and you didn't need a lot of bandwidth the crash site. But,
that was back in the day. Today, they fixed a lot of things, but you know that
no system is perfect, and no matter how hard you try, and how much you invest
yourself, and how much capital you invest into it there will always be something
to exploit. It's completely impossible to make the system foolproof against
anything, against a DoS attack. Of course, the big companies like Google, or
Facebook, or Twitter, or something of a kind, their servers are simply too big to
DoS. You would literally require I don't know how many machines,
and how much bandwidth, in order to DoS it, which is pretty good. My
gmail account I can always access it, it's always readily available, and it
never goes down. Fantastic way there. But, if you do remember, I don't know, when was
it? Like a year or two ago, they actually managed to DoS a PayPal site, which is
pretty bad. I'm not sure how they managed to do that. They probably did
have a large amount of computers in the background. Basically, zombies, hijacked
computers, which were generating a lot of requests, and then eventually the site went
down. But, don't hold my word to it. You can feel free to
scream in the discussions that it wasn't so, or something of a kind, because I'm
not that familiar with the event. I just wanted to give an example. Basically, what
I'm trying to say is that if you have sufficient bandwidth, either your own
bandwidth or bandwidth combined with other machines, you will be able to
perform meaningful DoS attacks on websites, brute-force attacks on websites.
If you don't have enough bandwidth, brute-forcing won't do you much good. I
can see a question forming in the discussions, how much bandwidth would I
need to do this, or to do that. I really don't know. It depends on how much
the server on the other side can handle. If you know how much a server on the
other side can handle, then you can do estimates regarding how many requests, how much
speed does it have, how much bandwidth does it have,
and then you can represent that in terms of amounts of requests, and then you can
see how many requests can you generate to perform a meaningful DoS attack. For
example, you don't need to, I don't know, I've seen partial
DoS attacks. For example, I don't know, let's just take a fictive example
for this. A site can handle ten thousand users, and you can
actually generate sufficient traffic to occupy bandwidth for five thousand users.
And if the site has average login users, I don't know, six or seven thousand, that
means that one to two thousand users won't be able to access that site,
because of your DoS attack, while five thousand will be able. So, those are
kind of a partial attack. I'm not sure how useful that is, but feel free to
check that out as well. What we want to achieve is a full DoS attack.
Have no doubt, today what we are doing is definitely a brute forcing
method, this is not a logic thing, or something of a kind.
Although, it can be interpreted as such, but we're just flooding it with requests
in a very short amount of time. And since it's our own router here at home, we have
the ability to send a ton load of requests, in a very short amount of time,
with relative ease. Now for this purpose today you won't actually need to install
anything, rather instead we're gonna be using a built-in, well not a built-in
tool, but rather instead a tool that comes pre-installed.
It's called hping3. It used to be called just hping, but now it's hping3.
Let's just take a look at the help menu to see what sort of options do
we have here. We will be using the SYN flag, so we'll be doing the syn flood. You
also have all these other things, feel free to check these flags out. You can
flood the server with all sorts of requests. That's one of the bright sides,
that's one of the good things about this tool. Okay, if one
flood doesn't work try another, if that one doesn't work, okay, try another.
Something is bound to work not because the web servers are poorly built, or
something of a kind, rather instead a lot of the time people just don't have the
sufficient capital, or something of a kind to invest
in the security. Because, you know, a security expert for a webserver, somebody
to fend off attacks and to tighten down security, that costs a lot of money. So,
yeah, not everybody's gonna be willing to invest. And a lot of minor sites,
unfortunately, I've seen it, it's pretty sad, that people are, that
competition is actually paying to, I don't know, take down their competitions
site during Christmas, or during some holiday, or something about kind. Yeah,
that's definitely not a good thing, and I strongly urge everybody who
is watching this tutorial, and I do recommend it, and I do say it, and so on
and so forth, do not perform DoS attacks on websites you do
not have permission to. You can get some serious fines for performing
DoS attacks on websites that you are not allowed to tamper with.
I know that I can get a bit tiring if I mentioned this in
between tutorials, or something like that, but believe me, it is important. I would
hate for anybody to get into trouble, or anything like that. Anyway, as I said we
are gonna flood it with SYN flags, this is gonna be a SYN flood. We're gonna
pass a SYN flag there, and up here we have the interval somewhere, let me just see
where it is, excellent! So, it's -i for interval. This is the format, so
you just type in -i, then u, and then the amount of micro seconds for that
interval, how long will be that interval. You definitely want to, if it can be
shorter of course, sure, put it and see what
can work. Because, I don't know, some servers will if they see too many
requests in too short of an interval, they will block you. But, rest assured, you
can route this through proxy chains, and if you route it to proxy chains, or
through a VPN, or something like that, you can keep on rotating the IP addresses so
they continuously have to put bans on IP addresses. And they can't
put permanent bans on IP addresses because that's not a very smart thing to
do, as they will disable other people when those IP addresses are reassigned
from accessing their site. Rather instead, IP addresses
will get locked out for a couple of days, or something like that, and then you will
need to change it, or something of a kind. But if we just go down below, clear the
screen, and there we go. So, hping3, there we go. Here is the time interval, here is the
syn flag, and here you can even tune the port, and then you
type in the IP address. You do need the IP address. I have shown you all how you
can get the IP addresses from domain names, and I've shown you all how to get
an IP address of your default gateway. Just type in route, let me just show it
to you one more time just in case, route, and here you can get the IP address of
your default gateway which will be your router. That shouldn't be a problem to
acquire. Anyway, go ahead and clear the screen, go back to this command if you've
typed it in, excellent! So, you have hping3, space, -i, space, u100, space,
-S, space, -p, and then space and the IP address. Very simple there. No complex things,
nothing of a kind. Although this does support some sort of regular expressions,
and you can type in, you can combine this with bash scripts and type in something
extremely complex here, which is not something you really need. The main thing
you would really need is for it to jump from one IP address to another, or to
flood different servers at a time. So, for example, you're DoSing one server,
I don't know, from three to five, and then from five to seven your DoSing another
server. So, these are also some tricks that you can have. I decided not to show
it here. You can find it online if you wish how to switch it, but the reason why
I didn't show it here, how to switch from one server to the other, it is highly
unlikely. I mean, I cannot explain to you how
unlikely is that you will have enough bandwidth to actually perform this. And
if you do need to switch from one server to, I mean, because these attacks they
don't work straight away. You do need to wait for a while for it
to take effect, I will show this to you. Here let me just
open up my Windows machine, and open up Explorer. It doesn't really matter
which browser you use, this is gonna work universally. So, 192.168.1.1, this is my
router webserver site. So, it's prompting me to log in with my username and
password. And if I say cancel, it's gonna throw me here. It says, Protected Object,
The object and the RomPager server is protected, and I can't access.
But it doesn't matter. I can't access the interior but I can still access the site.
It still prompted me for a login which means that the site is functional. I can
log in, no problems. There's no need to log in now so I just won't. But, it doesn't
really matter. Your own home routers, feel free to log in and then perform a
DOS attack, it's gonna work in exactly the same way. Now I am doing this in LAN
but this attack is, as I said, is viable on the Internet as well, over the Internet
as well, no problems. Now that we have proved that this site is functional,
let's just continue, let's just start the flood. And you can see the flood is in
progress, the DoS attack is in progress. And if I go back to the Windows 8.1
machine, spoiler, this is still not gonna work. So, if I reload it's gonna prompt me
for a username and password, we gotta wait, we gotta give it a minute or two, or
something of a kind, for the attack to actually take effect. Let
me just open up Firefox on my physical machine as well. Type in 192.168.1.1,
excellent! So I am prompted with a username and a password here, and you can
see even in our local area network we still have to wait. Imagine if this was
over the net, or something of a kind, it would take way longer. You can see how fast the
requests are being generated, it's just transmitting one after another, one after
another, one after another. The intervals are ridiculously short, and it should
start working at any moment now. Let me just try refreshing the site, no, it
doesn't. Okay, so, I'm just gonna call the tutorial here. I'm gonna let it run for a
while, and then I am gonna come back. I'm not gonna change anything. If I do I will
let you know, but all that I'm doing is cutting off
the tutorial here. I'm gonna let it run for a while and then I'll come back, just to
show you that you can no longer access the site, that you can no longer get this
error message, that you can no longer get the login, that you will no longer be
able to log in or in it, or do anything of a kind. Okay, so it is already saying
it's waiting, so I'll just see do I need to, yep, I do need to actually cut
the tutorial so as not to bore you while this is running. Anyway, I'll see
you in a couple of minutes, and then we'll see what happened. So here I am
back in my, well, not back in my virtual machine, back to my physical
machine. But, my virtual machine is here, let me just unlock it. I've allowed it to
run for like 15-20 minutes, and I've realized what the problem was, why it
didn't actually perform a DoS attack, it did, it did. But, take into consideration
this is a virtual machine, and it's resources are limited. So, when I am
recording, my physical machine pretty much prevents this DoS attack while I'm
recording, because I take up a lot of resources and you can, actually let me
just show you this here, excellent! So, you see that the VLC that I am using to
record is using 222%, whilst VirtualBox is using 84-86. And when I am
not recording, VirtualBox will be using, usually it will be around 140 if I'm doing
something serious, or something of a kind. And just to show you, you see
it says I went to 192.168.1.1, it says problem loading page. So, the connection
was reset, you won't be able to actually access it. But, since I am recording now
and my resources are reallocated, if I reload this, you see there is still a
problem with reloading. Am I connected?
Oops, not that one. Let me just see if I am connected. So, ping google.com...oh, actually,
I've allowed it to run for so long that I've blocked pretty much everything out,
which is a bit awkward. Let me just go back to Kali and stop this. Come on, any
time now. It says 63% packet loss, okay, not bad considering that I have pretty
much over whelmed it. So, it was unable to load the site, but now I'm just gonna
disconnect, now reconnect, please, excellent! So, you've managed to disconnect.
Connect again, there we go. Let's try it again. Okay, so it is prompting me for a
username and a password, so it does work. Look, basic logic behind what I did, what
I can't actually show you directly now, is, as I said before, while this attack is
running, if I'm recording, there simply isn't enough resources on my computer to
actually perform both, and the physical machine will always priority, will always
be the priority. If you run this, and you're not recording or doing anything
else in the background, it will work. It will actually DoS your router. As you
see it says problem loading site. Because when I started recording I saw that it
loaded it, and when I stopped recording I saw that it actually didn't load it. So,
there is a difference because VLC for recording uses quite a
bit of resources, especially processor, especially CPU time. Anyway, this was one
example. I strongly encourage you to try it out on your own. So you see this is
the command that I have used. It works on my router, see if it works on yours. You
can also set up a server of your own if you wish, either on a Windows machine, or
a Linux machine, or whatever these things are absolutely free. If you need help
there, please feel free to contact me in the discussions, post a question, or
something of a kind, I'll be more than happy to help you.
One key note that I would like to make at the end of this tutorial, is that you
shouldn't just message me directly. Rather instead, just post it in the discussion
section and there the discussion can continue, and I can answer it as well, and
other people can see what you have asked. So, if they've encountered the same
problem, they can see the possible solutions. They can say, for example, oh,
I've tried this, that, that didn't work, and then I can immediately give them a
third or fourth solution which is more likely to work. Anyway, as I said, try this
attack, you'll see that it most likely will work depending on your router. I
don't know if you have some sort of a Cisco router, or Juniper router, or
something like that, high tech, maybe it won't work. But, since you're in LAN I'm
pretty sure that it will, primarily because you can you have a lot of
bandwidth to flood it with. Anyway, I bid you all farewell, and I hope to see you
in the follow up tutorial.