Lab 1: Perform DoS and DDoS Attacks using Various Techniques

Module 10: Denial-of-Service

Lab 1: Perform DoS and DDoS Attacks using Various Techniques

Tasks 1: Perform a DoS Attack (SYN Flooding) on a Target Host using Metasploit

termanal

sudo su

nmap -p 21 10.10.10.10

port is open

Now, we will perform SYN flooding on the target machine (Windows 10) using port 21.

msfconsole

use auxiliary/dos/tcp/synflood

set RHOST 10.10.10.10

set RPORT 21

set SHOST 10.10.10.19 = spoofable ip so put a different device on the network as the IP

run

go to windows that is being attacked

open wireshark

ethernet 2

wireshark will be spamming source 10.10.10.19 to your IP that its syn flooding non stop in red

done this is good to detect what a syn flood looks like in wireshark

---------------------------------------------------------------------------------------------------------------------------------------

Module 10: Denial-of-Service

Lab 1: Perform DoS and DDoS Attacks using Various Techniques

Task 2: Perform a DoS Attack on a Target Host using hping3

hping3 is a command-line-oriented network scanning and packet crafting tool for the TCP/IP p rotocol that

sends ICMP echo requests and supports TCP, UDP, ICMP, and raw-IP protocols.

It performs network security auditing, firewall testing, manual path MTU discovery, advanced traceroute,

remote OS fingerprinting, remote uptime guessing, TCP/IP stacks auditing, and other functions.

Here, we will use the hping3 tool to perform DoS attacks such as SYN flooding, Ping of Death (PoD) attacks,

and UDP application layer flood attacks on a target host.

refer to blog for rest of steps

---------------------------------------------------------------------------------------------------------------------------------------

Module 10: Denial-of-Service

Lab 1: Perform DoS and DDoS Attacks using Various Techniques

Task 3: Perform a DDoS Attack using HOIC

HOIC (High Orbit Ion Cannon) is a network stress and DoS/DDoS attack application. This tool is written

in the BASIC language. It is designed to attack up to 256 target URLs simultaneously. It sends HTTP, POST,

and GET requests to a computer that uses lulz inspired GUIs. It offers a high-speed multi-threaded HTTP Flood;

a built-in scripting system allows the deployment of “boosters,” which are scripts designed to thwart DDoS

countermeasures and increase DoS output.

refer to blog for rest of steps

---------------------------------------------------------------------------------------------------------------------------------------

Module 10: Denial-of-Service

Lab 1: Perform DoS and DDoS Attacks using Various Techniques

Task 4: Perform a DDoS Attack using LOIC

LOIC (Low Orbit Ion Cannon) is a network stress testing and DoS attack application. We can also call it an

application-based DOS attack as it mostly targets web applications. We can use LOIC on a target site to flood

the server with TCP packets, UDP packets, or HTTP requests with the intention of disrupting the service of a

particular host.

refer to blog for rest of steps

---------------------------------------------------------------------------------------------------------------------------------------

Lab Scenarioas

DoS and DDoS attacks have become popular, because of the easy accessibility of exploit plans and the negligible amount of brainwork required while executing them. These attacks can be very dangerous, because they can quickly consume the largest hosts on the Internet, rendering them useless. The impact of these attacks includes loss of goodwill, disabled networks, financial loss, and disabled organizations.

In a DDoS attack, many applications pound the target browser or network with fake exterior requests that make the system, network, browser, or site slow, useless, and disabled or unavailable.

The attacker initiates the DDoS attack by sending a command to the zombie agents. These zombie agents send a connection request to a large number of reflector systems with the spoofed IP address of the victim. The reflector systems see these requests as coming from the victim’s machine instead of as zombie agents, because of the spoofing of the source IP address. Hence, they send the requested information (response to connection request) to the victim. The victim’s machine is flooded with unsolicited responses from several reflector computers at once. This may reduce performance or may even cause the victim’s machine to shut down completely.

As an expert ethical hacker or pen tester, you must have the required knowledge to perform DoS and DDoS attacks to be able to test systems in the target network.

In this lab, you will gain hands-on experience in auditing network resources against DoS and DDoS attacks.

Lab Objectives

Perform a DoS attack (SYN flooding) on a target host using Metasploit
Perform a DoS attack on a target host using hping3
Perform a DDoS attack using HOIC
Perform a DDoS attack using LOIC

Overview of DoS and DDoS Attacks

DDoS attacks mainly aim at the network bandwidth; they exhaust network, application, or service resources, and thereby restrict legitimate users from accessing their system or network resources.

In general, the following are categories of DoS/DDoS attack vectors:

Volumetric Attacks: Consume the bandwidth of the target network or service
Attack techniques:
- UDP flood attack
- ICMP flood attack
- Ping of Death and smurf attack
- Pulse wave and zero-day attack
Protocol Attacks: Consume resources like connection state tables present in the network infrastructure components such as load-balancers, firewalls, and application servers
Attack techniques:
- SYN flood attack
- Fragmentation attack
- Spoofed session flood attack
- ACK flood attack
Application Layer Attacks: Consume application resources or services, thereby making them unavailable to other legitimate users
Attack techniques:
- HTTP GET/POST attack
- Slowloris attack
- UDP application layer flood attack

Tasks 1: Perform a DoS Attack (SYN Flooding) on a Target Host using Metasploit

SYN flooding takes advantage of a flaw with regard to how most hosts implement the TCP three-way handshake. This attack occurs when the intruder sends unlimited SYN packets (requests) to the host system. The process of transmitting such packets is faster than the system can handle. Normally, the connection establishes with the TCP three-way handshake, and the host keeps track of the partially open connections while waiting in a listening queue for response ACK packets.

Metasploit is a penetration testing platform that allows a user to find, exploit, and validate vulnerabilities. Also, it provides the infrastructure, content, and tools to conduct penetration tests and comprehensive security auditing. The Metasploit framework has numerous auxiliary module scripts that can be used to perform DoS attacks.

Here, we will use the Metasploit tool to perform a DoS attack (SYN flooding) on a target host.

In this task, we will use the Parrot Security (10.10.10.13) machine to perform SYN flooding on the Windows 10 (10.10.10.10) machine through port 21.

Task 2: Perform a DoS Attack on a Target Host using hping3

hping3 is a command-line-oriented network scanning and packet crafting tool for the TCP/IP p rotocol that sends ICMP echo requests and supports TCP, UDP, ICMP, and raw-IP protocols.

It performs network security auditing, firewall testing, manual path MTU discovery, advanced traceroute, remote OS fingerprinting, remote uptime guessing, TCP/IP stacks auditing, and other functions.

Here, we will use the hping3 tool to perform DoS attacks such as SYN flooding, Ping of Death (PoD) attacks, and UDP application layer flood attacks on a target host.

Task 3: Perform a DDoS Attack using HOIC

HOIC (High Orbit Ion Cannon) is a network stress and DoS/DDoS attack application. This tool is written in the BASIC language. It is designed to attack up to 256 target URLs simultaneously. It sends HTTP, POST, and GET requests to a computer that uses lulz inspired GUIs. It offers a high-speed multi-threaded HTTP Flood; a built-in scripting system allows the deployment of “boosters,” which are scripts designed to thwart DDoS countermeasures and increase DoS output.

Here, we will use the HOIC tool to perform a DDoS attack on the target machine.

In this task, we will use the Windows 10, Windows Server 2019 and Windows Server 2016 machines to launch a DDoS attack on the Parrot Security machine.

Task 4: Perform a DDoS Attack using LOIC

LOIC (Low Orbit Ion Cannon) is a network stress testing and DoS attack application. We can also call it an application-based DOS attack as it mostly targets web applications. We can use LOIC on a target site to flood the server with TCP packets, UDP packets, or HTTP requests with the intention of disrupting the service of a particular host.

Here, we will use the LOIC tool to perform a DDoS attack on the target system.

In this task, we will use the Windows 10, Windows Server 2019, and Windows Server 2016 machines to launch a DDoS attack on the Parrot Security machine.