Okay so once again we find ourselves here in Kali Linux.
And today I'm gonna do something a bit different with you, today I'm gonna
actually perform a DoS attack, a demo of a DoS attack should I say.
Now, since we can't actually just go and DOS random sites,
primarily because we don't have permission to do so and that's illegal.
You do have an option, of course, to set up your own virtual environment and
then you can do whatever you want to it and it doesn't matter, it's yours.
Or, you can use a preexisting web server which you can actually
practice a DoS attack on.
Now, this preexisting web server is actually your own home router.
Your home routers, they do have web surfers.
You can access their interfaces via Port 80.
Pretty much all the ones that I know unless
it's disabled by default by your ISP provider or something of a kind.
I don't know, but they usually leave the Port 80 open so
the additional corrections and modifications can be made on demand.
Anyway, if the router is yours, you can pretty much do whatever you want to it.
And today, I will actually use that particular web server on my home router,
which I'm using for
this DoS testing exercise in order to practice this sort of attack on.
To demonstrate it, actually.
Anyway, in the very beginning I have spoken a little bit about DoS attacks,
I've explained what DoS is and what DDoS is, but
in addition to those two you also have two subcategories for each of them.
You have logical attacks and brute forcing attacks.
Now logic, basically relies on logic errors on the other side on
the web server on the other side and in a way it handles requests.
So, there were some problems with Apache where it just kept on stacking
incomplete requests and waiting for responses on end.
It was pretty easy to DoS that [LAUGH].
Just keep on sending requests and you didn't need a lot of bandwidth to
crash the site, but that was back in the days.
Today they've fixed a lot of things, but you know no system is perfect, and
no matter how hard you try and how much you invest yourself,
and how much capital you invest into it there will always be something to exploit.
It's completely impossible to make this system fool proof against anything.
Against a DoS attack.
Of course, the big companies like Google or
Facebook or Twitter, or something of that kind.
Their servers are simply too big to DoS.
You would literally require, I don't know how many machines,
and how much bandwidth in order to DoS it,
which is pretty good because my Gmail account I can always access it.
It's always readily available and it never goes down.
Fantastic way there.
But if you do remember.
I don't know when was it.
Like a year or two ago,they actually managed to DoS a PayPal site,
which is pretty bad.
I'm not sure how they managed to do that.
They probably did have a large amount of computers in the background.
Basically zombies, hijacked computers which were generating a lot of requests,
and then eventually the site went down.
Don't hold my word to it, you can feel free to scream in the discussion that it
wasn't so, it wasn't that kind, because I'm not that familiar with event.
I just want to give an example.
Basically what I'm trying to say is if you have sufficient bandwidth,
either your own bandwidth or bandwidth combined with over machines,
you will be able to perform meaningful DoS attacks on websites.
Brute force attacks on websites.
If you don't have enough bandwidth, brute forcing won't do you much good.
I can see a question forming in the discussions,
how much bandwidth would I need to do this or to do that?
I really don't know.
It depends on how much the server on the other side can handle.
If you know how much the server on the other side can handle,
then you can do estimates.
How much speed does it have?
How much bandwidth does it have?
And then you can represent that in terms of amounts of requests.
And then you can see how many requests can you generate to
perform a meaningful DoS attack.
For example, I don't know, I've seen actually partial DoS attacks.
For example, I don't know.
Let's just take a fictitious example for this.
A site can handle 10,000 users.
And you can actually generate sufficient traffic to occupy bandwidth for
five thousand users.
And if the site has average login users, six or
seven thousand, that means that one to two thousand users won't able to access that
site because of your DoS attack while 5000 will be able.
So those are kind of a partial attacks.
I'm not sure how useful that is, but feel free to check that out as well.
What we want to achieve is a full DoS attack where,
and have no doubt, today what we are doing is definitely a brute forcing method.
This is not a logic thing or something of a kind,
although it can be interpreted as such.
But we are just flooding it with requests in a very short amount of time, and
since it's our own router here at home, we have the ability to send
a ton load of requests in a very short amount of time with relative ease.
Now, for this purpose today, you won't actually need to install anything.
Rather, instead we are going to be using a built in, well, not a built-in tool, but,
rather, instead a tool that comes preinstalled.
It's called hping3.
It used to be called just hping, but now it's hping3.
And let's just take a look at the help menu to see
what sort of options do we have here.
We will be using the SYN flag, so we'll be doing the SYN flood.
You also have all these other things.
Feel free to check these flags out.
You can flood the server with all sorts of requests.
That's one of the bright sides,
that's one of the good things about this tool that you can, okay.
If one flood doesn't work, try another.
If that one doesn't work, okay.
Try another.
Something is bound to work.
Not because the web servers are poorly built or something of a kind.
Rather, instead, a lot of the time people just don't have the sufficient
capital or something of a kind, to invest in the security because
you know a security expert for a web server, somebody to fend off attacks and
to tighten down security that costs a lot of money.
Not everybody is going to be willing to invest and alot I've seen invest,
and a lot of minor sites unfortunately, I see that it's pretty sad,
that competition is actually paying to take down their competitive
site during Christmas or during some holidays or something of a kind.
Yeah, that's definitely not a good thing.
And I strongly urge everybody who is watching this tutorial, and
I do recommend it and I do say it and so on and so forth.
Do not DoS attack,
do not perform DoS attacks on websites you do not have permission to.
You can get some serious fines for performing such,
for performing DoS attacks on websites that you are not allowed to tamper with.
I know that I can get a bit tiring if I mention in between tutorials,
but believe it is important I would hate for
anybody to get into trouble or anything like that.
As I said we're going to flood it with syn flags.
This is going to be a syn flood we are going to pass a syn flag there and
up here we have the intervals somewhere, let me just see where it is.
Excellent. So it's dash i for interval.
This is the format.
So just type in dash i, then u, and then the amount of microseconds for
how long will be that interval.
You definitely want to, if it can be shorter of course, sure put it.
See what can work.
Because, I don't know, some servers,
if they see too many requests in too short of an interval, they will block you.
But rest assure, you can route this through proxy chains.
And if you route it through proxy chains or through a VPN, or
something like that, you can keep on rotating the IP addresses.
So they continuously have to put bans on IP addresses.
And that's not, they can't put permanent bans on IP addresses because that's
not a very smart thing to do.
As they will disable other people's Windows IP
addresses are reassigned from accessing their site.
Rather instead IP addresses will get locked out for a couple of days or
something like that.
Then you will need to change it or something of a kind.
But if we just go down below, clear the screen and there we go.
So, hping. There we go.
Here is the time interval.
Here is the sin flag and here, you can even tune the port and
then you type in the IP address.
You do need the IP address.
I have shown you all how you can get the IP addresses from domain names and
I've shown you all how to get a IP address off your default gateway.
Just type route.
I'll just show it to you one more time just in case.
Route, and here you can get IP address of your default gateway which will be
your router.
That shouldn't be a problem to acquire.
Anyway, go ahead and clear the screen, go back to this command.
If you've typed it in excellent.
So, you have hping3 -i u100 -S -p and
then space and IP address.
Very simple there.
No, complex things.
Nothing of a kind.
All though this does support some sort of regular expressions.
And you can type, you can combine this with barscripts and
type in something extremely complex here.
Which is not something you really need.
The main thing you would really need is for
it to jump from one IP address to another or to flood different servers at a time.
So for example, you're DoSing one server.
I don't know from 3 to 5 and then from 5 to 7 your DoSing another server.
So these are also some tricks that you can have.
I decided not to show it here, you can find it online if you wish.
I would switch it but
the reason why i didn't show it here, how to switch from one server to the other.
It is highly unlikely.
I cannot explain to you how unlikely is it that you will have
enough bandwidth to actually perform this, and if you do
need to switch from one server, cuz these attacks, they don't work straight away.
You do need to wait for a while for it to take effect.
I will show this to you.
Here, let me just open up my Windows machine and open up Explorer.
It doesn't really matter which browser you use, this is gonna work universally.
So, 192.168.1.1, this is my router web server site,
so it's prompting me to log in with my username and password,
so if I say cancel It's gonna throw me here.
It says protected object.
The object on the RomPager server is protected, and I can't access it.
But it doesn't matter, I can't access the interior but I can still access the site.
It still prompts me for a log in, which means that the site is functional.
I can log in, no problems.
There is no need to login now, so I just won't.
But it doesn't really matter.
On your own home routers, feel free to login and then perform a DoS attack.
It's gonna work in exactly the same way.
Now, I'm doing this in LAN.
But this attack is, as I said, viable on the internet as well.
Over the internet, as well, no problems.
Now that we have proved that this site is functional, let's just start the flood.
And you can see the flood is in progress.
The DoS attack is in progress.
And if I go back to the Windows 8.1 machine.
Spoiler, this is still not gonna work.
So, if I reload it's gonna prompt me for a username and password.
We can wait. We can give it a minute or two, or
something of a kind for the attack to actually take effect.
Let me just open up Firefox and my physical machine as well.
It's like 192.168.1.1.
Excellent, so, I am prompted with a username and a password here.
And you can see even in our local area network we still have to wait.
Imagine if this was over the net or something of a kind.
Take way longer. You can see how
fast the requests are being generated.
It's just transmitting one after the other, one after the other,
one after the other.
The intervals are ridiculously short.
And it should start working any moment now.
Let me just try refreshing the site.
No, it doesn't.
Okay, so, I'm just gonna call the tutorial here.
I'm gonna let it run for a while, and then I am gonna come back.
I'm not gonna change anything.
If I do I will let you know, but all that I'm doing is cutting the tutorial here.
I'm gonna let it run for a while and then I'll come back just to show you that you
can no longer access the site, and you can no longer get this Error message, that you
can no longer get the login,that you will no longer be able to login or do anything
of a kind, so this is already saying, it's waiting so lets just see if we need to.
Yes, so I do need to actually cut the tutorial just not the bore you
while this is running, anyway I'll see you in a couple of minutes and
we will see what happened.
So, here I am.
Back in my, well not back in my virtual machine,
but back into my physical machine but my virtual machine is here.
Let me just unlock it.
I've allowed it to run for like 15, 20 minutes and
I've realized what the problem was, why it didn't actually perform a DoS attack.
It did. It did, but take into consideration that
this is a virtual machine and it's resources are limited.
So when I'm recording, my physical machine pretty much prevents this
DoS attack while I'm recording because I take up a lot of resources.
And you can actually, let me just show you this here.
Excellent, so you see that the VLC that I am using to record is
using 222%, while virtual box is using 84, 86.
And when I am not recording, VirtualBox will be using, it will usually be
around 140, if I'm doing something serious or something of a kind.
And, just to show you, see, it says,
I have gone to 192.168.1.1, it says problem loading page.
So, the connection was reset, it won't be able to actually access it.
But since I am recording now and my resources are reallocated,
if I reload this, you see there is still a problem with reloading.
While I connect it.
Oops.
Not that one.
Let me just see if I am connected to this thing.
google.com.
Oh, actually, I've allowed it to run for so
long it blocked pretty much everything out, which is a bit awkward.
Let me just go back to Kali and stop this.
Come on.
Any time now.
It says 63% packet loss.
Okay. Not bad,
considering that I've pretty much overwhelmed it.
It was unable to load the site, but now I'm just gonna disconnect.
And, come on.
Now reconnect.
Please.
Excellent, so you've managed to disconnect, and connect again.
There we go.
Let's try it again.
Okay, so it is prompting me for a username and a password, so it does work.
Look, basic logic behind what I did, what I can't actually show you directly now is,
as I said before, while this attack is running, if I'm recording,
there is simply not enough resources on my computer to actually perform both.
And physical machine will always be the priority.
If you run this and you're not recording or doing anything else in the background,
it will work.
It will actually DoS your router.
As you see, it says problem loading site because when I started recording,
I saw that it loaded it, and
when I stopped recording I saw that it actually didn't load it.
So there is a difference because VLC for recording uses quite a bit of resources,
especially CPU time.
Anyway this was one example.
I strongly encourage you to try it out on your own so
you see that this is the command that I have used.
It works on my router, see if it works on yours.
You can also set up a server of your own if you wish either on a Windows machine or
a Lenox machine or whatever.
These things are absolutely free.
If you need help there, please feel free to contact me in the discussions,
post a question or something of a kind.
I'll be more than happy to help you.
One key note that I would like to make at the end of this tutorial
is that you shouldn't just message me directly,
rather instead just post it in the discussion section.
And there the discussion can continue and I can answer it as well.
And other people can see what you have asked.
So, if they've encountered the same problem they can see
the possible solutions.
They can say, for example, I've tried this, that, that, didn't work.
And then I can immediately give them a third or
fourth solution which is more likely to work.
Anyway, as I said, try this attack.
You'll see that it most likely will work depending on your router.
I don't know if you have some sort of a Cisco router or Juniper router or
something like that, high tech.
Maybe it won't work, but since you're in LAN, I'm pretty sure that it will,
primarily because you have a lot of bandwidth to flood it with.
Anyway, I bid you all farewell, and I hope to see you in the follow-up tutorial.