Okay, so welcome to yet another tutorial on DOS attacks, and
this time we're gonna be combining two tools.
We're gonna use SlowLoris.pl.
It's basically a pro script, and we're gonna be using Nmap to actually conduct
a scan of a website in order to determine whether it's vulnerable or not.
Now, this attack is not perfect by any means.
The more bandwidth you have, the better.
The stronger computer you have, also the better,
because you'll be able to make more threads.
Threads means just more simultaneous tasks.
However, sometimes, most of the time actually,
if you don't have enough bandwidth, the site will not be
permanently DOSed, so users will still be able to access it,
however their loading time will be like yeah pretty long, a minute or two.
Try putting yourselves in such a position,
try thinking about a commercial site where they sell things and
imagine if all the clients logging into that server have to wait for
a couple of minutes before that site actually loads.
How many of you would actually stick around and wouldn't just go to pretty much
a very similar site, it sells pretty much the same things.
That's just a fictive scenario and just trying to prove a point
that you don't need to actually permanently bring the site down.
You can just render it unusable in this fashion where users' access time
is extremely long and basically that site becomes unusable.
So whatever you're loading it takes a minute or two and
it feels like you're, I don't know if everybody's going to remember
those ISDN connections or something of a kind where everything was extremely slow.
Well that's basically how that website would look like,
when you are performing this sort of attack.
Anyway, there are a few things which we need to do here.
And one of those things is that we need to conduct a scan, so
lets go and use our Nmap as we have used before.
You see I have the commands memorized here as I
have used these things before to test them out to see how it works out.
So, I have nmap.
I'm telling Nmap to use a particular script for this purpose parallels 400.
And I am giving it an IP address that I wish to scan for
this particular vulnerability.
I've also issued the double verbose output in order for
Nmap to actually tell me what is going on, what it is doing.
On Nmap website, let me just go ahead and do this.
Excellent, so this is the site where you can find all the scripts.
I have shown you this before in the previous tutorials that have label endmap
or something of a kind where we've dwelt on the chapter Footprinting and
seen how we can actually scan the servers for vulnerabilities.
Remember how I told you that you can find the scripts here on their website?
Well, you can also find categories and what every script does.
I've also mentioned that as well.
What we want is to click on DOS, so denial of service.
These particular scripts will scan for those particular vulnerabilities.
They will scan for vulnerabilities related to DOS attacks.
And we have, I dunno, broadcast of avahi DOS to discover hosts and local networks.
So we're not really that interested in local networks at the moment.
I've dealt a lot with that on wireless and
how you can actually perform a DOS attack there.
We want this one, http-slowloris.
Web server for vulnerability to the slow loris dos attack by launching that
particular type of an attack.
There are also other ones.
Feel free to actually try them out on your own systems,
and see how that works out for you,
what different types of attacks will actually work for you.
Anyway, we want this one for web servers, and
in order to be able to DOS a website or something of a kind.
So I'm just going to go ahead and use it here you see script http-slowloris.
Press enter, and let the scan run its course.
The scan can take quite a bit of your time.
Why I don't know.
It's in LAN.
It should be a bit faster, but apparently it's not.
Over internet it's bound to be slower than this, so
don't just think it doesn't work or something of the kind.
It does work, but if you're doing this online it might take a while longer.
In LAN, I really thought it was faster but
apparently this is the speed at which it progresses.
Anyway, you have all the standard stuff that you would usually have.
And down below, it says Completed SYN Stealth Scan.
Excellent. So that's just the normal stuff.
Down below, you have NSE: Script scanning.
Only after it has conducted its regular scan does it begin the NSE: Script scan,
the script which we have actually passed and
the script which we want to utilize in order to figure out,
is the server actually vulnerable to this type of an attack.
You have a separate timer for the NSE script and
the separate percentage done for NSE script as well.
So it says here the current time and this is the remaining time.
I'm sorry this is not the current time,
this estimated time to completion, something of a kind.
It doesn't matter, you don't have to pay attention to this.
This is the important part.
It says two minutes and forty-one seconds remaining, one minute and
fifty-one seconds remaining.
It's gonna keep on issuing them until its task is done.
Once that is done, we will know whether the server is vulnerable or not.
These routers, they tend to be vulnerable, I mean, to a ton load of things.
I had a bit of an awkward experience.
Just goes to show that you should never really move away from your computer while
it's unlocked.
My friends, they took my IP address and, because the home routers are not
really that good in terms of protection, so they were dossing me basically.
Of course, I can avoid it quite easily by just changing the IP address,
turning the router on and off pretty much will do the trick.
There are other ways.
But I couldn't figure out for about five,
ten minutes, I couldn't figure out what was going on.
I didn't figure it out anyway because one of the first things that people do when
something is wrong with their internet connection, they reset the router.
That's what I did and of course the IP address changed so the DOS attack stopped.
Only later on did they actually tell me that they were messing around with
me a little bit.
Anyway.
The scan has completed.
It says probably vulnerable.
So let's see what we can do.
You can go ahead and clear the screen here, unless you have a 100 clients, or
more than one client here that you have scanned,
then you want to redirect this to a file as I have showed previously.
So, go ahead and clear the screen.
[COUGH] In the follow-up tutorial.
Sorry for the cough, something just got into my throat.
But in the follow up tutorial, we will actually go ahead and
download the PERL script and
see how we can actually utilize it in order to actually perform this attack.
Until then I bid you farewell.