Okay, so we're just going to continue from where we left off.
Yep, I still have the terminal up and running.
And now we need to go onto that, here's the address.
Okay, so you no longer need this one.
You just need
http://ha.ckers.org/slowloris/.
And you can go ahead and visit this website.
This is the official website for this, exploit for this Perl script.
There isn't that much information on it, but
there is enough for a script of this kind.
I would strongly recommend that you don't necessarily need to read through all this,
but skim it.
Just go and skim it.
See what's in there.
See what the developers have written.
See how it works, what it is for, in addition to what I have already stated.
You might get some deeper insights into how this attack actually works.
One of the bright sides of this attack is it doesn't actually
require a lot of bandwidth, not necessarily anyway.
But the more you have, the better.
Okay, so let's scroll down.
This is the part that you really should take a look at.
These are the servers, web servers, that are affected by this sort of an attack.
And down below,
these are the servers that should not be vulnerable to this type of attack.
Okay, change here.
I have a slight correction for myself here.
These are not the servers that are vulnerable to this type of an attack, but
rather instead, that are probably vulnerable or
that are likely to be susceptible to this.
Same applies here.
On these servers, it's not likely that this type of an attack will work.
You see, for
these two, it's actually verified by user community that it doesn't work.
You can still go ahead and try it, if you have the permission,
but it is unlikely that it will work.
Anyway, here you have Apache 2, point something.
That's important because a large amount of servers out there run on Apache.
And what I am pleased to see here is that Lighttpd doesn't seem to be
affected by this and Nginx also doesn't seem to be affected by this.
More importantly, NginX.
If you don't know what NginX is, it's spelled NginX.
It's an alternative to Apache.
It hasn't been quite around for that long, like Apache, but definitely long enough,
and people have been using it as a substitute for Apache.
It's said to be faster, but I can't really confirm this.
Anyway, that's a bit of extra information that I just dumped in there somehow.
Doesn't really matter.
It says here also that there are requirements for
this script to actually run.
But if you're running it on Kali Linux in the latest version, as I am,
you shouldn't need to install anything extra.
If you do, refer to this site and
see what else is missing, but I don't know, I've tried it.
I've tried it on the Cullen Linux that I'm running and you are running the same
system back at your place, you shouldn't need to install anything of a kind.
Anyway, if you just keep on scrolling.
Just a key note here for anybody out there
that wants to do this on Windows,
you can, but you need to setup Cygwin.
Yeah, this is definitely doable, but I wouldn't really recommend it.
Anyway, you go down further and it says download.
It's slowloris.pl.
You will need to download this particular script or if you want to perform
this DoS attack on an IPv6 protocol, you can also download this script.
I wouldn't say that that high of a percentage of the world is using IPv6,
not yet anyway.
But slowly, but surely, they are switching to IPv6.
Let me tell you why.
You have about four billion IPv4 addresses and
you have exponentially more IPv6 addresses.
Because there is a shortage of IP addresses,
they've switched over to IPv6 protocol.
They made it available, but I don't know why exactly.
But not that high of a percentage has switched to IPv6, not yet, anyway.
But in the future, sure, why not?
Anyway, for the time being, you're going to use this particular script that I said.
Just go ahead and click on it.
And, you see that this is not your average download link.
This is basically a script on the Net that you are going to CTRL+A to select
everything, and then CTRL+C to copy it.
Normally, I wouldn't advise doing this, but I trust this site to a good extent and
you're doing this in a virtual machine, so, yeah.
Though, if you're doing it in a virtual machine, it's not that dangerous, but
if you're doing it in a physical machine, it could present problems.
Anyway, let's just go ahead,
I'm gonna I have two of the files which I've previously created.
So I'm just going to delete both of them.
And I'm going to create a new one, nano slowloris.
You can name this whatever you want, by the way.
.pl, but this just makes sense.
And you do need an extension pl, though.
That is an absolute must-have here.
Just open up the file in nano.
Paste the contents.
Don't close it and save it immediately.
It takes a while for everything to load.
You have the code here,
down below as explanations, the developers have placed there.
So you got some things here, you can go through the script,
if you wish, if you know how to read perl scripts.
Ctrl+Alt save.
Press Enter, Ctrl+X to exit.
Do the chmod, make the file executable.
+x slowloris.pl.
Clear the screen.
I'm sure I have the command here somewhere because I really don't feel like
typing it in now.
I'm bound to make mistakes doing tutorials when I type them in.
So you have this standard script execution command ./ to
execute pretty much any executable script in Linux.
Then you type in the name of the script or the path to the script.
Then you have this argument dns, then you have the IP address,
then you have -port 80.
And I do believe this is the number of threads or
should I say SOCKS that are opened.
Anyway, go ahead.
I have typed in the IP address of my router,
of course, on which I'm gonna be performing this.
I have done the Nmap scan for this particular IP address.
So go ahead and press Enter and this is going to run.
Let's open up a browser.
It's 192.168.1.1, now it might load, it might not load.
Okay, it doesn't load.
It says the connection was reset.
I am unable to access it.
So let's go ahead and into Kali,
stop this attack, go back to Firefox.
Let's try reloading the site now.
Try again.
No, I have stopped the script, have I?
Excellent, there we go.
I didn't press try again, I just pressed Ctrl+R on my keyboard to reload the site.
You can see that now I can type in, as opposed to before,
you can see that the connection was reset.
So let's just go ahead and cancel this, and while I'm running the tutorial,
let me just go ahead and do this thing, Google, so that you know that I have
Internet connectivity, that I am not disconnected from the Net completely.
Not Q, but Ctrl+C.
So pretty simple to execute.
No, you don't have to invest that much thought into it,
if you just conduct the scan.
If you see that it's vulnerable, then you can perform an attack.
If you see that it's not vulnerable, then, of course, you won't be able to do it.
Now, a key reminder before I finish this, all of these tests I'm doing on
my router so, on this particular web service that I'm running on this router,
as you can see, it does have a list of servers on which it is likely to run.
But, if you do try it on some other servers that you, of course,
have permission to do so, it might not run.
Also, it might actually slow the sites down, increase the loading time or
increase the loading time to a couple of minutes as, I do believe, I stated before.
So, it can be a full DoS attack or a partial DoS attack.
If it's a partial one, don't be discouraged.
It's pretty much just as effective as the real one, primarily because nobody is
going to wait around for five minutes for their sites to load or rarely anyone will.
Just try putting yourself in such a position.
Anyway, I bid you farewell here and I hope to see you in the next tutorial.