Project 3

Denial of Service (DoS) is a cyber-attack on an individual Computer or Website with the intent to deny services to intended users. Their purpose is to disrupt an organization’s network operations by denying access to its users. Denial of service is typically accomplished by flooding the targeted machine or resource with surplus requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled. For example, if a bank website can handle 10 people a second clicking the Login button, an attacker only has to send 10 fake requests per second to make it so no legitimate users can login. DoS attacks exploit various weaknesses in computer network technologies. They may target servers, network routers, or network communication links. They can cause computers and routers to crash and links to bog down. The most famous DoS technique is Ping of Death. The Ping of Death attack works by generating and sending special network messages (specifically, ICMP packets of non-standard sizes) that cause problems for systems that receive them. In the early days of the Web, this attack could cause unprotected Internet servers to crash quickly. It is strongly recommended to try all described activities on virtual machines rather than your working environment Following is the command for performing flooding of requests on an IP

ping ip_address –t -65500

HERE,

• “ping” sends the data packets to the victim.
• “ip_address” is the IP address of the victim.
• “-t” means the data packets should be sent until the program is stopped.
• “-l(65500)” specifies the data load to be sent to the victim.

Other basic types of DoS attacks involve

• Flooding a network with useless activity so that genuine traffic cannot get through. The TCP/IP SYN and smurf attacks are two common examples.
• Remotely overloading a system’s CPU so that valid requests cannot be processed.
• Changing permissions or breaking authorization logic to prevent users from logging into a system. One common example involves triggering a rapid series of false login attempts that lockout accounts from being able to log in.
• Deleting or interfering with specific critical applications or services to prevent their normal operation (even if the system and network overall are functional).

Another variant of the DoS is the Smurf_attack. This involves emails with automatic responses. If someone emails hundreds of email messages with a fake return email address to hundreds of people in an organization with an autoresponder on in their email, the initial sent messages can become thousands sent to the fake email address. If that fake email address actually belongs to someone, this can overwhelm that person’s account. DoS attacks can cause the following problems:

• Ineffective services
• Inaccessible services
• Interruption of network traffic
• Connection interference

Following is the python script for performing a denial of service attack for a small website that didn’t expect so much socket connection

We can use above code as

python ddos.py target_ip_address apache

How Do DoS Attacks Work?

DoS attacks typically exploit vulnerabilities in a target’s network or computer systems. Attackers can use a variety of methods to generate the overwhelming traffic or requests, including:

1. Flooding the target with a massive amount of data
2. Sending repeated requests to a specific part of the system
3. Exploiting software vulnerabilities to crash the system

Prevention Given that Denial of Service (DoS) attacks are becoming more frequent, it is a good time to review the basics and how we can fight back.

• Cloud Mitigation Provider – Cloud mitigation providers are experts at providing DDoS mitigation from the cloud. This means they have built out massive amounts of network bandwidth and DDoS mitigation capacity at multiple sites around the Internet that can take in any type of network traffic, whether you use multiple ISP’s, your own data center, or any number of cloud providers. They can scrub the traffic for you and only send “clean” traffic to your data center.
• Firewall – This is the simplest and least effective method. Generally, someone writes some Python scripts that try to filter out the bad traffic or an enterprise will try and use its existing firewalls to block the traffic
• Internet Service Provider (ISP) – Some enterprises use their ISP to provide DDoS mitigation. These ISP’s have more bandwidth than an enterprise would, which can help with the large volumetric attacks

Features to help mitigate these attacks:

Network Segmentation: Segmenting the network can help prevent a DoS attack from spreading throughout the entire network. This limits the impact of an attack and helps to isolate the affected systems.

Implement Firewalls: Firewalls can help prevent DoS attacks by blocking traffic from known malicious IP addresses or by limiting the amount of traffic allowed from a single source.

Use Intrusion Detection and Prevention Systems: Intrusion Detection and Prevention Systems (IDS/IPS) can help to detect and block DoS attacks by analyzing network traffic and blocking malicious traffic.

Limit Bandwidth: Implementing bandwidth limitations on incoming traffic can help prevent a DoS attack from overwhelming the network or server.

Implement Content Delivery Network (CDN): A CDN can help to distribute traffic and reduce the impact of a DoS attack by distributing the load across multiple servers.

Use Anti-Malware Software: Anti-malware software can help to detect and prevent malware from being used in a DoS attack, such as botnets.

Perform Regular Network Scans: Regular network scans can help identify vulnerabilities and misconfigurations that can be exploited in a DoS attack. Patching these vulnerabilities can prevent a DoS attack from being successful.

Develop a Response Plan: Having a DoS response plan in place can help minimize the impact of an attack. This plan should include steps for identifying the attack, isolating affected systems, and restoring normal operations.

DOS Attack: A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with traffic or sending it information that triggers a crash. In both instances, the DoS attack deprives legitimate users (i.e. employees, members, or account holders) of the service or resource they expected.

Victims of DoS attacks often target web servers of high-profile organizations such as banking, commerce, and media companies, or government and trade organizations. Though DoS attacks do not typically result in the theft or loss of significant information or other assets, they can cost the victim a great deal of time and money to handle.

There are two general methods of DoS attacks: flooding services or crashing services. Flood attacks occur when the system receives too much traffic for the server to buffer, causing them to slow down and eventually stop. Popular flood attacks include:

· Buffer overflow attacks — the most common DoS attack. The concept is to send more traffic to a network address than the programmers have built the system to handle. It includes the attacks listed below, in addition to others that are designed to exploit bugs specific to certain applications or networks

· ICMP flood — leverages misconfigured network devices by sending spoofed packets that ping every computer on the targeted network, instead of just one specific machine. The network is then triggered to amplify the traffic. This attack is also known as the smurf attack or ping of death.

· SYN flood — sends a request to connect to a server, but never completes the handshake. Continues until all open ports are saturated with requests and none are available for legitimate users to connect to.

DDOS Attacks: A DDoS attack occurs when multiple systems orchestrate a synchronized DoS attack to a single target. The essential difference is that instead of being attacked from one location, the target is attacked from many locations at once. The distribution of hosts that defines a DDoS provide the attacker multiple advantages: He can leverage the greater volume of machine to execute a seriously disruptive attack

The location of the attack is difficult to detect due to the random distribution of attacking systems (often worldwide)

It is more difficult to shut down multiple machines than one.

The true attacking party is very difficult to identify, as they are disguised behind many (mostly compromised) systems

Modern security technologies have developed mechanisms to defend against most forms of DoS attacks, but due to the unique characteristics of DDoS, it is still regarded as an elevated threat and is of higher concern to organizations that fear being targeted by such an attack.

DOS attack using hping3 command:

What is hping3 ???

hping3 is a network tool able to send custom TCP/IP packets and to display target replies like ping program does with ICMP replies. hping3 handle fragmentation, arbitrary packets body and size and can be used in order to transfer files encapsulated under supported protocols.

It is also known as packet crafting technique.

DOS SYN attack using hping3 command:

Open your kali Linux

Type the command: hping3 -i u1 -S -p 80 192.168.243.131(ip address of target machine)

where :

i — interval wait

u1- 1 microsecond

-S — Syn packet

-p — port number

Let's check in the Wireshark how this command works.

To open Wireshark in your kali Linux type

Wireshark in the terminal.

Type the command in terminal & press enter.

hping3 -i u1 -S -p 80 192.168.243.131

You will get the following result.

Now let's check it in Wireshark

It can be clearly seen that my machine is sending syn packet continuously to the target machine.

Similarly, we can use the same command with another option( — flood)

Instead of -i we will use –flood which will send the packet as fast as possible & doesn’t show the replies.

Command: Hping3 -S –p 135 — flood 192.168.243.131

Let's check-in Wireshark

Clearly, we can see my machine is sending a syn packet and the target machine is responding with syn ack but instead of sending syn packet my machine is again sending the syn packet.

Now let me show you how to spoof your IP address and send the syn packet to the target machine for performing SYN DOS attack

Command: hping3 -S –p 135 — flood — rand-source 192.168.243.131

this command will make you anonymous and the target will never get to know that the packet is coming from which IP.

• *Also along with this command you can spoof your mac address**

Let's check the result in Wireshark

We can clearly see that the source IP is changing every time for sending the syn packet to the target machine. By this, the target will never get to know from which actual IP the packet is coming thus making the attacker anonymous over the internet.

This is all for this for more articles stay tuned…

Thanks