Okay, so welcome to yet another tutorial on DoS attacks. This time we're gonna be
combining two tools: we're gonna use slowloris.pl,
it's basically a Perl script, and we're gonna be using nmap to actually
conduct the scan of a website, in order to determine whether it's vulnerable or
not. Now, this attack is not perfect by any means. The more bandwidth you have
the better, sure. The stronger computer you have also
the better because you'll be able to make more threads, threads means just
more simultaneous tasks. However, sometimes, most of the time actually,
if you don't have enough bandwidth the site will not be permanently DoSsed. So,
users will still be able to access it, however their loading time will be like,
yeah, pretty long, a minute or two. Try putting yourselves in such a
position. Try thinking about a commercial site where they sell things, and imagine
if all the clients logging in to that server have to wait for a couple of
minutes before that site actually loads. How many of you would actually stick
around and wouldn't just go to pretty much a very similar site, that sells pretty
much the same things? That's just a fictive scenario, and just
trying to prove a point that you don't need to actually permanently bring the
site down. You can just render it unusable in this fashion where users
access time is extremely long, and basically that site becomes unusable. So,
whatever you're loading it takes a minute or two, and it feels like you're, I
don't know, if everybody's gonna remember those ISDN connections, or
something of a kind, where everything was extremely slow. Well, that's basically
how that website would look like when you are performing this sort of an
attack. Anyway, there are a few things which
I need to do here, and one of those things is that we need to conduct a
scan. So, let's go and use our nmap as we have used before. You see I
have the commands memorized here as I have used these things before to test
them out to see how it works out. So, I have nmap. I am telling nmap to use a
particular script for this purpose, parallels 400, and I am giving it an IP
address that I wish to scan for this particular vulnerability.
I've also issued the double verbose output in order for nmap to actually tell me
what is going on, what it is doing it. On the nmap website just go ahead and do this,
excellent! So, this is the site where you can find all the scripts.
I have shown you this before in the previous tutorials that are labeled
nmap, or something of a kind, where we've dwelled on the chapter of foot
printing. and seeing how we can actually scan the servers for vulnerabilities.
Remember how I told you that you can find the scripts here on their
website? Well, you can also find categories with what every script does. I
also mentioned that as well. What we want is click on DoS, so
denial-of-service, these particular scripts will scan for those particular
vulnerabilities. They will scan for vulnerabilities related to DoS attacks,
and we have, I don't know, broadcast-avahl-dos attempts to discover hosts in the
local network. So we're not really that interested in local networks at the
moment, I've dwelled a lot with that on wireless, and how you can actually
perform a DoS attack there. We want this one: http-slowloris, web server
for vulnerability to the Slowloris DoS attack by launching that
particular type of an attack. There are also other ones.
Feel free to actually try them out on your own systems and see how that works
out for you, what different types of attacks will
actually work for you. Anyway, we want this one for web servers, and in order to
be able to DoS a website, or something of a kind. So, I'm just gonna go ahead and
use it here. You see - -script http-slowloris, press Enter, and let the scan run
run its course. Now the scan can take a quite
a bit of your time. Why? I don't know. It's in LAN, it should be a bit faster, but
apparently it's not. Over the Internet it's bound to be slower than this. So, don't
just think it doesn't work, or something of a kind, it does
work. But, you know, if you're doing this online it might take a while longer.
In LAN it's, I really thought it was faster, but apparently this is the
speed at which it progresses. Anyway, you have all the standard stuff that you
would usually have, and down below it says, Completed SYN Stealth Scan,
excellent! So, that's just the normal stuff. Down below you have NSE
script scanning. Only after it has conducted its regular scan does it
begin the NSE script scan, the script which we
have actually passed, and the script which we want to utilize in order to figure
out is the server actually vulnerable to this type of an attack. You have a
separate timer for the NSE script, and a separate percentage down for the NSE
script as well. So, it says here the current time, and this is the remaining
time. I'm sorry this is not the current time, this is estimated time to
completion, or something of a kind. It doesn't matter, you don't have to pay
attention to this, this is the important part. It says 2 minutes and 41 seconds
remaining, 1 minute and 51 seconds remaining, it's gonna keep on issuing
them until its task is done. Once that is done, we will know whether the server is
vulnerable or not. These routers they tend to be vulnerable, I mean, to a tonload of
things. I've had a bit of an awkward experience, just goes to show that you
should never really move away from your computer while it's unlocked.
My friends they took my IP address, and because the home routers are not really
that good in terms of protection, so they were they were DoSsing me, basically. Of
course, I can avoid it quite easily by just changing the IP address, turning the
router on and off pretty much will do the trick, there are other ways. But, I
couldn't figure out, for about 5-10 minutes I couldn't really figure out what was
going on, I didn't figure it out. Anyway, because one of the first things that
people do when something is wrong with their internet connection, they reset the
router. That's what I did and of course the IP address changed, so the DoS
attack stopped, and later on did they actually tell me that they were messing
around with me a little bit. Anyway, the scan has completed, it says probably
vulnerable. So, let's see what we can do. You can go ahead and clear the screen
here unless you have like a hundred clients, or more than one client here
that you have scanned, then you want to redirect this to a file, as I have showed
previously. So, go ahead and clear the screen. In the follow-up tutorial, sorry
for the cough something just got into my throat, but in the follow-up tutorial
we will actually go ahead and download the Perl script, and see how we can
actually utilize it in order to actually perform this attack. Until then, I bid you
farewell.