Tools for conducting denial-of-service attacks - Revision history

Luongqt at 03:51, 13 April 2009

2009-04-13T03:51:52Z

← Older revision		Revision as of 03:51, 13 April 2009
Line 184:		Line 184:
	* [http://www.hackforums.net Hacker Forums]<BR>		* [http://www.hackforums.net Hacker Forums]<BR>
	* [http://lib.tkk.fi/Diss/2006/isbn9512282151/article1.pdf Mitigating denial of service attacks: A tutorial]<BR>		* [http://lib.tkk.fi/Diss/2006/isbn9512282151/article1.pdf Mitigating denial of service attacks: A tutorial]<BR>
		+	* [http://homepages.cs.ncl.ac.uk/jeff.yan/sec2002.pdf Denial of Service: Another Example]<BR>
		+	* [http://e-articles.info/e/a/title/Wireless-Attacks-~-Jamming-(Denial-of-Service)/ Wireless Attacks ~ Jamming (Denial of Service)]<BR>
		+	* [http://kondor.etf.bg.ac.yu/~vm/tutorial/ssgrr2001/denial.ppt Denial of Service Attacks: Methods, Tools, and Defenses]

-	--[[User:Luongqt\|Luongqt]] 23:45, 12 April 2009 (EDT)	+	--[[User:Luongqt\|Luongqt]] 23:51, 12 April 2009 (EDT)

Luongqt at 03:45, 13 April 2009

2009-04-13T03:45:37Z

← Older revision		Revision as of 03:45, 13 April 2009
Line 7:		Line 7:


-	==Definition==	+	==Definition<sup>[3]</sup>==
	[[Image:Dosgeek.jpg\|thumb\|right\|400px\|DoS in comic]]		[[Image:Dosgeek.jpg\|thumb\|right\|400px\|DoS in comic]]
	Denial-of-service (DoS) attack is an attempt to violate the availability condition of		Denial-of-service (DoS) attack is an attempt to violate the availability condition of
Line 38:		Line 38:
	* UDP floods (protocol)		* UDP floods (protocol)
	* [http://en.wikipedia.org/wiki/SYN_(TCP) SYN] floods (bandwidth)		* [http://en.wikipedia.org/wiki/SYN_(TCP) SYN] floods (bandwidth)
-	==Tools for conducting DoS attacks==	+	==Tools for conducting DoS attacks<sup>[2]</sup>==
	===SSPing===		===SSPing===
	[[Image:SmurfAttack.gif\|thumb\|right\|300px\|Smurf]]		[[Image:SmurfAttack.gif\|thumb\|right\|300px\|Smurf]]
Line 67:		Line 67:
	network also.		network also.
	There is a similar tool called Fraggle which uses UDP packets instead.		There is a similar tool called Fraggle which uses UDP packets instead.
-	===SYN Flood===	+	===SYN Flood<sup>[1]</sup>===
	With a series of SYN packets, the attacker can drain the victim resources which leads to		With a series of SYN packets, the attacker can drain the victim resources which leads to
	rejecting legitimate requests.		rejecting legitimate requests.
Line 114:		Line 114:

	==References==		==References==
-	* Stuart McClure, Joel Scambray and George Kurtz, Hacking Exposed—Network Security Secrets & Solutions, Fifth Edition,McGraw-Hill/Osborne, ISBN:9780072260816	+	* [1] Stuart McClure, Joel Scambray and George Kurtz, Hacking Exposed—Network Security Secrets & Solutions, Fifth Edition,McGraw-Hill/Osborne, ISBN:9780072260816
-	* International Council of Electronic Commerce Consultants, Ethical Hacking and Countermeasures [EC-Council Exam 312-50]—Student Courseware,ISBN No 0972936211	+	* [2]International Council of Electronic Commerce Consultants, Ethical Hacking and Countermeasures [EC-Council Exam 312-50]—Student Courseware,ISBN No 0972936211
-	* Jelena Mirkovic, Sven Dietrich, David Dittrich, Peter Reiher, Internet Denial of Service: Attack and Defense Mechanisms, Prentice Hall PTR, Print ISBN: 0-13-147573-8	+	* [3] Jelena Mirkovic, Sven Dietrich, David Dittrich, Peter Reiher, Internet Denial of Service: Attack and Defense Mechanisms, Prentice Hall PTR, Print ISBN: 0-13-147573-8

	==See also==		==See also==
Line 183:		Line 183:
	* [http://en.wikipedia.org/wiki/Network_security Network security]<br>		* [http://en.wikipedia.org/wiki/Network_security Network security]<br>
	* [http://www.hackforums.net Hacker Forums]<BR>		* [http://www.hackforums.net Hacker Forums]<BR>
-	--[[User:Luongqt\|Luongqt]] 15:12, 10 April 2009 (EDT)	+	* [http://lib.tkk.fi/Diss/2006/isbn9512282151/article1.pdf Mitigating denial of service attacks: A tutorial]<BR>
		+
		+	--[[User:Luongqt\|Luongqt]] 23:45, 12 April 2009 (EDT)

Luongqt at 19:12, 10 April 2009

2009-04-10T19:12:41Z

← Older revision		Revision as of 19:12, 10 April 2009
Line 183:		Line 183:
	* [http://en.wikipedia.org/wiki/Network_security Network security]<br>		* [http://en.wikipedia.org/wiki/Network_security Network security]<br>
	* [http://www.hackforums.net Hacker Forums]<BR>		* [http://www.hackforums.net Hacker Forums]<BR>
-	[[User:Luongqt\|Luongqt]]	+	--[[User:Luongqt\|Luongqt]] 15:12, 10 April 2009 (EDT)

Luongqt at 19:12, 10 April 2009

2009-04-10T19:12:22Z

← Older revision		Revision as of 19:12, 10 April 2009
Line 18:		Line 18:
	===Fact===		===Fact===
	[[Image:CnnDoS.PNG\|thumb\|right\|400px\|DoS reported on CNN]]		[[Image:CnnDoS.PNG\|thumb\|right\|400px\|DoS reported on CNN]]
		+	[[Image:NewDoSTool.PNG\|thumb\|right\|400px\|Trinity]]
	* On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, [http://en.wikipedia.org/wiki/Ebay eBay (EBAY)], Amazon.com (AMZN), and [http://en.wikipedia.org/wiki/Cnn CNN] (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off. As a result, Yahoo, which relies on advertising for much of its revenue, lost potentially an estimated $500,000 because its users were unable to access Yahoo's Web pages and the advertisements they carried. (Business Week Online, 12 February 2000)		* On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, [http://en.wikipedia.org/wiki/Ebay eBay (EBAY)], Amazon.com (AMZN), and [http://en.wikipedia.org/wiki/Cnn CNN] (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off. As a result, Yahoo, which relies on advertising for much of its revenue, lost potentially an estimated $500,000 because its users were unable to access Yahoo's Web pages and the advertisements they carried. (Business Week Online, 12 February 2000)

Line 41:		Line 42:
	[[Image:SmurfAttack.gif\|thumb\|right\|300px\|Smurf]]		[[Image:SmurfAttack.gif\|thumb\|right\|300px\|Smurf]]
	[[Image:SYN_flood.jpg\|thumb\|right\|300px\|SYN Flood]]		[[Image:SYN_flood.jpg\|thumb\|right\|300px\|SYN Flood]]
-	[[Image:~~NewDoSTool~~.~~PNG~~\|thumb\|right\|~~400px~~\|~~Trinity~~]]	+	[[Image:Mixter.jpg\|thumb\|right\|300px\|The creator of Targa]]
		+
	SSPing, a DoS tool, is a program sends the victim's computer a series of highly fragmented,		SSPing, a DoS tool, is a program sends the victim's computer a series of highly fragmented,
	over-sized ICMP data packets. While trying to put the fragments together, the computer can		over-sized ICMP data packets. While trying to put the fragments together, the computer can
Line 47:		Line 49:
	attacker can lock the victim's computer instantaneously. The identity of the attacker is		attacker can lock the victim's computer instantaneously. The identity of the attacker is
	unknown since the connection is lost as the victim restarts the computer. SSPing affects		unknown since the connection is lost as the victim restarts the computer. SSPing affects
-	Windows 95/NT and Mac OS.	+	[http://en.wikipedia.org/wiki/Windows_95 Windows 95]/[http://en.wikipedia.org/wiki/Windows_NT NT] and [http://en.wikipedia.org/wiki/Mac_os Mac OS].
	Jolt is a program known for this kind of attack. It will freeze unpatched Windows 95, NT		Jolt is a program known for this kind of attack. It will freeze unpatched Windows 95, NT
	machines by sending a series of spoofed & highly fragmented ICMP packets to the target,		machines by sending a series of spoofed & highly fragmented ICMP packets to the target,
Line 181:		Line 183:
	* [http://en.wikipedia.org/wiki/Network_security Network security]<br>		* [http://en.wikipedia.org/wiki/Network_security Network security]<br>
	* [http://www.hackforums.net Hacker Forums]<BR>		* [http://www.hackforums.net Hacker Forums]<BR>
-		+	[[User:Luongqt\|Luongqt]]
-	--[[User:Luongqt\|Luongqt]] ~~15:03, 10 April 2009 (EDT)~~	+

Luongqt at 19:03, 10 April 2009

2009-04-10T19:03:12Z

← Older revision		Revision as of 19:03, 10 April 2009
Line 41:		Line 41:
	[[Image:SmurfAttack.gif\|thumb\|right\|300px\|Smurf]]		[[Image:SmurfAttack.gif\|thumb\|right\|300px\|Smurf]]
	[[Image:SYN_flood.jpg\|thumb\|right\|300px\|SYN Flood]]		[[Image:SYN_flood.jpg\|thumb\|right\|300px\|SYN Flood]]
		+	[[Image:NewDoSTool.PNG\|thumb\|right\|400px\|Trinity]]
	SSPing, a DoS tool, is a program sends the victim's computer a series of highly fragmented,		SSPing, a DoS tool, is a program sends the victim's computer a series of highly fragmented,
	over-sized ICMP data packets. While trying to put the fragments together, the computer can		over-sized ICMP data packets. While trying to put the fragments together, the computer can
Line 180:		Line 181:
	* [http://en.wikipedia.org/wiki/Network_security Network security]<br>		* [http://en.wikipedia.org/wiki/Network_security Network security]<br>
	* [http://www.hackforums.net Hacker Forums]<BR>		* [http://www.hackforums.net Hacker Forums]<BR>
-	[[User:Luongqt\|Luongqt]]	+
		+	--[[User:Luongqt\|Luongqt]] 15:03, 10 April 2009 (EDT)

Luongqt at 18:58, 10 April 2009

2009-04-10T18:58:37Z

← Older revision		Revision as of 18:58, 10 April 2009
Line 1:		Line 1:
		+	[[Image:Bot_attack.jpg\|thumb\|right\|400px\|Attack of the bots. Too late for something too big.]]
	In the world of computer [http://en.wikipedia.org/wiki/Network_security network security], denial-of-service attack is a sneaky and furious monster. It is calm and quite. But when it attacks you, your system will be defeated within minutes (sometimes seconds). What is it? Where does it come from? What can it do? How can you conduct it? Conduct with what? Software or hardware?		In the world of computer [http://en.wikipedia.org/wiki/Network_security network security], denial-of-service attack is a sneaky and furious monster. It is calm and quite. But when it attacks you, your system will be defeated within minutes (sometimes seconds). What is it? Where does it come from? What can it do? How can you conduct it? Conduct with what? Software or hardware?

Line 16:		Line 17:
	information/data. Others aim for the victim's Achilles' heel that cause it to crash.		information/data. Others aim for the victim's Achilles' heel that cause it to crash.
	===Fact===		===Fact===
		+	[[Image:CnnDoS.PNG\|thumb\|right\|400px\|DoS reported on CNN]]
	* On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, [http://en.wikipedia.org/wiki/Ebay eBay (EBAY)], Amazon.com (AMZN), and [http://en.wikipedia.org/wiki/Cnn CNN] (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off. As a result, Yahoo, which relies on advertising for much of its revenue, lost potentially an estimated $500,000 because its users were unable to access Yahoo's Web pages and the advertisements they carried. (Business Week Online, 12 February 2000)		* On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, [http://en.wikipedia.org/wiki/Ebay eBay (EBAY)], Amazon.com (AMZN), and [http://en.wikipedia.org/wiki/Cnn CNN] (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off. As a result, Yahoo, which relies on advertising for much of its revenue, lost potentially an estimated $500,000 because its users were unable to access Yahoo's Web pages and the advertisements they carried. (Business Week Online, 12 February 2000)

Line 67:		Line 69:
	System A sends a SYN packet to system B asking to establish a connection via three-way		System A sends a SYN packet to system B asking to establish a connection via three-way
	handshake. However the source address of the packet is spoofed thus misleads system B to		handshake. However the source address of the packet is spoofed thus misleads system B to
-	switch to SYN_RECV state and send an SYN/ACK packet to the spoofed address. These	+	switch to SYN_RECV state and send an SYN/ACK packet to the [http://en.wikipedia.org/wiki/IP_address_spoofing spoofed address]. These
	connections are called half-open connections. The source address does not exist and system		connections are called half-open connections. The source address does not exist and system
	B can only flush the potential connection once the connection-establishment timer expires.		B can only flush the potential connection once the connection-establishment timer expires.
Line 92:		Line 94:

	==Prevention==		==Prevention==
		+	[[Image:Network_security.jpg\|thumb\|right\|400px\|Network security]]
	You could do the following things to minimize the DoS attack:		You could do the following things to minimize the DoS attack:

Line 113:		Line 116:

	==See also==		==See also==
		+	* [[Cell BE - A Network on a Chip]]<BR>
	* [[Digital Enhanced Cordless Telecommunications (DECT)]]<BR>		* [[Digital Enhanced Cordless Telecommunications (DECT)]]<BR>
-	* [[Internet Control Message Protocol ~~(ICMP)~~]]<BR>	+	* [[Internet Control Message Protocol]]<BR>
	* [[Denial Of Service Attacks]]<BR>		* [[Denial Of Service Attacks]]<BR>
		+	* [[Wi-Fi]]<BR>
	* [[Cryptography in Information Security]]<BR>		* [[Cryptography in Information Security]]<BR>
	* [[Hypertext Transfer Protocol over Secure Socket Layer (HTTPS)]]<BR>		* [[Hypertext Transfer Protocol over Secure Socket Layer (HTTPS)]]<BR>
	* [[Bluetooth]]<BR>		* [[Bluetooth]]<BR>
-	* [[~~Cell BE Hardware Employed as Network on a Chip]]<BR>~~	+	* [[The practicality of IPv6]]<BR>
-	* [[IPv6]]<BR>	+
	* [[Dynamic Host Configuration Protocol (DHCP)]]<BR>		* [[Dynamic Host Configuration Protocol (DHCP)]]<BR>
-	* [[Social Network ~~Services~~ ]]<BR>	+	* [[Social Network Service ]]<BR>
		+	* [[Keystroke Logging: Are You Next]]<BR>
	* [[Network Latency]]<BR>		* [[Network Latency]]<BR>
	* [[Onion Routing]]<BR>		* [[Onion Routing]]<BR>
-	* [[Radio Frequency Identification]]<BR>	+
		+	* [[Radio Frequency Identification (RFID)]]<BR>
	* [[3G Communications]]<BR>		* [[3G Communications]]<BR>
	* [[Security in Smartphones]]<BR>		* [[Security in Smartphones]]<BR>
Line 131:		Line 137:
	* [[Address Resolution Protocol (ARP)]]<BR>		* [[Address Resolution Protocol (ARP)]]<BR>
	* [[How to Connect to the Internet via an ISP]]<BR>		* [[How to Connect to the Internet via an ISP]]<BR>
-	* [[~~CAPTCHAs~~]]<BR>	+	* [[CAPTCHA]]<BR>
	* [[Security for Small Home Networks]]<BR>		* [[Security for Small Home Networks]]<BR>
	* [[Rootkits]]<BR>		* [[Rootkits]]<BR>
-	* [[Proxy ~~Servers~~]]<BR>	+	* [[Proxy Server]]<BR>
-	* [[Network ~~Firewalls~~]]<BR>	+	* [[Network Firewall]]<BR>
	* [[Steganography and Digital Watermarking]]<BR>		* [[Steganography and Digital Watermarking]]<BR>
	* [[Malware]]<BR>		* [[Malware]]<BR>
-	* [[Peer-to-Peer ~~File Sharing~~]]<BR>	+	* [[Peer-to-Peer Network Security]]<BR>
	* [[High-Speed Downlink Packet Access (HSDPA)]]<BR>		* [[High-Speed Downlink Packet Access (HSDPA)]]<BR>
-	* [[Network Attached Storage ~~(NAS) Devices~~]]<BR>	+	* [[Man in the Middle Attack]]<BR>
		+	* [[Network Attached Storage]]<BR>
	* [[RSA Encryption Algorithm]]<BR>		* [[RSA Encryption Algorithm]]<BR>
	* [[Corporate Security and IT Policies]]<BR>		* [[Corporate Security and IT Policies]]<BR>
Line 153:		Line 160:
	* [[IP Spoofing]]<BR>		* [[IP Spoofing]]<BR>
	* [[WLAN Standard 802.11n]]<BR>		* [[WLAN Standard 802.11n]]<BR>
-	* [[Domain Name System ~~(DNS)~~]]<BR>	+	* [[Domain Name System]]<BR>
	* [[Web 2.0]]<BR>		* [[Web 2.0]]<BR>
-	* [[Local Area ~~Networks~~]]<BR>	+	* [[Local Area Network]]<BR>
-	* [[Botnets]]<BR>	+	* [[Bots & Botnets]]<BR>
-	* [[Trivial ~~FTP~~]]<BR>	+	* [[Trivial File Transfer Protocol]]<BR>
	* [[Load Balancing for Network Servers]]<BR>		* [[Load Balancing for Network Servers]]<BR>
	* [[Simple Mail Transfer Protocol (SMTP)]]<BR>		* [[Simple Mail Transfer Protocol (SMTP)]]<BR>
	* [[Email Security]]<BR>		* [[Email Security]]<BR>
	* [[Data Encryption for Storage Devices]]<BR>		* [[Data Encryption for Storage Devices]]<BR>
-	* [[~~Statistical Analysis~~ of Internet ~~Security~~ Threats]]<BR>	+	* [[Statistics of Internet Threats]]<BR>
-	* [[~~Voice over IP (~~VoIP)]]<BR>	+	* [[VoIP]]<BR>
	* [[Deep Packet Inspection]]<BR>		* [[Deep Packet Inspection]]<BR>
	* [[Fingerprint Authentication]]<BR>		* [[Fingerprint Authentication]]<BR>
Line 172:		Line 179:
	* [http://en.wikipedia.org/wiki/Denial-of-service_attack Denial-of-service Attacks]<BR>		* [http://en.wikipedia.org/wiki/Denial-of-service_attack Denial-of-service Attacks]<BR>
	* [http://en.wikipedia.org/wiki/Network_security Network security]<br>		* [http://en.wikipedia.org/wiki/Network_security Network security]<br>
		+	* [http://www.hackforums.net Hacker Forums]<BR>
	[[User:Luongqt\|Luongqt]]		[[User:Luongqt\|Luongqt]]