🚧 Denial of Service (DoS) Attacks

Introduction

In this lab, we will explore the concept of Denial of Service (DoS) attacks. DoS attacks are a type of cyber attack that aims to make a computer or network resource unavailable to its intended users by overwhelming it with an excessive amount of traffic or requests. The goal of this lab is to help you understand the principles behind DoS attacks and gain hands-on experience in launching and defending against such attacks.

Understanding DoS Attacks

In this step, we will introduce the concept of Denial of Service (DoS) attacks and explain how they work.

A Denial of Service (DoS) attack is an attempt to make a computer or network resource unavailable to its intended users by overwhelming it with an excessive amount of traffic or requests. The primary goal of a DoS attack is to disrupt the normal operations of a system, causing it to become unresponsive or crash.

There are various types of DoS attacks, but one of the most common is the SYN flood attack, which exploits the TCP three-way handshake process. Here's how a SYN flood attack works:

1. The attacker sends a large number of SYN packets (the initial packet in the TCP handshake process) to the target system.
2. The target system responds to each SYN packet with a SYN-ACK packet and allocates resources (such as memory) to maintain the half-open connections.
3. The attacker never sends the final ACK packet to complete the handshake, leaving the target system with a large number of half-open connections and eventually exhausting its resources.

This overwhelms the target system, preventing it from accepting legitimate connections and rendering it unavailable to legitimate users.

## Run the following command to simulate a SYN flood attack using hping3
hping3 -S -P -U --flood -V --rand-source 192.168.122.102

In this example, the hping3 command is used to send a flood of SYN packets with various flags set (SYN, PUSH, URG) to the target IP address 192.168.122.102. The --rand-source option randomizes the source IP address for each packet, making it harder to filter the attack traffic.

Launching a DoS Attack

In this step, we will launch a DoS attack using the Apache Benchmark (ab) tool and observe its impact on the target system.

The Apache Benchmark (ab) is a tool for measuring the performance of HTTP web servers. However, it can also be used to simulate a large number of concurrent requests, effectively launching a DoS attack against the target web server.

Follow these steps to launch a DoS attack using ab:

1. Start the target system by running the following command:

sudo virsh start Metasploitable2

2. Run the following command to start a Kali Linux container and access its bash shell:

docker run -ti --network host b5b709a49cd5 bash

3. Inside the Kali Linux container, execute the following command to launch a DoS attack against the target web server:

ab -n 10000000 -c 600 http://192.168.122.102/mutillidae

This command sends 10,000,000 requests to the http://192.168.122.102/mutillidae URL with a concurrency level of 600 (i.e., 600 parallel requests at a time).

4. While the attack is in progress, log in to the target system using SSH:

ssh msfadmin@target

5. Once logged in, use the top command to observe the system load and CPU usage:

top

You should see a high system load and a significant portion of the CPU being consumed by Apache processes, indicating that the DoS attack is overwhelming the target system.

Mitigating DoS Attacks

In this step, we will discuss some common techniques for mitigating and defending against DoS attacks.

While it is challenging to completely prevent DoS attacks, there are several measures that can be taken to mitigate their impact:

1. Implement rate-limiting: Rate-limiting can help control the number of incoming requests from a single IP address or a network range. This can be achieved by configuring web server software (e.g., Apache or Nginx) or using a dedicated load balancer or web application firewall (WAF).

2. Use SYN cookies: The SYN cookies mechanism can help defend against SYN flood attacks by avoiding the allocation of resources for incomplete TCP connections. This technique can be enabled by setting the net.ipv4.tcp_syncookies kernel parameter on Linux systems.

3. Deploy DDoS mitigation services: For large-scale DDoS attacks, it may be necessary to use specialized DDoS mitigation services offered by content delivery networks (CDNs) or dedicated DDoS protection providers. These services can absorb and filter the malicious traffic before it reaches the target system.

4. Increase system resources: While not a long-term solution, increasing the available system resources (e.g., CPU, RAM, network bandwidth) can help a system withstand DoS attacks for a longer period before becoming overwhelmed.

5. Keep software up-to-date: Regularly updating and patching the operating system, web server software, and other applications can help address vulnerabilities that could be exploited in DoS attacks.

It's important to note that defending against DoS attacks is an ongoing process, and a combination of various mitigation techniques may be required based on the specific threat landscape and system requirements.

Summary

In this lab, we explored the concept of Denial of Service (DoS) attacks, particularly focusing on the SYN flood attack. We learned how to launch DoS attacks using tools like hping3 and ab, and observed the impact of these attacks on the target system. Additionally, we discussed various techniques for mitigating and defending against DoS attacks, such as rate-limiting, using SYN cookies, deploying DDoS mitigation services, increasing system resources, and keeping software up-to-date.

Through this hands-on experience, you gained a practical understanding of DoS attacks and the importance of implementing proper security measures to protect systems and networks from such threats. Remember, while DoS attacks can be challenging to prevent entirely, a proactive and multi-layered approach to security can significantly reduce the risk and impact of these attacks.