Hello, guys, and welcome to another video of this chapter.
This video will help you understand TCP
SYN Flood Attacks otherwise known as denial of service attack.
So you have to perform one using Kali Linux and it's been three
and correctly identified one using the Wireshark protocol
for some information regarding denial of service attacks in general, there are
simple to carry out and it can cause serious damage.
And they are and always of this
in a SYN flood Attack and malicious party Exploit the TCP
protocol three way handshake to quickly cause service and network disruptions,
ultimately leading to a denial of service attack.
These types of attacks can easily take
admin's by surprise and can become challenging to identify.
Likely DOS like Wireshark makes it an easy
process to capture and verify any suspicions of a denial of service attack.
So how a TCP SYN Flood Attack work.
So let's go and explore how a TCP SYN Flood Attack works.
So when a client attempts to connect to a Server using the TCP protocol,
for example, HTTP or HTTPs it is first required to perform a three
way handshake before any data starts to be exchanged between the two
since, the three way TCP handsyn is always initiated by a client.
It sends a Syn packet to the Server.
The Server next replies, acknowledging the request and at the same
time it sends its own SYN request with the SYN-ACK packet.
Then finally, the client sense and
acknowledge packet, which confirms both two hosts agreed to create a connection.
The connection is therefore established
and they can be transferred between these two.
In a SYN Flood Attack
the attacker sends a high volume of SYN packet to the Server using Spoofed IP
addresses, causing the Server to send a reply.
SYN-ACK.
In this case, as we said earlier, and live
exports half open are waiting for a reply from the host that basically doesn't
exist, as you can see from the picture here.
So in a simpler, more direct Attack without IP Spoofing
by flooding, the target was seen packets and not responding.
With acknowledgement, and I think you can easily overwhelm the target resources in
this state, the target struggles to handle traffic, which in turn will increase CPU
users and memory consumption, ultimately leading to the exhaustion.
Of its resources, CPU and RAM.
At this point, the Server will no longer be able to serve legitimate client request
and ultimately lead to a denial of service.
So let's just go ahead and perform a TCP
SYN Flood Attack in Kali Linux with hping3.
And at the same time, we're going to
locate Wireshark at the target machine so we can see and
identify and capture the denial of service attack.
So the simplest way to perform such an
attack is via Kali Linux machine and more especially with the hping3,
a popular TCP Penetration Testing Tool usually including Kali Linux.
If you don't have a hping3 in your Kali
Linux distribution, you can just go ahead and install it.
Using apt does get install hping3.
So in this machine.
I have already installed hping3.
So I don't need to install it in most of the cases, attackers will use
hping or another tool to spoof random IP addresses.
So that's what we are going to focus on.
So I'm not.
Going to type the command, the full
command that we're going to use, I have it.
I have it here, but I am going to explain in detail what this command includes.
So let's explain in detail.
We are setting one thousand five hundred
packets at the size of one hundred twenty Bytes each.
We are specifying the SYN, Flug.
That IT should be enabled.
With TCP window of 64
to directly, Attack, to our victim, to HTTP, Web, Server, we specify the port.
In this case, which is eighty for HTTP and used to flood the flood fog
and use the flood flag to send packets as fast as possible.
As you would expect, the -- run dust the source flag
generates spoofed IP addresses to disguise the real source and avoid detection, but
at the same time, stop the victims SYN-ACK reply packets from reaching the target.
So this IP that I have here, the command
is the my windows look on machine IP address, which is not Server.
We are going to perform this attack on my local Windows machine and you will see
that it is able to capture such an attack using Wireshark.
Before you press enter on this command, you need to be able to go
to the Windows machine and open wireshark, so let just go ahead and do
that first, so you go to your Windows machine and you
open the Wireshark and you choose the network opt here you would like to capture
the packet from this case is my Wi-fi and start capturing.
So now we start capturing the traffic on
the Windows machine and we're going to go straight away to our Kali Linux machine to
perform the DDOS Attack and then come back to Windows Machine to see how the
SYN Flood Attack is being captured by the Wireshark.
So we are in our Kali Linux machine ready to press under to perform the Attack.
So we just going to have.
So we just going to go ahead and
press enter and see that the command is already running and creating.
The SYN Flood Mode.
Let's go now to Windows Machine and see if
our shark is detecting the SYN F lood Attack.
So now we are on this machine, and as you can see, there is a lot of SYN
packages coming in our machine continuously.
From BIOS IP addresses, as we said.
All Directory to our windows machine.
And they keep coming and coming and coming.
This, of course, raises CPU consumption.
You can go ahead and see that when you
open task manager, in your windows machine checking the performance.
And take the CPU consumption,
so the SYN, the TCP SYN Flood Attack continuous right now, we can see like.
Wireshark is capturing that, so let's go ahead to our Kali Linux machine, stop the
SYN Flood Attack and then immediately return to our windows machine and stop the
capturing and go ahead and check a little bit.
The SYN Flood Attack.
So you can stop this Attack by pressing Clt X to your Kali Linux machine.
So you can stop the Attack by pressing
until see, and you can see that the Attack has
stopped, so let us go back to our window machine and stop the capturing Wireshark.
So now we are back to our Windows machine, and as you can see, we
stopped the capture of the network traffic and.
We can start, like, investigating the whole thing from the beginning, and you
can see that when we started capturing the package, there's stuff going on.
And if you go further.
You can see that the Attack will start at some point and Wireshark is
capturing that, so the moment you see a lot of
SYN Flood attacks on the port ID, you will see that the attack start.
So here.
This moment.
You can see the.
SYN flood Attack on Port 80 starts happening.
There is a lot of packets.
Targeting Bot 80.
And since we let this attack happen for a
long time, the more you go down on this capture.
The more you see port 80,
the more you will see our Port 80 on Windows Machine flooded with SYN packets.
So since we stopped this.
Capturing we can always just go ahead and save this file and Exploit later.
You can see that the source
are different IPS that have nothing to do with
the IP of the Linux machine that we sent this traffic to Windows machine.
That is the power of hping3 randomizing IP address Spoofing
coming from all sorts of different IP addresses to specific.
one the SYN Flood Attacks. There is a lot of packets for a long time.
And at some point when we pressed CLT X,
and we stopped the functionality of this command and the attack stopped.
As you can see, so in this lesson we explained.
In rather detail, how a TCP SYN Flood Attack works.
And we also demonstrated how to perform such an Attack in Kali Linux with hping3.
And we also saw in the targeted machine how wireshark detected
this TCP SYN Flood Attack that we send from Kali Linux machine, but
with different IP sources as we are Spoofing the IPS.
So that was it for this lesson.
And you can just go ahead and click on the
next video where you can learn how to identify the Bot infected host.