Hello guys and welcome to another video of this chapter.
So this video will help you
understand, icmp flow the tags, otherwise
known as Smurf attacks. Of course, we are going
to show you how to perform such an attack using
Kali Linux and how you
can precisely identify one
of these type of a
Likes using Wireshark Smurf,
attacks have the potential to be devastating,
both to the victim network.
And to the Network's used to uplift by the
attack, which we are going to explain later on how it
works. And I didn't
control message. Protocol Smurf, attack is
a Brute Force attack on the date. Broadcast feature.
That is built.
Into the IP protocol.
So, this type of attacks?
I can easily take Atmos by surprise
and can become challenging to identify.
Luckily, the tools like Wireshark that makes it easier
to capture and verify such
suspicions of any type of denial of
service attacks. So how is
MP float? The tax work. A Smurf attack
is not so terribly sophisticated. It's
just a matter of routing and letting
IP take its course.
Usually unfolds in some simple steps that
we're going to go through now. So the hiker
firstly identifies a victim IP address
with usually the web
server after that hike, it
tries to identify an intermediary site
that will help him or
here amplify the attack.
Then if I give starts to send a large amount of icmp
traffic at
the broadcast, address of the intermediary sides,
this bag is have the source
IP address both to point towards the victim. If
the mediator is delivered broadcast at
layer 2 to all the holes on the
subnet and the whole supplied the
victim Network.
So in this case, you might be wondering how
could a little ping traffic take
down the side. So take for instance that a
hiker has a cable modem and
since one Mega
BPS spoofed icmp stream at
a chosen intermediary site. So
let's suppose that this intermediary sides
have 150 horse that
can respond to that icmp.
Dream. So this means that the
intermediary sites can
amplify to 150 megabits PS attack
traveling from the appli fires towards
the victim. So this how you can keep this
up as long as he has a connection and as long as
of course the amplifiers continue to broadcast the icmp traffic and
as long as you could then use, of course this
traffic overwhelms, the victim resulting
in a denial of service.
Attack for the victim. So now we're going to
go ahead and see and perform such
an attack. Icmp flag attack with
Kali Linux. So we are going to use ATP, 3
on Kali Linux. And of course, our Target machine
will be a Windows machine. With
we're going to load Wireshark
the in order to capture this
type of Smurf, attack on our Windows
machine and see I'm
Go through the results of Wireshark and
just explore how Wireshark captured the
traffic.
So here back to our Linux machine Kali
Linux machine, we're going to open a
command line. Make sure you're always roots or you
can also use a pseudo if you want. So the command
is already laid
out and I have it here which
I am going to explain how everything
works. What is the syntax of the command? So you
start with shoe. Do you type h pink, three?
You can also use H pink three space
Dash does help, so you can find all
sorts of things that this command includes and
what you can do with it. So in this type of
lesson, we're going to learn how to flag a
target with icmp stream. So
that means and we are going to use icmp as
a protocol. That's does icmp. And
then space we're going to choose. Then the type of
Attack we won, which is flood. There's the flood and
then space does a which means that it's going to be
spoofing, our address 192
168 8.16 for
is our victims address.
In this case, as I told you before, we would be a Windows machine.
And then you have to go ahead and type another
IP address, which is basically your network range,
which you want to amplify
the
Stream. So before we go ahead
and hit enter. We need to go back to our
Windows machine fire up, Wireshark
start capturing the traffic and then we hit the
command. So we fired up Wireshark
in our Windows machine. We
need to select our interface. We
can select a network interface that
we can select start capturing, hit
capture.
Start capturing packets, and why
should we start capturing your traffic that
is generated now on your windows messy.
So let's just go back on Kali, Linux, hit
enter on H pink, three, command,
and then come back here and see if something
happens.
So back to a Linux machine, we are ready to hit enter
here and lock the attack and
then we immediately going to turn back to Windows
machine and check
if Wireshark can catch this type of attack
and what is happening. So let's just hit enter.
So let's just hit enter and you can see that the
attack is starting. Let's go back to Windows machine
and check wire circuit. If it
started capturing the traffic. So back in
our Windows machine, you can see that why I
said it's already starting capturing.
The icmp packets.
Coming straight, you can see there is a continuous stream.
Happening all the time.
And I can keep this attack up. As long as I
want it. I can use like intermediary sides.
With more holes that we can amplify my S MB.
Stream, you can see the
attack is going on. So let's just go back to
Kali Linux machine, stopped the attack and
come back here. And
Take a deeper look on the captured
traffic so you can stop
the attack by hitting Pedrosa, just
stops the attack and then we can go back to our Windows
machine and see what is happening on
wires check. So as you can see where
I went back to capture in normal traffic.
and we can just go ahead and stop the capturing and
You can just go ahead and review this. You
can just go ahead and save the
results by going to file save as your
white sock, if you want to keep this traffic and you
can see that when before we start the attack, the
Wireshark started, capturing normal traffic and
responses from our computer. Then
we hit the attack.
Now, Kali Linux machine and all
of a sudden.
Huge flood of icmp packets started hitting our
Windows machine continuously. You
can see the source IP, which is Windows
AP and our Network range.
Here.
Do you see this will go on forever?
You can leave it if you want.
So what was covered in this lesson is
that we basically learned
how icmp flood
attacks work. We learned how
to perform one on Kali Linux and
of course how to correctly, identify
such an attack on our,
in this case with those my seam by
using Wireshark. Thank you guys for
this lesson and you can just go ahead.
Ed and click on the next video which is detecting Mark
flooding.