Welcome back!
In the last video we have seen how DCP works what are the security problems in how a hacker could attack
for the DHCP protocol.
Let's move on and attack the DCP with a Discover flooding attack.
I'm going to use you as a senior.
We've already seen here senior before when I've shown you the CTP and SDP attacks you are senior.
Oh first a DCP discover a flute functionality which should not be confused with an actual DCP starvation
attack.
The effect of this one is far more temporary.
In this attack you are a senior since the ACP discover messages to the ACP server at a very high rate.
Most probably far higher than what the ACP server can reasonably handle.
Note that the ACP server is not as resilient as let's say a web server.
This attack will probably make the DCP server unavailable for the duration of the attack.
It will be unable to process any legitimate requests for the duration of the flute.
Once the flute stops since the senior did not answer to any offer sent by this server the server will
automatically delete all flood related entries from ICS releases database.
After a few minutes timeout licks lunch the attack in this lab I'm gonna attack the DCP server of my
land which is also the default gateway.
First I want to open wire shark to see the generated traffic and then start Yersinia is the route I'm
starting.
White Shark
capture options.
I'm selecting the interface ENP so is free and start if you want to see only the ACP packets you can
apply a display filter in wire shell.
If you're right DCP in this version of wire shark it won't recognize it.
You'll see it didn't recognise this filter but if you're right.
But B both p e to recognise the option would be comes from both protocol and where a shark will filter
and display only the ACP packets but B is a legacy protocol of the ACP the H ACP has sometimes in the
past replaced but B we are seeing only the ACP packets in wire shark in times starting yet a C minus
G means that I want to start a graphical interface okay perfect.
This is our senior in dial click on a launch a tick and then I'll select the DCP tab we see here.
All available attacks on DCP sending discover packet is the option used for the flooding attack.
I'm gonna launch in a few seconds.
The next option is for setting up a rogue the ACP server in the last option is for sending the ACP release
packets to the server so the server considers the IP addresses available to be offered to other clients
so this is also a kind of denial of service attack and I'm launching the attack
Lexi the captured traffic nowhere shark in the not these bonds of broadcast.
The ACP discover messages sent to the server.
In fact they are sent to the broadcast address.
But the server will process them it's sending hundreds of the ACP discover messages per second.
Now the server is under a lot of stress.
It's the ACP Lizzie's database is probably unavailable to legitimate clients.
Let's test if I can still communicate on the Internet
it's not working because that the ACP server is also the default gateway and is under attack destination
host unreachable I am stopping the attack least attacks and stop all
being we'll start shortly.
This is a temporary attack
okay.
It has started
if you want to launch the attack at the console you execute is rude.
You are senior DCP minus attack one
Okay vex all in the next lecture.
I'll show you a real DCP starvation attack.