Now is the time for a demonstration.
The first demonstration which we'll be seeing is about
denial‑of‑service attack or DoS attack.
For that, let's see the environment.
The environment which I have set up is pretty straightforward.
On the left side I have Kali Linux and on the right side I have Ubuntu.
In Kali Linux, I have already configured Slowloris.
In Ubuntu, I have configured Wireshark,
which is for monitoring networks and already configured Apache servers.
Now, on the screen, you can see the IP address of both of the Linux machines.
In the Ubuntu server on the same IP address,
I've configured Apache, so if you go to Firefox and type in the same IP address,
you will see the default page of the Apache Ubuntu server.
Also,
if you want to see how many threats currently Apache
is handling at port 80 or 443,
you can run this netstat command and see the answer.
Currently, it says 4.
Now, go to Wireshark,
and over here I have already provided a filter for Kali Linux.
Currently, you will see no incoming traffic from Kali Linux.
Now, let's see our Slowloris tool in action.
The syntax is pretty straightforward.
Type in Slowloris and the IP Address on which you want to attack.
Here I have typed in Slowloris and the IP address of our Ubuntu server.
Now, hit Enter,
and as soon as you do that you will notice that it is creating 150 sockets.
Once it creates those sockets,
it starts sending keep‑alive headers to our target server.
Let's go on the right side in our target server Ubuntu
and start scrolling in our Wireshark.
You will see from the source of Kali Linux lots of TCP
traffic coming into our destination.
This is because we have initiated a Slowloris attack.
If you have a tool like Wireshark,
you can easily figure it out from where you are getting
traffic and where exactly it is going.
Now, on the target server,
go to the terminal and type in the netstat command multiple times.
One of these times you will catch active keep‑alive
header connections to the target server.
You can see currently there are 153 active connections to our Apache server.
Now,
let's go to the Firefox browser and hit reload on our Ubuntu default home page.
It will work just fine because the Apache server can
easily handle around 150 active threats.
Now, let's go back to our attacker server and stop the Slowloris attack.
All right,
now is the time to see Slowloris in action to do a denial‑of‑service attack.
For that, let's type in slowloris, name of the IP address,
and right following that,
specify how many numbers of active threats you want to send to target.
Here, I'm typing 900.
Let's hit Enter and see our denial‑of‑service in action.
Let's go to the target server.
Over here, type in netstat.
You will see 739.
This means this many threats it has received from the attacker.
Now let's jump to Firefox, and over here hit refresh.
You will see Apache Ubuntu default page will not complete loading,
it will never finish its task.
Actually, it is denying legit user requests right now,
and that is endpoint denial‑of‑service attack from
MITRE ATT&CK practice number T1499.
Now, let's stop our Slowloris attack,
and as soon as we stop that in Firefox the Ubuntu default home page will load.
This is because now the server is available to serve legit users.
So far,
what we have seen is a straightforward denial‑of‑service attack
from attacker to target from a single terminal.
Now,
if you have a network analyzer or any tool which can analyze
your traffic or any advanced firewall,
you can easily detect from where actually the attack is
coming and you can block that particular IP.
Now that is a very unique scenario, but with the help of the Slowloris tool,
we can keep on generating impact from attacker to
target and let's see how we can do that.
But first, let's learn a lesson on how we can block attacks of Slowloris.
Let's go back to the attacker and type in the same
command which we have typed in before.
This time, also we are generating 900 keep‑alive headers.
Now, when we go to Wireshark,
you can see all the traffic is coming from a single IP address.
As I mentioned to you,
with the help of Wireshark or any other similar traffic analysis tool,
you can figure it out where actually the attack is coming.
We can go to the Linux firewall and block the IP address of our attacker.
First, we will enable our firewall, and if the firewall is enabled,
the next thing which we will do is type in the command to block our IP address.
We just blocked our IP address of Kali Linux.
Now,
let's go to Wireshark and you will see it is
continuously refusing all the connection.
If we go back to netstat,
we will also notice that the connection number is now reducing.
On the left side in attacker, at one point in time we had 900 active threats,
now that is decreasing to 686, and it will continue to decrease.
Netstat now shows 240 active connections,
whereas Kali Linux is showing us 461 connections.
Let's go to Firefox one more time,
and this time you can successfully load the web page
because there is actually no attack.
All the headers which were alive before are now getting
expired or are resetting themselves.
That's why the load on the server is continuously reducing
and we can operate the server normally.
The reason I'm showing you this demonstration is to explain to
you a very unique characteristic of Slowloris.
Slowloris is aware of how many active threats are going on on an Apache server
as the number of threats decreasing on the Apache server,
a similar number reflects also on a Slowloris terminal.
This is very helpful and important because if our target server has
closed any port or has somehow mitigated our attack,
we will get that feedback immediately and we can change our tactics.
Slowloris is very unique in this regard,
and that's why it is the favorite of many of the red tool experts,
as well as some not‑so‑good people.
Now, in this situation, we should actually switch to DDoS attack,
but that we will see in the next demonstration.
For the moment,
let's remove the entry from our firewall and see what
happens to our Slowloris attacking terminal.
Here, I remove our firewall entry.
Now, once again, Slowloris can continue attacking our Apache server.
Here,
you can see in Wireshark that once again there is
traffic coming in from our Kali Linux.
Also, when we go to netstat, we can see a very high number of connections.
The next thing is to go to our Firefox browser,
and over here, once again, we cannot load the page.
This means our denial‑of‑service attack is back in action
as we have removed the firewall entry.
Let's go back and stop our attack.
And there we go, now the world is perfect as it was before.
This concludes our demonstration of T1499 endpoint denial‑of‑service attack.
In the next demonstration,
we will see how the distributed denial‑of‑service attack happens,
and at that time, we will also discuss about T1498 network denial‑of‑service.