In the previous clip we learned about how DoS attack works with Slowloris.
Now is the time to learn about distributed DoS attack.
Let's see environment and setup.
On the screen I have two sections.
On the left side we have attackers, and on the right side we have target.
On the left side, this time I have three different systems set up.
On the top I have Kali Linux,
and on the bottom I have two different Ubuntu instances.
As you can see, the IP addresses of all three machines are different.
And on the right side I have the same Ubuntu Linux
machine which I've used in previous clip.
It already has Wireshark installed in it and Apache server up and running.
Lot of people often wonder why we should use Slowloris
for MITRE ATT&CK tactics of impact.
We will get a very clear answer in this demonstration.
We'll be talking about network denial‑of‑service attack, which is T1498.
I think it is a good time to start our Slowloris attack.
This time, we'll be doing it with three different terminals.
On the top over here I have a 300 socket,
and sleeptime between sending header is 3 seconds.
That means approximately around 3 seconds new 300 headers will be sent.
Now, I've just started that attack.
Has very similar setup, and it has 400 sockets,
and sleeptime between sending headers is 4 seconds.
The one on the right I have set up as 500 sockets and
sleeptime of 5 seconds between sending headers.
Now, all three of them are currently attacking via network to our target server.
This time when we run netstat on our target server,
we can see it says 636 threads.
That means our Ubuntu right now is processing 336 threads.
When we add up 300, 400, and 500,
that means there are total 1200 headers we are sending from our attackers.
However,
our Apache server has reached its limit and not able to process
any more threads and currently just failing,
and you can see that in Wireshark.
Now at this point of time,
I want to show you a very interesting behavior of Slowloris tool.
As you can see, Slowloris is running from three different Linux systems.
However, the attack is pretty coordinated.
When only Kali Linux was attacking a target,
at that time it was sending 300 threads,
but as soon as 2 other attackers came into the picture,
entire attack was coordinated,
and Kali Linux reduced its attacking threads to much lower number.
Eventually, all three attackers worked together,
even though they are different system.
They distributed their attack based on what they find comfortable among them.
Now the real trouble is on that target side.
On target,
it is very difficult to identify now from where
exactly the attack is originating.
Now we have different IP, as well as number of the header,
and frequency is very different.
Now let's assume the target server is very lucky,
and they figured out IP address of one of the attackers.
Let's see what happens when they block one of the IP addresses of attacker.
The target server is hoping when they block this particular IP they
will be able to load that web page just fine.
However, Slowloris is way more intelligent.
Just watch what happens when the IP is blocked.
When IP is blocked,
that particular Linux server will slowly send less active headers.
This is because all the active headers which have connections are currently on,
but it is not able to establish new connection.
At the same time,
other two attackers will seize the opportunity and will
start sending more keep‑alive headers.
Here the target is optimistic.
Target is thinking that now they have blocked one IP address,
they will be able to just run fine.
However, that's not going to be true.
The amount of the work and attack which they are receiving will remain the same.
If you check the netstat or go and check browser,
you will still see the page still does not load.
This is because when we blocked one IP, at the same time,
other attackers adjusted their workload.
This particular behavior of auto‑adjusting of workload makes Slowloris more
preferred tool among its peers of impact methodology.
Even though target server has blocked one of the attackers,
still target server is not able to respond,
and you can see T1498 network denial‑of‑service in action.
Now let's go and remove our IP address from firewall.
As soon as we remove our IP address from firewall,
the server which we had blocked earlier now starts
sending keep‑alive headers once again.
Now, before we end this demo,
let's try one more time if we are able to load our Ubuntu default page.
Well, we are out of luck.
Distributed denial‑of‑service attack is very powerful on network
and will make your target server unresponsive.
With this, we conclude our demonstration.
In this module, we talked about MITRE ATT&CK tactics impact with Slowloris.
We particularly discussed about to tactics,
which is T1498, network denial‑of‑service,
and T1499, endpoint denial‑of‑service.
Now is the time to see some of the important resources
which can help you progress with Slowloris.