In this demo,
we're going to use LOIC to exhaust a service on one of our target hosts.
We're going to target a web application running on
port 80 on one of our target hosts.
We're also going to run a dump of the traffic and
observe it as it comes into our target.
The topics covered in this demo enable you to simulate an attempted
denial‑of‑service attack from a single host on a remote network.
Let's head over to our lab and get started.
For this demo,
we're going to attack the web server running on our Metasploitable 2 host.
The IP address for that host is 10.0.0.100,
and the web server is running on the standard HTTP port 80.
We already verified that we could ping this host when we set up the lab.
Let's explore the pages available to see what we can target specifically.
We have a few options for specific pages to attack.
There's a wiki page, phpMyAdmin,
which enables the administration of MySQL over the web,
utility Mutillidae, is a site vulnerable to SQL injection,
and the Damn Vulnerable Web Application,
DVWA.
For this demo, we'll target DVWA.
We can copy the web address, but even if we enter it in this URL field,
as soon as we hit Lock on, LOIC will resolve it to the IP address 10.0.0.100.
We could send a large number of packets to this IP; however,
from our single host, that's unlikely to have much impact. Instead, let's target
the DVWA app specifically. To do that, we need to add the rest of the path here
in Subsite. Before we can enter anything there,
we need to change our method from TCP to HTTP and then we can
check this box and add the path to DVWA.
Now that we've selected HTTP, we're also able to use the GET
method over here, but we're going to leave this unchecked and
use the POST method instead.
We'll leave everything else default for now.
Let's set up a TCP dump on our target and see if we can view the traffic coming
in. Just like before, we can log into Metasploitable 2 using vagrant ssh, and
again the password is vagrant. To run a TCP dump,
we type sudo tcp dump ‑i eth1, and Enter to start. You might see some
traffic coming in from your network or you may not,
your output might differ at this point. Once we have our TCP dump set up,
we're ready to start our attack. As we saw in the intro, this is the button
we hit. All right, now that our attack has begun and we can see the status
down here, let's head over to our host and check on that TCP dump. And we
can see a large amount of packets coming in. I'm going to go ahead and
navigate away from that.
If we go to our Firefox page, we'll notice that if we hit Refresh,
we have a little bit of a delay we didn't have before, but not much
performance impact other than that. We can log in to this app using the
username admin and password password, and here we can navigate to each of
these menus and we don't have any issues yet.
So our attack has not yet been effective.
Let's go ahead and stop the flooding on our host and see if we can
make changes to the attack to make it more effective.
We could increase our thread count to increase the number of simulated hosts.
Let's try increasing that from 10 to 50, and now we'll restart our attack.
Give it a minute to let some of these idle hosts connect.
Quick check of our TCP dump shows that's still going well. Going back here,
we're getting a little bit of a slowdown, but again,
nothing too significant.
Let's try to log in again, and we're still able to use
the web application as we expected.
Refreshing shows still minimal impact.
Let's go ahead and stop this attack again. A single instance of LOIC
isn't very effective at stopping an application from running or denying
network service, unless of course you have a lower amount of bandwidth.
On our test network that's running on basically a local LAN, we have
plenty of bandwidth and our application is able to handle this attack
from a single source. In the next demo, we're going to get set up to
connect two of these LOIC instances together in an IRC chat channel and
control them both and see if we can have a greater impact on our target.
For a quick recap, in this demo,
we selected a target application and used LOIC to attack the target over
HTTP. We modified the HTTP subsite and thread count to increase the
effectiveness of our attack on a single application.