In this demo,
we're going to use LOIC to flood a network with a distributed attack.
We'll use Hive Mind to execute this network flood with commands from
the IRC channel we connected to in the last demo.
This enables us to simulate a distributed
denial‑of‑service attack in our lab environment.
Using these features in a lab allows you to simulate network flooding
attacks from multiple hosts using LOIC. Let's head over to the lab and get
started. Before we run the attack, let's try selecting a new target. Our
other host on the network has a few applications also hosted on port 80.
We can view them by navigating to the host by IP address again in our web
browser. This target is 10.0.0.101. Rather than targeting a specific
application,
we're going to simulate a network attack and just target the host
IP address using TCP. From our chat window, we can control the two
hosts by entering an exclamation point followed by the word lazor,
spelled L‑A‑Z‑O‑R in this case. You then enter all the properties
for the attack.
In our case, we would use target ip followed by the IP address
of our target host, in this case 10.0.0.101.
Next, we enter the message we want to send with all the packets.
I'm just going to put test, but you can put whatever you want in this space.
Then we select our port. I'm going to use 80.
We need the method, which we'll use TCP, and finally,
we'll set the wait value to false.
Let's go ahead and add the additional threads as well and set both hosts to 50.
Once we hit Enter, we can check LOIC on both machines, and we
notice that the configuration was updated remotely.
Before we start our attack, let's set up the TCP dump on
Metasploitable 3 to capture the traffic.
We can use vagrant ssh to log in again, and then start
a TCP dump using the same command.
Now we just go back to our IRC channel and we start the attack
using the lazor command followed by start. And immediately we see
a lot of packets coming into our host.
Let's check the web browser and see if we can still access the remote host.
Again, not much slow down because we have a lot of bandwidth on this network and
we're only attacking this with two hosts right now.
Normally in these type of attacks, there would be quite a few more.
To stop our attack, we use the same lazor command and follow it with
stop. Checking through our TCP dump, we can see a few examples of
both of our IP addresses attempting to connect numerous times to our
target host on port 80.
Although we didn't have enough hosts to conduct a wide enough attack
and really put stress on our network to make these applications fail,
we did succeed in the goals of this course,
which was to explore LOIC's features and conduct some simulated attacks
in our lab. For a quick recap of the course overall,
we reviewed the options available in the LOIC interface and conducted
an attack on a target from a single LOIC instance.
Once we conducted our first test,
we set up an IRC server, connected two LOIC instances using Hive Mind, and
conducted a second attack controlling both hosts simultaneously.
This completes the short course over Low Orbit Ion Cannon. In
the last clip, we'll discuss a few additional resources for
LOIC and then also talk about the other impact tools and
techniques that you can explore.