‫Although it's not the subject of our cause because it's very common usage, I'd like to show you how
‫to perform an IP spoofed D.O.C. or denial of service attack using the Bing tool.
‫Going to attack my own server first, I'll testify, I can connect to the application.
‫So open a terminal screen and ping the application w WW Dot, OWASP, BW Accom.
‫OK, I have a connection through the application.
‫Open a browser and visit the website.
‫Here I click a few links to show the response time of the server.
‫Well, it's really fast, it responds as soon as I click on the links.
‫Now, let's prepare the shipping command to prepare a dos attack.
‫The first parameter of the command is Dash Flood.
‫You know what, let's run a ping three dash help in another terminal screen to see the meanings of the
‫parameters.
‫Flood parameter is used to send packets as fast as possible to make it a sin flood attack.
‫I said the sin flag using Dash s parameter when I send a sin packet.
‫Since it's a legitimate TCP handshake starter, the server will try to respond to all the packets at
‫the start of the TCP communication, so the server will be very, very busy.
‫Dash V is to open verbose mode.
‫That means we'd like to see the results of sent packets.
‫The next parameter is Rand Source, this parameter will randomize the source IP addresses as if they
‫are requested by different systems, so the attack is distributed denial of service now and since the
‫IP addresses are random, the victim doesn't know about you.
‫You have the target domain as a last parameter.
‫Oh, by the way, the order of the parameters is not important.
‫Hit enter to start the attack.
‫Now, because we're in flood mode, no replies have shown.
‫Let's try to click a few links to see the response time of the server while it's under attack.
‫Click a link.
‫It's waiting, waiting, waiting is obviously so down.
‫Maybe our request will be timed down.
‫So this is how a simple denial of service attack is performed.
‫I'll stop the flood by stopping the run of the command using Control C keys.
‫As you see, in less than a minute, we spent more than a million signed packets to the victim server,
‫no packets received because we randomized to source IP addresses of the packet.
‫That means the responses were sent to different IP addresses.
‫This is why we didn't receive any packets.
‫Since I stopped sending packets, the server is now responding in good time again.
‫Now, let's repeat the attack while Wireshark is running to see what's happening under the hood.
‫Start Wireshark, since we're using the eith zero interface of call.
‫I'll double click the eth0 on the home screen to start to listen to the traffic passing through the
‫E0 interface.
‫There's still some packets on the queue because of our previous attack.
‫I restart capturing by pressing the green button at the upper left corner of Wireshark to clean the
‫screen before the second attack.
‫Continue without saving.
‫OK.
‫Wireshark is running and clean.
‫We're ready to repeat the attack.
‫You can see the number of packets at the bottom of Wireshark, as you see we sent hundreds of thousands
‫of packets in seconds.