WEBVTT 00:00:00.640 --> 00:00:01.030 Hi there. 00:00:01.030 --> 00:00:04.090 This is Pinal Dave, and I welcome all of you to this new course, 00:00:04.100 --> 00:00:05.730 Impact with Slowloris. 00:00:05.740 --> 00:00:06.420 In this course, 00:00:06.420 --> 00:00:09.990 we are going to talk about MITRE ATT&CK methodology and 00:00:09.990 --> 00:00:14.560 particularly focus on DoS attack and DDoS attack. 00:00:15.140 --> 00:00:16.960 Let us talk about Slowloris. 00:00:17.020 --> 00:00:19.750 If you search this word on the internet you will end 00:00:19.750 --> 00:00:22.420 up on this cute and cuddly animal. 00:00:22.650 --> 00:00:25.970 It is usually spotted in Southeast Asia. 00:00:25.980 --> 00:00:29.630 However, when we are talking about Slowloris impact tool, 00:00:29.640 --> 00:00:32.360 which we use in the red team engagement, 00:00:32.390 --> 00:00:38.150 the tool is very impactful when used for an attack on target. 00:00:38.540 --> 00:00:41.270 Let us learn a little bit more about Slowloris. 00:00:41.450 --> 00:00:44.000 This tool is created by Gokberk. 00:00:44.010 --> 00:00:46.470 Gokberk has done many different tools, 00:00:46.480 --> 00:00:50.860 and I have included the link to his website in our resources section. 00:00:51.240 --> 00:00:56.550 Slowloris is an HTTP denial‑of‑service attack that affects threaded servers. 00:00:56.790 --> 00:00:58.960 This exhausts the server's thread pool, 00:00:58.970 --> 00:01:01.950 and the server can't reply to other people. 00:01:02.540 --> 00:01:02.890 Now, 00:01:02.890 --> 00:01:08.560 let's understand why we should use Slowloris in our MITRE ATT&CK methodology. 00:01:09.040 --> 00:01:11.080 Slowloris is an impact tool. 00:01:11.340 --> 00:01:15.510 The impact methodology of MITRE ATT&CK consists of techniques to 00:01:15.510 --> 00:01:20.480 disrupt our ability or compromise integrity by manipulating 00:01:20.480 --> 00:01:23.370 business and operational processes. 00:01:23.370 --> 00:01:26.940 Essentially, a denial‑of‑service, or DoS, 00:01:26.940 --> 00:01:31.740 attack is used to consume website resources so that user who 00:01:31.740 --> 00:01:35.220 needs to access the site cannot access them. 00:01:35.220 --> 00:01:41.230 Because a DoS attack can be easily originated from nearly any location, 00:01:41.230 --> 00:01:44.860 finding those responsible can be extremely difficult. 00:01:45.540 --> 00:01:51.410 When multiple origins of DoS attack as a single endpoint as a target, 00:01:51.440 --> 00:01:57.660 the attack of DoS becomes DDoS, which is more effective and dangerous. 00:01:58.340 --> 00:02:01.550 The real question is that why should we use Slowloris? 00:02:01.690 --> 00:02:03.120 Well, the answer is, 00:02:03.130 --> 00:02:08.539 this tool generates a traffic and attack which is extremely difficult to 00:02:08.539 --> 00:02:12.250 differentiate from legit traffic for a target server. 00:02:12.250 --> 00:02:17.310 Here are three primary reasons which make Slowloris a very unique tool. 00:02:17.500 --> 00:02:21.370 The first one is that it keeps the connections open with target. 00:02:21.560 --> 00:02:26.250 The second one is that when it sends the traffic it can randomize user‑agent. 00:02:26.640 --> 00:02:31.090 And the third one is that we can adjust time to sleep between 00:02:31.100 --> 00:02:34.350 header which we send from attacker to target. 00:02:34.510 --> 00:02:36.750 Now is the time to discuss kill chain. 00:02:37.340 --> 00:02:39.830 If you are familiar with the red team kill chain, 00:02:39.840 --> 00:02:44.150 we can map the Slowloris tool to all the phases after reconnaissance. 00:02:44.540 --> 00:02:49.230 It actually focuses, making the server unresponsive by various actions, 00:02:49.230 --> 00:02:51.640 like manipulation and interruption. 00:02:51.940 --> 00:02:52.800 In real world, 00:02:52.810 --> 00:02:57.950 I've seen many using this tool as a distraction to the end user's security team. 00:02:58.340 --> 00:03:02.730 While the security team focuses on preventing the DDoS attacks, 00:03:02.740 --> 00:03:06.210 often there are other attacks happening in parallel, 00:03:06.220 --> 00:03:07.760 damaging a system. 00:03:08.440 --> 00:03:11.260 Here is the list of MITRE ATT&CK tactics. 00:03:11.300 --> 00:03:14.680 We are going to focus in this course about impact. 00:03:14.690 --> 00:03:16.440 When we are talking about impact, 00:03:16.450 --> 00:03:19.630 particularly we are going to focus on two tactics. 00:03:19.820 --> 00:03:24.650 The first one is T1498, which is Network Denial of Service, 00:03:24.770 --> 00:03:29.360 and the second one is T1499, Endpoint Denial of Service. 00:03:29.740 --> 00:03:35.260 Ultimately we are going to see the target is not going to serve legit user. 00:03:35.640 --> 00:03:38.920 Now, both of these we are going to explore in demonstration, 00:03:38.930 --> 00:03:44.250 but before we go to demonstration, we must understand that we must stay legal. 00:03:44.740 --> 00:03:48.330 I want you to keep in mind that performing any of those 00:03:48.340 --> 00:03:51.540 attacks without authorization is illegal. 00:03:51.580 --> 00:03:55.170 And this means that if you start such an attack on the 00:03:55.170 --> 00:03:57.960 server which eventually stops responding, 00:03:57.970 --> 00:04:00.230 it gets you in legal trouble. 00:04:00.310 --> 00:04:04.930 I can't stress enough that this tool and teaching is for you to learn what 00:04:04.930 --> 00:04:08.760 can worst happen to your server if someone attacks you. 00:04:09.140 --> 00:04:13.280 The learning from the course should be applied in such a way that 00:04:13.290 --> 00:04:16.880 it protects you during unwanted attack scenario. 00:04:17.010 --> 00:04:19.360 If you are working on a red team project, 00:04:19.370 --> 00:04:23.560 make sure that you have all the authorizations in place. 00:04:23.940 --> 00:04:28.240 Before we go to demonstration, let's understand how Slowloris works, 00:04:28.240 --> 00:04:32.400 as well as a legit request from a user to a web server. 00:04:32.400 --> 00:04:33.430 On the screen, 00:04:33.440 --> 00:04:36.310 I have a diagram when there is a normal computer which is 00:04:36.310 --> 00:04:39.590 sending HTTP header to a web server. 00:04:39.590 --> 00:04:43.430 Now web server processes this request and response is 00:04:43.430 --> 00:04:45.560 sent back to a normal computer. 00:04:45.940 --> 00:04:50.860 This will all work fine, and eventually web server will close the thread. 00:04:51.240 --> 00:04:54.260 This is happening every day when we are surfing the web. 00:04:54.640 --> 00:04:57.080 Let's assume that we do not have a normal computer, 00:04:57.080 --> 00:05:01.060 but there is a person with malicious intention and it 00:05:01.060 --> 00:05:04.530 uses Slowloris to attack our server. 00:05:04.540 --> 00:05:08.810 In normal case, we would have one or two threads from user. 00:05:08.820 --> 00:05:12.020 However, in case of Slowloris attack, by default, 00:05:12.030 --> 00:05:15.910 it sends around 150 HTTP headers. 00:05:16.140 --> 00:05:19.980 Now our target server would think this is absolutely normal 00:05:19.990 --> 00:05:22.330 and start processing each of these threads. 00:05:22.470 --> 00:05:26.360 The problem is that each of these HTTP headers are kept 00:05:26.360 --> 00:05:29.460 alive and resent at fixed intervals. 00:05:29.840 --> 00:05:33.310 This will further confuse our target server because it 00:05:33.310 --> 00:05:35.920 will keep on receiving HTTP headers, 00:05:35.930 --> 00:05:40.850 which are kept open and continuously keeping our server engaged. 00:05:41.340 --> 00:05:46.410 Every single threaded server has a limit of how many threads they can process. 00:05:46.470 --> 00:05:47.370 Eventually, 00:05:47.380 --> 00:05:51.190 our threaded server will give up when number of HTTP 00:05:51.190 --> 00:05:54.660 headers are more than what it can process. 00:05:55.040 --> 00:05:58.930 The final result will be that our server will stop responding, 00:05:58.930 --> 00:06:02.890 and this is when denial‑of‑service attack is successful. 00:06:02.930 --> 00:06:05.590 One final thing before we jump to demonstration. 00:06:05.740 --> 00:06:09.290 Currently on the diagram, we are seeing a single computer. 00:06:09.290 --> 00:06:13.960 When there are multiple computers from different locations and IP addresses, 00:06:14.040 --> 00:06:19.730 the same attack, which is DoS, becomes distributed denial‑of‑service attack. 00:06:19.930 --> 00:06:22.750 Well, now is the time for demonstration.