WEBVTT 00:00:01.240 --> 00:00:03.140 Now is the time for a demonstration. 00:00:03.340 --> 00:00:05.750 The first demonstration which we'll be seeing is about 00:00:05.760 --> 00:00:08.160 denial‑of‑service attack or DoS attack. 00:00:08.640 --> 00:00:10.450 For that, let's see the environment. 00:00:10.450 --> 00:00:14.220 The environment which I have set up is pretty straightforward. 00:00:14.230 --> 00:00:18.340 On the left side I have Kali Linux and on the right side I have Ubuntu. 00:00:18.470 --> 00:00:21.750 In Kali Linux, I have already configured Slowloris. 00:00:22.140 --> 00:00:24.540 In Ubuntu, I have configured Wireshark, 00:00:24.550 --> 00:00:29.250 which is for monitoring networks and already configured Apache servers. 00:00:29.640 --> 00:00:34.350 Now, on the screen, you can see the IP address of both of the Linux machines. 00:00:34.940 --> 00:00:37.310 In the Ubuntu server on the same IP address, 00:00:37.320 --> 00:00:42.290 I've configured Apache, so if you go to Firefox and type in the same IP address, 00:00:42.300 --> 00:00:45.760 you will see the default page of the Apache Ubuntu server. 00:00:46.640 --> 00:00:47.090 Also, 00:00:47.100 --> 00:00:49.980 if you want to see how many threats currently Apache 00:00:49.990 --> 00:00:53.410 is handling at port 80 or 443, 00:00:53.420 --> 00:00:56.390 you can run this netstat command and see the answer. 00:00:56.400 --> 00:00:57.650 Currently, it says 4. 00:00:58.840 --> 00:01:00.300 Now, go to Wireshark, 00:01:00.310 --> 00:01:03.890 and over here I have already provided a filter for Kali Linux. 00:01:03.900 --> 00:01:08.460 Currently, you will see no incoming traffic from Kali Linux. 00:01:09.140 --> 00:01:12.090 Now, let's see our Slowloris tool in action. 00:01:12.290 --> 00:01:14.030 The syntax is pretty straightforward. 00:01:14.090 --> 00:01:17.650 Type in Slowloris and the IP Address on which you want to attack. 00:01:17.660 --> 00:01:21.860 Here I have typed in Slowloris and the IP address of our Ubuntu server. 00:01:22.440 --> 00:01:23.530 Now, hit Enter, 00:01:23.540 --> 00:01:29.660 and as soon as you do that you will notice that it is creating 150 sockets. 00:01:30.040 --> 00:01:31.690 Once it creates those sockets, 00:01:31.700 --> 00:01:35.260 it starts sending keep‑alive headers to our target server. 00:01:35.940 --> 00:01:39.120 Let's go on the right side in our target server Ubuntu 00:01:39.140 --> 00:01:41.550 and start scrolling in our Wireshark. 00:01:41.560 --> 00:01:46.160 You will see from the source of Kali Linux lots of TCP 00:01:46.160 --> 00:01:48.730 traffic coming into our destination. 00:01:48.940 --> 00:01:52.620 This is because we have initiated a Slowloris attack. 00:01:52.630 --> 00:01:54.450 If you have a tool like Wireshark, 00:01:54.540 --> 00:01:57.730 you can easily figure it out from where you are getting 00:01:57.730 --> 00:02:00.260 traffic and where exactly it is going. 00:02:01.040 --> 00:02:02.410 Now, on the target server, 00:02:02.410 --> 00:02:05.960 go to the terminal and type in the netstat command multiple times. 00:02:06.090 --> 00:02:08.800 One of these times you will catch active keep‑alive 00:02:08.800 --> 00:02:11.190 header connections to the target server. 00:02:11.270 --> 00:02:17.660 You can see currently there are 153 active connections to our Apache server. 00:02:18.440 --> 00:02:18.830 Now, 00:02:18.830 --> 00:02:23.770 let's go to the Firefox browser and hit reload on our Ubuntu default home page. 00:02:23.810 --> 00:02:26.900 It will work just fine because the Apache server can 00:02:26.910 --> 00:02:30.560 easily handle around 150 active threats. 00:02:31.140 --> 00:02:35.460 Now, let's go back to our attacker server and stop the Slowloris attack. 00:02:36.240 --> 00:02:36.770 All right, 00:02:36.780 --> 00:02:41.590 now is the time to see Slowloris in action to do a denial‑of‑service attack. 00:02:41.600 --> 00:02:44.950 For that, let's type in slowloris, name of the IP address, 00:02:44.960 --> 00:02:46.630 and right following that, 00:02:46.640 --> 00:02:52.120 specify how many numbers of active threats you want to send to target. 00:02:52.130 --> 00:02:54.290 Here, I'm typing 900. 00:02:54.330 --> 00:02:58.760 Let's hit Enter and see our denial‑of‑service in action. 00:02:59.140 --> 00:03:00.670 Let's go to the target server. 00:03:00.670 --> 00:03:02.230 Over here, type in netstat. 00:03:02.230 --> 00:03:04.750 You will see 739. 00:03:04.800 --> 00:03:08.460 This means this many threats it has received from the attacker. 00:03:08.840 --> 00:03:12.030 Now let's jump to Firefox, and over here hit refresh. 00:03:12.030 --> 00:03:16.390 You will see Apache Ubuntu default page will not complete loading, 00:03:16.390 --> 00:03:19.360 it will never finish its task. 00:03:19.360 --> 00:03:23.230 Actually, it is denying legit user requests right now, 00:03:23.230 --> 00:03:27.120 and that is endpoint denial‑of‑service attack from 00:03:27.120 --> 00:03:30.140 MITRE ATT&CK practice number T1499. 00:03:31.540 --> 00:03:33.750 Now, let's stop our Slowloris attack, 00:03:33.760 --> 00:03:38.840 and as soon as we stop that in Firefox the Ubuntu default home page will load. 00:03:38.960 --> 00:03:42.980 This is because now the server is available to serve legit users. 00:03:42.990 --> 00:03:43.790 So far, 00:03:43.790 --> 00:03:47.120 what we have seen is a straightforward denial‑of‑service attack 00:03:47.130 --> 00:03:50.150 from attacker to target from a single terminal. 00:03:50.210 --> 00:03:50.690 Now, 00:03:50.700 --> 00:03:54.750 if you have a network analyzer or any tool which can analyze 00:03:54.750 --> 00:03:57.520 your traffic or any advanced firewall, 00:03:57.530 --> 00:04:00.760 you can easily detect from where actually the attack is 00:04:00.760 --> 00:04:03.960 coming and you can block that particular IP. 00:04:04.040 --> 00:04:08.510 Now that is a very unique scenario, but with the help of the Slowloris tool, 00:04:08.520 --> 00:04:12.040 we can keep on generating impact from attacker to 00:04:12.040 --> 00:04:14.500 target and let's see how we can do that. 00:04:14.510 --> 00:04:19.360 But first, let's learn a lesson on how we can block attacks of Slowloris. 00:04:20.040 --> 00:04:22.300 Let's go back to the attacker and type in the same 00:04:22.300 --> 00:04:24.330 command which we have typed in before. 00:04:24.380 --> 00:04:28.350 This time, also we are generating 900 keep‑alive headers. 00:04:28.740 --> 00:04:30.540 Now, when we go to Wireshark, 00:04:30.550 --> 00:04:34.460 you can see all the traffic is coming from a single IP address. 00:04:34.500 --> 00:04:35.720 As I mentioned to you, 00:04:35.730 --> 00:04:40.100 with the help of Wireshark or any other similar traffic analysis tool, 00:04:40.140 --> 00:04:43.690 you can figure it out where actually the attack is coming. 00:04:43.740 --> 00:04:49.160 We can go to the Linux firewall and block the IP address of our attacker. 00:04:49.940 --> 00:04:53.870 First, we will enable our firewall, and if the firewall is enabled, 00:04:53.900 --> 00:04:58.850 the next thing which we will do is type in the command to block our IP address. 00:04:59.240 --> 00:05:02.560 We just blocked our IP address of Kali Linux. 00:05:03.040 --> 00:05:03.420 Now, 00:05:03.430 --> 00:05:05.760 let's go to Wireshark and you will see it is 00:05:05.760 --> 00:05:08.720 continuously refusing all the connection. 00:05:08.830 --> 00:05:10.500 If we go back to netstat, 00:05:10.510 --> 00:05:14.350 we will also notice that the connection number is now reducing. 00:05:14.360 --> 00:05:20.260 On the left side in attacker, at one point in time we had 900 active threats, 00:05:20.350 --> 00:05:25.660 now that is decreasing to 686, and it will continue to decrease. 00:05:26.140 --> 00:05:29.560 Netstat now shows 240 active connections, 00:05:29.570 --> 00:05:34.960 whereas Kali Linux is showing us 461 connections. 00:05:35.440 --> 00:05:37.170 Let's go to Firefox one more time, 00:05:37.180 --> 00:05:40.260 and this time you can successfully load the web page 00:05:40.270 --> 00:05:42.550 because there is actually no attack. 00:05:42.940 --> 00:05:46.480 All the headers which were alive before are now getting 00:05:46.490 --> 00:05:49.660 expired or are resetting themselves. 00:05:50.040 --> 00:05:53.130 That's why the load on the server is continuously reducing 00:05:53.140 --> 00:05:56.160 and we can operate the server normally. 00:05:56.640 --> 00:05:59.640 The reason I'm showing you this demonstration is to explain to 00:05:59.640 --> 00:06:02.810 you a very unique characteristic of Slowloris. 00:06:02.930 --> 00:06:09.120 Slowloris is aware of how many active threats are going on on an Apache server 00:06:09.120 --> 00:06:12.450 as the number of threats decreasing on the Apache server, 00:06:12.460 --> 00:06:16.100 a similar number reflects also on a Slowloris terminal. 00:06:16.190 --> 00:06:21.410 This is very helpful and important because if our target server has 00:06:21.410 --> 00:06:25.500 closed any port or has somehow mitigated our attack, 00:06:25.510 --> 00:06:30.440 we will get that feedback immediately and we can change our tactics. 00:06:30.660 --> 00:06:33.030 Slowloris is very unique in this regard, 00:06:33.040 --> 00:06:37.000 and that's why it is the favorite of many of the red tool experts, 00:06:37.010 --> 00:06:39.460 as well as some not‑so‑good people. 00:06:40.040 --> 00:06:44.690 Now, in this situation, we should actually switch to DDoS attack, 00:06:44.700 --> 00:06:46.960 but that we will see in the next demonstration. 00:06:47.540 --> 00:06:48.470 For the moment, 00:06:48.480 --> 00:06:51.820 let's remove the entry from our firewall and see what 00:06:51.830 --> 00:06:54.590 happens to our Slowloris attacking terminal. 00:06:54.600 --> 00:06:57.270 Here, I remove our firewall entry. 00:06:57.270 --> 00:07:02.030 Now, once again, Slowloris can continue attacking our Apache server. 00:07:02.040 --> 00:07:02.420 Here, 00:07:02.420 --> 00:07:05.660 you can see in Wireshark that once again there is 00:07:05.660 --> 00:07:08.260 traffic coming in from our Kali Linux. 00:07:08.440 --> 00:07:13.360 Also, when we go to netstat, we can see a very high number of connections. 00:07:13.840 --> 00:07:16.300 The next thing is to go to our Firefox browser, 00:07:16.310 --> 00:07:19.840 and over here, once again, we cannot load the page. 00:07:19.870 --> 00:07:23.340 This means our denial‑of‑service attack is back in action 00:07:23.350 --> 00:07:25.660 as we have removed the firewall entry. 00:07:26.040 --> 00:07:28.010 Let's go back and stop our attack. 00:07:28.020 --> 00:07:31.650 And there we go, now the world is perfect as it was before. 00:07:32.140 --> 00:07:37.650 This concludes our demonstration of T1499 endpoint denial‑of‑service attack. 00:07:37.670 --> 00:07:38.790 In the next demonstration, 00:07:38.800 --> 00:07:42.660 we will see how the distributed denial‑of‑service attack happens, 00:07:42.670 --> 00:07:47.950 and at that time, we will also discuss about T1498 network denial‑of‑service.