WEBVTT

00:00:01.140 --> 00:00:05.200
In the previous clip we learned about how DoS attack works with Slowloris.

00:00:05.320 --> 00:00:08.610
Now is the time to learn about distributed DoS attack.

00:00:08.700 --> 00:00:10.620
Let's see environment and setup.

00:00:10.620 --> 00:00:13.030
On the screen I have two sections.

00:00:13.030 --> 00:00:17.040
On the left side we have attackers, and on the right side we have target.

00:00:17.040 --> 00:00:20.980
On the left side, this time I have three different systems set up.

00:00:20.980 --> 00:00:22.850
On the top I have Kali Linux,

00:00:22.860 --> 00:00:27.070
and on the bottom I have two different Ubuntu instances.

00:00:27.070 --> 00:00:31.350
As you can see, the IP addresses of all three machines are different.

00:00:31.350 --> 00:00:34.260
And on the right side I have the same Ubuntu Linux

00:00:34.260 --> 00:00:36.750
machine which I've used in previous clip.

00:00:36.760 --> 00:00:41.970
It already has Wireshark installed in it and Apache server up and running.

00:00:41.970 --> 00:00:45.780
Lot of people often wonder why we should use Slowloris

00:00:45.870 --> 00:00:48.870
for MITRE ATT&CK tactics of impact.

00:00:48.920 --> 00:00:51.780
We will get a very clear answer in this demonstration.

00:00:51.780 --> 00:00:57.250
We'll be talking about network denial‑of‑service attack, which is T1498.

00:00:57.740 --> 00:01:00.980
I think it is a good time to start our Slowloris attack.

00:01:00.980 --> 00:01:03.530
This time, we'll be doing it with three different terminals.

00:01:03.530 --> 00:01:06.750
On the top over here I have a 300 socket,

00:01:06.760 --> 00:01:10.350
and sleeptime between sending header is 3 seconds.

00:01:10.510 --> 00:01:15.260
That means approximately around 3 seconds new 300 headers will be sent.

00:01:15.520 --> 00:01:17.750
Now, I've just started that attack.

00:01:18.240 --> 00:01:21.940
Has very similar setup, and it has 400 sockets,

00:01:21.940 --> 00:01:25.460
and sleeptime between sending headers is 4 seconds.

00:01:25.460 --> 00:01:29.260
The one on the right I have set up as 500 sockets and

00:01:29.260 --> 00:01:32.300
sleeptime of 5 seconds between sending headers.

00:01:32.400 --> 00:01:37.560
Now, all three of them are currently attacking via network to our target server.

00:01:37.940 --> 00:01:40.960
This time when we run netstat on our target server,

00:01:40.970 --> 00:01:44.450
we can see it says 636 threads.

00:01:44.550 --> 00:01:48.830
That means our Ubuntu right now is processing 336 threads.

00:01:48.830 --> 00:01:52.490
When we add up 300, 400, and 500,

00:01:52.610 --> 00:01:58.060
that means there are total 1200 headers we are sending from our attackers.

00:01:58.540 --> 00:01:59.250
However,

00:01:59.260 --> 00:02:02.970
our Apache server has reached its limit and not able to process

00:02:03.130 --> 00:02:06.090
any more threads and currently just failing,

00:02:06.090 --> 00:02:08.660
and you can see that in Wireshark.

00:02:08.660 --> 00:02:10.570
Now at this point of time,

00:02:10.580 --> 00:02:14.310
I want to show you a very interesting behavior of Slowloris tool.

00:02:14.550 --> 00:02:18.920
As you can see, Slowloris is running from three different Linux systems.

00:02:18.930 --> 00:02:21.760
However, the attack is pretty coordinated.

00:02:21.760 --> 00:02:25.110
When only Kali Linux was attacking a target,

00:02:25.150 --> 00:02:27.630
at that time it was sending 300 threads,

00:02:27.650 --> 00:02:31.160
but as soon as 2 other attackers came into the picture,

00:02:31.340 --> 00:02:33.060
entire attack was coordinated,

00:02:33.060 --> 00:02:38.150
and Kali Linux reduced its attacking threads to much lower number.

00:02:38.640 --> 00:02:41.100
Eventually, all three attackers worked together,

00:02:41.110 --> 00:02:43.560
even though they are different system.

00:02:43.940 --> 00:02:48.560
They distributed their attack based on what they find comfortable among them.

00:02:49.040 --> 00:02:52.010
Now the real trouble is on that target side.

00:02:52.010 --> 00:02:52.910
On target,

00:02:52.920 --> 00:02:55.760
it is very difficult to identify now from where

00:02:55.770 --> 00:02:58.410
exactly the attack is originating.

00:02:58.500 --> 00:03:02.280
Now we have different IP, as well as number of the header,

00:03:02.280 --> 00:03:04.960
and frequency is very different.

00:03:05.340 --> 00:03:08.100
Now let's assume the target server is very lucky,

00:03:08.110 --> 00:03:11.330
and they figured out IP address of one of the attackers.

00:03:11.470 --> 00:03:16.740
Let's see what happens when they block one of the IP addresses of attacker.

00:03:17.010 --> 00:03:20.450
The target server is hoping when they block this particular IP they

00:03:20.450 --> 00:03:23.080
will be able to load that web page just fine.

00:03:23.080 --> 00:03:25.590
However, Slowloris is way more intelligent.

00:03:25.590 --> 00:03:28.710
Just watch what happens when the IP is blocked.

00:03:28.720 --> 00:03:29.900
When IP is blocked,

00:03:29.900 --> 00:03:34.360
that particular Linux server will slowly send less active headers.

00:03:34.410 --> 00:03:38.610
This is because all the active headers which have connections are currently on,

00:03:38.620 --> 00:03:41.800
but it is not able to establish new connection.

00:03:41.800 --> 00:03:43.110
At the same time,

00:03:43.110 --> 00:03:46.340
other two attackers will seize the opportunity and will

00:03:46.340 --> 00:03:49.200
start sending more keep‑alive headers.

00:03:49.200 --> 00:03:51.330
Here the target is optimistic.

00:03:51.340 --> 00:03:54.540
Target is thinking that now they have blocked one IP address,

00:03:54.540 --> 00:03:56.570
they will be able to just run fine.

00:03:56.580 --> 00:03:58.760
However, that's not going to be true.

00:03:58.780 --> 00:04:02.850
The amount of the work and attack which they are receiving will remain the same.

00:04:03.040 --> 00:04:05.730
If you check the netstat or go and check browser,

00:04:05.750 --> 00:04:08.610
you will still see the page still does not load.

00:04:09.000 --> 00:04:12.330
This is because when we blocked one IP, at the same time,

00:04:12.340 --> 00:04:14.820
other attackers adjusted their workload.

00:04:15.240 --> 00:04:20.089
This particular behavior of auto‑adjusting of workload makes Slowloris more

00:04:20.089 --> 00:04:23.790
preferred tool among its peers of impact methodology.

00:04:23.960 --> 00:04:27.090
Even though target server has blocked one of the attackers,

00:04:27.100 --> 00:04:29.780
still target server is not able to respond,

00:04:29.780 --> 00:04:35.550
and you can see T1498 network denial‑of‑service in action.

00:04:36.140 --> 00:04:39.340
Now let's go and remove our IP address from firewall.

00:04:39.690 --> 00:04:42.400
As soon as we remove our IP address from firewall,

00:04:42.470 --> 00:04:45.420
the server which we had blocked earlier now starts

00:04:45.420 --> 00:04:47.730
sending keep‑alive headers once again.

00:04:48.040 --> 00:04:49.800
Now, before we end this demo,

00:04:49.850 --> 00:04:54.400
let's try one more time if we are able to load our Ubuntu default page.

00:04:54.400 --> 00:04:56.670
Well, we are out of luck.

00:04:56.670 --> 00:05:00.890
Distributed denial‑of‑service attack is very powerful on network

00:05:00.900 --> 00:05:03.780
and will make your target server unresponsive.

00:05:03.780 --> 00:05:06.240
With this, we conclude our demonstration.

00:05:06.240 --> 00:05:11.520
In this module, we talked about MITRE ATT&CK tactics impact with Slowloris.

00:05:11.630 --> 00:05:14.200
We particularly discussed about to tactics,

00:05:14.200 --> 00:05:17.250
which is T1498, network denial‑of‑service,

00:05:17.260 --> 00:05:20.170
and T1499, endpoint denial‑of‑service.

00:05:20.170 --> 00:05:23.600
Now is the time to see some of the important resources

00:05:23.610 --> 00:05:26.370
which can help you progress with Slowloris.