WEBVTT

00:00:00.740 --> 00:00:01.280
Hello.

00:00:01.290 --> 00:00:05.810
I'm Matt Glass, and welcome to this course on Impact with Low Orbit Ion Cannon,

00:00:05.820 --> 00:00:06.860
or LOIC.

00:00:07.340 --> 00:00:11.670
In this course, I'll show you how to use LOIC to send large volumes of TCP,

00:00:11.680 --> 00:00:15.860
UDP, and HTTP packets to target hosts and services.

00:00:16.340 --> 00:00:18.830
You'll also learn how to control multiple hosts running

00:00:18.830 --> 00:00:21.350
LOIC to execute distributed attacks.

00:00:22.240 --> 00:00:25.860
But first, let's look at what LOIC is and how it's used.

00:00:26.740 --> 00:00:30.120
Low Orbit Ion Cannon is an open source network stress tool

00:00:30.130 --> 00:00:32.560
originally created by Praetox Technologies.

00:00:33.240 --> 00:00:35.630
This tool is available on GitHub and is currently

00:00:35.630 --> 00:00:37.460
managed by multiple contributors.

00:00:38.440 --> 00:00:41.110
LOIC is designed to send a large volume of packets

00:00:41.120 --> 00:00:45.160
targeted at a host domain name, website or IP address.

00:00:45.940 --> 00:00:48.610
You can download versions of this tool from GitHub or

00:00:48.610 --> 00:00:50.800
clone the repository using Git.

00:00:50.800 --> 00:00:54.660
Once loaded on your host, LOIC is very easy to operate.

00:00:55.340 --> 00:00:59.480
You can also connect LOIC to an IRC channel using Hive Mind mode and

00:00:59.480 --> 00:01:02.470
control numerous instances with single commands.

00:01:02.470 --> 00:01:08.190
On the kill chain, LOIC falls under action, the impact phase of an attack.

00:01:08.190 --> 00:01:12.320
It is not used for any previous phase as it does not allow you to

00:01:12.320 --> 00:01:15.830
discover vulnerabilities or gain access to a network.

00:01:15.830 --> 00:01:19.780
LOIC is a single‑purpose tool for conducting denial‑of‑service and

00:01:19.780 --> 00:01:22.560
distributed denial‑of‑service attacks on your targets.

00:01:23.540 --> 00:01:26.640
The ATT&CK knowledge base developed by MITRE categorizes

00:01:26.640 --> 00:01:30.220
adversary tactics and techniques into multiple categories to

00:01:30.220 --> 00:01:31.960
describe the adversary's behavior.

00:01:32.840 --> 00:01:36.230
The tactics are categories that cover different phases of an

00:01:36.230 --> 00:01:39.990
attack and allow defensive teams to model an adversary's actions

00:01:40.000 --> 00:01:42.160
and improve the defense of their networks.

00:01:43.040 --> 00:01:45.560
We'll cover two techniques that LOIC can be used for.

00:01:45.560 --> 00:01:48.090
The first is service direct network flood,

00:01:48.180 --> 00:01:51.450
which is a sub‑technique of the network denial‑of‑service technique.

00:01:52.340 --> 00:01:54.700
The second is service exhaustion flood,

00:01:54.810 --> 00:01:58.060
which is a sub‑technique of the endpoint denial‑of‑service technique.

00:01:59.540 --> 00:02:02.680
Low Orbit Ion Cannon can accomplish this by enabling

00:02:02.680 --> 00:02:05.880
adversaries to quickly and easily deploy a tool that sends

00:02:05.880 --> 00:02:07.960
large volumes of packets at their target.

00:02:08.740 --> 00:02:13.050
They could use a single instance of LOIC to send traffic to a target and

00:02:13.050 --> 00:02:17.700
attempt to impact their performance of that network or service. Adversaries

00:02:17.700 --> 00:02:22.080
could also connect multiple LOIC instances together using Hive Mind and

00:02:22.080 --> 00:02:24.160
have a far greater impact on targets,

00:02:24.640 --> 00:02:29.460
denying legitimate use of the application, host or network to its users.