WEBVTT 00:00:01.040 --> 00:00:01.950 In this demo, 00:00:01.960 --> 00:00:05.560 we're going to use LOIC to exhaust a service on one of our target hosts. 00:00:06.440 --> 00:00:09.090 We're going to target a web application running on 00:00:09.090 --> 00:00:11.260 port 80 on one of our target hosts. 00:00:12.040 --> 00:00:14.110 We're also going to run a dump of the traffic and 00:00:14.110 --> 00:00:16.149 observe it as it comes into our target. 00:00:17.040 --> 00:00:20.500 The topics covered in this demo enable you to simulate an attempted 00:00:20.500 --> 00:00:24.060 denial‑of‑service attack from a single host on a remote network. 00:00:25.040 --> 00:00:27.450 Let's head over to our lab and get started. 00:00:27.450 --> 00:00:28.950 For this demo, 00:00:29.020 --> 00:00:32.250 we're going to attack the web server running on our Metasploitable 2 host. 00:00:32.940 --> 00:00:36.200 The IP address for that host is 10.0.0.100, 00:00:36.200 --> 00:00:41.160 and the web server is running on the standard HTTP port 80. 00:00:41.840 --> 00:00:44.860 We already verified that we could ping this host when we set up the lab. 00:00:45.340 --> 00:00:49.150 Let's explore the pages available to see what we can target specifically. 00:00:50.540 --> 00:00:53.150 We have a few options for specific pages to attack. 00:00:53.840 --> 00:00:56.190 There's a wiki page, phpMyAdmin, 00:00:56.190 --> 00:00:59.460 which enables the administration of MySQL over the web, 00:01:00.240 --> 00:01:03.260 utility Mutillidae, is a site vulnerable to SQL injection, 00:01:03.840 --> 00:01:06.160 and the Damn Vulnerable Web Application, 00:01:06.200 --> 00:01:07.460 DVWA. 00:01:08.240 --> 00:01:10.720 For this demo, we'll target DVWA. 00:01:10.720 --> 00:01:15.960 We can copy the web address, but even if we enter it in this URL field, 00:01:16.440 --> 00:01:23.060 as soon as we hit Lock on, LOIC will resolve it to the IP address 10.0.0.100. 00:01:24.140 --> 00:01:27.390 We could send a large number of packets to this IP; however, 00:01:27.400 --> 00:01:32.710 from our single host, that's unlikely to have much impact. Instead, let's target 00:01:32.720 --> 00:01:38.430 the DVWA app specifically. To do that, we need to add the rest of the path here 00:01:38.430 --> 00:01:41.460 in Subsite. Before we can enter anything there, 00:01:41.470 --> 00:01:46.290 we need to change our method from TCP to HTTP and then we can 00:01:46.290 --> 00:01:49.960 check this box and add the path to DVWA. 00:01:51.440 --> 00:01:54.800 Now that we've selected HTTP, we're also able to use the GET 00:01:54.800 --> 00:01:58.410 method over here, but we're going to leave this unchecked and 00:01:58.410 --> 00:01:59.960 use the POST method instead. 00:02:00.840 --> 00:02:02.660 We'll leave everything else default for now. 00:02:03.440 --> 00:02:07.470 Let's set up a TCP dump on our target and see if we can view the traffic coming 00:02:07.470 --> 00:02:14.410 in. Just like before, we can log into Metasploitable 2 using vagrant ssh, and 00:02:14.410 --> 00:02:18.230 again the password is vagrant. To run a TCP dump, 00:02:18.240 --> 00:02:26.700 we type sudo tcp dump ‑i eth1, and Enter to start. You might see some 00:02:26.700 --> 00:02:29.190 traffic coming in from your network or you may not, 00:02:29.200 --> 00:02:33.660 your output might differ at this point. Once we have our TCP dump set up, 00:02:33.660 --> 00:02:38.060 we're ready to start our attack. As we saw in the intro, this is the button 00:02:38.060 --> 00:02:42.570 we hit. All right, now that our attack has begun and we can see the status 00:02:42.570 --> 00:02:48.480 down here, let's head over to our host and check on that TCP dump. And we 00:02:48.480 --> 00:02:51.170 can see a large amount of packets coming in. I'm going to go ahead and 00:02:51.170 --> 00:02:52.660 navigate away from that. 00:02:53.840 --> 00:02:57.620 If we go to our Firefox page, we'll notice that if we hit Refresh, 00:02:57.630 --> 00:03:01.090 we have a little bit of a delay we didn't have before, but not much 00:03:01.090 --> 00:03:05.250 performance impact other than that. We can log in to this app using the 00:03:05.250 --> 00:03:10.100 username admin and password password, and here we can navigate to each of 00:03:10.100 --> 00:03:12.750 these menus and we don't have any issues yet. 00:03:13.340 --> 00:03:15.950 So our attack has not yet been effective. 00:03:20.040 --> 00:03:22.800 Let's go ahead and stop the flooding on our host and see if we can 00:03:22.800 --> 00:03:25.350 make changes to the attack to make it more effective. 00:03:29.840 --> 00:03:33.890 We could increase our thread count to increase the number of simulated hosts. 00:03:34.540 --> 00:03:41.860 Let's try increasing that from 10 to 50, and now we'll restart our attack. 00:03:44.440 --> 00:03:47.350 Give it a minute to let some of these idle hosts connect. 00:03:50.940 --> 00:03:56.080 Quick check of our TCP dump shows that's still going well. Going back here, 00:03:56.080 --> 00:03:59.940 we're getting a little bit of a slowdown, but again, 00:03:59.940 --> 00:04:01.150 nothing too significant. 00:04:03.140 --> 00:04:08.160 Let's try to log in again, and we're still able to use 00:04:08.160 --> 00:04:10.660 the web application as we expected. 00:04:11.940 --> 00:04:14.760 Refreshing shows still minimal impact. 00:04:16.339 --> 00:04:21.360 Let's go ahead and stop this attack again. A single instance of LOIC 00:04:21.370 --> 00:04:25.060 isn't very effective at stopping an application from running or denying 00:04:25.060 --> 00:04:28.660 network service, unless of course you have a lower amount of bandwidth. 00:04:28.660 --> 00:04:33.400 On our test network that's running on basically a local LAN, we have 00:04:33.400 --> 00:04:36.770 plenty of bandwidth and our application is able to handle this attack 00:04:36.780 --> 00:04:41.360 from a single source. In the next demo, we're going to get set up to 00:04:41.360 --> 00:04:45.720 connect two of these LOIC instances together in an IRC chat channel and 00:04:45.720 --> 00:04:49.050 control them both and see if we can have a greater impact on our target. 00:04:50.540 --> 00:04:52.450 For a quick recap, in this demo, 00:04:52.460 --> 00:04:56.390 we selected a target application and used LOIC to attack the target over 00:04:56.390 --> 00:05:01.460 HTTP. We modified the HTTP subsite and thread count to increase the 00:05:01.460 --> 00:05:04.060 effectiveness of our attack on a single application.