Metasploitable/Apache/Python - Revision history

Admin: /* Tor's Hammer Slow Body Attack */

2016-03-29T03:39:24Z

Tor's Hammer Slow Body Attack

← Older revision		Revision as of 03:39, 29 March 2016
Line 184:		Line 184:

	Tor's Hammer, in particular, provides a Python script that enables running the slow body attack through a web proxy like Tor, to provide anonymity. It also implements other disguising elements like a slew of User Agent headers.		Tor's Hammer, in particular, provides a Python script that enables running the slow body attack through a web proxy like Tor, to provide anonymity. It also implements other disguising elements like a slew of User Agent headers.

			See [[Metasploitable/TorsHammer]]

	=Command-Line Utility Attacks=		=Command-Line Utility Attacks=

2016-03-29T03:37:54Z

Tor's Hammer Slow Body Attack

@@ Line 150: / Line 150: @@
 ==Tor's Hammer Slow Body Attack==
-Tor's Hammer (https://sourceforge.net/projects/torshammer/) is a tool that uses the slow body attack to swamp Apache servers and cause a denial of service. Tor's Hammer, in particular, provides a Python script that enables running the slow body attack through a web proxy like Tor.
+Tor's Hammer (https://sourceforge.net/projects/torshammer/) is a tool that uses the slow body attack to swamp Apache servers and cause a denial of service. It does this by sending a POST request with a large declared content-length, then sending data one bit at a time.
 =Command-Line Utility Attacks=

2016-03-29T03:34:21Z

R U Dead Yet (RUDY) Attack

← Older revision		Revision as of 03:34, 29 March 2016
Line 147:		Line 147:

	This proof of concept code is in Python and uses BeautifulSoup to automatically search for forms: https://github.com/loganhasson/r-u-dead-yet		This proof of concept code is in Python and uses BeautifulSoup to automatically search for forms: https://github.com/loganhasson/r-u-dead-yet

			==Tor's Hammer Slow Body Attack==

			Tor's Hammer (https://sourceforge.net/projects/torshammer/) is a tool that uses the slow body attack to swamp Apache servers and cause a denial of service. Tor's Hammer, in particular, provides a Python script that enables running the slow body attack through a web proxy like Tor.

	=Command-Line Utility Attacks=		=Command-Line Utility Attacks=

2016-03-28T18:20:50Z

R U Dead Yet (RUDY) Attack

← Older revision		Revision as of 18:20, 28 March 2016
Line 146:		Line 146:
	The attack starts by browsing the target website and finding forms. RUDY then sends very long POST requests, and sends the large payload one byte at a time. The server won't kill the connection.		The attack starts by browsing the target website and finding forms. RUDY then sends very long POST requests, and sends the large payload one byte at a time. The server won't kill the connection.

	This proof of concept code uses BeautifulSoup to automatically search for forms: https://github.com/loganhasson/r-u-dead-yet		This proof of concept code is in Python and uses BeautifulSoup to automatically search for forms: https://github.com/loganhasson/r-u-dead-yet

	=Command-Line Utility Attacks=		=Command-Line Utility Attacks=

2016-03-28T18:20:40Z

R U Dead Yet (RUDY) Attack

← Older revision		Revision as of 18:20, 28 March 2016
Line 140:		Line 140:
	(This attack relies on POST requests. This means the site you are attacking must have a form.)		(This attack relies on POST requests. This means the site you are attacking must have a form.)

	https://www.incapsula.com/ddos/attack-glossary/rudy-r-u-dead-yet.html		Some background info on the RUDY attack: https://www.incapsula.com/ddos/attack-glossary/rudy-r-u-dead-yet.html

	~~https://github.com/loganhasson/r-u-dead-yet~~

	This type of DoS attack opens a few connections, and leaves them open for long periods of time. This will eventually exhaust the server's resources, although the slow speed of the attack means it "should" go undetected.		This type of DoS attack opens a few connections, and leaves them open for long periods of time. This will eventually exhaust the server's resources, although the slow speed of the attack means it "should" go undetected.

	The attack starts by browsing the target website and finding forms. RUDY then sends very long POST requests, and sends the large payload one byte at a time. The server won't kill the connection.		The attack starts by browsing the target website and finding forms. RUDY then sends very long POST requests, and sends the large payload one byte at a time. The server won't kill the connection.

			This proof of concept code uses BeautifulSoup to automatically search for forms: https://github.com/loganhasson/r-u-dead-yet

	=Command-Line Utility Attacks=		=Command-Line Utility Attacks=

2016-03-28T05:49:14Z

Slow Body (RUDY) Attack

← Older revision		Revision as of 05:49, 28 March 2016
Line 188:		Line 188:
	[[Image:SlowLoris_Relief.png\|500px]]		[[Image:SlowLoris_Relief.png\|500px]]

	===Slow ~~Body (RUDY)~~ Attack===		===Slow POST Attack===

	Not sure how this attack works without a form on the page being attacked, but somehow, it works.		Not sure how this attack works without a form on the page being attacked, but somehow, it works.

2016-03-28T05:42:13Z

SlowLoris DoS Attack

@@ Line 187: / Line 187: @@
 [[Image:SlowLoris_Relief.png|500px]]
 =Flags=
 {{MSFlag}}

2016-03-28T05:35:44Z

R U Dead Yet (RUDY) Attack

← Older revision		Revision as of 05:35, 28 March 2016
Line 137:		Line 137:

	==R U Dead Yet (RUDY) Attack==		==R U Dead Yet (RUDY) Attack==

			(This attack relies on POST requests. This means the site you are attacking must have a form.)

	https://www.incapsula.com/ddos/attack-glossary/rudy-r-u-dead-yet.html		https://www.incapsula.com/ddos/attack-glossary/rudy-r-u-dead-yet.html

2016-03-28T05:24:20Z

Kill Apache DoS

← Older revision		Revision as of 05:24, 28 March 2016
Line 135:		Line 135:

	However, the version of Apache on Metasploitable (2.2.8) is too old to be vulnerable to this exploit.		However, the version of Apache on Metasploitable (2.2.8) is too old to be vulnerable to this exploit.

			==R U Dead Yet (RUDY) Attack==

			https://www.incapsula.com/ddos/attack-glossary/rudy-r-u-dead-yet.html

			https://github.com/loganhasson/r-u-dead-yet

			This type of DoS attack opens a few connections, and leaves them open for long periods of time. This will eventually exhaust the server's resources, although the slow speed of the attack means it "should" go undetected.

			The attack starts by browsing the target website and finding forms. RUDY then sends very long POST requests, and sends the large payload one byte at a time. The server won't kill the connection.

	=Command-Line Utility Attacks=		=Command-Line Utility Attacks=

2016-03-28T03:33:22Z

Kill Apache DoS

← Older revision		Revision as of 03:33, 28 March 2016
Line 134:		Line 134:
	There is a Python version of this code here: https://github.com/MaYaSeVeN/KillApachePy		There is a Python version of this code here: https://github.com/MaYaSeVeN/KillApachePy

	However, the version of Apache on Metasploitable is too old to be vulnerable to this exploit.		However, the version of Apache on Metasploitable (2.2.8) is too old to be vulnerable to this exploit.

	=Command-Line Utility Attacks=		=Command-Line Utility Attacks=