Phoenix Network Forums

who is capable of ddosing?
is thier a way of countering if you are being ddos?

What do you mean?I didn't undarstand anything.

DDoS is Distributed Denial of Service Attacks.

Essentially its a whole lot of hosts sending alot of data to a target host causing it to overload/deplete network space/etc.

Anyone who has more than 1 host could do so, however being illegal, it is generally only done by hosts which have been "taken over". These actions are genereally also associated with "botnets".

You can't stop DDoS persay, however its not overly difficult to filter it (which generally involves just dropping packets from offending hosts). There are actually commercial devices that you can place between your connection to the internet and your local network which identify DDoS style attacks based off massive rulesets and reject them without user interaction.

Who can DDoS? Anyone that knows how... how can you counter it? You can drop packets like said before. Normally a decent ISP would filter DDoS attacks on a "client" "normal" "home user".

I have a question though... you don't seem know how to detect it if it takes place, so why exactly do you ask this?

packet the same as nuking isnt it?

I have a question though... you don't seem know how to detect it if it takes place, so why exactly do you ask this?

i was wondering if i were being nuked or ddos b4, bcoz i always get disconnect in the internet for a long time.

Is this for your home computer or a web server?

DDoS attack suppression is normally handled by the colocation facility or carier grade ISP. There are verious systems that can be used to detect and filter DDoS packets http://www.mazunetworks.com/ sells one. Also, if a residential ISP detects that one of its customer's computers is being used for such an attack it will typically drop that customer temporarily.

It sounds however that you are talking about your home computer. In this case what could very likely be happening is that your computer has been comprimized and is being used as the source for DDoS attacks (not the target). I think it is extreamly unlikely that someone would go through the trouble of setting up a DDoS to target your desktop.

I suggest getting running an anti spyware program and contacting your ISP to see if they know why your connection keeps dropping.

-Selket

I also suggest to get a packet sniffer and sniff your interface traffic. That way you would know if you are used as source or as target. If you send alot of packets you are not supposed to, it means you've been compromised. If you recieve alot you are the target. Also, if you are used as source you can identify the IP who issued the attack, then filter it and it all stops. If you are used as target keep in mind that if you have a low bandwidth connection (like Dial-up) you can be disconnected by just a simple denial of service. If this is the case be very carefull because some attacks can even fry some older modems (maybe new ones too?).

Cheers!

Just to mention, droping incoming packets will not save you from big bandwidth load, just from procesing of it.

Shadowed wrote:Just to mention, droping incoming packets will not save you from big bandwidth load, just from procesing of it.

Shadowed is right. That means you need to contact your ISP about getting the excess traffic filtered out at their end of your Internet link. This is useful because generally ISPs have big Internet connections, which may not be fully saturated by the DDOS attack, but your residential link may be completely filled by the attack.

See http://www.grc.com/dos/grcdos.htm for an example of a DDOS attack and how to mitigate it.

I can't remember if GRC mentions it there, but if you have thousands of sources, like a really big botnet, and they all fake the source addresses on the packets they send, it's unreasonably hard to track them all down. From what I can tell, as the victim your only choice is to get your ISP to stop the attack clogging your link, and then wait out the storm, so to speak.

Something to keep in mind when dealing with flooding attacks against residential Internet links is that many people pay a fee for excess data downloaded. Flood packets count towards any download limits. So in Australia at least, this means that you can DDOS a Telstra Cable customer to ramp up a huge data bill for them. On other providers, you can force the "download counter" up enough to make the ISP cap their broadband Internet to dial-up speed. A complaint from the customer might make their ISP waive the excess usage fees, but they will still get the scare of a lifetime when they open a $7,000 Internet bill.

The attacker could even ring them up and say, "We've detected an unusal amount of usage, could you please verify your identity so that we can check out your account and see if we can waive some charges?" But that would be social engineering, not to mention thinking too much.

-pcweirdo.

In any event, dropping packets is the first thing to do (imo) considering all the types of DDoS out there. This way you prevent your CPU from processing large amounts of fragmented packets, so you prevent a machine crash. Until the problem is inspected and categorised, it may be the case of a combined DDoS attack, with fragmented/SYN flood/ICMP flood packets. Log any abnormal traffic to be able to sue the ISP, or to defend yourself if sued. Apart from that I see now way to escape large bills.

PS: IMO DDoS wasn't invented to make its victims go broke, though it can be used for that if you know the ISP a user has (not hard to find out most of the time) and if that particular ISP charges for bandwidth usage. Keep in mind that many ISP have more than one type of offer.

PS2: Also I don't know of any 'home users' being DDoS-ed, as this is very unlikely. A hacker DDoS-es (usually) boxes that he can't hack. So a home computer is of no real interest, as many many others are vulnerable and easy to hack. Unless, ofcourse, he has a personal vendetta, it is unlikely that that will happen.

my question is . suppose we have a botnet. then how we can send packets tp specific ip and how we can make botnet capable of ddos , do i need any specific software or script.
please can any body send me the config file of eggdrop so i wanna load my eggdrop
cheer up bye

...

Somehow, I can't help but think that your message is coming very close to being in violation of TOS and possibly several laws inside and outside the US. Anyhow, these scripts are widely available all over the internet, you need not ask here.

slave, I am somewhat perturbed by this blunt request for a script kiddy tool. However, in my limited capacity as a non-expert, I can point you towards
* http://tangentsoft.net/wskfaq/advanced.html#rawsocket and http://tangentsoft.net/wskfaq/advanced.html#pktheader
- While this code relates to Winsock, searching Google for some of the socket option names might yield something for Linux or BSD, though I can only guess that your botnet would live on Windows hosts.

* http://www.uni-giessen.de/faq/archiv/in ... 00000.html looks somewhat relevant. It seems (at a glance) to be a raw sockets guide for *nix.

* I recommend #hackthissite on irc.hackthissite.org:7000 (secure IRC) for people like you. The people there are somewhat experienced at answering such questions.

I had a friend who spent far too much time on IRC. One of the things he became involved in was portscanning for a botnet operator. What my friend, who we'll refer to as "Ivan" to protect his identity, would do is use the portscanner the botnet operator gave him to scan IP blocks finding things like blank admin passwords, unpatched systems, basically anything vulnerable-looking. The botnet operator would then take Ivan's list of targets and add them to his botnet. The story loses credibility when Ivan tells how the botnet took down Steam for a short time, but the strategy of systematically portscanning for vulnerable hosts is valid.

-pcweirdo.

slave (in a PM) wrote:the server you told irc.hackthissite.com isn't working
when i try to coneect it shows the message that software caused connection abort. so tell me whts wrong with it and do you know some other resourse or links about ddos . please tell me and about scripts too that can be usefull with eggdrop, psybnc,botnet and ddos .

waiting for your reply

cheer up
bye

Hi slave,

Check out http://www.hackthissite.org/pages/irc/ssl.php for some information regarding connecting to HackThisSite's secure IRC server. Also on that website are articles about various topics; you might find something about DDOS there.

Unfortunately, I can't help you out with DDOS scripts, since I don't have any. However I can tell you that an eggdrop script will not help you launch DDOS attacks, unless you're planning on running an eggdrop on the "zombie" computer. It is generally unwise to ask for a solution using a specific application or platform in this kind of context; you are better off asking about DDOS in general and then finding out what tools to use.

http://www.findarticles.com/p/articles/mi_zdewk/is_200201/ai_ziff20762/pg_2 wrote:"Eggdrop is a pretty popular bot because it seems to be one of the easier ones to configure," said Dave Dittrich, senior security engineer at the University of Washington, in Seattle, and a widely recognized authority on DDoS attacks. "It's not used much in attacks. If he was looking to use it for an attack, putting that many bots on one network isn't the smartest way to do it. You would lose the whole network rather easily if the company finds the problem, which they did."

You would be better off finding or making your own trojan that is specifically designed for your needs.

Sub7 is a fairly full-featured beast, or so it claims to be, which will probably do the job for you (if it isn't too buggy). The problem with Sub7, as with any publicly-available tool of this kind, is that anti-virus programs will detect it. BO2K (Back Orifice 2000) might be handy for you, though I haven't personally used it.

You are much better off coding your own trojan in, say, C, or even Visual Basic. I recommend starting off learning about sockets (Winsock on Windows platforms), and if you feel really fancy you could work on a rootkit. Some other suggestions are to hide your trojan as "explorer.exe", "System Idle Process" (if possible), or make your trojan dynamically pick a name (this is harder to pick out from the victim's point of view; IIRC the Wank worm did this). And for the love of cream pie, if you're trying to force a website off the Internet, have your botnet attack a domain name, not an IP address. You can also use traceroute to attack routers both inside and outside the target's network gateway.

Apparently there are 3.6 million remote-controlled trojans out there. /Only/ 3.6 million. So get cracking and in no time you'll own the Internet.

Some more info can be found at
* http://en.wikipedia.org/wiki/Ddos
* http://en.wikipedia.org/wiki/Sub7
* http://hackpr.net/~sub7/main.shtml
* http://en.wikipedia.org/wiki/BO2K
* http://www.dos-attacks.com/index.php?op ... &Itemid=12

Also, read the 'Stealing the Continent' books for some good ideas; it might not specifically be about DDOS, but it might help with your adventures in general.

Really, I'm probably missing the point here. Am I correct in thinking that your goal here is to use a DDOS to knock someone off the Internet?

Yours,
-pcweirdo.

PS. Check out http://www.catb.org/~esr/faqs/smart-questions.html,
which can be partially summarised as: "RTFM! STFW! TLDR? GTFO!"

PPS edit: Another problem you will run into is when the "white hats" (which, for now, I'll use as a collective term for security analysts, anti-virus software vendors, and the police) dissect your trojan and see how it works. They can then shut down your means of commanding the botnet, whether that be an IRC channel or a listening port on the bot. Often botnets are connected in such a way that professional analysis allows the white hats to follow a trail around your botnet and dismantle it.

However, I have been thinking about a few ways to make your botnet very robust. Here are some ideas:
* Use IP packets with fake source addresses to control bots. This would prevent anyone tracking you down as the botnet operator.
* Use a public space like myspace, Wikipedia, or (even better) some kind of government website that allows anyone to add any kind of content. Have the bots check those places regularly for new orders. The white hats would have to shut down the website provider, or implement inconvenient countermeasures, to stop you.
* A variation on the previous idea is to give the bots instructions to trawl the Internet, perhaps through portscans, Google, or random IRC servers, for new orders. Just make sure that the white hats can't post their own orders to tell the botnet to shut down.
* Asymetric public-key encryption will allow the bots to verify orders from you, mitigating the white hats' efforts to post their own commands.
* Use onion-routing, or any relevant anonymous peer-to-peer filesharing technology, to hide the bots (and your) locations and intentions.
* Implement a time-bomb DDoS attack against some target, so that even if your command mechanisms are cut off, your botnet will still cause damage. The Windows update site might be a fun target, but that has done before.

buddy tell me how can i find ssl for window xp and how can i install it and how can i install
please in detail
i m waiting for your answer