Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing) « Null Byte :: WonderHowTo

Welcome back, my hackers novitiates!As you read myvarious hacking tutorials, you're probably asking yourself, "What are the chances that this hack will be detected and that I'll land behind bars, disappointing my dear mother who already thinks I'm a loser?"In this tutorial, I will try to answer that question by running an attack against a vulnerable system, but with anNetwork Intrusion Detection Systemin place monitoring for malicious traffic, i.e. you.We'll be usingSnort, the ubiquitous NIDS, to identify the attack and the attacker. Snort, having been purchased by the networking giant Cisco in 2013, is likely to continue its position as the world's most-widely used detection system. Using it here, we should get a good idea of how a security engineer at the victim company will view our remote exploits/hacks.If you're unfamiliar with Snort, take a look at my previous guides onevading an NIDS using Snortandreading and writing Snort rulesbefore continuing.Step 1: Open Up SnortSnort is built intoBackTrack, so there's no need to download and install. We simply need to start the Snort daemon (Services, then Snort) and then run Snort. We can start Snort with its configuration file by typing:bt > snort -vde -c /etc/snort/snort.confWhen we do so, Snort will begin sniffing traffic off the wire and analyzing it for signatures of malicious traffic.The Importance of Using a DoS AttackThe first attack we want to view through the eyes of the security engineer at Victim Inc., is the ever populardenial of service(or DoS) attack. The beauty of DoS attacks is that they are simple and relatively easy to perform. In addition, because you do not need a TCP connection and return traffic, you can spoof your IP address without any downside.Although the attacker will not gain any info or credit card numbers by performing a DoS attack, they can certainly do significant financial harm to the victim, especially to e-commerce sites. For instance, last year Amazon generated $70B in sales from their website. That works out to $192 million per day, or $8M every hour, and $133,181 for every MINUTE. To put it another way, a DoS attack against Amazon that is successful for JUST 10 minutes, would cost them $1.3 million!There are numerous tools on the market that can be used for DoS. In this case, we will use one of my favorite tools,hping3—a versatile tool that I refer to as a "packet crafting tool" because it enables us to basically create just about any type of packet we can imagine. If you aren't familiar with hping, check out my tutorial onconducting active recon on your target with hping3.Step 2: Use a SYN Flood Attack & Spoof Your IP AddressAmong the simplest DoS attacks is the SYN flood attack, which sends millions of TCP packets at the target with the SYN flag set, in essence, asking the system to establish a TCP connection. It never creates a TCP connection, so the server never logs the IP address (all successful connections are logged). It uses up all the bandwidth on the network as well as all the connection queue, so that new connections cannot be established.As for the target and the security engineer there, they will see the flood of SYN packets coming and trace the attack to the IP address on the packets, i.e. YOURS. To avoid this, hping enables us to spoof our IP address so that the flood appears to be coming from another IP. In this case, let's use Microsoft's IP address, so the attack appears to be coming from our friends at Microsoft.We can start a SYN flood with hping by typing:bt > hping3 -S -a 65.55.58.201 192.168.1.101 -p 80 --flood-Sis the packet flag type (SYN)-a= spoof the following address65.55.58.201is the spoofed IP address (Microsoft's)-p 80= the port to send the packets to--flood= send the packets as fast as you canHping in--floodmode won't show any returned packets, as it will just be way too many to display on the screen. In addition, since we spoofed Microsoft's IP address, any responses are going there.Step 3: Check the AlertsIf you still have the Snort terminal open, you're seeing thousands of packets going by. Let's stop Snort withControl C. When we do that, we'll see that Snort will display some statistics for us. If we scroll up a bit, we can see the number of alerts that were generated. I ran hping3 for just a few seconds and it generated 91 alerts on Snort.Now, let's open our Snort alerts file. This is the file that Snort generates to alert the security engineer of any malicious activity. We can use any text editor, but here I am simply going to usethe tail commandin Linux to see the end of the file. When you have large log or alert files, tail is perfect tool as it will only show the "tail" of the file (the most recent additions).To see the last 50 lines of the Snort alerts, I can type:tail -50 /var/log/snort/alertWhen we do, we will see several alerts that were triggered by our attack.Notice in the fourth line from the bottom that the alert references the appropriate Microsoft TechNet Security Bulletin, which in this case is MS01-059.Step 4: Reference Microsoft's Security BulletinsWe can now go toMicrosoft's Technet Bulletinsto see what Mr. Gates has to say about this attack. For more info on what the Technet Bulletins are, check out my guide onfinding the latest exploits and vulnerabilities directly from Microsoft.Below is a copy of the page for MS01-059.Note the highlighted area. It reads:"An attacker could specify a third-party server as the host for the device description in the NOTIFY directive. If enough machines responded to the directive, it could have the effect of flooding the third-party server with bogus requests, in a distributed denial of service attack. As with the first scenario, an attacker could either send the directives to the victim directly, or to a broadcast or multicast domain."Snort has classified our attack as a DoS attack. Although it appears to Snort that it might be a DDoS, it did a pretty good job of detecting our attack and notifying the security admin. Now when the admin attempts to trace the attack, it will take him directly to Microsoft.You're Safe from Detection!So, for now, you will avoid an extended stay in the concrete 8 by 8 foot room and save your dear mother from heartbreak, but she still kinda thinks you're a loser, albeit, a lovable one.Keep coming back, my hacker novitiates, formore Null Byte adventures, and make sure to keep tabs on my section onDigital Forensics for the Aspiring Hackerto stay up to date on recent forensics tutorials.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseDirty pig snoutimage via ShutterstockRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)News:What to Expect from Null Byte in 2015News:Why YOU Should Study Digital ForensicsHow To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:How to Evade a Network Intrusion Detection System (NIDS) Using SnortHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)News:Airline Offers Frequent Flyer Miles to HackersHack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHacking macOS:How to Create an Undetectable PayloadHow To:Why You Should Study to Be a HackerHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingLevitation Challenge:Evading Arrest