DDOS/DOS information

What is DoS Attack?
DoS is the acronym forDenial of Service. It is an attack that is aimed at either cutting off access to a resource such as a web site/app/service etc or making it extremely slow. This type of attack is usually implemented by hitting the target resource such as a web server with too many requests at the same time. This results in the server failing to respond to all the requests. The effect of this can either be crashing the servers or slowing them down.

Types of Dos Attacks
There are two types of Dos attacks namely;

•     DoS : this type of attack is performed by a single host
•     Distributed DoS : this type of attack is performed by a number of compromised machines that all target the same victim. It floods the network with data packets.

How DoS attacks work
Ping of Death
The ping command is usually used to test the availability of a network resource. It works by sending small data packets to the network resource. The ping of death takes advantage of this and sends data packets above the maximum limit (65,536 bytes) that TCP/IP allows. TCP/IP fragmentation breaks the packets into small chunks that are sent to the server. Since the sent data packages are larger than what the server can handle, the server can freeze, reboot, or crash.
Smurf
This type of attack uses large amounts of Internet Control Message Protocol (ICMP) ping traffic target at an Internet Broadcast Address. The reply IP address is spoofed to that of the intended victim. All the replies are sent to the victim instead of the IP used for the pings. Since a single Internet Broadcast Address can support a maximum of 255 hosts, a smurf attack amplifies a single ping 255 times.  The effect of this is slowing down the network to a point where it is impossible to use it.
Buffer overflow
A buffer is a temporal storage location in RAM that is used to hold data so that the CPU can manipulate it before writing it back to the disc. Buffers have a size limit. This type of attack loads the buffer with more data that it can hold. This causes the buffer to overflow and corrupt the data it holds. An example of a buffer overflow is sending emails with file names that have 256 characters.
Teardrop
This type of attack uses larger data packets. TCP/IP breaks them into fragments that are assembled on the receiving host. The attacker manipulates the packets as they are sent so that they overlap each other. This can cause the intended victim to crash as it tries to re-assemble the packets.
SYN attack
SYN is short form for Synchronize. This type of attack takes advantage of the three-way handshake to establish communication using TCP. SYN attack works by flooding the victim with incomplete SYN messages. This causes the victim machine to allocate memory resources that are never used and deny access to legitimate users.

DoS/DdoS attack tools

• Nemesy : this tool can be used to generate random packets. It works on windows. This tool can be downloaded from http://packetstormsecurity.com/files/25599/nemesy13.zip.html . Due to the nature of the program, if you have an anti virus, it will most likely be detected as a virus.
• Land and LaTierra :  this tool can be used for IP spoofing and opening TCP connections
• Blast : this tool can be downloaded from http://www.opencomm.co.uk/products/blast/features.php
• Panther : this tool can be used to flood a victim’s network with UDP packets.
• Botnets :  these are multitudes of compromised computers on the internet that can be used to perform a distributed denial of service attack.
• nmap
• #Refref : based on vulnerabilities in SQL database software that allow for injection attacks. Using an SQL injection, #RefRef forces a target server to use a special SQL function that repeatedly executes SQL expressions.
• R.U.D.Y(R U Dead Yet?) : user can create many simultaneous connections to the server, ultimately exhausting the server’s connection table and causing a denial of service condition.