DoS test on specific TCP Port

[Shankar Arjunan]

Dear All,
 
I am performing a pentest on server, can anyone tell me if there is any script or tool or a method available to test a specific TCP port (eg: 1310) for server load test by doing DoS/DDoS type attacks.  This is to check how the server responds for attack on specific port, any possibilities of server going down or to check any degrade of performance.
 
Please advice.
 
Regards
Shankar

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Benjamin Greenfield]

You can try using hping3 to send out all sorts of traffic in all kinds
of different frequencies and bursts.   However, the first thing you
should do is verify with your client that they consent to you trying a
DoS attack.  Depending on application / service / OS is connected to
that port there may be particular vulnerabilities and / or exploits
that result in DoS conditions as well.

As far as determining the effectiveness of the attack, you'd need to
log all the incoming responses and evaluate them I suppose.  I would
expect subtle differences would account for things like an IPS
blacklisting your IP versus the host actually going offline or slowing
due to load, and depending on the specifics it may not actually be
possible to determine what precisely occurred target-side happened.

Seriously, verify that the client wants you to test a DoS first though...


On Thu, Jul 16, 2009 at 9:18 PM, <shankar.arjunan@...> wrote:

> Dear All,
>
> I am performing a pentest on server, can anyone tell me if there is any script or tool or a method available to test a specific TCP port (eg: 1310) for server load test by doing DoS/DDoS type attacks.  This is to check how the server responds for attack on specific port, any possibilities of server going down or to check any degrade of performance.
>
> Please advice.
>
> Regards
> Shankar
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Shenk, Jerry A]

A new tool for me is scapy...with some scripting, you can send all kinds of odd stuff.

-----Original Message-----
From: Benjamin Greenfield <bcg@...>
Sent: Friday, July 17, 2009 4:45 PM
To: shankar.arjunan@... <shankar.arjunan@...>
Cc: pen-test@... <pen-test@...>
Subject: Re: DoS test on specific TCP Port

You can try using hping3 to send out all sorts of traffic in all kinds
of different frequencies and bursts.   However, the first thing you
should do is verify with your client that they consent to you trying a
DoS attack.  Depending on application / service / OS is connected to
that port there may be particular vulnerabilities and / or exploits
that result in DoS conditions as well.

As far as determining the effectiveness of the attack, you'd need to
log all the incoming responses and evaluate them I suppose.  I would
expect subtle differences would account for things like an IPS
blacklisting your IP versus the host actually going offline or slowing
due to load, and depending on the specifics it may not actually be
possible to determine what precisely occurred target-side happened.

Seriously, verify that the client wants you to test a DoS first though...


On Thu, Jul 16, 2009 at 9:18 PM, <shankar.arjunan@...> wrote:

> Dear All,
>
> I am performing a pentest on server, can anyone tell me if there is any script or tool or a method available to test a specific TCP port (eg: 1310) for server load test by doing DoS/DDoS type attacks.  This is to check how the server responds for attack on specific port, any possibilities of server going down or to check any degrade of performance.
>
> Please advice.
>
> Regards
> Shankar
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------


**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Shankar Arjunan]

Hi Benjamin / All,

Thank you all for the responses.

It is for an inhouse application which is going to be live soon, before
going live thought of doing a stress test on specific port for DoS type
attacks and see the outcomes.

I will use hping and do a test.

Regards
Shankar
----- Original Message -----
From: "Benjamin Greenfield" <bcg@...>
To: <shankar.arjunan@...>
Cc: <pen-test@...>
Sent: Saturday, July 18, 2009 5:56 AM
Subject: Re: DoS test on specific TCP Port


You can try using hping3 to send out all sorts of traffic in all kinds
of different frequencies and bursts.   However, the first thing you
should do is verify with your client that they consent to you trying a
DoS attack.  Depending on application / service / OS is connected to
that port there may be particular vulnerabilities and / or exploits
that result in DoS conditions as well.

As far as determining the effectiveness of the attack, you'd need to
log all the incoming responses and evaluate them I suppose.  I would
expect subtle differences would account for things like an IPS
blacklisting your IP versus the host actually going offline or slowing
due to load, and depending on the specifics it may not actually be
possible to determine what precisely occurred target-side happened.

Seriously, verify that the client wants you to test a DoS first though...


On Thu, Jul 16, 2009 at 9:18 PM, <shankar.arjunan@...> wrote:

> Dear All,
>
> I am performing a pentest on server, can anyone tell me if there is any
> script or tool or a method available to test a specific TCP port (eg:
> 1310) for server load test by doing DoS/DDoS type attacks. This is to
> check how the server responds for attack on specific port, any
> possibilities of server going down or to check any degrade of performance.
>
> Please advice.
>
> Regards
> Shankar
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review
> Board
>
> Prove to peers and potential employers without a doubt that you can
> actually do a proper penetration test. IACRB CPT and CEPT certs require a
> full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Shawn Merdinger]

Hi Shankar,

You might consider looking into the following tools.

NAPTHA (TCP resource exhaustion)
ISIC (specifically TCPsic)

Also, this document by Cisco CIAG and STAT folks, even at 6 years old,
is most helpful in getting started breaking stuff.

"A Structured and Practical Methodology For Security Evaluation of a
IP Based Stack"

http://www.cisco.com/web/about/security/security_services/ciag/documents/stack-howto.pdf

Cheers,
--scm



On Thu, Jul 16, 2009 at 9:18 PM, <shankar.arjunan@...> wrote:

> Dear All,
>
> I am performing a pentest on server, can anyone tell me if there is any script or tool or a method available to test a specific TCP port (eg: 1310) for server load test by doing DoS/DDoS type attacks.  This is to check how the server responds for attack on specific port, any possibilities of server going down or to check any degrade of performance.
>
> Please advice.
>
> Regards
> Shankar
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[R. DuFresne]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


It's likely not so much a specific port you are testing as it is the
network underneath it, and the HW behind it.

Thanks,

Ron DuFresne


On Tue, 21 Jul 2009, Shankar Arjunan wrote:

> Hi Benjamin / All,
>
> Thank you all for the responses.
>
> It is for an inhouse application which is going to be live soon, before going
> live thought of doing a stress test on specific port for DoS type attacks and
> see the outcomes.
>
> I will use hping and do a test.
>
> Regards
> Shankar

  [SNIP]
- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         admin & senior security consultant:  sysinfo.com
                         http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

These things happened. They were glorious and they changed the world...,
and then we fucked up the endgame.    --Charlie Wilson
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFKZiITst+vzJSwZikRAuR+AKCxe1Sl8xScV+aNrTWjl2C9+UHK3ACgw42n
wwYaVOk+HAdYven1pfOREwk=
=1yn1
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Wong Yu Liang]

Hi,
 Not sure if anyone suggested syn flooding. Jolt is pretty cool.

Regards
Yuliang

-----Original Message-----
From: listbounce@... [mailto:listbounce@...] On Behalf Of Shankar Arjunan
Sent: Tuesday, July 21, 2009 3:18 PM
To: Benjamin Greenfield
Cc: pen-test@...
Subject: Re: DoS test on specific TCP Port

Hi Benjamin / All,

Thank you all for the responses.

It is for an inhouse application which is going to be live soon, before
going live thought of doing a stress test on specific port for DoS type
attacks and see the outcomes.

I will use hping and do a test.

Regards
Shankar
----- Original Message -----
From: "Benjamin Greenfield" <bcg@...>
To: <shankar.arjunan@...>
Cc: <pen-test@...>
Sent: Saturday, July 18, 2009 5:56 AM
Subject: Re: DoS test on specific TCP Port


You can try using hping3 to send out all sorts of traffic in all kinds
of different frequencies and bursts.   However, the first thing you
should do is verify with your client that they consent to you trying a
DoS attack.  Depending on application / service / OS is connected to
that port there may be particular vulnerabilities and / or exploits
that result in DoS conditions as well.

As far as determining the effectiveness of the attack, you'd need to
log all the incoming responses and evaluate them I suppose.  I would
expect subtle differences would account for things like an IPS
blacklisting your IP versus the host actually going offline or slowing
due to load, and depending on the specifics it may not actually be
possible to determine what precisely occurred target-side happened.

Seriously, verify that the client wants you to test a DoS first though...


On Thu, Jul 16, 2009 at 9:18 PM, <shankar.arjunan@...> wrote:

> Dear All,
>
> I am performing a pentest on server, can anyone tell me if there is any
> script or tool or a method available to test a specific TCP port (eg:
> 1310) for server load test by doing DoS/DDoS type attacks. This is to
> check how the server responds for attack on specific port, any
> possibilities of server going down or to check any degrade of performance.
>
> Please advice.
>
> Regards
> Shankar
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review
> Board
>
> Prove to peers and potential employers without a doubt that you can
> actually do a proper penetration test. IACRB CPT and CEPT certs require a
> full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------


DISCLAIMER
This message may contain confidential and privileged information for its intended recipient(s) only. If you are not an intended recipient, you are hereby notified that any review, dissemination and distribution, printing or copying of this message or any part thereof is strictly prohibited. Please delete the entire message and inform the sender of the error. Any opinions, conclusions and other information in this message that are unrelated to the official business of VADS Berhad are those of the individual sender and shall be understood as neither explicitly given nor endorsed by VADS Berhad. VADS Berhad does not authorise any of its employees to make any defamatory or seditious statements which is contrary to the laws of Malaysia. Any such communications by such employees are outside their scope of employment and VADS Berhad shall not be liable for such communications.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Derek_Chen]

Hi,

I'm trying to customize an abnormal fragmented packet by setting the fragment offset to a large value. When I sent out the packet, I can sniffer it on the local machine but cannot find it on the LAN. I doubt this packet has never been sent out of the machine. Is there anyone having the same experience? The tool I use is Scapy.

Regards,
Derek

TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Derek_Chen]

The value has already been 0. Is there other setting that may affect the behavior?

Regards,
Derek

-----Original Message-----
From: Huzeyfe ONAL(Gmail) [mailto:huzeyfe.onal@...]
Sent: Thursday, October 22, 2009 1:58 PM
To: Derek Chen (RD-TW)
Cc: pen-test@...
Subject: Re: Does Debian drop customized fragmented packets?

Hi,

try after disabling spoof protection on the interface which you'r
trying to send frag. packets.

If you read readme.debian for fragroute package it says " ... Under
GNU/Linux, this behaviour is most likely controlled by the kernel.
You can set the specific interface by using:     echo "0" >
/proc/sys/net/ipv4/conf/INTERFACE/rp_filter



---
Huzeyfe ONAL
Ag Guvenligi Listesine uye oldunuz mu?
http://www.lifeoverip.net/netsec-listesi/

---


On Tue, Oct 20, 2009 at 1:17 PM, <Derek_Chen@...> wrote:

>
> Hi,
>
> I'm trying to customize an abnormal fragmented packet by setting the fragment offset to a large value. When I sent out the packet, I can sniffer it on the local machine but cannot find it on the LAN. I doubt this packet has never been sent out of the machine. Is there anyone having the same experience? The tool I use is Scapy.
>
> Regards,
> Derek
>
> TREND MICRO EMAIL NOTICE
> The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>

TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------