Study Guide: Denial-of-Service (DoS) Analysis

This document outlines the theoretical and practical application of stress-testing tools within Kali Linux for educational purposes.

1. Overview of DoS Vectors

A Denial-of-Service attack aims to exhaust resources so that a system cannot respond to legitimate requests. In pentesting, we categorize these into three main layers:

Volumetric: Flooding the network with massive amounts of traffic (Gbps).
Protocol-Based: Exploiting weaknesses in the TCP/IP stack (e.g., SYN Floods).
Application Layer: Targeting specific services like web servers or databases.

2. Key Tools and Practical Usage

Below are common tools included in Kali Linux, their specific focus, and how they are typically executed in a controlled lab.

A. hping3 (Transport Layer)

A versatile packet generator used to test firewall rules and network performance. It can send custom TCP, UDP, and ICMP packets.

Example Usage: Performing a SYN flood test on port 80.

sudo hping3 -S --flood -p 80 [Target_IP]

-S: Sets the SYN flag.
--flood: Sends packets as fast as possible without waiting for replies.

B. SlowHTTPTest (Application Layer)

Simulates "Slowloris" attacks. It opens many connections and keeps them open by sending partial HTTP headers very slowly, eventually exhausting the server's connection pool.

Example Usage: Testing a server's resilience to slow headers.

slowhttptest -c 1000 -H -g -o slow_report -i 10 -r 200 -t GET -u http://[Target_URL]

-c 1000: Specifies the target number of connections.
-H: Starts the attack in "SlowLoris" mode.

C. GoldenEye (Application Layer)

A Python-based tool that targets HTTP servers by requesting "Keep-Alive" and bypassing cache mechanisms to force the server to work harder on every request.

Example Usage: Launching a resource exhaustion test.

./goldeneye.py http://[Target_URL] -w 10 -s 500

-w: Number of concurrent workers (threads).
-s: Number of sockets per worker.

3. The Mechanics: SYN Flooding

The SYN flood is a classic example of a protocol-based attack that exploits the TCP Three-Way Handshake.

When the attacker sends a SYN but never responds to the server's SYN-ACK, the server keeps the connection "half-open" in its memory. With enough of these, the server runs out of memory for new connections.

Disclaimer: These materials are for educational and ethical testing purposes only. Unauthorized use against systems is illegal and unethical.