1

I am a student so please don't be rude for I miss something and this project is for research purpose only.

I am willing to perform a denial of service attack(on my own servers) I am not willing to do the script kiddie method of downloading and running some online codes I have programmed my own servers and clients here is the client which sends buffers thereby overflowing the buffers

class BufferOverflow:
def overflow(self,host,port):
    id = 0
    while True:
        print("================================================================")
        try:
            client = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
            print("[*] NetWorker Report: Sockets have been created against the server")
        except socket.error:
            print("[*] Adim permission required or port in use")
        buffer = "\x4e"*3000
        print("[*] Connecting to %s on %d"%(host,port))
        client.connect((host,port))
        print("[*] Connection established")
        exploit_packet = ("USV "+buffer+"//n//r//r").encode("UTF-8")
        print("[*] Initializing...")
        client.send(exploit_packet)
        print("[*] Initialized!")
        print("[*] Restarting...")
        client.close()
        print("[*] Restarted!")
        print("[*] Session ID: %d"%id)
        id+=1

This sends buffers to the server with the desired it, I have implemented my own sniffer which could resolve DNS to I.P so that I can get the I.P.

Here is the code to my own custom servers implementation, https://codereview.stackexchange.com/questions/144661/penetration-testing-in-an-unsuitable-environment

I used a basic TCP server from my code on code review on it to test, enter image description here

In the screen shot the top left most is the server which displays the buffer like "NNN....3000*N" = > single buffer which is sent by the client, I used multiple clients to overblown the buffer. Finally I got success the top right most one which displayed this message, enter image description here

Win 10061 error is nothing but the server has stopped or inactive. I know that the service is available for the present clients which I have created, so I have opened a new power shell along with the running clients and connected to the server but the server still responds , I don't know why?

Am I missing something or this is not actually the correct implementation of denial of service attack?

I am a student and I am willing to learn from you please do not be rude I have misunderstood some concepts and provided a wrong implementation

19
  • 1
    While your program is used in the context of information security the problem you face is actually a programming question, i.e. off-topic here and on-topic on stackoverflow.com. What would be on-topic here are the concepts of how to do such thing but not the debugging of your program. But the concepts are mainly missing from your question. Commented Oct 28, 2016 at 17:09
  • 1
    If your service becomes unavailable, then your DoS worked... It's unclear in your question whether you think you were successful or not ...
    – schroeder
    Commented Oct 28, 2016 at 17:13
  • 1
    @AdHominem that's DDoS ... and you do NOT have to spoof IPs. DoS is perfectly valid even if it only takes a single packet from a single source.
    – schroeder
    Commented Oct 28, 2016 at 17:14
  • 1
    @VISWESWARAN1998 you might not know it, but you are asking us to debug your code. To cause a service to fail, it must have a design vulnerability of some sort. There are numerous types of vulnerabilities that can cause a DoS. By giving us your client code, you are asking about your specific implementation. What I suggest is that you focus on the server code, not the client or the runtime errors. But once you do that, then it becomes a specific code design review, which brings us back to a debug question.
    – schroeder
    Commented Oct 28, 2016 at 17:37
  • 2
    @VISWESWARAN1998 that's exactly what I'm saying. If you want to kill any type of service, then you need to flood it with so much traffic that the network the server is on gets too full to operate. Then you need a great deal of clients, and enormous amounts of traffic. But for a single client to kill a single service, you need to exploit a resource vulnerability in that service.
    – schroeder
    Commented Oct 28, 2016 at 17:52

0

Browse other questions tagged .