Steps to Harden your External Router

• Implement RFC1918 (Private Address Space), RFC2827 (Network Ingress Filtering), and bogon Filtering (filtering unassigned address spaces).
• Drop fragmented traffic
• Implement Authentication, Authorization, and Accounting (AAA).
• Implement management console access restrictions using AAA and ACLs.
• Harden the routing protocols
• Implement ACLs to restict SNMP access.
• Implement flood management through the use of traffic shaping, Quality of Service (QoS), and Weighted Fair Queuing (WFQ), on routers that support it.
• Remove all unnecessary services.
• Implement logging with syslog, SNMP traps and accounting.
• Drop directed broadcasts.
• Implement anti-spoofing. Don't allow your internal IP range to be the source address of packets arriving on the external interface.
• Prevent source routing.
• Prevent ICMP redirects.
• For your Cisco routers, implement Cisco Express Forwarding(CEF) to handle SYN floods.
• Ensure that you are running the latest stable software version to prevent being susceptible to threats that have been patched or updated.
• If your router has the horsepower to support it, implement the first line of traffic to allow only traffic that should be traversing the network edge through the use of ACLs, or in the case of Cisco routers running the IOS firewall feature set and using Context Based Access Control (CBAC).

REF: Hardening Network Infrastructure p.357

Ten DOS Attacks and Free DOS Attacking Tools

Some of  these tools are dated but will still work. Please read the notes prior to usage and always use in a lab environment or permission of system/network/server proprietors.

1. LOIC (Low Orbit Ion Canon) - LOIC is one of the most popular DOS attacking tools freely available on the Internet. This tool was used by the popular hackers group Anonymous against many big companies’ networks last year. Anonymous has not only used the tool, but also requested Internet users to join their DDOS attack via IRC.

It can be used simply by a single user to perform a DOS attack on small servers. This tool is really easy to use, even for a beginner. This tool performs a DOS attack by sending UDP, TCP, or HTTP requests to the victim server. You only need to know the URL of IP address of the server and the tool will do the rest.

You can see the snapshot of the tool above. Enter the URL or IP address and then select the attack parameters. If you are not sure, you can leave the defaults. When you are done with everything, click on the big button saying “IMMA CHARGIN MAH LAZER” and it will start attacking on the target server. In a few seconds, you will see that the website has stopped responding to your requests.

This tool also has a HIVEMIND mode. It lets attacker control remote LOIC systems to perform a DDOS attack. This feature is used to control all other computers in your zombie network. This tool can be used for both DOS attacks and DDOS attacks against any website or server.

The most important thing you should know is that LOIC does nothing to hide your IP address. If you are planning to use LOIC to perform a DOS attack, think again. Using a proxy will not help you because it will hit the proxy server not the target server. So using this tool against a server can create a trouble for you.

Download LOIC Here: http://sourceforge.net/projects/loic/

2. XOIC - performs a DOS attack on any server with an IP address, a user-selected port, and a user-selected protocol. Developers of XOIC claim that XOIC is more powerful than LOIC in many ways. Like LOIC, it comes with an easy-to-use GUI, so a beginner can easily use this tool to perform attacks on other websites or servers.

3. HULK (HTTP Unbearable Load King) - generates a unique request for each and every generated request to obfuscated traffic at a web server. This tool uses many other techniques to avoid attack detection via known patterns.
It has a list of known user agents to use randomly with requests. It also uses referrer forgery and it can bypass caching engines, thus it directly hits the server’s resource pool.

The developer of the tool tested it on an IIS 7 web server with 4 GB RAM. This tool brought the server down in under one minute.

Download HULK here: http://packetstormsecurity.com/files/112856/HULK-Http-Unbearable-Load-King.html

4. DDOSIM—Layer 7 DDOS Simulator - used to perform DDOS attacks by simulating several zombie hosts. All zombie hosts create full TCP connections to the target server. This tool is written in C++ and runs on Linux systems.

These are main features of DDOSIM

• Simulates several zombies in attack
• Random IP addresses
• TCP-connection-based attacks
• Application-layer DDOS attacks
• HTTP DDoS with valid requests
• HTTP DDoS with invalid requests (similar to a DC++ attack)
• SMTP DDoS
• TCP connection flood on random port

Download DDOSIM here: http://sourceforge.net/projects/ddosim/

Read more about this tool here: http://stormsecurity.wordpress.com/2009/03/03/application-layer-ddos-simulator/

5. R-U-Dead-Yet - also known as RUDY. It performs a DOS attack with a long form field submission via the POST method. This tool comes with an interactive console menu. It detects forms on a given URL and lets users select which forms and fields should be used for a POST-based DOS attack.Download RUDY: https://code.google.com/p/r-u-dead-yet/

6. Tor’s Hammer - It is a slow post tool written in Python. This tool has an extra advantage: It can be run through a TOR network to be anonymous while performing the attack. It is an effective tool that can kill Apache or IIS servers in few seconds.Download TOR’s Hammer here: http://packetstormsecurity.com/files/98831/

7. PyLoris - PyLoris is said to be a testing tool for servers. It can be used to perform DOS attacks on a service. This tool can utilize SOCKS proxies and SSL connections to perform a DOS attack on a server. It can target various protocols, including HTTP, FTP, SMTP, IMAP, and Telnet. The latest version of the tool comes with a simple and easy-to-use GUI. Unlike other traditional DOS attacking tools, this tool directly hits the service.Download PyLoris: http://sourceforge.net/projects/pyloris/

8. OWASP DOS HTTP POST - You can use this tool to check whether your web server is able to defend DOS attack or not. Not only for defense, it can also be used to perform DOS attacks against a website.Download here: https://code.google.com/p/owasp-dos-http-post/

9. DAVOSET - The latest version of the tool has added support for cookies along with many other features. You can download DAVOSET for free from Packetstormsecurity.
Download DavoSET: http://packetstormsecurity.com/files/123084/DAVOSET-1.1.3.html

10. GoldenEye HTTP Denial Of Service Tool - tools that can put heavy load on HTTP servers in order to bring them to their knees by exhausting resource pools.

Download GoldenEye: http://packetstormsecurity.com/files/120966/GoldenEye-HTTP-Denial-Of-Service-Tool.html

I love Cyberghost - Secure your connections in 3 easy steps: No registration, super easy, completely free.

3 Steps, and It's fast, it's easy, and it's free!!

 

1. Download Cyberghost VPN by clicking link below:

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&sqi=2&ved=0CCUQjBAwAQ&url=http%3A%2F%2Fwww.cyberghostvpn.com%2Fen_us%2Fdownload&ei=fGEAVYzZJMLiU_qrgdAO&usg=AFQjCNHxDAXwshwWpCM3nQmTtywM1__htQ&bvm=bv.87611401,d.d24

*If your download doesn't start click on the download button on this page => www.cyberghostvpn.com/en_us/download

2. When cyberghost installs it will launch a window indicating your real location. Click on the power

button in the middle of the lower part of the window. Leave the Automatic defaults for simulated 

country and IP address.

3. You will now see your simulated location. Confirm by copying the IP address provided into a google search. 

Happy Surfing!

Virtual Machine Utilization, Highlights and Advantages

Virtual Machine utilization highlights and advantages:

VMWare and Virtual Box are the most popular free distributions of virtualization software. The documentation below is for VirtualBox but google searches will provide extensive installation and configuration documentation to both applications/appliances.

Why are virtual machines useful?

Multiple Operating Systems on one computer:

Virtualization allows you to run more than one operating system at a time. This way, you can run software written for one operating system on another (for example, Windows software on Linux or a mac) without having to reboot to use it.

OS Management:

Virtual machines and their virtual hard disks can be considered "containers" that can be

arbitrarily frozen, woken up, copied, backed up, and transported between hosts.

Software Testing and Disaster Recovery:

Utilizing VirtualBox "snapshots", one can save a particular state of a virtual machine and revert  back to that state, if necessary.  

This way, one can freely experiment with a computing environment.  If something goes wrong (e.g. after installing misbehaving software or infecting  theguest with a virus), one can easily switch back to a previous snapshot and avoid the need of frequent backups and restores.

Any number of snapshots can be created, allowing you to travel back and forward in virtual machine time. You can delete snapshots while a VM is running to reclaim disk space.

------------------

Resources:

Virtual Box installation manual:

http://www.virtualbox.org/manual/ch01.html

How to install Virtual Box in Windows 7 YouTube install videos:

https://www.youtube.com/results?search_query=virtual+box+install+in+windows+7

Virtual box download page:

https://www.virtualbox.org/wiki/Downloads

Lists & Dictionaries

https://downloads.skullsecurity.org/passwords/

http://dazzlepod.com/site_media/txt/passwords.txt

brute force with ncrack, hydra and medusa

nrack
wget http://nmap.org/ncrack/dist/ncrack-0.4ALPHA.tar.gz

./configure
make
make install

hydra
wget http://freeworld.thc.org/releases/hydra-6.3-src.tar.gz

./configure
make
make install

medusa
wget http://www.foofus.net/jmk/tools/medusa-2.0.tar.gz

./configure
make
make install

 ----------------------------------------
Medusa main page:
 http://foofus.net/goons/jmk/medusa/medusa.html

HOWTO : DirBuster on Ubuntu Desktop 12.04 LTS

HOWTO : DirBuster on Ubuntu Desktop 12.04 LTS

DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers.

Step 1 :

sudo -sH

cd /opt

wget "http://downloads.sourceforge.net/project/dirbuster/DirBuster%20%28jar%20%2B%20lists%29/1.0-RC1/DirBuster-1.0-RC1.tar.bz2?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fdirbuster%2Ffiles%2FDirBuster%2520%2528jar%2520%252B%2520lists%2529%2F1.0-RC1%2F&ts=1370262745&use_mirror=nchc" -O DirBuster-1.0-RC1.tar.bz2

tar -xjvf DirBuster-1.0-RC1.tar.bz2

mv DirBuster-1.0-RC1 DirBuster

rm DirBuster-1.0-RC1.tar.bz2

Step 2 :

To run it.

sudo -sH

cd /opt/DirBuster

./DirBuster-1.0-RC1.sh

That's all! See you.