Bugtraq mailing list archives
dnsa1.c - Exploit code for a denial of service attack using DNS (updated version)
From: zelea () IBM COM (Zelea)
Date: Mon, 28 Feb 2000 09:49:01 -0800
This program works by sending spoofed UDP packets to a list of nameservers. The packets contain valid type ANY class IN queries. The amplification effect comes from the fact that the query packet is much smaller in size than the answer. A list of queries is already included in this source. These queries have been selected for the highest amplification ratio (currently between 20-25) but you can provide your own list of queries in a separate file. ICMP (udp port unreachable) packets are sent back to the nameservers reducing even more the victim's bandwidth. This program has a short delay at the start due to the time required to resolve the nameserver's IPs. Then it sends each UDP query at full speed to each nameserver from the list. The nameservers file has one server per line. To quickly build yourself a list of nameservers use the following script after you have downloaded the domain inaddr.zone.gz file. #!/bin/sh ZONE=inaddr.zone; if [ "x$1x" == "xx" ]; then echo "Usage: print_ns aprox_nr_of_servers"; exit fi if [ ! -f $ZONE ]; then echo "Zone file $ZONE not found"; exit fi NR=`wc -l $ZONE`; awk --assign=TOT="$NR" --assign=DES="$1" ' BEGIN { srand(); th=DES/TOT; }; /NS/ { if( rand() < th ) { fi = split( $0, entry ); if( entry[fi-1] == "NS" ) serv[entry[fi]] = 1; }}; END { for( ns in serv ) printf "%s\n", ns; }' $ZONE If you plan to use high bandwidth you should select the nameservers by their own bandwidth (they should have at least 50 times the bandwidth of the incoming queries otherwise the packets send to them will be just wasted) [ a way of checking a server's bandwidth capacity is using 'bing' ] This kind of DoS attack has several advantages over a smurf attack. There are more than 25000 nameservers which will always be out there. It is also more difficult to block because UDP queries are valid packets which pass through almost all firewalls. Since every computer has to have some kind of name resolver the only way to block this is by denying all UDP packets with source port 53 except those coming from your local nameserver. [ There is still your own nameserver that can flood you in this case ] <HR NOSHADE> <UL> <LI>text/plain attachment: dnsa1.c </UL>
Current thread:
- dnsa1.c - Exploit code for a denial of service attack using DNS (updated version) Zelea (Feb 28)