Creation of a DDOS attack using HTTP-GET Flood with the Cyber Kill Chain methodology
DOI:
https://doi.org/10.15332/.v16i1.2160Keywords:
Distributed attacks of denial of services, Botnet, Security InformaticsAbstract
This article illustrates by means of a demonstration and taking advantage of the vulnerability “Open redirect”, how easy it can be to attack web servers through distributed attacks of denial of services. In it, the Cyber Kill Chain® model is used to carry out this attack in phases. In the development of the research, a systematic UFONet tool is applied and the results obtained are analyzed and it is recommended to protect the Internet application services of said attacks through web application firewalls (WAF) whose presence allows the DDoS traffic of the application layer (including the HTTP-GET flood) arrives effortlessly at the destination server.
Downloads
References
N. Figuerola, “Seguridad en Internet de las cosas Estado del Arte,” 2014.
A. F. A. Rahman, M. Daud, and M. Z. Mohamad, “Securing Sensor to Cloud Ecosystem using Internet of Things (IoT) Security Framework,” in Proceedings of the International Conference on Internet of things and Cloud Computing - ICC ’16, 2016, pp. 1-5.
T. Yu, V. Sekar, S. Seshan, Y. Agarwal, and C. Xu, “Handling a trillion (unfixable) flaws on a billion devices,” in Proceedings of the 14th ACM Workshop on Hot Topics in Networks - HotNets-XIV, 2015, pp. 1-7.
J. Martínez, J. Mejía, and M. Muñoz, “Análisis de la seguridad en Internet de las cosas: Una revisión sistemática de literatura,” IEEE.
T. Olavsrud, “CIO,” CIOs should step into the IoT oversight void, 2017. [Online]. Available: https://www.cio.com/article/3202398/leadership-management/ciosshould-step-into-the-iot-versight-void.html. [Accessed: 23-Jun-2017].
I. Arbor Networks, “Digital Attack Map,” 2017. [Online]. Available: http://www.digitalattackmap.com/. [Accessed: 30-Oct-2017].
E. Filiol, “Viruses and Malware,” Handb. Inf. Commun. Secur. Part F, pp. 747-769, 2010.
A. M. del Rey, “Mathematical modeling of the propagation of malware: A review,” Security and Communication Networks, vol. 8, no. 15. pp. 2561-2579, 2015.
Cisco, “The Evolution of Malware,” no. January, 2017.
S. McGregory, “Preparing for the next DDoS attack,” Netw. Secur., vol. 2013, no. 5, pp. 5-6, May 2013.
K. Singh, P. Singh, and K. Kumar, “Application layer HTTP-GET flood DDoS attacks: Research landscape and challenges,” Computers and Security, vol. 65. pp. 344-372, 2017.
D. Kostadinov, “Layer Seven DDoS Attacks.” [Online]. Available: https://resources.infosecinstitute.com/layer-seven-ddos-attacks/. [Accessed: 29-Nov-2018].
V. Zakharevich, “Understanding and Discovering Open Redirect Vulnerabilities,” 2017. [Online]. Available: https://www.trustwave.com/Resources/Spider- Labs-Blog/Understanding-and-Discovering-Open-Redirect-Vulnerabilities/. [Accessed: 29-Nov-2018].
“LOIC download | SourceForge.net.” [Online]. Available: https://sourceforge.net/projects/loic/. [Accessed: 30-Nov-2018].
“High Orbit Ion Cannon download | SourceForge.net.” [Online]. Available: https://sourceforge.net/projects/highorbitioncannon/. [Accessed: 30-Nov-2018].
“UFONet - Denial of Service Toolkit.” [Online]. Available: https://ufonet.03c8.net/. [Accessed: 30-Nov-2018].
“Dirt Jumper - Krebs on Security,” [Online]. Available: https://krebsonsecurity.com/tag/dirt-jumper/. [Accessed: 30-Nov-2018].
“Torshammer download | SourceForge.net.” [Online]. Available: https://sourceforge.net/projects/torshammer/. [Accessed: 30-Nov-2018].
“Nuclear DDoser ~ Hacking.” [Online]. Available: http://anonganesh.blogspot.com/2014/03/nuclear-ddoser.html. [Accessed: 30-Nov-2018].
“Cyber Kill Chain® | Lockheed Martin.” [Online]. Available: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html. [Accessed:29- Nov-2018].
“Intelligence Driven Defense® | Lockheed Martin.” [Online]. Available: https://www.lockheedmartin.com/en-us/capabilities/cyber/intelligence-driven-defense.html. [Accessed: 29-Nov-2018].
Downloads
Published
How to Cite
Issue
Section
License
La revista ITECKNE se encuentra registrada bajo una licencia de Creative Commons Reconocimiento-NoComercial 4.0 Internacional Por lo tanto, esta obra se puede reproducir, distribuir y comunicar públicamente, siempre que se reconozca el nombre de los autores y a la Universidad Santo Tomás. Se permite citar, adaptar, transformar, autoarchivar, republicar y crear a partir del material, siempre que se reconozca adecuadamente la autoría, se proporcione un enlace a la obra original y se indique si se han realizado cambios.
La Revista ITECKNE no retiene los derechos sobre las obras publicadas y los contenidos son responsabilidad exclusiva de los autores, quienes conservan sus derechos morales, intelectuales, de privacidad y publicidad. Sin embargo esta facultada para editar, publicar, reproducir y distribuir tanto en medios impresos como digitales, además de incluir el artículo en índices internacionales y/o bases de datos, de igual manera, se faculta a la editorial para utilizar las imágenes, tablas y/o cualquier material gráfico presentado en el artículo para el diseño de carátulas o posters de la misma revista.
