0

I am trying to simulate a SYN attack for an essay I am doing and gather some results (time taken for computer to respond to some message), but nothing seems to happen when I try this method.

I use WAMP server to host a basic server on the victim PC using a local router with no internet access, completely disable all firewalls on the router and the PC, and then access the web page that is hosted by the victim PC on the attacker PC in order to capture a legitimate SYN packet using wireshark.

I then copy the hexadecimal for the legitimate SYN packet into colasoft packet builder, and change the source port to 1444, and then create a new rule for windows firewall to block all inbound connections on that port, so that the SYN, ACK is not responded to in any way.

I then ping the victim PC from the attacker PC procedurally to check for a reply delay and loop send the now malicious SYN packet to the victim PC, but there is no delay in response except from the occasional spike which is to be expected.

My question is what am I doing wrong, or is there a better way of simulating a SYN attack than this on windows? (as a sidenote, I tried to use hping, but could not get this to work at all.)

Thanks!

1 Answer 1

0

I apologize in advance if I don't truly understand the question. When sending a SYN flood attack the point of it to attempt to create as many half open connections on the victim as possible. This leaves each of the half open connections in the SYN-RECVD state temporarily utilizing resources.

However, it appears that you are not sending your SYN flood properly by not spoofing the attackers source IP. When your attacking machine receives the SYN/ACK it will immediately send a reset packet shutting down that socket and negating any flood attempts. However I am not familiar wit the behavior of the Windows Firewall. If you spoof the source address to an unused IP the RST will not get sent and each SYN/ACK being sent by the victim will go into exponential back off dramatically upping the effectiveness of the attack. (please use an IP in private space so the SYN/ACKs aren't reflecting back at something on the internet)

Ok, next up is the fact that you are replaying the same packet with the same 4-tuple and the same initial sequence number. You need each SYN to be unique to be effective. I would strongly suggest you use any Linux distro and the application "hping3". You should be able to get the results you want. Also consider that ping uses ICMP and may not be a good test of server delay since it is considerably different process in how the server responds. May I suggest nmap or even hping3 again for testing the servers TCP response.

1
  • I think that the firewall blocking the outbound signals stops the transmission of the SYN/RST, but i think the issue is the sequence number. I will tried hping3 on a virtual machine, but since I am not familiar with the workings of Linux, I couldn't get it to work! Thanks so much for the answer I will try and use hping3 again.
    – felmo_
    Nov 3, 2017 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .