[The Monarch]

today i was looking through the many different talks that are going to be at DEFCON this year and i saw that Sam Bowne was going to speak again this year. It reminded me of his talk last year about different types of DoS attacks and the one that i remembered the most was the layer 7 DoS attack. (im packing to go to DEFCON right now!)

a layer 7 attack only needs one person to take down a web server. It works by sending incomplete requests, each request times out 400 seconds after it was sent. this allows us to send less packets to the target thus making it look like normal traffic. layer 7 attacks also allow us to send them through tor or other proxies since it only affects the web server. note that this type of attack will not crash the physical server but Apache (doesnt need to be apache) running on the physical server.

this brings me to PyLoris, it is a python version of SlowLoris that was used at DEFCON 19. I find it to be very easy and fun to use. the program is similar to the one that the jester uses but not exactly. the website is: http://motomastyle.com/pyloris/

a direct download is: http://sourceforge.net/projects/pyloris/

to use just start the pyloris.py script
it requires Python 2.x to run.

have fun.

[orunu]

YES!!!! ZOMFG THANKS NOW WE CAN ALL BECOME 5UP3R 1337 /\/\3G4 |-|4X0RZ!!

[The Monarch]

YES!!!! ZOMFG THANKS NOW WE CAN ALL BECOME 5UP3R 1337 /\/\3G4 |-|4X0RZ!!

ya i think its pretty cool to, loic is garbage compared to this

[orunu]

no, its not cool, its shit, and HF is skiddy enough we dont need more skids coming here with their 1337 ub3r dos tools thinking they can hack a site by knocking it offline. heres a tip, drop the skid shit and learn how to actually hack.

[k1ngj0sh143]

Every hacker is. Anon just so u know.unless they are showboats that deface shit. Just saying we all try to be anonymous.

[The Monarch]

when did i ever say this program was good or was real hacking, i just said it was fun and easy to use. any dos attack is shit but not to many people know how to sql inject, upload a shell and get in so that is what they do. all i know is that im a pentester, i graduated with a BE and i use PyLoris it is very useful in making my clients look bad. you guys just don't see the whole picture of pentesting, you just cant go in and f up the whole network, you have to start from the ground up using attacks that shouldn't work, to attacks that are very successful. i share a useful program and get blasted for it.

[zer0pwn]

Of course it's better than LOIC.
LOIC was designed for Distributed Denial of Service, which is when a bunch of people participate in an attack.

DOS is just Denial of Service, with one person.

To be honest... There's a lot of things that can work for DOSing. There's this script I came across which was meant to secure information such as Cookies and stuff as you browse the web. It doesn't exactly encrypt the data, but it causes the headers to spit out crazy and a lot of random information. This can be used to actually successfully crash a website's server.

For the extremely weak sites, I've used HAVIJ's POST injection to DOS, it's quite hilarious.