[regexks_]

Requirements

Hardware:

a dedi or VPS with some form of Linux installed (I'll be using my dedi with Debian Squeeze)

Software:

a network monitor (I'll be using iptraf)
a text editor (nano is fine)
screen
grep
sort
uniq
cat (maybe)

Idea

DNS reflection attacks utilize small, spoofed DNS queries for large amounts of information from open recursive name servers that return this large response to a target. These attacks rely on a fairly large list of these open recursive name servers to query, which, in reality, are fairly easy to scan for and compile into a list. Some users decide to sell these lists and profit off of them though. Naughty naughty. Now there are plenty of guides and utilities online to gather this data yourself but why not just steal tried and tested lists from existing stressers that are using them?

Like I mentioned above, the attack utilizes open recursive name servers to do its dirty work. These servers are sending large amounts of UDP traffic right at a target. Who's to say I can't just log the traffic hitting my server and parse that data to find every single open recursive name server utilized by the attack? Why can't I just SE stressers or use accounts to hit my server for a few minutes to gather this information quickly?

Process

1. SSH into the dedi/VPS and start up iptraf in screen (you don't want your SSH socket to close and have your iptraf process killed! You can just reattach to the detached session in the case of a disconnect)





2. Go into Configure... and make sure Logging is set to On





3. Start up an IP traffic monitor session on all interfaces (or eth0 if you want to keep the list a little less bulky) and specify a location for the log to be saved







4. Hit your server. I suggest hitting the server for 5-10 minutes (most 100Mb dedis will get completely assfucked by most attacks so you'll see your SSH session freeze or even disconnect for the duration). Stop logging after the attack completes (you'll know when your server starts responding again). It's time to parse the logs.

5. I have some logs from previous attacks which I can go ahead and show you some data from. I'll be using Formality Stresser as an example





So you have your log... but none of this data is usable... yet. "There are words and duplicates and OH MY GOD REGEXKS WHAT DO I DO WITH THIS LOG?" We'll have to pass it through some stuff to get the data we need. This is easy with some piping!

Code

grep -Eo "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:53" formalitystresser1.log | sort -n | uniq | grep -Eo "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" > finaldnslist.txt

Using some simple regular expressions, sort and uniq you've managed to pull only the IP address ending in port 53 (the port name servers use), list them all in numerical order (mostly to get all the duplicates right next to each other) and merge all the duplicates! You're a god!



ENJOY YOUR FREE AMP LISTS

Oh and you can use cat to merge lists if you ever need to.

[Zanelot]

Vouch for this method, it works, and I've personally used it.

[Starfall]

Very impressive. Can be done with SNMP reflectors as well, just change the port you're looking for

[Whiteh4t]

so you attack your own server and capture traffic from?.

[TheNeutron]

Pretty cool & interesting tutorial... Thanks mate :)

[phlow]

Very interesting. Thanks for the tutorial.

[ItsFluffy]

talk about a well done tut
nice work man

[regexks_]

Thanks for the good feedback guys. Keep it coming

[CarrotMilk]

Actually a really cool tutorial there, bud. Nice work :)

[Deadlydennis]

Thanks for posting this very nice well written tutorial. Nice work

[regexks_]

Thanks for the feed back nerds. Keep it coming and let me know if you've stolen some good lists!

[ca9a2536fd8b17df76f7ee082]

Nice job, Keep up the HQ posts man!

[Mindpower]

Wow this was a very good tutorial, Good job! :)

[Dolan.]

Thanks for the tutorial, going to bookmark it for future use c:

[RyanC]

I'd be rather shocked if this wouldn't be obvious to anyone with a brain.