HackerGuide: Syn-Flood Attack

Warning: Malicious use of SYN-floods are punishable by law.

This post shows howto to establish a synflood attack on an arbitrary remote host. The attack is performed using hping, which is free packet generator and analyzer for the TCP/IP protocol. Hping is one of the de facto tools for security auditing and testing of firewalls and networks. A syn-flood attack is basically a DOS-attack on a bug in TCP – some will argue that TCP is defective by design ;)

The actual attack is initialized by this command:

hping -i u1 -S -p 80 dst-host-or-ip

In most cases DoS attacks like this one renders a webserver totally unable to serve any requests from users.

To get hping installed on a Debian or Ubuntu-based system, type this to install:

aptitude install hping2

5 Comments.

  1. Hping2 ile syn flood testi nas?l yap?l?r? | - pingback on October 18, 2011 at 17:23
  2. Use this to randomize the source ips hitting the target:

    –rand-source

  3. die in a fire!

  4. wowww nice artliches thanxx

  5. Pretty simple but not efficient. With this technique, there are at most 65536 opened TCP connections… (16 bits for source port, and this attack is done on only one destination port)
    A better alternative is to spoof source IPs, and then have lot more connections and then you’ll have a efficient DoS attack.
    An easy way to do this is to use packETH.

Trackbacks and Pingbacks: