Ip Spoofed Get Request Dos ?

setthesun

Mar 20 2004, 08:39 AM

Can we do large amount of IP Spoofed GET requests to webserver ? without waiting for an answer.

So our server will sent all replies to another victim or just a random IP, so server will be crashed soon because of the bandwith or request/response buffer.

Any idea about this ? Or do we have a tool for it

or am I missing something in this scenario ?

lasantarosa

Mar 20 2004, 11:18 AM

http://www.grc.com/dos/drdos.htm

clip

Mar 20 2004, 01:54 PM

No.. you can't do this. go read the TCP/IP rfc.

Before you can send a GET request you need to have a TCP connection witch means the client has sent a "SYN" the server then sends a (SYN | ACK) The client then sends a ACK and then you can send your get request. Eveything this has to be timed. you could however just send A SYN with a spoofed source and right afterwards send a ACK. This might work on some OS'es with very bad TCP/IP implementation. Test it.

Btw. Don't read anything Steve Gibson writes he is a Troll and FUD spreader.

setthesun

Mar 21 2004, 07:05 AM

QUOTE (clip @ Mar 20 2004, 01:54 PM)

No.. you can't do this. go read the TCP/IP rfc.

Before you can send a GET request you need to have a TCP connection witch means the client has sent a "SYN" the server then sends a (SYN | ACK) The client then sends a ACK and then you can send your get request. Eveything this has to be timed. you could however just send A SYN with a spoofed source and right afterwards send a ACK. This might work on some OS'es with very bad TCP/IP implementation. Test it.

Btw. Don't read anything Steve Gibson writes he is a Troll and FUD spreader.

Just what I'm looking for, Thank you.

I know 3 way handshake but I missed this;

QUOTE

Before you can send a GET request you need to have a TCP connection

So if we really need a DOS we have to do DDOS - zombie style.

QUOTE

This might work on some OS'es with very bad TCP/IP implementation

I know it, but most of today OSes don't fool this

just like ping of death.