Detecting Web DDoS | TryHackMe
Table of Contents
- Task 1 Info
- Task 2 Info
- Task 2 Q&A
- Task 3 Info
- Task 3 Q&A
- Task 4 Info
- Task 4 Q&A
- Task 5 Info
- Task 5 Q&A
- Task 6 Info
- Task 6 Q&A
- Task 7 Info
Introduction
Task 1 Information
Distributed Denial-of-Service (DoS) attacks primary goal is to shut down or block access to a system, this purpose of this room is to learn how DDoS attacks target the application layer, and how to detect and defend against them.
Objectives
- Lean how DDoS attacks function
- Understand why they happen
- See how logs can detect them
- Practice analyzing them through log analysis.
- Learn how to stop them
DoS and DDoS Attacks
Task 2 information
The primary way DoS attacks work is by overwhelming a system so that it can’t respond or provide service. These types of DoS attacks can be launched against different layers of the OSI model but this room focuses on the 7th or application layer.
Any type of intentional disruption where a web service sises to function as intended is considered a form of DoS attack. For example the search function of your custom e-commerce site runs SQL in the back-end, if your SQL database configuration or the way the app turns your input into a searchable query is misconfigured, and the user intentionally sends a bunch of garbled random data, or a massive query, that would be considered a DoS attack.
Distributed Denial-of-Service
A single computer with a single internet connection can only do so much when it comes to DoS attacks, this is why attackers often utilize botnets. The computers in this botnet often are comprised of hacked desktop computers, servers, and even IoT devices. These resources are used to flood the target with traffic, overwhelming it more than a single machine could.
Types of DoS attacks
- Slowloris: Sending many partial HTTP requests to tie up server resources
- HTTP Flood: Sending a large number of HTTP requests to overwhelm the server
- Cache Bypass: Bypassing CDN edge servers and forcing the origin server to respond
- Oversized Query: Forcing the server to process large, resource-intensive requests
- Login/Form Abuse: Overloading authentication logic with login attempts or password resets
- Faulty Input Validation Abuse: Exploiting poorly designed input handling
Task 2 Questions & Answers:
Question 1: What class of attack relies on disrupting the availability of a web service?
Answer: denial-of-service
Question 2: What do we call the network of compromised machines that attackers use to launch DDoS attacks?
Answer: botnet
Attack Motives
Task 3 Information:
Possible Attack Motives:
- Financial Loss: Disrupt services to reduce their sales revenue, an example of this could be someone flooding Amazons’ website with HTTP requests during peak holiday sales.
- Extortion: An adversary might demand a ransom from a company to stop their attacks, example: Threatening a high up-time corporation like a stock trading platform.
- Hacktivism: Disruption for a social or political cause, an example of this is someone launch an attack on a political figures website during an election
- Distraction: Distract defenders while other attacks take place on other infrastructure, example: While critical services are being compromised, other critical services are offline, taking the defenders attention away from their network getting compromised.
- Competition: This is closely tied to Financial Loss, where a company such as Ebay might flood Amazons services during peak holiday season to lower their sales and gain more market share.
- Denial of Wallet: Causes victim to rack up service usage costs — could be tied in with Competition or Financial Loss, an example would be a comapany like Ebay flooding apecifically Amazons EC2 services with specific requests that put a heavy load on them, causing their costs to go higher.
- Reputational Damage: Causes customers to lose trust or respect for a company, an example of this could be EA crashing Rockstar game’s servers during the launch of GTA6.
Real Word Example
On New Year’s Eve 2015, the BBC was the victim of a DDoS attack that took its website offline. The site’s readers could not access articles for several hours as their requests timed out or returned internal error messages. The group that claimed responsibility, New World Hacking, says it carried out the DDoS simply as a test of its capabilities.
In 2023, Microsoft experienced a large-scale layer 7 DDoS attack that caused Azure, OneDrive, and Outlook outages. The hacktivist group Anonymous Sudan claimed responsibility. The attackers used techniques such as HTTP flooding and Slowloris to overwhelm web servers, causing major disruptions for Microsoft customers around the world.
Task 3 Questions and Answers:
Question 1: Which attacker motive aims to make customers lose confidence in a company?
Answer: Reputational Damage
Question 2: Which motive most likely drove the 2023 DDoS attack against Microsoft?
Answer: Hacktivism
Log Analysis
Task 4 Information
Web server logs are the primary evidence used when investigating DoS attacks. Almost every web service, weather it be Apache, NGINX, or Microsoft IIS keeps records of nearly everying going on with the system, these records are crucial for examining the evidence for DoS and DDoS attacks.
Some specific indicators to look for include
- High Request Rate: Hundreds of thousands of requests going to a single web page that doesn’t normally have that many suck as /login
- Odd User-Agents: “curl/7.6.88” or “Python-urllib/3.x” can indicate that odd traffic, spoofted traffic, or automated traffic is occuring.
- Geographic Anomalies: Most of your customers are based in the US but sudently there is a surge of traffic from various addresses around the world.
- Burst Timestamps: 50 requests for the /search endpoint in 1 second.
- Server Errors: A significant and unusual amount of 503 Service Unavailable responses indicates that a service is no longer servicing requests.
- Logic Abuse: GET /products?limit=999999999, this could cause the products service, if it’s misconfigured, to break down from the huge load of information it will attempt to service.
It’s important to maintain an active watchlist for these indicators.
Targeted Resources
An attacker can take an inventory of the most commonly used or exposed endpoints on a web server, and target specifically those. Pages such as /login or other search forms are prime targets.
Here’s a list of some primary targets:
/login- involves authentication processes/search- requires complex database queries/apiendpoints - critical for dynamic content delivery/registeror/signup- requires database writes and validation/contactor/feedback- requires database entries and can trigger email notifications/cartor/checkout- requires session management, inventory checks, and payment processing
Log Sample
- Normal User Traffic — Starting at 10:01:02 the traffic is spaced out normally, and the user-agents are normal.
- DoS attack — Starting at 10:01:10 in the span of around 10 seconds hundreds of GET requests get sent to /login.php
- The result is that legitimate requests get responses of 9 bytes and status codes of 503, indicating the service is down.
Task 4 Questions and Answers:
Question 1: What is the attacker’s IP address?
Answer: 203.12.23.195
Explanation: In the logs we see this IP make a slew of the same type of request, this matches our High Request Rate indicator
Question 2: Which page is repeatedly targeted by the attacker’s requests?
Answer: /login
Question 3: After the attack, what error code do legitimate users receive?
Answer: 503
Get Samuel McLamb’s stories in your inbox
Join Medium for free to get updates from this writer.
Explanation: The attacker started receiving 503 errors, after this everyone else was receiving 503 errors.
Leveraging SIEMs
Task 5 Information
Security Information and Event Management (SIEM) platforms are systems that make log analysis easier and streamlined. Instead of scrolling manually through thousands of lines of log entries, you can filter and look at specific types of log statistics based on IP address, user-agent, or response code or size.
There is a DoS example where 1,000 requests are made to /login.php
Statistics is a powerful tool for detecting DoS/DDoS attacks. As we will see with the following questions:
Task 5 Questions & Answers
Question 1: What was the most frequently requested uri?
Answer: /search
Explanation: If we go click on the uri_path field we can see that the search value comes up at 81.8%
Question 2: Which clientip made the most requests to the target uri?
Answer: 203.0.113.7
Explanation: Use this search to filter for the specific uri:
index=”main” AND uri_path=”/search”
Then click on the clientip field and look at the top ip address
Question 3: How many IP addresses were part of the botnet that attacked your website?
Answer: 60
Explanation: We can narrow down the malicious ip subnet to the 203.0.113.0/24 subnet, based on how many of them we see quering the /search endpoint, also all of them have weird user-agents like “libwww-perl/6.05”, “curl”, “Java/1.8.0_181”, and so on. From here we can simply use a wildcard search like index=”main” clientip=”203*” to isolate the subnet that is doing the attacking. After this we look at the clientip field and see that the number of possible fields is 60.
Question 4: Which useragent was most commonly used by the attacking traffic?
Answer: Java/1.8.0_181
Explanation: from the same filter we were on simply check the useragent field’s top value.
Question 5: Use the timechart command to visualize the requests.
What is the peak number of requests made per second during the attack?
Answer: 207
Explanation: the timechart allows you to use see blocks of certain events in a specified period of time, for us this is 1 second.
per the splunk documentation:
we also want to be able to count out y value based off of a request, so after we specify the span we will say count by uri_path this will show us a graph that looks like this:
The higher peak has a value of 207.
Question: Which legitimate (non-attacking) clientip received the first 503 response status post-attack?
Answer: 10.10.0.27
Explanation: We need to filter for two things here, we need to filter for the status of 503, and we also need to filter for an ip on the 10.10.0.0/24 network. The command for this is:
index=”main” AND status=503 AND clientip=10*
It’s not perfect because the 10* doesn’t represent a subnet, but it works for our purposes.
After applying this filter we get this data segment:
If we go to that first block, then the first event within the first block, we can see that the first has an ip address of 10.10.0.27:
Defense
Task 6 Information
Defending against DDoS attacks has become much easier with the advent of Cloudflare and widespread CDNs, but there are still risks we must take in to account.
Application Level Defense
Secure coding practices must be followed first and foremost, if a site crashes due to a misconfigured input handling mechanism there is nothing that cloudflare or any kind of external application can do about it. An example of this is backend logic that prevents search queries from being over a certain character threshold.
Challenges
One way to prevent bots from making requests is to have some type of challenge that only a human can easily solve, these challenges are called CAPTCHAs, and they are what prevent slow down bot traffic on the internet.
Network and Infrastructure Defenses
Content Delivery Network (CDN)
CDNs cache static pages on edge servers and when a website get’s requested it will typically get resolved through DNS to one of those servers, when requests that aren’t cached are made they are forwarded to one of the origin servers. This principle reduces latency and allows the origin servers to make requests at a much faster rate. This additionally largely mitigates DDoS attacks. CDNs provide load-balancing to ensure requests are balanced evenly among servers.
Web Application Firewall (WAF)
Most CDNs integrate WAFs for their customers’ servers. They allow, challenge, or block requests based off a set of rules that often detect DoS and DDoS attacks. They also usually provide customers with a way of creating their own rules.
For example a firewall rule might rate limit the /login.php endpoint, and if a IP address requests the page more than five time in under three seconds each time, that IP address might be blacklisted.
Modern Large-Scale Mitigations are quite impressive. Google, with it’s vast distributed infrastructure, absorbed a massive DDoS attack that peaked at nearly 398 million requests per second. Cloudfare does take the claim to the highest ever mitigated DDoS attack ever recorded of 11.5 Tbps, one that lasted only 35 seconds. These real world examples show how providers use global networks and traffic filtering to keep some of the largest attacks from taking their customers offline.
Bypassing Security Measures
One way attackers creatively bypass the measures that CDNs put in place to stop DDoS attacks, attackers might trick the edge server into forwarding the request to the origin server by appending random GET parameters, if the CDN has a cached page at /products, the attacker could request something like /products?param=randomstuff.
Task 6 Questions and Answers
Question 1: What type of security challenge blocks bots by asking users to solve a simple puzzle?
Answer: CAPTCHA
Question 2: Which CDN feature spreads traffic across multiple servers to prevent overload?
Answer: Load-balancing
Conclusion
Task 7 Information
We explored different types of DoS attacks, as well as DoS forensics, detection with text logs, detection with splunk. We also explored defenses, such as CDN solutions.
Answer Glossary
Task 2 Questions & Answers:
Question 1: What class of attack relies on disrupting the availability of a web service?
Answer: denial-of-service
Question 2: What do we call the network of compromised machines that attackers use to launch DDoS attacks?
Answer: botnet
Task 3 Questions and Answers:
Question 1: Which attacker motive aims to make customers lose confidence in a company?
Answer: Reputational Damage
Question 2: Which motive most likely drove the 2023 DDoS attack against Microsoft?
Answer: Hacktivism
Task 4 Questions and Answers:
Question 1: What is the attacker’s IP address?
Answer: 203.12.23.195
Question 2: Which page is repeatedly targeted by the attacker’s requests?
Answer: /login
Question 3: After the attack, what error code do legitimate users receive?
Answer: 503
Task 5 Questions & Answers
Question 1: What was the most frequently requested uri?
Answer: /search
Question 2: Which clientip made the most requests to the target uri?
Answer: 203.0.113.7
Task 6 Questions and Answers
Question 1: What type of security challenge blocks bots by asking users to solve a simple puzzle?
Answer: CAPTCHA
Question 2: Which CDN feature spreads traffic across multiple servers to prevent overload?
Answer: Load-balancing
