• SSPing is a DoS tool.
• SSPing program sends the victim’s computer a series of highly fragmented, oversized ICMP data packets.
• The computer receiving the data packets lock when it tries to put the fragments together.
• The result is a memory overflow which in turn causes the machine to stop responding.
• Affects Win 95/NT and Mac OS

• Land Exploit is a DoS attack in which a program sends a TCP SYN packet where the target and source addresses are the same and port numbers are the same.
• When an attacker wants to attack a machine using the land exploit, he sends a packet in which the source/destination ports are the same.
• Most machines will crash or hang because they do not know how to handle it.

• Smurf is a DoS attack involving forged ICMP packets sent to a broadcast address.
• Attackers spoof the source address on ICMP echo requests and sending them to an IP broadcast address. This causes every machine on the broadcast network to receive the reply and respond back to the source address that was forged by the attacker.
  1. An attacker starts a forged ICMP packet-source address with broadcast as the destination.
  2. All the machines on the segment receives the broadcast and replies to the forged source address.
  3. This results in DoS due to high network traffic.

• SYN attack floods a targeted system with a series of SYN packets.
• Each packet causes the targeted system to issue a SYN-ACK response, while the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue.
• SYN-ACKs are moved of the queue only when an ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the TCP three-way handshake
• Once the queue is full, the system will ignore all incoming SYN requests, making the system unavailable for legitimate users.

• WinNuke works by sending a packet with “Out of band” data to port 139 of the target host. First off, port 139 is the NetBIOS port and does not accept packets unless the flag OOB is set in incoming packet.
• The OOB stands for Out Of Band. When the victim’s machine accepts this packet, it causes the computer to crash a blue screen.
• Because the program accepting the packets does not know how to appropriately handle Out Of Band data, it crashes.

• Jolt2 enables users across different networks to send IP fragment-driven denial of service attacks against NT/2000 by making victim’s machine utilize 100% of its CPU when it attempts to process the illegal packets.

  c: \> jolt2 1.2.3.4 -p 80 4.5.6.7

• The above command launches the attack from the attacker’s machine with a spoofed IP address of 1.2.3.4 against the IP address 4.5.6.7
• The victim’s machine CPU resources reach 100% causing the machine to lock up.

• Bubonic.c is a DOS exploit that can be run against Windows 2000 machines.
• It works by randomly sending TCP packets with random settings with the goal of increasing the load of the machine, so that it eventually crashes.

  c: \> bubonic 12.23.23.2 10.0.0.1 100

• Targa is a program that can be used to run 8 different Denial Of Service attacks.
• The attacker has the option to either launch individual attacks or to try all the attacks until it is successful.
• Targa is a very powerful program and can do a lot of damage to a company’s network.

• Jolt by Jeff W. Roberson (modified by Mixter for overdrop effect) – discussed separately
• Land by m3lt – discussed separately
• Winnuke by _eci – discussed separately
• Nestea by humble and ttol – Nestea exploits the “off by one IP header” bug in the Linux IP packet fragmentation code. Nestea crashes Linux 2.0.33 and earlier and some Windows versions. A new and improved version of the Nestea Linux IP fragmentation is available
• Syndrop by PineKoan – Syndrop is a mixture of teardrop and a TCP SYN flooding attack. Affected platforms are Linux and Windows 95/NT.
• Teardrop by route|daemon9 – This type of denial of service attack exploits the way that the Internet Protocol (IP) requires a packet that is too large for the next router to handle be divided into fragments. The fragment packet identifies an offset to the beginning of the first packet that enables the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker’s IP puts a confusing offset value in the second or later fragment. If the receiving operating system does not have a plan for this situation, it can cause the system to crash.

How To Jailbreak The iPad Using JailbreakMe