Section: .. / distributed /
|
Denial of Service tools are for use when testing your own machines only. Use of these tools on a test network is the only way to build a stable network enabled product that will not crash under the load of a distributed packet flood.
|
| /// File Name: |
saltine-cracker-1.05.00.tar.gz |
Description:
|
Saltine Cracker v1.05 is a TCP/IP Distributed Network Password Auditing Tool for NTHASH (MD4) and POSIX LibDES Crypt(3) passwords. With the incorporated cross-compatiblity, you can audit Win9X/NT client passwords attached to POSIX servers and vice-versa.
| | Author: | Ambient Empire. | | File Size: | 24051 | | Last Modified: | Aug 17 02:07:14 1999 |
| MD5 Checksum: | dd7b4dc6f6572dac714e538eda547ab2 |
|
| /// File Name: |
scrutinizer-1.02.tar.gz |
Description:
|
The scrutinizer toolkit is designed to protect Web servers from HTTP (D)DoS attacks. It is a toolkit consisting of an analysis engine which analyzes Web server access logfiles in almost real time, an Apache module which is able to block wrongdoers on the Web server, an extension to block offenders with netfilter firewalls, and a set of visualization tools. The analysis engine uses statistical anomaly detection to expose offenders. The engine has to be trained with old log files so that it can adapt itself to your system.
| | Author: | Markus Roth | | Homepage: | http://www.solutix.ch/scrutinizer | | File Size: | 55121 | | Last Modified: | Dec 31 23:32:46 2004 |
| MD5 Checksum: | d657105db587ae9a595b953ea44cad2c |
|
| /// File Name: |
scrutinizer-1.03.tar.gz |
Description:
|
The scrutinizer toolkit is designed to protect Web servers from HTTP (D)DoS attacks. It is a toolkit consisting of an analysis engine which analyzes Web server access logfiles in almost real time, an Apache module which is able to block wrongdoers on the Web server, an extension to block offenders with netfilter firewalls, and a set of visualization tools. The analysis engine uses statistical anomaly detection to expose offenders. The engine has to be trained with old log files so that it can adapt itself to your system.
| | Author: | Markus Roth | | Homepage: | http://www.solutix.ch/scrutinizer | | Changes: | Bugfix release. | | File Size: | 72126 | | Last Modified: | Jan 11 02:42:35 2005 |
| MD5 Checksum: | fec85dffee76c0c834baef6f0198296a |
|
| /// File Name: |
shaft_analysis.txt |
Description:
|
An analysis of the "Shaft" distributed denial of service tool. Shaftnode was recovered initially in November, 1999. Distinctive features are the ability to switch handler servers and handler ports on the fly, making detection by intrusion detection tools difficult from that perspective, a "ticket" mechanism to link transactions, and the particular interest in packet statistics, showing the "yield" of the DDoS network as a whole.
| | Author: | Sven Dietrich, David Dittrich, and Neil Long | | Homepage: | http://sled.gsfc.nasa.gov/~spock/ | | File Size: | 45788 | | Last Modified: | Mar 25 00:20:50 2000 |
| MD5 Checksum: | e3af444432b23dbc909e55320c0991b2 |
|
| /// File Name: |
shaftnode.txt |
Description:
|
Analysis of a Shaft Node and Master - This analysis is in addition to Sven Dietrich's analysis of the Shaft DDoS tool. The analysis we provide here is a description of the rootkit used and the methods of distribution of the tool.
| | Author: | Richard Wash | | Homepage: | http://biocserver.cwru.edu/~jose/ | | File Size: | 19752 | | Last Modified: | Mar 30 09:27:13 2000 |
| MD5 Checksum: | 9151ef63ab39cef209bf82545d608b9c |
|
| /// File Name: |
sickenscan.tar |
Description:
|
"gag" is a program to remotely scan for "stacheldraht" agents, which are part of an active "stacheldraht" network. It will not detect trinoo, the original Tribe Flood Network (TFN), or TFN2K agents. Tested on linux/solaris/AIX/BSD.
| | Author: | David Dittrich and Marcus Ranum | | File Size: | 20480 | | Last Modified: | Jan 6 20:23:16 2000 |
| MD5 Checksum: | 735e6aeaeb3262d11a092a649b0b7813 |
|
| /// File Name: |
siden-0.1.0.tar.gz |
Description:
|
SIDEN is a distributed network discovery tool which allows you to simulate coordinated/distributed network probes by a group of attackers against one or many target machines. It uses a client/agent architecture where the agents are installed on multiple hosts. Works well on OpenBSD and FreeBSD.
| | Author: | Lawrence Teo | | Homepage: | http://siden.sourceforge.net | | File Size: | 21157 | | Last Modified: | Oct 1 03:16:41 2000 |
| MD5 Checksum: | b5f5da44d96230d8bf03326be0662dca |
|
| /// File Name: |
skd303ddos.zip |
Description:
|
Unavailable.
| | File Size: | 14814 | | Last Modified: | Mar 5 01:01:49 2001 |
| MD5 Checksum: | c126be197418e69355b00c0492002b5c |
|
| /// File Name: |
skd36.zip |
Description:
|
Skydance v3.6 is a distributed denial of service tool for Windows. Uses the IP_HDRINCL option. Tested on Win98 and Win2k. Uses ICMP for communication.
| | Author: | Edrin | | File Size: | 19638 | | Last Modified: | Jul 19 03:26:02 2001 |
| MD5 Checksum: | 8fe6af0053bfac72292fd1f41687414f |
|
| /// File Name: |
slurpie.tgz |
Description:
|
Slurpie v2.0b - Slurpie is a passwd file cracker similar to CrackerJack and John the Ripper except that it runs in a distributed environment. It supports file based and generated dictionary comparison.
| | Author: | Adam Klosowicz. | | File Size: | 8117 | | Last Modified: | Aug 17 02:07:14 1999 |
| MD5 Checksum: | 820b4bf746e0a1297516ddd4a83958db |
|
| /// File Name: |
stachel.tgz |
Description:
|
StacheldrahtV4 - (German for "barbed wire") combines features of the "trinoo" distributed denial of service tool, with those of the original TFN, and adds encryption of communication between the attacker and stacheldraht masters and automated update of the agents.
| | File Size: | 36831 | | Last Modified: | Feb 8 23:25:28 2000 |
| MD5 Checksum: | 110065233eb12ee3a1a5c88b985f865e |
|
| /// File Name: |
stachelantigl.tar.gz |
Description:
|
Stacheldraht v1.666 + antigl + yps distributed denial of service tool.
| | Author: | Psychoid and Randomizer. | | File Size: | 191096 | | Last Modified: | Jan 26 08:49:38 2001 |
| MD5 Checksum: | 7181039d0767fd4cf4cb3a77bea3c47f |
|
| /// File Name: |
stacheldraht.analysis |
Description:
|
The following is an analysis of "stacheldraht", a distributed denial of service attack tool, based on source code from the "Tribe Flood Network" distributed denial of service attack tool. Stacheldraht (German for "barbed wire") combines features of the "trinoo" distributed denial of service tool, with those of the original TFN, and adds encryption of communication between the attacker and stacheldraht masters and automated update of the agents.
| | Author: | David Dittrich | | Homepage: | http://staff.washington.edu/dittrich | | File Size: | 43953 | | Last Modified: | Jan 4 09:25:38 2000 |
| MD5 Checksum: | 40a973414685d1eee7d607575441ca3a |
|
| /// File Name: |
stick.htm |
Description:
|
The Stick DDOS tool is a resource starvation attack against IDS systems. Many IDS systems are affected.
| | Homepage: | http://www.eurocompton.net/stick/ | | File Size: | 20049 | | Last Modified: | Mar 16 23:47:53 2001 |
| MD5 Checksum: | 2c5d68195d4c598cc87cc2fad2b59d88 |
|
| /// File Name: |
stick.tgz |
Description:
|
Stick is a distributed denial of service attack which targets IDS systems. It takes a snort rule file as input. Binary distribution.
| | Author: | Coretez Giovanni | | Homepage: | http://www.eurocompton.net/stick | | File Size: | 152159 | | Last Modified: | Mar 20 22:49:49 2001 |
| MD5 Checksum: | 453b280e24ece40bd1f9837bd2d12f9b |
|
| /// File Name: |
tfn.analysis.txt |
Description:
|
The following is an analysis of the "Tribe Flood Network", or "TFN", by Mixter. TFN is ai powerful distributed attack tool and backdoor currently being developed and tested on a large number of compromised Unix systems on the Internet. TFN source available here.
| | Author: | David Dittrich | | File Size: | 31815 | | Last Modified: | Aug 17 02:07:14 1999 |
| MD5 Checksum: | 5e83210b7399408c0735c3ea14cdfe35 |
|
| /// File Name: |
tfn.tgz |
Description:
|
Distributed flood network client/server that can be installed on a large number of hosts and used to hit a target with high bandwidth simultaneously. communicates over icmp and supports udp, syn, icmp/8, smurf flood and more. Courtesy of Mixter.
| | File Size: | 8093 | | Last Modified: | Sep 23 21:47:52 1999 |
| MD5 Checksum: | 4286277c823ee297b84142ebb50be118 |
|
| /// File Name: |
tfn2k.tgz |
Description:
|
Tribe Flood Network 2000. Using distributed client/server functionality, stealth and encryption techniques and a variety of functions, TFN can be used to control any number of remote machines to generate on-demand, anonymous Denial Of Service attacks and remote shell access. The new and improved features in this version include Remote one-way command execution for distributed execution control, Mix attack aimed at weak routers, Targa3 attack aimed at systems with IP stack vulnerabilities, Compatibility to many UNIX systems and Windows NT, spoofed source addresses, strong CAST encryption of all client/server traffic, one-way communication protocol, messaging via random IP protocol, decoy packets, and extensive documentation. Currently no IDS software will recognise tfn2k.
| | Author: | Mixter | | Homepage: | http://1337.tsx.org | | File Size: | 27134 | | Last Modified: | Dec 20 22:04:14 1999 |
| MD5 Checksum: | fc1cb14f2e24cdc2b64f93dde22f8420 |
|
| /// File Name: |
TFN2k_Analysis-1.3.txt |
Description:
|
This document is a technical analysis of the Tribe Flood Network 2000 (TFN2K) distributed denial-of-service (DDoS) attack tool, the successor to the original TFN Trojan by Mixter. Additionally, countermeasures for this attack are also covered.
| | Author: | Jason Barlow | | Homepage: | http://www2.axent.com/swat/ | | Changes: | This revision includes several new discoveries, corrections, and clarifications. Many thanks to those who responded with feedback and comments to the original posting of this paper. | | File Size: | 12384 | | Last Modified: | Mar 9 21:03:42 2000 |
| MD5 Checksum: | b5d3d9e9a39745decbd6d2d701451e77 |
|
| /// File Name: |
TFN2k_Analysis.htm |
Description:
|
This document is a technical analysis of the Tribe Flood Network 2000 (TFN2K) distributed denial-of-service (DDoS) attack tool, the successor to the original TFN Trojan by Mixter.
| | Author: | Jason Barlow and Woody Thrower of the Axent Security Team | | Homepage: | http://www2.axent.com/ | | File Size: | 14506 | | Last Modified: | Feb 12 00:07:50 2000 |
| MD5 Checksum: | 0c37df4a37a47a7796b46d5b840a3628 |
|
| /// File Name: |
tfn2kpass.c |
Description:
|
Tfn2k password recovery tool - Tfn2k asks for a password during the build, which is used to prevent someone from recovering the password from the td or tfn binaries. Usefor for forensics, or to command a whole flood network to send you mail letting you know all the machines infected, or to command an attack to stop if you can recover a binary.
| | Author: | Simple Nomad | | Homepage: | http://razor.bindview.com | | File Size: | 7716 | | Last Modified: | Feb 25 04:13:08 2000 |
| MD5 Checksum: | 85a08d1006bc2666af3ae36a80775b53 |
|
| /// File Name: |
tfn3k.txt |
Description:
|
TFN3k is a paper about the future of DDOS tools, how they can be used, and the dangerous features that can and probably will be implemented in the future. Also has information on establishing Network Intrusion Detection (NIDS) Rules for DDOS attacks.
| | Author: | Mixter | | File Size: | 13850 | | Last Modified: | Feb 15 00:35:13 2000 |
| MD5 Checksum: | f1466777d721d4f9217b4a1627315faa |
|
| /// File Name: |
TFN_toolkit.htm |
Description:
|
Analysis of TFN-Style Toolkit v 1.1 - One of our systems was compromised and prompt action by the local sysadmin prevented the hackers from running their cleanup scripts. Consequently, we were able to get the toolkit that they were using against us. This toolkit contains components that are similar to what is in the TFN toolkit.
| | Author: | Randy Marchany | | Homepage: | http://www.sans.org | | File Size: | 31282 | | Last Modified: | Jan 4 09:33:02 2000 |
| MD5 Checksum: | 041e3e37ef839cbb8854b8a129075874 |
|
| /// File Name: |
tk.tgz |
Description:
|
Torn Kit is a linux rootkit which has been optimized for linux/x86 mass installation. It is the first rootkit which uses precompiled binaries yet still allows a user defined password. This code is being widely used to automatically compromise hosts which have the wu.ftpd and rpc.statd vulnerabilities, and was mentioned in CERT's recent Incident Note IN-2000-10 advisory.
| | Author: | Johnny7 | | File Size: | 343567 | | Last Modified: | Sep 19 01:44:39 2000 |
| MD5 Checksum: | 2332de2af78eca68542fa30fb2d37283 |
|
|
|
|
|
![.:[ packet storm ]:.](/images/ps-ani.gif)
