The following are the steps demonstrate an Dos attacks using Nmap NSE:
- Prior to using Nmap NSE scripts to perform DoS testing, we will need to identify what DoS scripts are available. There is a greppable script.db file in the Nmap NSE script directory that can be used to identify scripts in any given category:
- By grepping DoS from the script.db file and then piping the output to a cut function, we can extract the scripts that can be used. By reading the beginning of any one of the scripts, we can usually find a lot of helpful information:
- To read the script from top to bottom, we should use the cat command on the file and then pipe the output to the more utility. The top part of the script describes the vulnerability that it exploits and the conditions that must exist for a system to be vulnerable. It also explains that the exploit will cause a blue screen of death (BSOD) DoS. By scrolling further down, we can find more useful information:
- Further down in the script, we can find a description of the script usage and the arguments that can be supplied with the script. It also provides additional details about the vulnerability it exploits. To execute the script, we will need to use the --script option in Nmap:
- In the example provided, Nmap is directed to only scan TCP port 445, which is the port associated with the vulnerability. The --script option is used in conjunction with the argument that specifies the script to be used. A single script argument is passed to indicate that an unsafe scan is acceptable.
- This argument is described as a safety switch that can be used to authorize the DoS attack. After executing the script in Nmap, the output indicates that the system is vulnerable to the attack. Looking back at the Windows XP machine, we can see that the DoS was successful, and this results in a BSOD:
