certharrow/sctp_dos_multi_threading repository overview

An SCTP flooding is a cyberattack designed to disrupt an established SCTP session or connection, thereby preventing communication between two endpoints. Various methods can be used to achieve this disruption.

One approach is session flooding, where the attacker inundates an established SCTP session with a massive amount of traffic. By generating numerous "chunks" containing high volumes of data and sending them directly into targeted sessions, the attacker overloads their processing power. This results in disrupted functionality, affecting system performance for legitimate users and potentially causing poor performance or system crashes for all involved parties.

Another method is an SCTP INIT attack, where the attacker repeatedly sends INIT chunks to a target system. For each INIT chunk, the target system must allocate resources to handle the expected new association, even if the association is never completed. This slows down the system, making it less responsive to legitimate traffic, and in extreme cases, can cause the system to run out of resources and crash.

Initially, all ports are scanned to find those that are open and support the SCTP protocol. Multiple SCTP sessions are then created from parallel threads, increasing linearly based on the number of failed resource consumption attempts. If few sessions fail due to insufficient resources, the number of threads will increase. The attack continues until either the user commands it to stop, or 8,000 consecutive requests fail, indicating a complete service crash.

To execute an SCTP DoS attack, Docker must be installed on the system. The tool is typically run from the command line, allowing users to specify the target host and port. It accepts two command-line arguments: -ip and -port.

Commands:

docker pull certharrow/sctp_dos_multi_threading

docker run --rm --network="host" -it certharrow/sctp_dos_multi_threading ./sctp_dos_multi_threading.bin -ip <target_ip> -port

1. ip <target_ip>: The -ip flag, followed by the target's IP address specifies the server to be attacked. Replace <target_ip> with the appropriate value for your target system.

2. port <target_port>: The -port flag, followed by the target's port number, specifies the port number to be attacked. Replace <target_port> with the appropriate value for your target system.

Example:

docker run --rm --network="host" -it certharrow/sctp_dos_multi_threading ./sctp_dos_multi_threading.bin -ip 10.0.0.1 -port 38412