[Autogenerated] in this video we're going to try to bring down a
necessary server in an environment protected by Angela SSH Let's
visualize the next attack first.
As an attacker,
we try to launch a bite on script with the
objective to flood unnecessary server.
The script has been run against my real ssh server and as you can
see it has successfully disrupted our server.
This happened before we had our annual SSH instance running.
We need to take a look at the python script first and
don't worry if you don't know Peyton,
I will explain everything in enough detail so that even people
who do not code every day will understand,
we noticed that we use the ssh part on library to attempt to
launch connection requests to our ssh server.
We take the host name as an argument when calling this program.
We then create a session object,
we set the host that we capture from the argument list and we are called the
ports 22 as this is the standard one for SSH we then call the connect
function to establish the connection in the entry point of the program
recall the launch function which holds the code that we've already seen now
that we have all the information.
Let's try to execute this from a windows machine.
I will execute are biting script on the SSH instance that we the vicious
black hat hacker believed that the real ssh server is deployed on we will
then analyze the network packages as well as to check if our real service
is disrupted or not in our simulation.
Our Attackers don't know that on the standard SSH board,
there is no real SSH service,
but just a decoy server powered by endless SSH As soon as we start the script,
we can see only that there is nothing in the consult
looking in the endless SSH logs.
We see that many connections are attempting to flood our
server different from the previous video.
Those connections are dropping after some time but it will still
be costly for the attacker since many resources will be kept
busy trying to flood a decoy server.
We can consider this as an active defense technique even
though we are not trying to hack back,
we will still inflict costs on our Attackers,
keeping their resources busy and leaving our real services out of harm's way.
Let's analyze the network traffic through Wireshark you can see that the
server doesn't reply with its own identification string.
Instead it will send a random string to the client every 10 seconds.
This prevents the handshake from completing trapping the
attacker and keeping its resources busy.
Before we finish this video,
let's do a recap of what we've seen during this module,
we define what endless his age is,
We saw how to install and how to properly configure it to offer the
best protection we then try to simulate some attacks.
An active discovery type of attack as well as a denial of service and saw how
Angela SSH is protecting us against this kind of techniques.
I hope that you had fun watching this module as much as I did creating it,
and I hope all this information will be useful for you in
our objective to protect your ssh service.
Thank you for taking this course with me.
If you have any questions or feedback,
feel free to ping me on twitter or reach out to me
via the email shown on the screen.