TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Reflected DDoS Attack
VideoSecurityFree

DEMO: Reflected DDoS Attack

A DDoS reflected attack uses address spoofing to redirect traffic from intermediate machines toward a victim, amplifying the assault while obscuring the attacker's true origin.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A reflected DDoS attack exploits normal network behavior by forging the source IP address in outbound requests, substituting the attacker's address with the victim's. When those requests reach legitimate third-party servers, those servers send their replies to the spoofed address — the victim — rather than back to the true sender. By sending spoofed requests to many machines simultaneously, an attacker can direct a large volume of traffic at the target from sources that appear entirely unrelated to the attack itself. This indirection is a core advantage of the technique, as it separates the attacker from any direct contact with the victim and makes attribution significantly more difficult. Although reflection can theoretically occur through a single intermediary machine, it is almost universally classified as a distributed attack because a single reflector rarely generates enough traffic to overwhelm a modern server. Distributing the reflection across many machines is therefore both a practical necessity and what defines the DDoS component of this attack category. The technique is also frequently combined with amplification, where the protocol or service used as a reflector produces responses that are substantially larger than the triggering requests. The convergence of distribution, reflection, and amplification in a single attack makes this one of the more potent and difficult-to-mitigate threat patterns in network security, and understanding how address spoofing enables it is foundational to both offensive and defensive practice.

What you'll learn

What's covered

DDoS Reflected Attack

Key terms

Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Reflected DDoS Attack
A DDoS technique where an attacker spoofs a victim's IP address when sending requests to intermediary hosts, causing those hosts to direct their replies at the victim rather than the attacker.
Amplification Attack
A denial-of-service technique that exploits protocols where a small request generates a disproportionately large reply, allowing an attacker with limited resources to produce high volumes of traffic toward a victim.

Topics

Ddos Reflected Attack Ip Spoofing Icmp Traffic Amplification Network Security

Transcript

How a Reflected Attack Works

What we're going to do is a reflected attack, and what we're going to do is we're going to reflect our attack off of another machine. So this is the attacking machine, this is the victim here, and we're going to utilize all of these machines. So it's a distributed denial of service attack.

This does two things for us. Number one, we can utilize all these machines right here to do a reflection, so essentially we're making this a more powerful attack by utilizing all those machines. But number two is that we also are removing us from directly contacting this machine, which gives us a little bit more obscurity. It allows us to mask ourselves a little better in this scenario.

How we're going to do this is through address spoofing. So we're going to send an ICMP request to one of these machines, but we're going to spoof the address of this machine right here. What that will do is then this machine will think it's coming from this server, and then do a reply to that server. Well, now we can do that to many machines, and it will all come back to the server at the same time.

I'm going to show you how to do this. Remember, this is for ethical hacking purposes only. Only do this on your own network to your own machines, or on a network of machines that you've gotten permissions to carry this out. So make sure you're practicing ethical hacking.

The Demo

I'm on my demo laptop here, and we're just going to pull up a command prompt and type in ipconfig so we can see what the IP address is. So, 10.11094. That's the machine we're going to attack.

All right, we're going to reflect it off of another machine. So I'm going to pull up, actually to see the attack, we'll open up the Ethernet connection here, and so we'll monitor that. I'm going to pull up Kali Linux, and just to show you, ip a, just to show you the IP address of this. It's 10.110.18. So we're attacking 194 from 198.

So what we're going to do is we're going to do sudo hping3. And this is going to be, we're going to ping 10.1.30.23, which is some web server that's on a whole other network. It's not even on this network. And we're going to spoof the address 10.110.194. So the request is going to 10.1.30.23, but the reply should come back to 10.110.194 instead of this machine. And we're going to do MP, so ICMP, and this is going to be a flood attack, so we should see a lot of them.

So we'll hit enter on there. As soon as we do that, we can see that it's coming in. The source that it's coming in from is 10.1.30.23, and it's coming to this machine. So we see a ton of it. Uh-oh. We must have overwhelmed that machine on the other side and it must have crashed, because it's been working fine. Oh, there it goes again. So now we can see that we're getting replies back from this other machine. So we've reflected the attack off of that web server that's on a whole other network.

Is Reflection Always Distributed?

Now, I will tell you one thing that I struggle a little bit with, and that is calling all reflection attacks a type of DDoS attack. And the reason is because this reflection seems like it could happen off of just a single machine. Here I've got a machine right here, an adversary that I can reflect off of this machine to attack this victim right here. However, most sources that I look at really claim that this is a type of DDoS, that almost always you're reflecting it off of many machines.

And you're probably always reflecting it off of many machines, because if you were just to target a single machine and use just a single machine as reflection, you're really kind of attacking two machines. You're attacking this machine right here and this machine right here. And then if this machine doesn't have enough resources, you're not going to overwhelm this server right here. So you probably have to distribute this, have it off of many different machines, so that way you can get enough traffic to go against this victim machine right here. So just realize in almost all cases it's considered a DDoS. However, the idea of reflection seems like it could occur off of just one machine.

Combined with Amplification

Now this type of attack is often, to most of the time, combined with some sort of amplification attack. So we've got a distributed denial of service and a reflected attack and an amplification attack all rolled into one. And by doing the amplification attack, we can amplify it by the reply back being much bigger than the request.

So here's that attack card for reflected DDoS attack. The idea is that we'll reflect off of other machines to the victim, taking the attack to the victim reflected off of these other machines.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →