Initiating Advanced DHCP Exhaustion Attacks and Stress Tests (with examples)

Introduction

The dhcpig command is a tool that allows users to perform advanced DHCP (Dynamic Host Configuration Protocol) exhaustion attacks and stress tests. It can be used to test the DHCP server’s limits by simulating a large number of DHCP client requests, thereby exhausting all available IP addresses and potentially causing disruptions in the network.

In this article, we will explore various use cases of the dhcpig command, along with the corresponding code examples, motivations, explanations, and example outputs for each use case.

Use Case 1: Exhaust All Available DHCP Addresses

Code Example

sudo ./pig.py eth0

Motivation

This use case is helpful when you want to test the DHCP server’s ability to handle a large number of client requests and exhaust all available IP addresses. By running dhcpig with the specified interface (in this case, eth0), the command will continuously send DHCP discovery packets to request IP addresses until all available addresses are exhausted.

Explanation

• sudo: Runs the command with root privileges, as dhcpig requires root access to initiate the DHCP exhaustion attack.
• ./pig.py: Executes the dhcpig command.
• eth0: Specifies the network interface to use for sending DHCP requests.

Example Output

DHCP exhaustion attack initialized on interface eth0.

Sending DHCP discovery packets...
[+] Request sent to 10.0.0.1
[+] Request sent to 10.0.0.2
[+] Request sent to 10.0.0.3
...
[+] Request sent to 10.0.0.255
All available DHCP addresses exhausted.

Use Case 2: Exhaust IPv6 Addresses

Code Example

sudo ./pig.py -6 eth1

Motivation

IPv6 is the next generation Internet Protocol, and testing DHCP server’s ability to handle IPv6 address allocation is crucial. This use case allows you to exhaust IPv6 addresses on the specified network interface (eth1).

Explanation

• sudo: Runs the command with root privileges.
• ./pig.py: Executes the dhcpig command.
• -6: Specifies that the target IP addresses are IPv6.
• eth1: Specifies the network interface to use for sending IPv6 DHCP requests.

Example Output

IPv6 DHCP exhaustion attack initialized on interface eth1.

Sending IPv6 DHCP discovery packets...
[+] Request sent to 2001:db8::1
[+] Request sent to 2001:db8::2
[+] Request sent to 2001:db8::3
...
[+] Request sent to 2001:db8::ffff
All available IPv6 DHCP addresses exhausted.

Use Case 3: Send Fuzzed/Malformed Data Packets

Code Example

sudo ./pig.py --fuzz eth1

Motivation

Fuzzing is a technique used to test the robustness of a system by injecting malformed or unexpected data. This use case allows you to test the DHCP server’s response to fuzzed/malformed DHCP packets on the specified interface (eth1).

Explanation

• sudo: Runs the command with root privileges.
• ./pig.py: Executes the dhcpig command.
• --fuzz: Enables the sending of fuzzed/malformed DHCP packets.
• eth1: Specifies the network interface to use for sending DHCP requests.

Example Output

Fuzzed DHCP packets attack initialized on interface eth1.

Sending fuzzed DHCP discovery packets...
[+] Fuzzed request sent to 192.168.0.1
[+] Fuzzed request sent to 192.168.0.2
[+] Fuzzed request sent to 192.168.0.3
...
[+] Fuzzed request sent to 192.168.0.255

Use Case 4: Enable Color Output

Code Example

sudo ./pig.py -c eth1

Motivation

Enabling color output enhances the readability of the output and makes it easier to distinguish different types of messages or alerts during the DHCP exhaustion attack on the specified interface (eth1).

Explanation

• sudo: Runs the command with root privileges.
• ./pig.py: Executes the dhcpig command.
• -c: Enables color output.
• eth1: Specifies the network interface to use for sending DHCP requests.

Example Output

Color output enabled.

DHCP exhaustion attack initialized on interface eth1.

Sending DHCP discovery packets...
[+] Request sent to 192.168.1.1
[+] Request sent to 192.168.1.2
[+] Request sent to 192.168.1.3
...
[+] Request sent to 192.168.1.255

Use Case 5: Enable Minimal Verbosity and Color Output

Code Example

sudo ./pig.py -c --verbosity=1 eth1

Motivation

By enabling minimal verbosity, you can limit the amount of verbose output during the DHCP exhaustion attack, resulting in a cleaner and less verbose output. Combining this with color output makes it easier to identify important information.

Explanation

• sudo: Runs the command with root privileges.
• ./pig.py: Executes the dhcpig command.
• -c: Enables color output.
• --verbosity=1: Sets the verbosity level to a minimum, reducing the amount of verbose output.
• eth1: Specifies the network interface to use for sending DHCP requests.

Example Output

Minimal verbosity enabled. Color output enabled.

DHCP exhaustion attack initialized on interface eth1.

Sending DHCP discovery packets...
[+] Request sent to 192.168.1.1
[+] Request sent to 192.168.1.2
[+] Request sent to 192.168.1.3
...
[+] Request sent to 192.168.1.255

Use Case 6: Set Debug Verbosity and Scan Network of Neighboring Devices

Code Example

sudo ./pig.py -c --verbosity=100 --neighbors-scan-arp eth1

Motivation

This use case allows you to set the verbosity level to debug (level 100) for a more detailed analysis of the DHCP exhaustion attack. Additionally, it enables the scanning of neighboring devices using ARP (Address Resolution Protocol) packets to identify potential IP address conflicts or irregularities.

Explanation

• sudo: Runs the command with root privileges.
• ./pig.py: Executes the dhcpig command.
• -c: Enables color output.
• --verbosity=100: Sets the verbosity level to debug, providing detailed information about the DHCP exhaustion attack.
• --neighbors-scan-arp: Enables the scanning of neighboring devices using ARP packets.
• eth1: Specifies the network interface to use for sending DHCP requests.

Example Output

Debug verbosity enabled. Color output enabled.

DHCP exhaustion attack initialized on interface eth1.

Sending DHCP discovery packets...
[DEBUG] Sent DHCP discovery packet to 192.168.1.1
[DEBUG] Sent DHCP discovery packet to 192.168.1.2
[DEBUG] Sent DHCP discovery packet to 192.168.1.3
...
[+] Request sent to 192.168.1.255

Scanning neighboring devices using ARP...
[DEBUG] ARP request sent to 192.168.1.1
[DEBUG] ARP request sent to 192.168.1.2
[DEBUG] ARP request sent to 192.168.1.3
...
[DEBUG] ARP request sent to 192.168.1.255

Use Case 7: Enable Printing Lease Information, Scan and Release Neighbor IP Addresses

Code Example

sudo ./pig.py --neighbors-scan-arp -r --show-options eth1

Motivation

This use case aims to provide a comprehensive analysis of the DHCP exhaustion attack by printing lease information, scanning and releasing neighbor IP addresses, and displaying DHCP options used during the attack on the specified interface (eth1).

Explanation

• sudo: Runs the command with root privileges.
• ./pig.py: Executes the dhcpig command.
• --neighbors-scan-arp: Enables the scanning of neighboring devices using ARP packets.
• -r: Releases all neighbor IP addresses after the DHCP exhaustion attack.
• --show-options: Displays the DHCP options used during the attack.
• eth1: Specifies the network interface to use for sending DHCP requests.

Example Output

Printing lease information enabled.
Scanning neighboring devices using ARP enabled. Releasing neighbor IP addresses enabled.
DHCP options display enabled.

DHCP exhaustion attack initialized on interface eth1.

Sending DHCP discovery packets...
[+] Request sent to 192.168.1.1
[+] Request sent to 192.168.1.2
[+] Request sent to 192.168.1.3
...
[+] Request sent to 192.168.1.255

Scanning neighboring devices using ARP...
[+] Neighbor IP address: 192.168.1.1
[+] Neighbor IP address: 192.168.1.2
[+] Neighbor IP address: 192.168.1.3
...
[+] Neighbor IP address: 192.168.1.255

Releasing neighbor IP addresses...
[+] Released IP address: 192.168.1.1
[+] Released IP address: 192.168.1.2
[+] Released IP address: 192.168.1.3
...
[+] Released IP address: 192.168.1.255

DHCP options used:
- Option 53: DHCP Discover
- Option 55: Parameter Request List (Code: 1, 3, 15)

Conclusion

The dhcpig command provides a versatile tool for performing advanced DHCP exhaustion attacks and stress tests. By utilizing the various options and arguments available, you can customize the attack based on your specific requirements. Remember to use this tool responsibly and only on networks that you are authorized to test.

With the provided code examples, motivations, explanations, and example outputs for different use cases, you now have a better understanding of how to utilize the dhcpig command effectively and efficiently. Stay vigilant and always prioritize the security and stability of the network you are testing.