{"id":74,"date":"2013-09-14T17:05:00","date_gmt":"2013-09-14T15:05:00","guid":{"rendered":"http:\/\/celilsemi.erkiner.com\/blog\/?p=74"},"modified":"2020-05-29T13:57:24","modified_gmt":"2020-05-29T11:57:24","slug":"ddos-with-google-servers","status":"publish","type":"post","link":"https:\/\/celilsemi.erkiner.com\/blog\/ddos-with-google-servers\/","title":{"rendered":"DDos with Google Servers"},"content":{"rendered":"<p>In computing, a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to its intended users.<\/p>\n<p>&nbsp;<\/p>\n<p>This usually requires lots of computing&nbsp;power and good internet connection.&nbsp;And to overcome some of the precautions that can be considered normal today, &nbsp;well treated-parallel attacks are required to being done simultaneously.<\/p>\n<p>When you find a way to use huge Google servers for that kind of attack, &nbsp;this saves you from a huge burden.<\/p>\n<p>In theory, since I am writing this post, there is a way.<\/p>\n<p>We will use Spreadsheets in Google Drive and&nbsp;FeedFetcher crawler bot for that,<\/p>\n<figure id=\"attachment_75\" aria-describedby=\"caption-attachment-75\" style=\"width: 201px\" class=\"wp-caption alignnone\"><a href=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/04\/googledrivespeadsheet.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-75\" src=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/04\/googledrivespeadsheet.png\" alt=\"Google Drive Speadsheet\" width=\"201\" height=\"368\"><\/a><figcaption id=\"caption-attachment-75\" class=\"wp-caption-text\">Google Drive Speadsheet<\/figcaption><\/figure>\n<p>If we put&nbsp;<strong>=image(\u201chttp:\/\/example.com\/image.jpg\u201d)<\/strong>&nbsp;in one of the cells of Google spreadsheet, Google will send the FeedFetcher crawler to grab the image and cache it to display.<\/p>\n<p>Do that again and you will noticed it will use cached image directly instead of getting it again. But we can force it to load that image again by adding an useless GET tag to url.<\/p>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_76\" aria-describedby=\"caption-attachment-76\" style=\"width: 459px\" class=\"wp-caption alignnone\"><a href=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/04\/spreadsheeturlimagefunc.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-76\" src=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/04\/spreadsheeturlimagefunc.png\" alt=\"Google Drive Spreadsheet image Function\" width=\"459\" height=\"68\" srcset=\"https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/04\/spreadsheeturlimagefunc.png 459w, https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/04\/spreadsheeturlimagefunc-300x44.png 300w\" sizes=\"auto, (max-width: 459px) 100vw, 459px\" \/><\/a><figcaption id=\"caption-attachment-76\" class=\"wp-caption-text\">Google Drive Spreadsheet image Function<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><code>=image(\"http:\/\/celilsemi.erkiner.com\/images\/me.jpg?id=0\")<br \/>\n=image(\"http:\/\/celilsemi.erkiner.com\/images\/me.jpg?id=1\")<br \/>\n=image(\"http:\/\/celilsemi.erkiner.com\/images\/me.jpg?id=2\")<br \/>\n=image(\"http:\/\/celilsemi.erkiner.com\/images\/me.jpg?id=3\")<br \/>\n...<br \/>\n=image(\"http:\/\/celilsemi.erkiner.com\/images\/me.jpg?id=1000\")<\/code><\/p>\n<p>&nbsp;<\/p>\n<p>Appending random parameter, each link is treated as different thus Google crawls it multiple times causing a loss of outbound traffic for the website owner. So anyone using a browser and opening just a few tabs on his PC can send huge HTTP GET flood to a web server.<\/p>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_80\" aria-describedby=\"caption-attachment-80\" style=\"width: 635px\" class=\"wp-caption alignnone\"><a href=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-80\" src=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator.png\" alt=\"Csv Codes of 1000 IMAGE Funcs Creator\" width=\"635\" height=\"173\" srcset=\"https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator.png 635w, https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator-300x81.png 300w\" sizes=\"auto, (max-width: 635px) 100vw, 635px\" \/><\/a><figcaption id=\"caption-attachment-80\" class=\"wp-caption-text\">Csv Codes of 1000 IMAGE Funcs Creator<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>Little piece of php codes to create thousand Google Spreadsheet image functions, after creating tags and coping them properly, a cvs file can be created with it.<\/p>\n<p>By properly, I mean you need to be sure that there is no other text than the image function on each line.<\/p>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_81\" aria-describedby=\"caption-attachment-81\" style=\"width: 540px\" class=\"wp-caption alignnone\"><a href=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-81\" src=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator2.png\" alt=\"Csv Codes of 1000 IMAGE Funcs\" width=\"540\" height=\"914\" srcset=\"https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator2.png 540w, https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/csvfileandimgfunccreator2-177x300.png 177w\" sizes=\"auto, (max-width: 540px) 100vw, 540px\" \/><\/a><figcaption id=\"caption-attachment-81\" class=\"wp-caption-text\">Csv Codes of 1000 IMAGE Funcs<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<p>After you name this file to &#8220;anytext.csv&#8221; you can import&nbsp;it to Google Drive Spreadsheet.<\/p>\n<figure id=\"attachment_83\" aria-describedby=\"caption-attachment-83\" style=\"width: 416px\" class=\"wp-caption alignnone\"><a href=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/googlespreadsheetimport.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-83\" src=\"http:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/googlespreadsheetimport.png\" alt=\"Google Spreadsheet Import Options\" width=\"416\" height=\"540\" srcset=\"https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/googlespreadsheetimport.png 416w, https:\/\/celilsemi.erkiner.com\/blog\/wp-content\/uploads\/2014\/03\/googlespreadsheetimport-231x300.png 231w\" sizes=\"auto, (max-width: 416px) 100vw, 416px\" \/><\/a><figcaption id=\"caption-attachment-83\" class=\"wp-caption-text\">Google Spreadsheet Import Options<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<p>It worked perfectly and started immediately when I chose &#8220;Comma&#8221; as a separator.<\/p>\n<p>&nbsp;<\/p>\n<p>Perhaps there will be some limits like number of cells in Spreadsheet or number of images Google let us have in Spreadsheet. I have tried just with an image and 1000 cells. In theory it is really possible to damage a server connection.<\/p>\n<p>&nbsp;<\/p>\n<p>To Amplify the attack an url of pdf document can be used. This will provide an almost perfect ratio of bandwidths to you. You will&nbsp;request Google to put the image link in the spreadsheet, even if &nbsp;Google fetches huge amount of&nbsp;data from the server, &nbsp;since it\u2019s a PDF(non-image file), you will&nbsp;N\/A from Google.<\/p>\n<p>&nbsp;<\/p>\n<p>Servers and accounts in this post are mine. I have no intent to hurt any one or support you to hurt any one. These information is purely scientific and experimental thus I am not responsible for any usage.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In computing, a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to its intended users. &nbsp; This usually requires lots of computing&nbsp;power and good internet connection.&nbsp;And to overcome some of the precautions that can be considered normal today, &nbsp;well treated-parallel attacks are required to being [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[8],"tags":[15,16],"class_list":["post-74","post","type-post","status-publish","format-standard","hentry","category-back-end","tag-google","tag-server"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/posts\/74","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/comments?post=74"}],"version-history":[{"count":2,"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/posts\/74\/revisions"}],"predecessor-version":[{"id":307,"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/posts\/74\/revisions\/307"}],"wp:attachment":[{"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/media?parent=74"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/categories?post=74"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/celilsemi.erkiner.com\/blog\/wp-json\/wp\/v2\/tags?post=74"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}