Amplification

Amplification

Amplification methods send a small request to a third-party reflector and spoof the target as the source address. The reflector sends its response to the target. The result can be much larger than the request.

These methods need a spoofable source address. They do not work from a normal home connection or from a host that filters spoofed packets.

Methods

Method	Reflector port	Request
MEM	11211	Memcached gets
NTP	123	NTP monitor
DNS	53	DNS ANY
ARD	3283	Apple Remote Desktop
CLDAP	389	CLDAP search
CHAR	19	Chargen
RDP	3389	RDP connection request

Requirements

• Root on Linux, or NET_RAW in Docker.
• A reflector list with one IPv4 address per line.
• A network that allows spoofed packets.
• A target that will receive the reflected replies.

sudo python3 start.py DNS 192.0.2.10:80 100 60 dns.txt

The reflector file path is relative to the files/ directory. dns.txt means files/dns.txt.

Creating a reflector list

A reflector is a server that will answer the relevant UDP or TCP request. Public scanners such as Zmap can find candidates, but only use lists you are allowed to use.

Example Zmap command for DNS:

zmap -p53 --output-filter='sport=53' -Mudp --probe-args=file:dns.pkt -f "saddr udp_pkt_size" -o dns.txt

The request payload must match what MHDDoS sends. A generic list of open resolvers is not enough; the service must answer the specific query.

Spoofing

MHDDoS builds the IP header with the target as the source and the reflector as the destination. The local interface address is used as the source for SYN and ICMP tests; amplification uses the target address as the spoofed source.

Two things must be true:

1. Your provider must allow packets with a foreign source address.
2. The reflector must accept the request and reply to the spoofed source.

If either fails, the method will look like it is sending packets but the target will receive nothing.

Safety and legality

Reflection attacks can affect the reflector as well as the target. Only run them on infrastructure you own or have explicit permission to test, and only with reflectors you are authorized to use.

Debugging

Run with debug logging:

sudo python3 start.py DNS 192.0.2.10:80 10 30 dns.txt debug

If the run starts but the target sees no traffic:

• confirm the reflector list is not empty;
• test one reflector manually with the same payload;
• check that your host can send spoofed packets;
• check that the target is not dropping the reflected traffic upstream.

If DOCTOR reports that raw sockets are unavailable, fix that first. On Linux, run as root or grant CAP_NET_RAW. In Docker, add cap_add: [NET_RAW].