format PE console 4.0
include 'WIN32AX.INC' 
entry main 
section '.data' data readable writeable 
CR EQU 0x0D 
LF EQU 0x0A 
wsaData WSADATA 
saddr sockaddr_in 
rHost db "192.168.21.129",0 
req db "HEAD / HTTP/1.1",CR,LF,CR,LF,0 
sizeof.req = $ - req 
hSock dd ? 
section '.code' code readable executable 
proc main 
invoke WSAStartup,0x202,wsaData 
invoke socket,AF_INET,SOCK_STREAM,0 
mov [hSock],eax 
mov [saddr.sin_family],AF_INET 
invoke inet_addr,rHost 
mov [saddr.sin_addr],eax 
invoke htons,80 
mov [saddr.sin_port],ax 
invoke connect,[hSock],saddr,sizeof.sockaddr_in 
mov ebx,3
.loop: 
invoke send,[hSock],req,sizeof.req,0 
dec ebx
cmp ebx,0
jnz .loop 
invoke closesocket,[hSock] 
invoke WSACleanup 
invoke ExitProcess,0 
endp 
section '.idata' import data readable 
library kernel32,'kernel32.dll',ws2_32,'ws2_32.dll' 
        include 'API\KERNEL32.INC' 
        include 'API\WS2_32.INC'    

I'm trying to send 1024 byte packet to 512 byte buffer to receive 2 times

I've tried also on my http server for testing but failed. When connected it just closes connection automatically when data is sent.

req db "HEAD / HTTP/1.1",CR,LF,CR,LF,0

How can I use send() function with any data what I want not only HEAD / HTTP/1.1 it was just for testing.

Edit: are you trying to write malware with DDoS function?

#if defined(__alpha__) || defined(__mips__)
#define SOL_SOCKET   0xffff
...
#else
#define SOL_SOCKET    1
...
#endif
    

/*
 * Level number for (get/set)sockopt() to apply to socket itself.
 */
#define SOL_SOCKET      0xffff          /* options for socket level */
...
    

Code:

#if defined(__alpha__) || defined(__mips__)
#define SOL_SOCKET        0xffff
...
#else
#define SOL_SOCKET    1
...
#endif
    

so SOL_SOCKET should be 0xffff on alpha and mips architectures, and 1 on all others, like x86 and x86-64.
...
I was looking at the winsock2.h file that comes with windows, and it says:

Code:

/*
 * Level number for (get/set)sockopt() to apply to socket itself.
 */
#define SOL_SOCKET      0xffff          /* options for socket level */
...
    

so I guess windows uses 0xffff

The http protocol states that the connection is stateless, among other things this means that once the client has sent a command, and the server has sent a response back, they are both supposed to disconnect. You can use the Keep-Alive flag, but that is for special cases, and is not supposed to be used in general.

drobole wrote:

The http protocol states that the connection is stateless, among other things this means that once the client has sent a command, and the server has sent a response back, they are both supposed to disconnect. You can use the Keep-Alive flag, but that is for special cases, and is not supposed to be used in general.

For HTTP/1.1, the default is to use Keep-Alive, unless the client specifies "Connection: Close".

Of course there's a shitload of broken software out there on the internet, so you can never depend on anything - HTTP/1.1 servers might close your connection even though you didn't ask for it, and clients might close their connection even though they didn't specify "Connection: Close".

Follow the robustness principle: Be conservative in what you send; be liberal in what you accept..

...
It still bugs me to this day seeing Bill Gates, back in the day, say about the W3 standard..."We don't follow standards, we set them." Grrrrrrrrrrrr.

SYN flood sends a flood of TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a half-open connection, by sending back a TCP/SYN-ACK packet, and waiting for a packet in response from the sender address. However, because the sender address is forged, the response never comes. These half-open connections saturate the number of available connections the server is able to make, keeping it from responding to legitimate requests until after the attack ends.