I have a website. Suppose someone will code a program that will click continuously on the links of my webpage: could this lead to a DoS attack ?
closed as unclear what you're asking by TildalWave, Xander, Iszi, D.W., Rory Alsop♦ Jul 30 '14 at 9:15
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The question is a bit vague, the short answer is Yes clicking on links could DoS your site.
A for a more in-depth answer you would need to look at what those links are doing. For example if every time you clicked a link it ran some monstrous database query that used all your CPU power or Disk IO, or if the links played a video that would quickly saturate your outbound bandwidth it wouldn't take a lot of clicking to DoS your site.
I've seen this happen with people's personal blog that's hosted at home on an ADSL connection and more than one person viewing a video at a time DoSes their site.
On the other hand if your links were to static HTML or something easily cached it would take a whole lot of clicking to DoS your site.
Actually, sending a lot of requests (and wildly clicking is one of the way of doing that) is what the DoS is about.
DoS is not about sending some specially prepared data that will kill your site (like exploits, ping of deaths etc.). It's about sending a lot of requests which are cheap to send but takes a long to process.
If someone writes the program that would 'click' the link (send GET/POST) and then receive/parse the response, it would be very inefficient since they will exhaust their resources (network bandwitch, CPU, memory) probably much quicker than your site.
Much more effective would be to send-and-forget the GET (don't read the data that your server is returning).
If your server creates a new session for every visit, and that session is expensive, such program can quickly kill your server. My collegue has said his client's JSF site was killed by google bot, because google bot visited each link without cookies, so every subpage visited has caused the creation of a new JSF session, which are quite expensive.