Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a website. Suppose someone will code a program that will click continuously on the links of my webpage: could this lead to a DoS attack ?

share|improve this question

closed as unclear what you're asking by TildalWave, Xander, Iszi, D.W., Rory Alsop Jul 30 '14 at 9:15

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

Nobody needs to write a program to click on your links. They just need to write a program that duplicates the requests that are generated when those links are clicked. This can be done much faster than anything that has to simulate UI interaction, and doesn't even need to wait on your site to process one request before the next is sent. –  Iszi Jul 29 '14 at 16:44
What research have you done? There is lots written on denial of service (and there's lots on this site, under the tag denial-of-service). You might want to start by reading the Wikipedia article on denial-of-service; see, e.g., application-level floods and unintentional denial of service, which seem to cover your situation. As the FAQ explains, this is a site for information security professionals; if you are new to this area, it helps to do some research before asking, to help you pose a more narrowly crafted question. –  D.W. Jul 29 '14 at 17:30

2 Answers 2

up vote 21 down vote accepted

The question is a bit vague, the short answer is Yes clicking on links could DoS your site.

A for a more in-depth answer you would need to look at what those links are doing. For example if every time you clicked a link it ran some monstrous database query that used all your CPU power or Disk IO, or if the links played a video that would quickly saturate your outbound bandwidth it wouldn't take a lot of clicking to DoS your site.

I've seen this happen with people's personal blog that's hosted at home on an ADSL connection and more than one person viewing a video at a time DoSes their site.

On the other hand if your links were to static HTML or something easily cached it would take a whole lot of clicking to DoS your site.

share|improve this answer
see related: en.wikipedia.org/wiki/Slashdot_effect - lots of honest traffic (flash mob) causing a website to go down. Just people clicking to view the site. Not that far of a stretch of many people clicking a link once... to one person clicking many times. –  WernerCD Jul 29 '14 at 15:04
@WernerCD: That would depend on the bandwidth of the client, most servers should be more capable than a single client. The problem with being slashdotted is that you can't efficiently block requests, as it's essentially a DDoS "attack". –  Bergi Jul 29 '14 at 17:13
@Bergi The question is: Can simple clicks lead to DoS? Specifically, me clicking real fast (paraphrased). Of course the bandwidth available will affect how many clicks lead to a "DoS". A self-hosted website, behind a home connection will need much fewer clicks than something hosted on a high-availability AWS... This question made me think of the slashdot effect because that's basically what it is, death by a million clicks. –  WernerCD Jul 29 '14 at 19:32

Actually, sending a lot of requests (and wildly clicking is one of the way of doing that) is what the DoS is about.

DoS is not about sending some specially prepared data that will kill your site (like exploits, ping of deaths etc.). It's about sending a lot of requests which are cheap to send but takes a long to process.

If someone writes the program that would 'click' the link (send GET/POST) and then receive/parse the response, it would be very inefficient since they will exhaust their resources (network bandwitch, CPU, memory) probably much quicker than your site.

Much more effective would be to send-and-forget the GET (don't read the data that your server is returning).

If your server creates a new session for every visit, and that session is expensive, such program can quickly kill your server. My collegue has said his client's JSF site was killed by google bot, because google bot visited each link without cookies, so every subpage visited has caused the creation of a new JSF session, which are quite expensive.

share|improve this answer
Actually, DoS can very well be about sending prepared data to the server. What you are thinking about is DDoS. It would be very hard for one person alone to DoS a page without sending prepared data which exploits a weakness of the site. –  tim Jul 29 '14 at 9:58
@tim I doubt we've seen the last DOS that uses something like NTP to saturate connections. As long as we develop new software, we will have new exploits to go along with it that allow a single person to DOS a website with surprisingly little effort. –  Nate Kerkhofs Jul 29 '14 at 11:06