Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

1
vote
2answers
53 views

How can perpertrators of denial of service attacks, determine the impact their attack has had?

Although I know how a user could mitigate Dos attacks and detect their presence e.g. checking packets received and sent, comparing current CPU usage to normal, comparing network usage to normal etc. ...
1
vote
1answer
106 views

Is there an easy way to know if a regex is “evil”

I was reading this article (about ReDos). The examples they give are pretty simple but I'm sure such regex can hide everywhere. If there is any way to test if a regex is evil without spending a lot of ...
1
vote
2answers
81 views

Hosting multiple websites on the same server - Prevention from DoS

I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a ...
1
vote
1answer
316 views

Root/Naked domain and DDOS

Some services like Github has DDOS mitigation measures for their root/naked domain, but not other subdomain(s). What so special about the root domain concerning the DDOS attacks? [1] ...
1
vote
2answers
2k views

How to mitigate SIP Reflection Attacks?

SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks. A freeswitch server I manage has seen heaps of registration requests ...
1
vote
2answers
814 views

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
1
vote
2answers
8k views

How to conduct DDoS attack practically? [duplicate]

Possible Duplicate: How to simulate DDoS attacks from the Internet? I want to conduct a DDoS attack. Can anyone please tell how can i conduct it? What are the latest DDos attacks? What are ...
1
vote
1answer
56 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the ...
1
vote
1answer
53 views

DHCP Exhaustiation / Rogue DHCP interrupted by real DHCP NACK

I was trying to run a Rogue DHCP Server which should cause a MITM attack. I did the following Exhaust the real DHCP Server using DHCPig (worked) Run a Rogue DHCP Server using the ...
1
vote
1answer
111 views

Strange IP's on my firewall log

Check the screenshot of my router firewall log below, I can see traffic originating from strange IP addresses to my public address. What are these? I've just setup this router few hours ago, am I ...
1
vote
1answer
69 views

Is DDOS more common than DOS?

Which attack takes place more often over the internet? I would have assumed DDOS due to the amount of botnets around today.
1
vote
1answer
872 views

802.11w protected management frames - Wi-Fi

I've been reading about protected management frames, introduced in 802.11w, and had a few questions. Apparently, a message integrity check is provided with de-authentication frames, allowing either ...
1
vote
1answer
197 views

Could a large amount of wget requests be viewed as an attack?

I'm working on a program that downloads and analyzes historical stock data from Yahoo Finance. I download the data in my program by using the wget command. I have a list of about 3,000 stock symbols ...
1
vote
1answer
138 views

Slow HTTP DoS Mechanics

Our firewall detected and blocked a Slow HTTP DoS the other day. There were only a few attempts in the log. It wasn't a full on attack (there would be more traffic). My question is...if I'm an ...
1
vote
1answer
58 views

Locking an enterprise account from an internet facing application

Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind. Those application usually have a user directory (usually LDAP) in the ...
1
vote
1answer
904 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
1
vote
2answers
86 views

Using pattern matching to make a port more secure

I am planning to make a web application deployed on a port more secure by detecting the pattern of the request an then comparing it with the patern next time that IP tries to connect.Any ways to move ...
1
vote
3answers
147 views

What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls?

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to ...
1
vote
1answer
150 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
1
vote
1answer
363 views

Is a multitenant web app built on Apache Cassandra more resilient against DoS attacks?

Imagine a multitenant web app that stores data in a Apache Cassandra cluster, with fairly many nodes. Now assume that: Mallory launches a DoS attack against one tenant. (Perhaps that tenant is a ...
1
vote
0answers
81 views

Router reporting DoS-Attack from rival provider

In my (netgear) routers logs there are entries like the following, often multiple times a second since quite some time. [DoS Attack: RST Scan] from source: 80.218.64.172, port 10646, Tuesday, ...
1
vote
1answer
232 views

Slow Loris Incomplete GET Request

A slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made after extremely long periods of time, from my ...
1
vote
0answers
73 views

DOS attack to increase packets received from a single request?

Is there any attack out there that can be implemented where a single request to a server i host for example responds by sending the same file say 20 times back ? the idea behind the attack is to DOS ...
1
vote
0answers
886 views

Akamai or Incapsula (or other) for CDN with DDoS Protection? [closed]

One of our clients is launching a new site and I've been tasked with making a short overview of the advantages/disadvantages of Akamai, Incapsula or other CDN providers who are strong with DDoS ...
1
vote
0answers
2k views

Ping Of Death reconstruction against a Windows 95 virtual machine

For the sake of demonstration, I'm trying to perform a Ping Of Death sent from a Kali Linux virtual machine to a Windows 95 virtual machine (vmware) on a private network. I've set both vms correctly, ...
1
vote
0answers
525 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
1
vote
0answers
495 views

Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]

I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html I was reading... ...
0
votes
5answers
1k views

How a DOS TCP packet different from normal Packet?

a normal tcp packet shown in figure How a TCP packet that causes dos attack different from normal Tcp Packet?
0
votes
3answers
552 views

Is it possible to “close” a port by dos'ing it?

If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?
0
votes
1answer
580 views

defend against LOIC Hive Mind attack

Other than client puzzles, what are some things a website can do to defend itself against a LOIC Hive Mind attack? The Low Orbit Ion Cannon (LOIC) is an attack tool which features a user-friendly GUI ...
0
votes
2answers
187 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
0
votes
2answers
599 views

Can someone help? I'm getting Dossed!

So basically since a few days my internet started being very slow. I checked my router logs and guess what! In the log where it is a record of DoS attacks it showed something like |Description ...
0
votes
1answer
181 views

Wordpress: Thousand of mail sent to my site from an unknown user! Site is near to be blacklisted by Google

Recently an employee of mine developed a website in WordPress. Things were all fine until we received an email from Google , notifying me that some stuff that can really create security issues is ...
0
votes
3answers
2k views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
0
votes
2answers
74 views

Requesting webpage as DOS

Is it possible to launch a DOS by repeatedly requesting a webpage (refreshing)? Like holding down F5 on your browser?
0
votes
3answers
157 views

DoS on an ordinary IP [duplicate]

So, I understand DoSing to an HTTP Server. I understand Layer 7 DoS attacks and how to even make these work. But what for an normal IP that isn't HTTP and is connected to the internet. Is the only ...
0
votes
1answer
106 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
0
votes
2answers
877 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
0
votes
1answer
401 views

Preventing DoS in Ajax Calls

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not. We have this URL exposed : https://mydomain.com/validateId?id=<user ...
0
votes
2answers
399 views

Denial Of Service attack in asynchronous communication

Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario: I have a client server application were there is a WAN communication between the client and ...
0
votes
2answers
109 views

Looking for information about CVE-2006-6876 vulnerability

In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server. But I ...
0
votes
1answer
171 views

Organizing results from netstat using find on Windows [closed]

I am trying to figure out a way to natively do this within Windows without having to load any 3rd party applications. When I run: netstat -ba I want to find established connections without losing ...
0
votes
2answers
335 views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
0
votes
1answer
124 views

Finding the method of attack [closed]

My server has been repeatedly attacked in the last few days. Here's the observations: The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
0
votes
1answer
89 views

How to test DOS attacks through Router?

One of my clients has been told by their ISP that a DoS attack has happened and they have provided the logs of Juniper router. What is the criteria in routers on which we can confirm DoS attack is ...
0
votes
1answer
637 views

Is there a layer 1, 2, 5 and 6 DDoS attack? [closed]

I'm doing some research on DDoS attacks, and I seem to only be finding information on layer 3,4 and 7 attacks. When I saw 3/4 and 7 DDoS attacks, I figured they were the most popular, but there were ...
0
votes
1answer
25 views

Is there some kind of a local DoS against processes?

Is there an attack that somehow floods a target process (e.g. by repeatedly calling a WinAPI function that involves the process) and thereby crashes or temporarily disables it?
0
votes
1answer
208 views

distinguish between bots and legitimate clients [closed]

If an attack (DoS & DDoS) involves thousands of bots, how can the server distinguish them from legitimate clients?
0
votes
1answer
127 views

Identifying attacks by network activity

Is it possible (and how) to tell from a network dump if there is a buffer overflow attack, DoS or brute force attack? A DDoS would be more obvious to identify, but those attacks mentioned above I ...
0
votes
1answer
397 views

what type of attack does LOIC do? [closed]

I have used LOIC (Low Orbit Ion Cannon) earlier . Today i was reading on wikipedia that there are many types of dos attacks , namely SYN attacks , HTTP flooding ,UDP flooding ,etc and two questions ...