Tag Info

New answers tagged

0

I'm not sure if this was what you were getting at with Automated Mitigation mentioned by @theterribletrivium, but they also use load balancers to distribute traffic evenly to separate servers in order for them to run as fast as possible. Although it's not the most effective way to evenly distribute users to servers, Google uses what is called Round-robin ...


3

My company has dealt with DDoS attacks up to 180gbps and here are my techniques that I have used to mitigate. The size of a website doesn't only make it a bigger target, things that also play a significant role are: Public relations (Are you marketing yourself as something you are not, what people are you targeting) Delivering on promises Treating ...


5

As a mid-sized company, we use a DOS mitigation service to reduce the risk of our website from being knocked offline. Our site resolves to the provider's IP address. The provider then forwards the request to our webserver. Our webserver only communicate with the provider. They then use their tools to determine if certain attacks are actual attacks by using ...


41

They generally have a very layered approach. Here are some things I've either implemented or seen implemented at large organizations. To your specific question on smaller businesses you generally would find a 3rd party provider to protect you. Depending on your use case this may be a cloud provider, a CDN, a BGP routed solution, or a DNS-based solution. ...


8

While there are no real counter measures for DDOS, there are someways to control it. First is by using a Content Delivery Network, Using several data centers across the world to serve contents to visitors from different geographical areas. This helps to eliminate single point of failure and makes it harder to exhaust resources or saturate the links and ...


0

The generic approach for a cache is to keep it in sync with the database. Right now you have some system, with RAM, that can decide whether a username+password is correct or not by checking with regards to its RAM contents, letting it flow to the database if the information is not in RAM (or is deemed too old in some way). If you can arrange for password ...


1

Routers usually has running lightweight Web server that provides access to the configuration web interface. In most cases, it runs on port 80, 8080 or other common one (if isn't changed by the user). The attacker (standing in the local subnet, if something like "Remote administration" is not enabled on the router, and the WAN port has public IP address) can ...


7

There are three main ways a SYN flood can work against a home router: If the router is performing NAT and has a port forwarded to a server, a SYN flood can fill up the router's NAT table, causing it to drop connections. The SYN flood can act as a simple bandwidth-starvation attack. A typical home router is on an asymmetric connection with limited upstream ...


3

Had done some work in this area myself while studying in College, found this website really useful: http://www.amanhardikar.com/mindmaps/Practice.html You will find what you are looking for in the "Vulnerable Operating System Installations" Make sure to check out the OWASP for goodies as well: https://code.google.com/p/owaspbwa/ sourceforge with some goods ...


2

By default, no, there is no need for administrative privileges for HTTP DoS, nor spamming nor pure UDP DoS (flooding UDP packets to the target in order to exhaust their bandwidth). However, the compromised system may have a firewall or some other security software preventing the malware from doing its thing, in which case administrator privileges will be ...


2

Sending HTTP request packets doesn't requires any privilege. The main aim behind sending HTTP request is to force the server or application to allocate the maximum resource in response to a single request. Two type of request can be used GET and POST. HTTP GET request is used to request the static contents and POST is used to request the dynamic contents. To ...


3

You might want to clarify if you're looking for DoS or DDoS protection. See this answer for more details. In a typical web-application architecture, the WAF stands in front of your web-application, either in your network zone (e.g. DMZ) or within an external service provider network that filters the traffic for you. In case of a DDoS attack, the WAF will be ...


-4

There are various solution in the market which can be used to protect from DDoS attack and depends on the device means what are methods used by the device to protect from layer 7 DDoS. If you want to use products available in the market then its fine because most of the products uses same and good techniques or if you are planning to use iptables then you ...


4

Akamai and Cloudflare provide DDoS protection services which will disperse traffic using DNS load balancing, blacklist bots, and filter attacks before they reach your server(s). LOIC produces an HTTP GET flood, this is not an advanced DoS technique but rather a simple script to carry out a trivial attack. Any worthwhile DDoS prevention product should solve ...


1

It's going to vary for every single attack. With DoS attacks, you can looks for attributes that are different than "real" requests, say values that are out of range, or the lack or specific format of a particular piece of data like a user-agent or referer in a HTTP request. Generally speaking for DDoS attacks, if the traffic gets to the server, you've ...


2

Assuming that the server is in production and that standard rules of thumb apply about having 30% spare capacity (I'm rounding down to 30Mbps spare capacity) and that the outbound pipe is 2x the inbound pipe (as is normal for web servers), the server is already receiving approximately 35Mbps on its inbound pipe, leaving 65Mbps free. This is 65,000,000 bps ...


0

Specific answer: DDoS Perl IrcBot v1.0 / 2012 by DDoS Security Team Disclaimer This was done around this specific version of this malware (called later tool)... This is not an general method! Playing with malwares and viruses could become harmful! Use a dedicated hardware, user, idealy not connected to Internet! You've been warned! Introduction I post ...


0

Another useful means to counteract on your own (without the need for third party services), is to specify low DNS' A record TTLs, which will allow the victim to direct traffic somewhere else relatively quickly.



Top 50 recent answers are included