Recently I heard about Distributed Denial of Service and Denial of Service attacks and to see how this worked, I made a quick script (this is not a debug thing, I have an actual question about Cyber Security)

function _DDoS(url){
document.body.innerHTML+='<iframe src="'+url+'" style="display:none;"> </iframe>';

Now my question here is would this work against a normal HTML site that displays text and an image or would it need to be against a site that sends post requests to a server or is in php?

I'm really sorry if this is a dumb question I can't find any helpful sites and I thought of Stack but my latest questions haven't been taken in very well.

  • 1
    This is more likely to just exhaust the client's memory - you're adding iframes to a page (each of which takes memory, even if hidden), containing a single page (which the browser would probably just provide from local cache). In other words, it is likely to cause a single request to the server, then cause your machine to run ever more slowly, until your browser crashes. – Matthew May 18 '17 at 6:37
  • Matthew is correct - you should avoid rendering pages at all. You can simply make http requests without rendering the responses – niilzon May 18 '17 at 8:00
  • Thanks @Matthew, 2 questions. First of all, would turning on something like Cache Killer stop that from happening and secondly, what could I do in JavaScript? And would any of these work:github.com/ninja25538/JavaScript-Based-DDOS/blob/master/main.js – The Gamer King May 18 '17 at 11:26

Plainly speaking, denial of service attacks can be targetted at anything. The point of a denial of service attack of that nature is simply to overwhelm the target.

Pointing this attack at something that takes longer (such as some sort of more complex php page/request) would yield a more effective denial of service attack, because the server will have to spend more time serving each request. If you're hitting a static page like index.html it's likely that that file could be cached or even served by a proxy - Depending largely on the target server's implementation.

To make the attack more effective, you should consider longer-running queries, such as things that talk to a database or to the filesystem.

Minor JavaScript note: You can use setInterval instead of setTimeout in a loop

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.