0

I am doing penetration testing on web application in my local network. As a part of testing procedure I am planning to perform DoS testing. Because I am using just one PC I think that the only reasonable DoS attack to test will be those type of attack that do not demand sending very large number of request, I mean:

  • Slowloris - Slow HTTP Headers
  • Slow HTTP Body

But these attack are known from many years, so does this make sense to still test these vulnerabilities nowadays? Is this enough to test that the application uses actual web server, which shouldn't be vulnerable? I've read that this vulnerability depends on configuration but is this issue still actual in modern server versions (majority of articles I found come from 2010 - 2014)?

Are there any other DoS test that I should perform which are reasonable on local network and will not affect my network which is used also by other users?

2

First, I would not rely solely on banner enumeration to determine vulnerability in terms of a penetration test.

Second, it might not be correct to assume these are the only viable DoS attacks. Web applications (particularly ones that are homegrown) are often vulnerable to all kinds of interesting DoS attacks. One example might be an application server that has a connector that interfaces incorrectly with a partnering web server and a series of requests (ie. content discovery with a tool like dirs3arch) for non-existent content will cause the server to fall over.

And for the slowloris style attack, any servers that will keep connections open indefinitely when receiving incomplete requests will be vulnerable. I've found quite a few applications where this is true in real-world penetration tests.

  • 1
    Also, there are not only DoS‘ that rely on brute force; if you for example have a partial SQLi, you may be able to send all n database connections off and running indefinitely with only n specifically crafted requests, DoS‘ing the service nonetheless. Or maybe a command injection allows for a rm on the web root via a badly implemented method for file management. – Tobi Nary Nov 21 '17 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.