DoS testing as a part of penetration testing

Question

I am doing penetration testing on web application in my local network. As a part of testing procedure I am planning to perform DoS testing. Because I am using just one PC I think that the only reasonable DoS attack to test will be those type of attack that do not demand sending very large number of request, I mean:

• Slowloris - Slow HTTP Headers
• Slow HTTP Body

But these attack are known from many years, so does this make sense to still test these vulnerabilities nowadays? Is this enough to test that the application uses actual web server, which shouldn't be vulnerable? I've read that this vulnerability depends on configuration but is this issue still actual in modern server versions (majority of articles I found come from 2010 - 2014)?

Are there any other DoS test that I should perform which are reasonable on local network and will not affect my network which is used also by other users?

Answer 1

First, I would not rely solely on banner enumeration to determine vulnerability in terms of a penetration test.

Second, it might not be correct to assume these are the only viable DoS attacks. Web applications (particularly ones that are homegrown) are often vulnerable to all kinds of interesting DoS attacks. One example might be an application server that has a connector that interfaces incorrectly with a partnering web server and a series of requests (ie. content discovery with a tool like dirs3arch) for non-existent content will cause the server to fall over.

And for the slowloris style attack, any servers that will keep connections open indefinitely when receiving incomplete requests will be vulnerable. I've found quite a few applications where this is true in real-world penetration tests.