-1

There's a question on infosec stack exchange here that is similar but not the same as what I want to know:

Threshold for DDOS Attack

I want to know how to calculate the amount of requests, and/or speed of requests it would take for a hacker to compromise a server's hard drives. This is how someone could theoretically gain administrative controls and total access to information.

What factors do we have to take into consideration so we can plug in some numbers?

EDIT: There are many requests that can be made, and I see that after the responses to this thread. Can this be put in to numbers? To what extent is internet security a relevant field? My computer (through which i am posting this on...) is not a server, or is it?

  • 1
    Welcome to the site! What do you mean by "This is how someone could theoretically gain administrative controls and total access to information"? For actual DoS, there are probably too many factors to consider. – multithr3at3d Apr 25 at 14:36
3

I want to know how to calculate the amount of requests, and/or speed of requests it would take for a hacker to compromise a server's hard drives. This is how someone could theoretically gain administrative controls and total access to information.

That's not how it works. Server security is not like a closed door or wall where you "just" need to hammer long and strong enough against it until it will finally break.

The hacker can neither "compromise a server's hard drive" nor "gain administrative controls" just by sending lots of "requests" (whatever you actually mean with this, HTTP requests?). The hacker can slow down the system or make it unreachable or maybe make it crash or maybe fill up the disk due to lots of logs messages ... but not gain administrative access this way. There need to be an actual security bug or misconfiguration for this to happen.

| improve this answer | |
0

If you want to know how much your server can cope you need to do a hardening testing with it, there is many factors that you need to take into consideration:

  1. What is the server do (file server, auth server, etc....)
  2. Capacity of your hardware (CPU, memory)
  3. Capacity of your farm/cluster.
  4. Capacity of the web server software.

Probably Im missing more, but you can have some of the important metrics.

| improve this answer | |
0

One request

You may see calculations like "8 character alphabetic passwords will require 26⁸ requests". However, that only means that it will require at most 26⁸ to attempt all of the passwords. An attack might succeed on the first attempt (luck, password guessed/stolen from a different system, vulnerability exploit...) login with administrative credentials and take full control of the system.

PS: I should note, your question doesn't make much sense. You probably want to take one step back and reconsider your approach.

| improve this answer | |
  • well, i don't really need to consider the approach because its still a valid question, coming from someone who's just trying to figure out how everything works on the internet. I've read that you can overwhelm a server in order to control it, which is essentially what a buffer overflow does, and once you've forced a computer to make unnecessary calculations you can do anything. Honestly this is more on a server defense side of things, how could you hard encode a "this might be a DoS" and just shut the request down for access? Forgive me, I've been wanting to learn more about internet security – Novelty Apr 26 at 4:15
  • 1
    @Novelty: "I've read that you can overwhelm a server in order to control it, which is essentially what a buffer overflow does" - this isn't what a buffer overflow does. A buffer overflow is targeting a specific bug (which need to exist in the first place) instead of just overwhelming the server. "...and once you've forced a computer to make unnecessary calculations you can do anything." - you can't. I have the feeling that you too much enrich actual facts with your own phantasy. – Steffen Ullrich Apr 26 at 15:13
  • @Novelty you are not paying attention and you are getting all the facts and details confused. – schroeder Apr 27 at 7:53
  • @schroeder: what's the point of even saying that without even mentioning facts and details, i feel like you are just trolling because you're simultaneously criticizing me without adding anything whatsoever to the thread. – Novelty Apr 27 at 14:04
  • @Novelty I'm referring to the very unkind comment you made that I had to delete. You ripped into Steffen for something he did not say. – schroeder Apr 27 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.