-1

There's a question on infosec stack exchange here that is similar but not the same as what I want to know:

Threshold for DDOS Attack

I want to know how to calculate the amount of requests, and/or speed of requests it would take for a hacker to compromise a server's hard drives. This is how someone could theoretically gain administrative controls and total access to information.

What factors do we have to take into consideration so we can plug in some numbers?

EDIT: There are many requests that can be made, and I see that after the responses to this thread. Can this be put in to numbers? To what extent is internet security a relevant field? My computer (through which i am posting this on...) is not a server, or is it?

1
  • 1
    Welcome to the site! What do you mean by "This is how someone could theoretically gain administrative controls and total access to information"? For actual DoS, there are probably too many factors to consider. Apr 25, 2020 at 14:36

3 Answers 3

3

I want to know how to calculate the amount of requests, and/or speed of requests it would take for a hacker to compromise a server's hard drives. This is how someone could theoretically gain administrative controls and total access to information.

That's not how it works. Server security is not like a closed door or wall where you "just" need to hammer long and strong enough against it until it will finally break.

The hacker can neither "compromise a server's hard drive" nor "gain administrative controls" just by sending lots of "requests" (whatever you actually mean with this, HTTP requests?). The hacker can slow down the system or make it unreachable or maybe make it crash or maybe fill up the disk due to lots of logs messages ... but not gain administrative access this way. There need to be an actual security bug or misconfiguration for this to happen.

0

If you want to know how much your server can cope you need to do a hardening testing with it, there is many factors that you need to take into consideration:

  1. What is the server do (file server, auth server, etc....)
  2. Capacity of your hardware (CPU, memory)
  3. Capacity of your farm/cluster.
  4. Capacity of the web server software.

Probably Im missing more, but you can have some of the important metrics.

0

One request

You may see calculations like "8 character alphabetic passwords will require 26⁸ requests". However, that only means that it will require at most 26⁸ to attempt all of the passwords. An attack might succeed on the first attempt (luck, password guessed/stolen from a different system, vulnerability exploit...) login with administrative credentials and take full control of the system.

PS: I should note, your question doesn't make much sense. You probably want to take one step back and reconsider your approach.

6
  • well, i don't really need to consider the approach because its still a valid question, coming from someone who's just trying to figure out how everything works on the internet. I've read that you can overwhelm a server in order to control it, which is essentially what a buffer overflow does, and once you've forced a computer to make unnecessary calculations you can do anything. Honestly this is more on a server defense side of things, how could you hard encode a "this might be a DoS" and just shut the request down for access? Forgive me, I've been wanting to learn more about internet security
    – Novelty
    Apr 26, 2020 at 4:15
  • 1
    @Novelty: "I've read that you can overwhelm a server in order to control it, which is essentially what a buffer overflow does" - this isn't what a buffer overflow does. A buffer overflow is targeting a specific bug (which need to exist in the first place) instead of just overwhelming the server. "...and once you've forced a computer to make unnecessary calculations you can do anything." - you can't. I have the feeling that you too much enrich actual facts with your own phantasy. Apr 26, 2020 at 15:13
  • @Novelty you are not paying attention and you are getting all the facts and details confused.
    – schroeder
    Apr 27, 2020 at 7:53
  • @schroeder: what's the point of even saying that without even mentioning facts and details, i feel like you are just trolling because you're simultaneously criticizing me without adding anything whatsoever to the thread.
    – Novelty
    Apr 27, 2020 at 14:04
  • @Novelty I'm referring to the very unkind comment you made that I had to delete. You ripped into Steffen for something he did not say.
    – schroeder
    Apr 27, 2020 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .