I am new to cybersecurity industry. I want to try if the company server is vulnerable to DDoS attack. Is it possible to conduct DDoS attack without damaging the live server?

What I mean is, my main target is just to take down the service, but I mean no harm to the server.

  • 2
    What do you hope to prove? That a bigger pipe can fill a smaller pipe?
    – vidarlo
    Nov 23 '21 at 10:42
  • You're asking the wrong question. Any service or server can be taken offline by a DDoS attack given a large enough botnet. The question you should be interested in is what the limits of traffic, requests, etc are for your specific setup. But usually you find these by exceeding them. What the first limitation in the setup is (and thus if DDoS'ing it would affect the server) is impossible for us to tell, that would be very specific to the setup and the attack.
    – Teun Vink
    Nov 23 '21 at 10:54

Generally, it's not really useful to test a company by DDoSing it. As far as I know, normal pentest don't include this, and practically every bug bounty forbids it. The reason is simple: DDoS is an obvious threat, and everybody is vulnerable to DDoS at some level. Even massive sites like GitHub have been knocked offline in the past.

If you want to find out exactly how much the server can handle, it's possible to make an estimate by taking in consideration the amount of resources the server has available (i.e the bandwidth, processing power and memory available), so there is usually no point in actually stress testing the server.

Although a DDoS usually won't physically harm a server, it can still cause other sorts of harm. For example, your ISP probably won't be happy with you sending massive amounts of traffic, and it might even be against their terms of service.

On the server's side, if the server happens to use some sort of auto-scaling cloud service, they might end up with a gigantic bill for the large amount of bandwidth consumed. Alternatively, if the server is hosted with some smaller hosting service, they might discontinue their providing their service to you, since the DDOS could have caused disruptions for other sites hosted with them too.

  • Thanks for the answer, I also want to know if I can bypass the firewall of our server. That's also one of the reason and not just to stress our server.
    – Ajay
    Nov 23 '21 at 3:10
  • 3
    Why would you think a DDoS has anything to do with "bypassing" a firewall? It will either match a ruleset and let it through, or it wont and it wont. If you send too many messages at worst it would just fill up the memory and a bunch of packets would be ignored. This is like wondering if 20 people give you different sets of instructions at the same time ... maybe you can achieve mind-control. Its just not how any of this works. Nov 23 '21 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.