I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here.

I hope one of you can enlighten me

  • One interesting but rare case: Server behind stateless firewall using SYN cookies to protect against SYN flooding. Under normal circumstances an attacker cannot connect to ports blocked by the firewall because the firewall blocks all SYN packets from attacker. Attacker then starts SYN flood against open port, server switches to SYN cookies to protect against SYN flood. Attacker then sends ACK to port supposed to be filtered, firewall being stateless lets packet through. If attacker guessed correct sequence number connection to filtered port has been established.
    – kasperd
    Commented Aug 17, 2015 at 16:02

5 Answers 5


DoS attacks can be used in several ways as part of gaining access:

  1. Overwhelming primary defenses. when you are conducting a DoS attack, the primary defense mechanisms get caught up in it too. They can be overwhelmed and as a result, they may: a) not respond appropriate b) can hang altogether c) the watchers watching them are distracted, or your efforts are lost in the DoS logs. In addition, if the primary systems are rolled over to secondary systems (which often happens) those may not be up-to-date configurations, or you could catch the roll-over in a time-gap whereby the synchronization of everything is not current.

  2. Overwhelming primary systems may expose flaws. A DoS attack may be used to expose flaws that could be exploited. Could be procedural flaws, it could be system flaws. It could be that as a result of a DoS attack you force the organization to upgrade, and during the upgrade you take that window of opportunity to exploit.

  3. The DoS attack is a decoy. Classic attack... What magicians do all the time. Watch the left hand while I steal with my right. The DoS has so much focus of the organization, secondary routes into the system (physical, social, or technical) could be undermanned, provisioned or systems can be more easily by-passed without being noticed.

  4. DoS attack could be a plant. I once heard of hacker who conducted a limited DoS attack on organization A, because he had done his research, and the CIO from organization A was very close to organization B, and both organizations were in the same general business arena. So he suspected that if he could get organization A to adopt a specific technology to thwart his rather crude DoS attack, that organization B would do the same - thinking they might be next. He was very correct, as organization B did. Why? Well the hacker had an 0day exploit in the piece of technology and he wanted to attack organization B.

  5. Secondary Route/Bridging Exploitation. An extended DoS attack that can be sustained, can force business units within the organization to move to secondary systems paths (networks) to keep critical business going. While some of these secondary paths may be well-planned and secured, many are not. For instance a business unit may stand up a wifi, or mifi device and start using it as their business network without any security infrastructure. If an attacker is actively monitoring and profiling, they may be able to capture and attack these very vulnerable paths and now you have a direct, totally unsecured bridged network into the organizations intranet.


There's a perfect illustration in this movie and an even better in that movie.

Spoiler alert (although if you have not seen these movies yet, then you must have spent the last three decades frozen in a glacier or whatev)

In the first movie, the bad guys simulate a terrorist attack (which can be thought of a massive DoS) so that the authorities apply their anti-terrorist procedures, which imply shutting down power -- which automatically opens the strong room that the bad guys wanted to enter in the first place.

In the other one, the newer bad guys simulate another terrorist attack, this time with actual bombing (there is nothing more DoSing than high explosives), because then the whole anti-terrorism scheme allocates all police forces to a bomb-seeking race (that's one effect of DoS: to divert defence resources from their normal stations) and the explosion itself overwhelms vibration detectors in the bank which is the true target of the villains -- who can then make a big hole in the strong room wall with bulldozers, undetected by the said detectors.

In a network+computers environment, you can think of a DoS as triggering abnormal conditions, under which normal defence mechanisms are less effective.

  • 2
    I like those examples. die hard 4 as well...sort of....the fire sale was a distraction to get them to download that stuff to woodlawn. (Was on last night)
    – user25517
    Commented May 2, 2013 at 20:51

I don't believe DoS attacks are traditionally utilized to gain access to the system per se. It is more of a tool utilized to confuse the system or flood the system with irrelevant requests and deny legitmate traffic access to the system. That can in turn facilitate the use of vulnerability exploits to actually gain access to the system.

Denial-of-Service attacks by definition is simply denying authorized users or devices access to the specific system or network. It could be utilized in conjunction with another exploit, say a buffer overflow, to get the required result of penetrating the system.

Also the DoS attack can thwart IT pros and security pros from focusing on the real issue at hand is that someone is exploiting their system. A lot of pressure is placed on the IT department by senior management when they can not get to or access certain pieces of technology. So while they are attempting to fix and resolve the DoS issue the hacker goes by completely obscured. Additionally, trying to sift through the plethora of log files that will have been created while it was going on leads to a difficulty in tracking a breach has ever occured.


A DoS attack can crash the server causing it to reboot and execute assets that the attacker previously compromised.

For example, the attacker compromised the cron table or a script called by cron. When the server reboots the corrupted cron is invoked.

Could even take the DDoS to a whole new level if the corrupted script overruns the drive partition.


A DoS attack may force a system's IPS to fail open the traffic towards internal recources. That is a configuration option on many defence in depth appliances and overwhelming them will lead to either service unavailability or degradation of security. If the service availability of the organization is more improtant than the security of the data provided by the service, the system is configured to fail open, meaning that security will be degraded by accepting all connections.

You must log in to answer this question.