I am hosting a site on a hosting server. How to identify whether my site is vulnerable to DOS/DDOS attacks?
Do you have a site? If so, you're vulnerable.
A distributed denial of service attack (DDOS) consists of a number of computers throwing data at your site faster than it can handle it. Unless you're operating on the scale of Google, you're vulnerable. Your main defense is to not be a target worth the effort of attacking.
A conventional denial of service (DOS) attack consists of an attacker finding a way to make you do more work than him. Unlike DDOS attacks, conventional DOS attacks can be mitigated through the design of the site (rate limiting, eliminating slow operations, preventing resource starvation using techniques such as SYN cookies) and stopped reactively, by blocking the attacker either at the firewall or with your upstream service provider.
The likelihood is you are vulnerable. If you use a scale-able cloud application platform and have enough resource budget or you use a massive CDN (content delivery network - http://en.wikipedia.org/wiki/Content_delivery_network) you might not be. Likewise if your ISP is especially pro-active in mitigating such threats you may be ok.
So in terms of how you know:
- Are you using a massively scaleable cloud architecture or CDN?
- Ask your ISP what DOS/DDOS mitigation they provide for hosted servers
If you don't have any specific protection against DDOS you are probably vulnerable, those measures are usually quite expensive and many customer prefer to use services like cloudflare and others.
Here some tips which may apply or not depending on technology/language:
fingerprint your webserver version and openssl version and look for public known common issues such as memory consumption/allocation bugs.
monitor the memory profile of your web application using appropriate tools, you could simulate simultaneous users with a traffic generator and look at the difference in the memory profile to understand how much data get actually stored for every user.
look inside the code for issues like unhandled exceptions and memory corruptions.
always destroy sessions and deallocate resource or data after you don't need it anymore.