7

I have bought a server and used it to host some game servers or my website. Now I am visiting a computer security course and I would like to test some of the presented attacks.

Am I allowed to, for example, DDoS my own server, or could I damage something? I don't want that other servers are damaged by my attack.

  • 8
    Ask the hosting provider, or even better, set up a virtual server at home. – BadSkillz Dec 5 '14 at 15:39
9

When you do the DDoS, you will be sending a flood of information. If you fully own the server, and you are sending it from your own server, then the 'send' and 'receive' points will be fine. But you still have to account for all the other machines inbetween.

If this is fully in an internal network you own, then there shouldn't be a problem. However, even if both of these are on physical boxes that you own on your own premises or you have legally documented permission to do this by the server host, if it goes through an ISP, you will be flooding them with the same hits (though they will be able to handle it far better than your server can). This is likely outside of any agreement you have with the ISP. There is also the possibility of this data flood going through other machines located in many different legal jurisdictions, meaning you'll also need to consult a lawyer.

In general, I would do it only on a network where I owned everything. Otherwise, if you want to stress test the server (and this is within the terms of your agreement), put something up on your website everyone would want to see and go post it somewhere where you will get a large number of legitimate views.

P.S.: If your denial attack is based off so something with very low data being sent, but high server cost (say, telling the server to compute the 1000th Fibonacci using the trivial recursion method or fork bombing it, then full ownership of the server is all you'll likely needed, but I'm not sure that would count as a DDoS, just a DoS).

However, at the core, 'Am I allowed to DDOS my server?' is more of a legal question, for which case, consult the lawyers.

  • So disconnecting it from your modem would probably work then, right? – PyRulez Aug 8 '15 at 2:49
17

If the server's on your own network, feel free. But if it's hosted somewhere, then your DDOS could impact other people using the same network path or other infrastructure. You could ask permission, but they'll almost certainly say no - SPs are generally comfortable with pentesting but nobody fools around with DDOS testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.