0

This question already has an answer here:

So, I understand DoSing to an HTTP Server. I understand Layer 7 DoS attacks and how to even make these work.

But what for an normal IP that isn't HTTP and is connected to the internet. Is the only way to attack them is by a bandwidth DDoS, which can be only done by more than 1 computer?

Pretend, I had my next door neighbors Internet protocol address. What is the most efficient way I can take it down or give it heavy load without requiring a bot net.

I'd like to know so I can protect my own IP so please answer without getting the wrong idea.

marked as duplicate by Stephane, Rory Alsop Jan 21 '15 at 9:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • You may try ICMP, this doesn't rely on any particular service running on the machine and most computers/routers reply to pings unless their firewall explicitly blocks them. – user42178 Jan 21 '15 at 3:01
  • Closed as dupe - the linked question should answer all the points in your question. Also read more of the questions here tagged ddos. – Rory Alsop Jan 21 '15 at 9:58
1

There are several ways to DoS an individual IP address, and to answer you're question you can still use an HTTP DoS attack if they have an HTTP port that's open, so ultimately the best type of DoS attack you would execute on an individual IP address directly relates to the results of a port scan or other methods of reconnaissance and information gathering you would have to complete on that sole IP.

  • When I port scan A regular IP, most of the times all the ports show closed. This would be because of the firewall from what I have seen and anyone would have to "port forward" a port to allow connections through it. – user3818650 Jan 21 '15 at 1:44
  • Still, when you try connect to the IP or send something it will still travel in there IP. If you were to do this to try take the IP down, would you not need a bot net? – user3818650 Jan 21 '15 at 1:52
  • It all depends on the individuals setting they may have stealth ports (in which they are in fact open but show up as closed) the only suggestion I could make would be to learn more about the reconnaissance portion of penetration testing so you are familiar with the tools and type of scans that you can run to display the most accurate information regarding a target. – CPagan Jan 21 '15 at 2:29
  • 1
    A lot of your questions are situational and the answers depend of more information, Try rephrasing your question in a better format with detailed information about your setup, the software you are using and the type of target you are attempting to DoS, individual person or a group etc. Please understand that the accuracy of someone's answer solely depends on how accurate the information they have to work with is. – CPagan Jan 21 '15 at 2:33
1

DDoS ovetloads the capacity of a device to process requests and forces it to miss valid requests. In that sense, it matters not what the target protocol is, assuming you have a high-enough bandwidth as an attacker.

Imagine that your wifi router is set to full block mode on external WAN network. By directing several Gbs of invalid requests at it, the simple router will be focused at contineously dropping the invalid requests, overloading it's CPU capacity. Since requests keep coming, the router will lock-up, causing denial of service to valid users, even having no clearly visible attack surface. This is due to the fact that blocking firewall rule is still a rule, hense it has impact on the device (even if tiny).

The difference between a dumb flood into nothing and an HTTP floor, or Syn flood is that the victim actively interacts with your invalid requests, eating up more CPU time on the device and therefore making the ammount of traffic needed to knock the victim off less.

A good (theoretical) example of required traffic to disable a network device can be seen in the following scenario:

Firewall Drop Rule: 3gbs

Syn Flood against any open TCP port: 0.5Gbs

Requests to an insecure, resource intensive, http search query: 10Mbs

As you can see, the more CPU cycles you force the target to use, the more effective the DDoS attack.

  • 1
    Good point, I hadn't thought of the possibility of using up the router's CPU power. But can you really send enough data to a residential connection to use up all the CPU? Usually they're only 10-50Mbps. If you have to send more than that, you'd saturate the connection and take it down regardless of how much CPU power the router has, wouldn't you? – tlng05 Jan 21 '15 at 3:16
1

If there are no services or ports open to the Internet on that IP address, then my understanding is that the only way to take down that IP is to saturate the connection by sending random data to that IP. The firewall will block it of course, but by the time it reaches the firewall the victim's download bandwidth will already have been consumed.

Theoretically speaking, it is possible to do it with just one computer, considering that we're talking about residential and not server-grade connections: If your own upload speed is greater than the victim's download speed, then one computer would be enough.

If this is not the case, it can still be done without a botnet using a DNS or NTP amplification attack. DNS and NTP are UDP protocols, so it is possible to spoof the IP address of the source (unlike with TCP). If you find a poorly secured public DNS or NTP server (ie, one that does not have rate limiting), you can send tons of queries spoofing the IP address of the victim, and the server will end up trying to send responses to the victim's IP address. If you send a small query that generates a large response, then you can send relatively little traffic to the server while the server sends large amounts of traffic to the victim (hence "amplification"). Essentially, you'd be leveraging the server's bandwidth to launch the attack.

As for ways to protect yourself against this, I don't think there is any - if you see an attack like this launched against your home connection, you should probably just call your ISP. If they're competent, they'll probably monitor your connection, realize what's happening, and then just null route your IP address and give you a new one.

Not the answer you're looking for? Browse other questions tagged or ask your own question.