Questions tagged [ddos]
Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks
502
questions
1
vote
0
answers
68
views
Code to detect HTTP/2 Rapid Reset Attack vulnerability
Is there code/library to detect this vulnerability? I have been searching online and do not find any
We are using Cloudflare which has fixed the issue but government says "we may" have the ...
- 153
0
votes
1
answer
77
views
Key difference between DoS & DDoS [duplicate]
What are the key components that define them and what are the differences? are there any standard structure of it? I've looked at several papers, and some of them using as a same, and some of them are ...
- 3
0
votes
0
answers
78
views
How can I verify that my DoS attack is effective?
I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
3
votes
0
answers
81
views
Can botnets/malicious traffic be effectively reduced on my exit nodes?
I host a small collection of TOR exit nodes to the clear net. Believe it or not, the number one complaint I get in my inbox is not due to illegal materials coming through the nodes (of which I have ...
- 192
0
votes
0
answers
16
views
How to limit user from making too many request on an API endpoint? [duplicate]
I have a form where the user can add his phone number then, he receives a verification code on his phone number to log in/register.
Now a user could make too many requests with generated valid numbers ...
- 101
2
votes
0
answers
670
views
Checking IP's reputation on CloudFlare and Google
Google and CloudFlare have recently indicated that my home IP address is contributing to a DDoS or spam network.
I am frequently being checked (What is the website checking about my browser to protect ...
- 125
0
votes
0
answers
47
views
Web browser Service Worker contributing to DDoS attacks and spam?
Google and CloudFlare have recently indicated that my home IP address is contributing to a DDoS or spam network.
In addition to all the other usual vectors, are web browser Service Workers a potential ...
- 125
2
votes
1
answer
129
views
How to avoid breaking end-to-end encryption while employing cloud-based DDoS protection?
I have a few websites and apps that I need to protect from DDoS attacks. These websites and apps are delivered by various servers that sit in several small data centers around the world.
I'm thinking ...
- 479
0
votes
1
answer
86
views
icmp smurf attack
I am learning about ICMP smurf attack and for this, I have forged a packet with the following details:
source_mac_address = **??**
destination_mac_address = router mac address
char ...
- 101
0
votes
3
answers
127
views
Avoid checking passwords for dos attacks
A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
- 2,125
0
votes
0
answers
95
views
How to test the reaction of an outsourced DDoS protection provider to a DDoS attack, similar to a red teaming engagement?
I work in a security/pentesting company and in the last year the demand for DDoS testing has dramatically increased. The issue is that the customer is not interested in what I call a mislabeled load ...
0
votes
1
answer
473
views
Does a DDoS Attack affect the internet connection apart from the service it's attacking?
Lately I've been experiencing some crashes related to my internet connection, I'm on the process of pin-pointing what is causing the issue and one of those possible causes might be a DDoS attack, ...
1
vote
1
answer
281
views
Is my website under attack?
I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs.
Note: In the log report, I replace the name of my website with example.com and my second ...
- 11
0
votes
1
answer
869
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 101
0
votes
1
answer
142
views
If I create multiple sockets on a single IP and create a connection with the server with each of them, can I do a DDoS?
So basically, if the server is let's say Apache or any other thread based server, so if I create multiple sockets on my machine and request the server until all of its threads get exhausted and try to ...
1
vote
3
answers
353
views
Limit REST API calls by fingerprinting and IP
I have a question regarding request limits for a REST service endpoint.
I think of course the most basic identification used to limit requests is by taking the user's IP address, but what if we have ...
- 11
0
votes
2
answers
261
views
Is Stack Exchange immune to DDoS and DoS attacks?
I have heard that DDoS and DoS attacks work most of the time and that they are used when SQL insertion and other methods fail. I know Stack Exchange has a lot of programmers, and that they have this ...
- 3
1
vote
0
answers
54
views
Opencart website getting request from random subdomains (DDoS)
We have an Opencart 3.0.3 website which is getting DDoSed, we then migrated it to AWS and noticed the same thing happening, we blocked access from all other countries except US & Canada. For admin ...
0
votes
1
answer
50
views
DDoS throttling vs deny actions
Recently I saw the Google Report about the DDoS Attack that they managed to stop. In the report, they said,
"They chose the ‘throttle’ action over a ‘deny’ action in
order to reduce chance of ...
- 3
1
vote
1
answer
528
views
How to protect home network from DDoS attacks when assigned a static IP that is already known to attackers?
Is there something I can do in this case? My ISP says they cannot assign me a different IP. At this stage a VPN no longer helps, correct?
- 13
2
votes
1
answer
413
views
What happens to malicious traffic in a scrubbing center during a DDoS attack?
My understanding of a scrubbing center is when a DDoS is underway, all traffic gets routed to a scrubbing center where traffic is analyzed and all legitimate traffic is then sent to the targeted ...
- 23
0
votes
1
answer
273
views
How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?
An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so:
#define CONNECTIONS 1
They then attack with xerxes-executable mydomain 433.
Their strategy is to ...
- 137
1
vote
0
answers
84
views
What other than ping tools might be suitable for overwhelming a server that has disabled its functionality of being pinged? [closed]
The following code:
#!/usr/bin/bash
TARGETS=("nalog.gov.ru" "www.nalog.gov.ru"
"customs.gov.ru" "www.customs.gov.ru"
"ffs.ru" "www.ffs.ru"
...
- 11
-1
votes
2
answers
327
views
How would routing DDoS attacks over Tor increase effectiveness?
In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes.
I'm curious how a DDoS attack would be more effective when routed over Tor. From ...
- 265
0
votes
1
answer
146
views
Why do DDoS attacks spoof DNS source IPs?
Recently, a lot of my friends have been talking about botnets. They said they've created their own. Obviously, I know this is all illegal so I try not to take part in any of it.
But I've been ...
1
vote
0
answers
69
views
How are DDOS protection mechanisms setup when confidential data is involved?
Scenario:
A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data.
Since a hospital is an obvious target for any type of hack, ...
- 11
0
votes
1
answer
129
views
Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?
I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This ...
- 261
2
votes
0
answers
133
views
I'm receiving a DDOS attack. What to do? [duplicate]
Yesterday, my website bandwidth got over. After seeing the logs I saw this
This request came every 1 second (Different IP's).
Luckily I use Cloudflare. So my question is what are the other things ...
- 121
2
votes
0
answers
252
views
How to stop a DDoS attack that brought down my ISP
I'm streamer and I guess I'm good target for DDOS'ers. Those bad people know my ISP (but they don't know my IP address - ISP changed that for me when the first attack happened). It's a small local ISP ...
- 21
-1
votes
1
answer
172
views
Is it safe to conduct DDoS attack on a live server?
I am new to cybersecurity industry. I want to try if the company server is vulnerable to DDoS attack. Is it possible to conduct DDoS attack without damaging the live server?
What I mean is, my main ...
- 101
27
votes
7
answers
16k
views
Someone knows my IP and is threatening to DDoS me
Around 4 months ago, someone learned my IP, and is threatening to DDoS attack me if I am not his slave. He was breaking the Discord TOS with all kinds of stuff in my DMs. I blocked him, but one of his ...
user269980
0
votes
1
answer
160
views
Block API calls from app to stop DDoS attacks
Recently we had a discussion about the security of a mobile app we are working on. The security team requested that if a user is blocked (due to many failed login attempts), then the back-end should ...
- 1
27
votes
2
answers
9k
views
How is Google abused for DDoS attacks?
While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent.
I'm ...
- 383
1
vote
0
answers
170
views
Duplicate client ids - possible ddos on rabbitmq
We are using RabbitMQ 3.9.5
There is a number of mqtt users that are being created. Each of these users is allowed to send data to its own topic. These users are not supposed to see data of other ...
- 111
1
vote
1
answer
326
views
Why are Bogons preferred in DDos attacks?
I am currently reading literature that states that Bogons are commonly used by attackers when conducting DDos attacks. I did some searching for an explanation and all I could find was that "...
- 75
1
vote
1
answer
179
views
Is a private VPS without a domain name and http entry likely to get DDOS'd for more than 5 hours?
I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program ...
- 145
34
votes
4
answers
12k
views
Is serverless code immune to DDoS attacks?
In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
- 684
1
vote
2
answers
164
views
Are high traffic apps and websites used in DDoS attacks?
Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
1
vote
1
answer
94
views
DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]
I humbly assume that DDoS is very unlikely to happen to my website.
A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
0
votes
1
answer
370
views
DDOS interrupted by nmap?
I discovered one of my machines was under an ssh DDOS attack when I was looking at logs to find out why my disk was slow. The auth log was about 90M, which is kind of unusual for this machine.
I ran ...
- 109
1
vote
1
answer
268
views
How do I differentiate a DDoS attack from a DoS attack?
My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
- 11
1
vote
0
answers
162
views
IPSec MTU DDos attack
I have this configuration:
HOST-A <---> GAT-A <---> MiTM <---> GAT-B <---> HOST-B
I'm doing a security project on MTU-IPsec vulnerabilities and following this guide of Hal-...
- 23
0
votes
0
answers
86
views
What is the greatest factor in DoS network flow connection tempo?
I'm conducting some research on botnet detection. I'm specifically looking at Zeek/Bro connection logs (so network flows). I was wondering what affects the tempo of the succession of network flows ...
0
votes
1
answer
156
views
Why ACK flood is effective?
I understand that SYN flood is effective due to how protocol works, waiting around 75 seconds before closing the connection.
What about ACK flood, what does it happen on the destination side that ...
- 5
1
vote
1
answer
120
views
Making website queries and return a large amount of data, can it be exploited for DOS attack?
I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
- 51
12
votes
4
answers
3k
views
Webserver DDOS protection without giving away private keys (https, tls, ssl)
What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys?
Many of the common solutions for DDoS protection of a ...
- 998
0
votes
1
answer
638
views
Can't free proxies be used to create a botnet?
I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
- 47
0
votes
2
answers
617
views
If HTTPS only runs on a single port, why is SYN flooding an issue?
I've read online that SYN flooding is when "the attacker sends repeated SYN packets to every port on the targeted server." However, HTTPS only runs on port 443. Therefore, why is it ...
- 47
1
vote
1
answer
141
views
Preventing DDOS attacks without collecting personal data? [closed]
Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
1
vote
0
answers
21
views
How do I use SYN cookies to perform a DOS attack [duplicate]
I am taking a computer security course but I have a question I am stuck on.
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...
- 11