Questions tagged [ddos]

Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Slow Loris Attack Wi-Fi variant

I watched a Computerphile video. In the end Dr. Bagley talked about the fact that a router can only receive/send a packet at a time, so if one device is slow it will slow every device down, because ...
user avatar
0 votes
1 answer
44 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
user avatar
1 vote
0 answers
66 views

What other than ping tools might be suitable for overwhelming a server that has disabled its functionality of being pinged? [closed]

The following code: #!/usr/bin/bash TARGETS=("nalog.gov.ru" "www.nalog.gov.ru" "customs.gov.ru" "www.customs.gov.ru" "ffs.ru" "www.ffs.ru" ...
user avatar
-1 votes
2 answers
193 views

How would routing DDoS attacks over Tor increase effectiveness?

In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes. I'm curious how a DDoS attack would be more effective when routed over Tor. From ...
user avatar
0 votes
1 answer
119 views

Why do DDoS attacks spoof DNS source IPs?

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it. But I've been ...
user avatar
1 vote
0 answers
58 views

How are DDOS protection mechanisms setup when confidential data is involved?

Scenario: A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data. Since a hospital is an obvious target for any type of hack, ...
user avatar
0 votes
1 answer
46 views

Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?

I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This ...
user avatar
  • 117
2 votes
0 answers
69 views

I'm receiving a DDOS attack. What to do? [duplicate]

Yesterday, my website bandwidth got over. After seeing the logs I saw this This request came every 1 second (Different IP's). Luckily I use Cloudflare. So my question is what are the other things ...
user avatar
  • 121
1 vote
0 answers
140 views

How to stop a DDoS attack that brought down my ISP

I'm streamer and I guess I'm good target for DDOS'ers. Those bad people know my ISP (but they don't know my IP address - ISP changed that for me when the first attack happened). It's a small local ISP ...
user avatar
0 votes
0 answers
59 views

Any approach to copy the disk and take RAM shapshot of RouterOS (Mikrotik)?

everyone! I have discovered suspicious activity on one of Mikrotik Routers. This device had an outdated version of RouterOS with open ports web, winbox, etc. I believe that it was infected by malware, ...
user avatar
  • 46
-2 votes
1 answer
151 views

Is it safe to conduct DDoS attack on a live server?

I am new to cybersecurity industry. I want to try if the company server is vulnerable to DDoS attack. Is it possible to conduct DDoS attack without damaging the live server? What I mean is, my main ...
user avatar
  • 99
27 votes
7 answers
14k views

Someone knows my IP and is threatening to DDoS me

Around 4 months ago, someone learned my IP, and is threatening to DDoS attack me if I am not his slave. He was breaking the Discord TOS with all kinds of stuff in my DMs. I blocked him, but one of his ...
user avatar
  • 447
0 votes
1 answer
77 views

Block API calls from app to stop DDoS attacks

Recently we had a discussion about the security of a mobile app we are working on. The security team requested that if a user is blocked (due to many failed login attempts), then the back-end should ...
user avatar
  • 1
27 votes
2 answers
9k views

How is Google abused for DDoS attacks?

While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent. I'm ...
user avatar
  • 383
1 vote
0 answers
75 views

Duplicate client ids - possible ddos on rabbitmq

We are using RabbitMQ 3.9.5 There is a number of mqtt users that are being created. Each of these users is allowed to send data to its own topic. These users are not supposed to see data of other ...
user avatar
  • 111
1 vote
1 answer
140 views

Why are Bogons preferred in DDos attacks?

I am currently reading literature that states that Bogons are commonly used by attackers when conducting DDos attacks. I did some searching for an explanation and all I could find was that "...
user avatar
  • 75
1 vote
1 answer
135 views

Is a private VPS without a domain name and http entry likely to get DDOS'd for more than 5 hours?

I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program ...
user avatar
34 votes
4 answers
10k views

Is serverless code immune to DDoS attacks?

In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
user avatar
1 vote
2 answers
153 views

Are high traffic apps and websites used in DDoS attacks?

Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
user avatar
1 vote
1 answer
84 views

DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]

I humbly assume that DDoS is very unlikely to happen to my website. A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
user avatar
0 votes
1 answer
217 views

DDOS interrupted by nmap?

I discovered one of my machines was under an ssh DDOS attack when I was looking at logs to find out why my disk was slow. The auth log was about 90M, which is kind of unusual for this machine. I ran ...
user avatar
  • 109
1 vote
1 answer
240 views

How do I differentiate a DDoS attack from a DoS attack?

My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
user avatar
  • 11
1 vote
0 answers
107 views

IPSec MTU DDos attack

I have this configuration: HOST-A <---> GAT-A <---> MiTM <---> GAT-B <---> HOST-B I'm doing a security project on MTU-IPsec vulnerabilities and following this guide of Hal-...
user avatar
  • 23
0 votes
0 answers
77 views

What is the greatest factor in DoS network flow connection tempo?

I'm conducting some research on botnet detection. I'm specifically looking at Zeek/Bro connection logs (so network flows). I was wondering what affects the tempo of the succession of network flows ...
user avatar
0 votes
1 answer
117 views

Why ACK flood is effective?

I understand that SYN flood is effective due to how protocol works, waiting around 75 seconds before closing the connection. What about ACK flood, what does it happen on the destination side that ...
user avatar
  • 5
1 vote
1 answer
105 views

Making website queries and return a large amount of data, can it be exploited for DOS attack?

I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
user avatar
13 votes
3 answers
3k views

Webserver DDOS protection without giving away private keys (https, tls, ssl)

What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys? Many of the common solutions for DDoS protection of a ...
user avatar
0 votes
1 answer
316 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
user avatar
  • 47
0 votes
2 answers
229 views

If HTTPS only runs on a single port, why is SYN flooding an issue?

I've read online that SYN flooding is when "the attacker sends repeated SYN packets to every port on the targeted server." However, HTTPS only runs on port 443. Therefore, why is it ...
user avatar
  • 47
1 vote
1 answer
132 views

Preventing DDOS attacks without collecting personal data? [closed]

Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
user avatar
1 vote
0 answers
21 views

How do I use SYN cookies to perform a DOS attack [duplicate]

I am taking a computer security course but I have a question I am stuck on. You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...
user avatar
1 vote
1 answer
411 views

Layer7 DDoS Protection vs WAF, which should I use?

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...
user avatar
  • 113
1 vote
1 answer
109 views

Best methods to mitigate DDOS with changing IP sources

Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
user avatar
1 vote
2 answers
134 views

Is the idea of a hosting provider with built-in DDoS protection plausible? [closed]

Any PaaS/shared hosting company which I came across offers its customers to protect their websites from DDoS via security-oriented CDNs such as CloudFlare or CloudFront which act as a proxy ...
user avatar
  • 13
1 vote
2 answers
275 views

JS challenge based on computational complexity

Assuming I have a website with a button that sends AJAX requests to my server which will be expensive to process. I suppose that mostly cookie or JavaScript + cookie challenges are used to prevent (...
user avatar
  • 11
1 vote
0 answers
180 views

What is the forensic procedure in investigating DDoS attacks

I'm currently in the process of researching for an assignment. In this assignment, I am asked to produce reports on new crimes enabled by technology and how, in Cyber Forensics, one would investigate ...
user avatar
1 vote
1 answer
195 views

How can a SYN flood affect a router in this scenario?

I'm using two routers in my home network, as described in this question (router B in the diagram). Therefore, router B is not accessible from the internet. Going over the logs of this router, I was ...
user avatar
0 votes
2 answers
136 views

Alternative to Proxy servers for limiting internet access?

My company is using on premise DMZ proxy servers to limit internet access to employees working from home. When they use company laptop, they are automatically configured to go through the proxy server ...
user avatar
  • 1
0 votes
0 answers
96 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
user avatar
0 votes
1 answer
95 views

Risks with setting up a authentication-less public VPN

I'm in the process of setting up an authentication-less public VPN. To prevent against DoS attacks, I'm going to set up some sort of IP address based rate limiting. The VPN is port-bound, i.e., it ...
user avatar
0 votes
1 answer
259 views

Being charged with DDoS – my IP address shows on hacked computer

On July 21 2020 a business was subjected to DDoS attacks crashing their system and causing a very expensive problem. My IP address was used and I am being blamed and have to explain how my IP address ...
user avatar
0 votes
1 answer
190 views

"Memory-Hard" vs. "Memory-Bound" Functions?

One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two ...
user avatar
  • 1,217
1 vote
1 answer
1k views

Slow HTTP POST vulnerability in IIS 10

I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer. From what I understood from this finding, ...
user avatar
  • 11
1 vote
1 answer
208 views

Avoid strong password hashing functions aiding a DDoS attempt on oneself [duplicate]

While reading this question, it got me to thinking. Let's say an attacker has some way to make all of their login attempts appear legitimate - enough IP addresses to never reuse them, different valid ...
user avatar
-1 votes
1 answer
146 views

How do hackers acquire large pools of ip addresses to use? [closed]

I've tried googling but can't find a satisfactory answer. Probably looking up the wrong search terms... I see questions on here and other forums that state they have a sophisticated attacker utilizing ...
user avatar
  • 302
20 votes
7 answers
5k views

Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords

For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place: Captcha on 3rd failed login ...
user avatar
  • 313
0 votes
2 answers
432 views

How to understand a single packet embedded with multiple requests?

When I read Multi VERB Single Request: This Attack is also a variation of the Excessive Verb Attack strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after another ...
user avatar
3 votes
1 answer
3k views

Possible Malicious Linux.Xor.DDoS installed

I am not an expert in information security. I am running Lubuntu on a laptop. Today, I ran chkrootkit and it printed the following: INFECTED: Possible Malicious Linux.Xor.DDoS installed /tmp/clamav-...
user avatar
0 votes
2 answers
293 views

How to ban IP address behind NAT

I am creating WebSocket server with rust and tokio and I want to prevent DDos attacks and spams. So I thought of creating HashMap and inserting IP address for 1 hour which i suspect is trying to do ...
user avatar
  • 101
-1 votes
1 answer
206 views

Can Cron cause the site to go down or DDos attack? [closed]

Yesterday I started running a cronjob [code below] on my server ('*/1 * * * *', 'api.cron.sync_with_elastic',['nginx-access-logs']) In the morning I got a message that my website is down. I was ...
user avatar

1
2 3 4 5
10