Questions tagged [denial-of-service]

Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

Filter by
Sorted by
Tagged with
3
votes
1answer
43 views

Email pattern ReDoS

I would like to verify that the input from the user complies to the format of email address (in Java application). On the following page there is verbose regex that should properly validate the email ...
1
vote
0answers
36 views

How susceptible are JWTs to being used for denial of service?

Consider an API that requires a JWT for authorisation. For each JWT presented, it has to validate the signature, including base64 decoding, hashing and asymmetric encryption, which is stated noted as ...
0
votes
2answers
58 views

Brute force without DOS'ing the server

How to conduct brute force tests for directory traversal or other operations that require trial and error without accidentally turning it into DOS attack? It comes to how much bandwidth a site is ...
0
votes
1answer
47 views

Is possible to deliver a dos attack increasing a database table?

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
0
votes
0answers
49 views

My friends are disrupting my internet connection [duplicate]

My friends have my ip address and they're all programmers/hackers. They've been interfering with my wifi connection several times today. Asking them to stop or saying "they won't do anything"...
0
votes
0answers
50 views

Ipsec fragmentation needed attack

I have this configuration |Subnet-1|<-->|GatewayA|<-->|Router|<-->|GatewayB|<-->|Subnet 2| Following this study from inria,for a Uni project, I'm trying to implement a DOS ...
1
vote
1answer
70 views

Denial of Service question

I am studying for an exam in computer security, and I got stuck on the following question from a past exam: A random program generator service S allows clients to generate random data. Each client Ci ...
1
vote
1answer
64 views

Outgoing messages while under massive denial-of-service attack

As I understand it, there is no internet protocol that provides true broadcast like in say a card game or a partially synchronous network assumption. How close can internet protocols come though? We'...
0
votes
1answer
69 views

Possible ways to intrigue IP blockage on practical websites

Assume that I share the same IP address with others. Then if I can do something bad to intrigue practical websites, such as Google, Amazon, or jQuery to block me, then all other users will also be ...
1
vote
1answer
91 views

How can a SYN flood affect a router in this scenario?

I'm using two routers in my home network, as described in this question (router B in the diagram). Therefore, router B is not accessible from the internet. Going over the logs of this router, I was ...
1
vote
4answers
102 views

Will brute force attack exhaust web server, resulting in DOS

I do know the difference between brute force attack and DOS. What if a web server doesn't have account lock out in place and a few brute force attacks is being started in parallel, and these attacks ...
1
vote
0answers
82 views

Suppose a mischievous coffeeshop wifi gateway wants to drain phone batteries

Suppose a mischievous coffeeshop wifi gateway wants to drain phone batteries. It is easy to see how it might weaken signals and flip a few bits to wreak NAK havoc at the link level so wifi chip power ...
0
votes
1answer
64 views

“Memory-Hard” vs. “Memory-Bound” Functions?

One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two ...
0
votes
1answer
57 views

DoS attack blocks website while in another connections show website run normally [closed]

I am learning Ethical Hacking. I create my own website on a cloud hosting service for testing purposes. I run DoS attack from my local VM and it shows that website is down. When I sent a link to my ...
1
vote
0answers
83 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
2
votes
1answer
914 views

Why would hackers attack a DNS server with a DoS?

I wake up this morning to a rebooted server. The DNS server was running at over 100%. After a little bit of work, I got fail2ban in place to block all of those requests. The requests themselves are ...
0
votes
2answers
94 views

Can a Slow Post HTTP attack be done from a single client?

Can a Slow Post HTTP attack be done from a single client? The following source cites this line: https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c Ports are 16-bit numbers,...
0
votes
0answers
45 views

slowhttptest showing up as service unavailable, but is inaccurate service still up and running

I've got a small contract with a website; they have given me permission to stress test their website, testing for DOS attacks. I have some experience in the field, but I am no omniscient hacker. I'm ...
0
votes
1answer
56 views

Is it considered as a DOS attack if I add too much data to a page so that it doesn't respond at all?

I am working on an application. There is a new feature implemented where a user create some IDs and secret keys for that application. I have observed that there is no rate limit for creating those. I ...
10
votes
4answers
2k views

Defending against DoS via product reservation

An e-commerce site should reserve products for a user while they're going through the payment process (more info). This creates a potential denial-of-service risk where an attacker could reserve many ...
0
votes
1answer
124 views

Why did my DoS attack fail against Windows 10?

I have multiple devices - a Samsung and a Lenovo tab, an Amazon Alexa, an HP laptop running Windows 7, and another running Windows 10. Bored, I tried to DoS my Windows 10 laptop using my Windows 7 ...
0
votes
0answers
54 views

Regular expression Denial of Service (ReDoS) case

In my application code, one person noticed that one line with regular expression is vulnerable to a Regular expression Denial of Service (ReDoS) attack. I did not have much contact with this topic, ...
0
votes
0answers
199 views

SSL/TLS client-initiated renegotiation enable

I am researching the CVE-2011-1473 - SSL/TLS client-initiated renegotiation vulnerability, and my goal would be to crash the test environment due to the denial of service vulnerability. My ...
1
vote
1answer
350 views

Access point uses different BSSID and deauth attack fails

I'm using airgeddon (https://github.com/v1s1t0r1sh3r3/airgeddon) to perform a deauthentication attack on my wifi network. When i put my wireless interface in monitor mode to scan the network from the ...
-2
votes
1answer
58 views

Why does hping3 test DoS not successfully?

I used hping3 to stress test a web app (DoS): sudo hping3 -S --flood -V -p 80 [IP addr/url] When I attempted to get access to the target web application through my network, it refused to connect ...
0
votes
1answer
108 views

What is the traffic volume of practical DDoS attacks

I wonder what is the volume of traffic, in terms of requests/second, forms a legit DDoS attack against a website. I know it highly depends on the website and where it is hosted. But is there any real-...
-2
votes
1answer
158 views

I think I may have DoS'ed a website accidentally

I had recently started using the nmap --script vuln option and I did try it on my own local router IP, which then crashed and we had to restart (coincidence?). Then today I wanted to try it again, ...
0
votes
1answer
72 views

Can wifi router be ddosed by “trying” to login to router repeatedly and in very fast manner?

Trying to make an important router as safe as possible from low skill "dos" attack on it. Is it possible for someone in the range of a wifi router to write a script in whatever programming language to ...
0
votes
4answers
52 views

Potential DoS in emailing admin on error pages

In my website, the backend sends an email to the sysadmin whenever there is an Error 500 with the logs and other data about the error. How can I prevent a cracker from intentionally triggering the ...
1
vote
1answer
77 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
0
votes
0answers
91 views

Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?

My team and I have written a web app, and we had a bug report regarding a DoS vulnerability. This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
0
votes
0answers
87 views

Is the half_md4 dirent hashing algorithm a security problem in ext* filesystems?

half_md4 does not look a very strong hash for me, although googling for it does not reveal too much. I suspect, the directory entries could be organized by a half_md4 hashed hash table. If it is so, ...
0
votes
4answers
192 views

How to identify IP from a UDP-based DoS

I'm running a Counterstrike server on UDP port 27015. I'm using Amazon AWS to host the game server. I have added only my friends' IPs (about 50 of them) into a security group so the rest of the ...
0
votes
1answer
53 views

Calculate pps for DDoS evaluation

I am working on a task where I have to evaluate how much throughput one can generate in packets per second. I know I can send them as fast as possible with hping3 [...] --flood, but is there a way to ...
0
votes
0answers
47 views

Network overload due to attack [duplicate]

My hosting provider (ovh) recently blocked my VPS due to some attack on the server. When I restored it to the normal mode, I can see indeed something is happening: the access to server is limited, ...
0
votes
4answers
521 views

Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server

Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file. Later, passwords were hashed ...
1
vote
1answer
88 views

Does a DDOS attack on an application using CDN have to first bring down all the involved CDN servers to affect the application's availability?

CDN are said to absorb and mitigate the Denial of Service and DDOS attacks. Consider an application that uses a CDN provider to deliver its content. So if an attacker tries to bring down such an ...
0
votes
1answer
50 views

Can an ethernet device plugged into a switch block all the other ethernet devices?

And if so, what protections are available against this kind of thing?
2
votes
0answers
112 views

Preventing DoS Attacks on NFC

There are some attack scenarios on NFC. These include e.g. Data modification, data insertion, relay attacks and DoS attacks. Just to name a few. While some of these attack scenarios are more likely ...
3
votes
1answer
838 views

Are these log messages in my nginx server evidence of an attempted attack?

My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
1
vote
0answers
102 views

Is Slowloris traceable? [closed]

When someone launches a slowloris attack on a website, could that attack be traced via IP? Could someone feasibly locate the IP of the person that launches said attack?
1
vote
0answers
75 views

Preventing DoS and flooding attacks on wireless MANET network

How can I prevent DoS/flooding attacks on a wireless MANET network?
0
votes
1answer
100 views

What type of vulnerabilty is this?

I'm testing a website: https://this-site.com/path/to/dirs but what i've found is if I do the following below the site will load 4 pages in a infinite loop https://this-site.com/path/to/dirs/.../. ...
1
vote
1answer
598 views

Client reconnects during deauthentication attack

During my first deauthentication attack the client I targeted was disconnected from the wireless network, however I was able to reconnect the client to the network even though aireplay-ng was still ...
1
vote
1answer
72 views

UDP amplification: length(response_packet) < length(request_packet)

I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
0
votes
0answers
36 views

Is it safe to pass user input through rails gsub?

Are there risks associated with using gsub on user input? Can it be used for regular expression DoS?
1
vote
0answers
116 views

Regex DoS: Is OWASP's characterization of “evil regexes” complete?

OWASP defines "evil regex" (here) as follows: Evil Regexes A Regex is called "evil" if it can stuck on crafted input. Evil Regex pattern contains: Grouping with repetition ...
0
votes
2answers
220 views

infinity redirection as Dos Attack

I was wondering that infinite redirection could be used as a dos attack in my case, I have this test.php <?php $url = $_GET['url']; header('Location: '.$newURL); ?> ...
0
votes
1answer
78 views

Failed logins on a windows server - performance impact?

I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files. I know what the cause is (another misconfigured ...
-1
votes
1answer
41 views

Validation issue in name field causes the page to hang

I am using a webpage that doesn't have validation for name field. If I give any special characters, the page just becomes unresponsive. Though the captcha times out after some time, the request still ...

1
2 3 4 5
9