Questions tagged [denial-of-service]

Denial of Service (DoS) is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) by flooding a target with useless packets, connections or tasks.

Filter by
Sorted by
Tagged with
1 vote
0 answers
55 views

Protection against JPEG compression bombs

There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and threory PNG/JPEG images might be a comperssion-bomb. I've found an ...
user avatar
-3 votes
1 answer
47 views

Are malicious crawling bots a form of application layer DoS?

I would assume that if someone is daily crawling a website in a way which is heavily laborious on the server it may overkill that server. Are malicious crawling bots a form of application layer DoS?
user avatar
10 votes
3 answers
4k views

Can one prove that a server can be secure against DoS?

Is it possible to prove mathematically that a server is immune to denial-of-service attacks? Or is there some result in computer science journal that it this is an impossible task to do?
user avatar
  • 127
0 votes
0 answers
16 views

When can rate limiting requests to a server introduce a DoS vector?

Is it correct to assume that rate-limiting requests to a server can only introduce a DoS vector if the server implements blocks/bans to accessing resources when the rate limit is exceeded? I know that ...
user avatar
1 vote
1 answer
80 views

Altering a load balancer's choice

I was wondering: are there attacks that target a load balancer's choice algorithm? For example, if an attacker takes control of a load balancer, the traffic could be redirected to a single server and ...
user avatar
  • 61
0 votes
1 answer
46 views

Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?

I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This ...
user avatar
  • 117
0 votes
0 answers
58 views

What is the risk of a known ReDOS Vulnerability in a client side (Browser) app

I'm trying to determine if a client side app, that runs in the browser has any real danger from being vulnerable to a known ReDOS issue. My understanding of ReDOS is that inefficiencies or known short ...
user avatar
  • 223
5 votes
4 answers
580 views

Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?

Imagine a simple API, which offers an endpoint POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses ...
user avatar
1 vote
1 answer
108 views

How to perform external network scans that will not cause DoS?

What are some tools or techniques that could be used in external network penetration testing to perform safe scans only that are designed to cause no DoS (Denial of Service) or other interruptions? Or ...
user avatar
  • 11
1 vote
2 answers
153 views

Are high traffic apps and websites used in DDoS attacks?

Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
user avatar
0 votes
2 answers
209 views

My postfix server is getting DOSed, what can I do?

Port 25 is open and I'm getting thousands of emails. How can I make it stop?
user avatar
  • 471
1 vote
1 answer
240 views

How do I differentiate a DDoS attack from a DoS attack?

My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
user avatar
  • 11
0 votes
0 answers
77 views

What is the greatest factor in DoS network flow connection tempo?

I'm conducting some research on botnet detection. I'm specifically looking at Zeek/Bro connection logs (so network flows). I was wondering what affects the tempo of the succession of network flows ...
user avatar
0 votes
1 answer
117 views

Why ACK flood is effective?

I understand that SYN flood is effective due to how protocol works, waiting around 75 seconds before closing the connection. What about ACK flood, what does it happen on the destination side that ...
user avatar
  • 5
0 votes
1 answer
111 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
user avatar
1 vote
1 answer
105 views

Making website queries and return a large amount of data, can it be exploited for DOS attack?

I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
user avatar
1 vote
0 answers
112 views

Dos and DDos attacks in UAV

Are modern-day UAVs secured from Dos or DDos attacks? Most of the drones available in the markets are easily hackable with the help of Dos attacks be how secure the UAV-GS authentication is. Moreover, ...
user avatar
  • 111
0 votes
1 answer
315 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
user avatar
  • 47
0 votes
2 answers
226 views

If HTTPS only runs on a single port, why is SYN flooding an issue?

I've read online that SYN flooding is when "the attacker sends repeated SYN packets to every port on the targeted server." However, HTTPS only runs on port 443. Therefore, why is it ...
user avatar
  • 47
1 vote
0 answers
82 views

How to prevent dos(denial of service) attack? [closed]

Hi is there any solid algorithm or solution where I can refer to for preventing dos (denial of service)attack on my apache server ? I did the dos attack using slowloris in ubuntu and switchblade in ...
user avatar
1 vote
1 answer
132 views

Preventing DDOS attacks without collecting personal data? [closed]

Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
user avatar
1 vote
0 answers
21 views

How do I use SYN cookies to perform a DOS attack [duplicate]

I am taking a computer security course but I have a question I am stuck on. You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...
user avatar
3 votes
1 answer
256 views

Email pattern ReDoS

I would like to verify that the input from the user complies to the format of email address (in Java application). On the following page there is verbose regex that should properly validate the email ...
user avatar
1 vote
0 answers
86 views

How susceptible are JWTs to being used for denial of service?

Consider an API that requires a JWT for authorisation. For each JWT presented, it has to validate the signature, including base64 decoding, hashing and asymmetric encryption, which is stated noted as ...
user avatar
  • 178
0 votes
2 answers
171 views

Brute force without DOS'ing the server

How to conduct brute force tests for directory traversal or other operations that require trial and error without accidentally turning it into DOS attack? It comes to how much bandwidth a site is ...
user avatar
0 votes
1 answer
91 views

Is possible to deliver a dos attack increasing a database table?

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
user avatar
  • 477
0 votes
0 answers
50 views

My friends are disrupting my internet connection [duplicate]

My friends have my ip address and they're all programmers/hackers. They've been interfering with my wifi connection several times today. Asking them to stop or saying "they won't do anything"...
user avatar
1 vote
1 answer
115 views

Denial of Service question

I am studying for an exam in computer security, and I got stuck on the following question from a past exam: A random program generator service S allows clients to generate random data. Each client Ci ...
user avatar
  • 23
1 vote
1 answer
114 views

Outgoing messages while under massive denial-of-service attack

As I understand it, there is no internet protocol that provides true broadcast like in say a card game or a partially synchronous network assumption. How close can internet protocols come though? We'...
user avatar
0 votes
1 answer
147 views

Possible ways to intrigue IP blockage on practical websites

Assume that I share the same IP address with others. Then if I can do something bad to intrigue practical websites, such as Google, Amazon, or jQuery to block me, then all other users will also be ...
user avatar
1 vote
1 answer
195 views

How can a SYN flood affect a router in this scenario?

I'm using two routers in my home network, as described in this question (router B in the diagram). Therefore, router B is not accessible from the internet. Going over the logs of this router, I was ...
user avatar
2 votes
4 answers
158 views

Will brute force attack exhaust web server, resulting in DOS

I do know the difference between brute force attack and DOS. What if a web server doesn't have account lock out in place and a few brute force attacks is being started in parallel, and these attacks ...
user avatar
  • 23
1 vote
0 answers
121 views

Suppose a mischievous coffeeshop wifi gateway wants to drain phone batteries

Suppose a mischievous coffeeshop wifi gateway wants to drain phone batteries. It is easy to see how it might weaken signals and flip a few bits to wreak NAK havoc at the link level so wifi chip power ...
user avatar
  • 230
0 votes
1 answer
189 views

"Memory-Hard" vs. "Memory-Bound" Functions?

One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested. As actually there are two ...
user avatar
  • 1,217
0 votes
1 answer
94 views

DoS attack blocks website while in another connections show website run normally [closed]

I am learning Ethical Hacking. I create my own website on a cloud hosting service for testing purposes. I run DoS attack from my local VM and it shows that website is down. When I sent a link to my ...
user avatar
  • 3
2 votes
0 answers
187 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
user avatar
  • 121
2 votes
1 answer
2k views

Why would hackers attack a DNS server with a DoS?

I wake up this morning to a rebooted server. The DNS server was running at over 100%. After a little bit of work, I got fail2ban in place to block all of those requests. The requests themselves are ...
user avatar
0 votes
2 answers
171 views

Can a Slow Post HTTP attack be done from a single client?

Can a Slow Post HTTP attack be done from a single client? The following source cites this line: https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c Ports are 16-bit numbers,...
user avatar
  • 1
0 votes
0 answers
108 views

slowhttptest showing up as service unavailable, but is inaccurate service still up and running

I've got a small contract with a website; they have given me permission to stress test their website, testing for DOS attacks. I have some experience in the field, but I am no omniscient hacker. I'm ...
user avatar
0 votes
1 answer
97 views

Is it considered as a DOS attack if I add too much data to a page so that it doesn't respond at all?

I am working on an application. There is a new feature implemented where a user create some IDs and secret keys for that application. I have observed that there is no rate limit for creating those. I ...
user avatar
10 votes
4 answers
2k views

Defending against DoS via product reservation

An e-commerce site should reserve products for a user while they're going through the payment process (more info). This creates a potential denial-of-service risk where an attacker could reserve many ...
user avatar
  • 32.6k
0 votes
1 answer
175 views

Why did my DoS attack fail against Windows 10?

I have multiple devices - a Samsung and a Lenovo tab, an Amazon Alexa, an HP laptop running Windows 7, and another running Windows 10. Bored, I tried to DoS my Windows 10 laptop using my Windows 7 ...
user avatar
1 vote
1 answer
988 views

Access point uses different BSSID and deauth attack fails

I'm using airgeddon (https://github.com/v1s1t0r1sh3r3/airgeddon) to perform a deauthentication attack on my wifi network. When i put my wireless interface in monitor mode to scan the network from the ...
user avatar
-2 votes
1 answer
233 views

Why does hping3 test DoS not successfully?

I used hping3 to stress test a web app (DoS): sudo hping3 -S --flood -V -p 80 [IP addr/url] When I attempted to get access to the target web application through my network, it refused to connect ...
user avatar
  • 103
0 votes
1 answer
230 views

What is the traffic volume of practical DDoS attacks

I wonder what is the volume of traffic, in terms of requests/second, forms a legit DDoS attack against a website. I know it highly depends on the website and where it is hosted. But is there any real-...
user avatar
  • 663
-2 votes
1 answer
260 views

I think I may have DoS'ed a website accidentally

I had recently started using the nmap --script vuln option and I did try it on my own local router IP, which then crashed and we had to restart (coincidence?). Then today I wanted to try it again, ...
user avatar
0 votes
1 answer
149 views

Can wifi router be ddosed by "trying" to login to router repeatedly and in very fast manner?

Trying to make an important router as safe as possible from low skill "dos" attack on it. Is it possible for someone in the range of a wifi router to write a script in whatever programming language to ...
user avatar
  • 103
0 votes
4 answers
90 views

Potential DoS in emailing admin on error pages

In my website, the backend sends an email to the sysadmin whenever there is an Error 500 with the logs and other data about the error. How can I prevent a cracker from intentionally triggering the ...
user avatar
  • 535
1 vote
1 answer
125 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
user avatar
  • 215
0 votes
0 answers
129 views

Entrypoint on webapp allows semi-arbitrary data to be written. Can it be considered as DoS?

My team and I have written a web app, and we had a bug report regarding a DoS vulnerability. This vulnerability, requires a basic account to be created and allows this user to inject semi-arbitrary ...
user avatar

1
2 3 4 5
9