Questions tagged [denial-of-service]
Denial of Service (DoS) is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) by flooding a target with useless packets, connections or tasks.
445
questions
0
votes
0
answers
21
views
How to prevent ARP spoofing attack with python scapy [closed]
I am performing ARP spoofing DOS attack from my Kali machine to the Parrot Os. Could you please suggest a script in Python that can be run in the victim end so that it will stop the ARP spoofing ...
-1
votes
0
answers
41
views
What website can I ddos [closed]
I recently got a DDoS tool and I want to see if it works.
I know that "website hosting websites" services like wix or 000webhost don't allow that because it affects them.
I want to find a ...
0
votes
0
answers
51
views
How can I verify that my DoS attack is effective?
I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
0
votes
0
answers
34
views
Hardened BitTorrent? DoS vulnerabilities?
Is there much information about hardening libtorrent usage, or perhaps other bittorrent flavors? I'm curious about denial-of-service attacks in particular.
I could narrow down the bittorrent protocol ...
- 837
0
votes
0
answers
86
views
DoS attack in my home router's logs
I logged in to my router to try to figure out why my phone randomly keeps being unable to connect to my WiFi. I looked in the logs and saw 2 strange rows:
[DoS attack: IP packet w/MC or BC SRC addr] ...
- 101
0
votes
0
answers
16
views
How to limit user from making too many request on an API endpoint? [duplicate]
I have a form where the user can add his phone number then, he receives a verification code on his phone number to log in/register.
Now a user could make too many requests with generated valid numbers ...
- 101
1
vote
1
answer
91
views
DOS UDP port scans in firewall logs
For a few days, we are getting the following logs on our firewall (Vigor2926ac, up-to-date firmware)
The traffic suggests that it comes from Google / Microsoft datacenters, but that's a bit odd that ...
- 11
0
votes
0
answers
78
views
How to test the reaction of an outsourced DDoS protection provider to a DDoS attack, similar to a red teaming engagement?
I work in a security/pentesting company and in the last year the demand for DDoS testing has dramatically increased. The issue is that the customer is not interested in what I call a mislabeled load ...
0
votes
1
answer
32
views
Would XerXes be effective without sending anything over the connections it opens?
From what I gathered, the gist of XerXes is doing this (snippet in Python):
with socket(AF_INET, SOCK_STREAM) as s:
s.connect((host, port))
s.send(b"0")
simultaneously, i.e. ...
- 137
0
votes
1
answer
117
views
Can an attacker flip bits of a signature to create DoS?
Assume two parties communicating. A sends a message to B signed with its private key. B received the message and verify it using the public key of A. Can an attacker launch a DoS attack by flipping ...
- 3
0
votes
1
answer
108
views
If I create multiple sockets on a single IP and create a connection with the server with each of them, can I do a DDoS?
So basically, if the server is let's say Apache or any other thread based server, so if I create multiple sockets on my machine and request the server until all of its threads get exhausted and try to ...
1
vote
0
answers
86
views
Implement Replay attacks in python [closed]
For an assignment I have to implement a proof of concept and (optionally attack it). The part of OCSP is working so far. I have a client that sends the request to a server, the server verifies if the ...
- 11
0
votes
1
answer
41
views
Exploitation Risks and Considerations specific to running internal DNS servers
I have heard of larger companies are utilizing their own internal DNS servers to route through internal resources. And was wondering if there is any specific exploitation risks and considerations for ...
- 726
0
votes
2
answers
65
views
Is triggering abort() and coredump considered denial of service?
I am surprised there is no consensus on mailing lists about this.
libgmp is library for big numbers.
It is not a library for very big numbers, because
if libgmp meets a very big number, it calls abort(...
- 105
0
votes
2
answers
246
views
Is Stack Exchange immune to DDoS and DoS attacks?
I have heard that DDoS and DoS attacks work most of the time and that they are used when SQL insertion and other methods fail. I know Stack Exchange has a lot of programmers, and that they have this ...
- 3
0
votes
1
answer
98
views
How would you counter an email/honeypot mischief scenario?
I'm thinking through a mischief denial-of-service scenario that seems too easy to employ.
Your web-site validates email addresses for new users on sign-up.
A rogue party (a competitor) performs sign-...
- 103
0
votes
1
answer
47
views
Is application layer DoS dangerous?
I host a website on a cheap 5$ IaaS hosting service without a CDN.
An actor with a higher bandwidth internet connection could try to overload my webserver with recursively downloading some data with ...
3
votes
0
answers
511
views
Protection against JPEG compression bombs
There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and in theory PNG/JPEG images might be a compression-bomb.
I've found an ...
- 43
-3
votes
1
answer
58
views
Are malicious crawling bots a form of application layer DoS?
I would assume that if someone is daily crawling a website in a way which is heavily laborious on the server it may overkill that server.
Are malicious crawling bots a form of application layer DoS?
10
votes
3
answers
4k
views
Can one prove that a server can be secure against DoS?
Is it possible to prove mathematically that a server is immune to denial-of-service attacks? Or is there some result in computer science journal that it this is an impossible task to do?
- 127
1
vote
1
answer
85
views
Altering a load balancer's choice
I was wondering: are there attacks that target a load balancer's choice algorithm?
For example, if an attacker takes control of a load balancer, the traffic could be redirected to a single server and ...
- 61
0
votes
1
answer
94
views
Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?
I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This ...
- 261
5
votes
4
answers
666
views
Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?
Imagine a simple API, which offers an endpoint POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses ...
user163495
1
vote
1
answer
114
views
How to perform external network scans that will not cause DoS?
What are some tools or techniques that could be used in external network penetration testing to perform safe scans only that are designed to cause no DoS (Denial of Service) or other interruptions? Or ...
- 11
1
vote
2
answers
161
views
Are high traffic apps and websites used in DDoS attacks?
Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
0
votes
2
answers
473
views
My postfix server is getting DOSed, what can I do?
Port 25 is open and I'm getting thousands of emails. How can I make it stop?
- 461
1
vote
1
answer
257
views
How do I differentiate a DDoS attack from a DoS attack?
My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
- 11
0
votes
0
answers
83
views
What is the greatest factor in DoS network flow connection tempo?
I'm conducting some research on botnet detection. I'm specifically looking at Zeek/Bro connection logs (so network flows). I was wondering what affects the tempo of the succession of network flows ...
0
votes
1
answer
142
views
Why ACK flood is effective?
I understand that SYN flood is effective due to how protocol works, waiting around 75 seconds before closing the connection.
What about ACK flood, what does it happen on the destination side that ...
- 5
0
votes
1
answer
179
views
Can display a GIF in <img> tag causing Client-side DOS
SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF?
Thanks everyone.
- 51
1
vote
1
answer
113
views
Making website queries and return a large amount of data, can it be exploited for DOS attack?
I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
- 51
1
vote
0
answers
142
views
Dos and DDos attacks in UAV
Are modern-day UAVs secured from Dos or DDos attacks? Most of the drones available in the markets are easily hackable with the help of Dos attacks be how secure the UAV-GS authentication is. Moreover, ...
- 111
0
votes
1
answer
599
views
Can't free proxies be used to create a botnet?
I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
- 47
0
votes
2
answers
526
views
If HTTPS only runs on a single port, why is SYN flooding an issue?
I've read online that SYN flooding is when "the attacker sends repeated SYN packets to every port on the targeted server." However, HTTPS only runs on port 443. Therefore, why is it ...
- 47
1
vote
0
answers
88
views
How to prevent dos(denial of service) attack? [closed]
Hi is there any solid algorithm or solution where I can refer to for preventing dos (denial of service)attack on my apache server ? I did the dos attack using slowloris in ubuntu and switchblade in ...
1
vote
1
answer
139
views
Preventing DDOS attacks without collecting personal data? [closed]
Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
1
vote
0
answers
21
views
How do I use SYN cookies to perform a DOS attack [duplicate]
I am taking a computer security course but I have a question I am stuck on.
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...
- 11
3
votes
1
answer
625
views
Email pattern ReDoS
I would like to verify that the input from the user complies to the format of email address (in Java application).
On the following page there is verbose regex that should properly validate the email ...
- 131
1
vote
0
answers
116
views
How susceptible are JWTs to being used for denial of service?
Consider an API that requires a JWT for authorisation. For each JWT presented, it has to validate the signature, including base64 decoding, hashing and asymmetric encryption, which is stated noted as ...
- 178
0
votes
2
answers
275
views
Brute force without DOS'ing the server
How to conduct brute force tests for directory traversal or other operations that require trial and error without accidentally turning it into DOS attack?
It comes to how much bandwidth a site is ...
0
votes
1
answer
130
views
Is possible to deliver a dos attack increasing a database table?
If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
- 567
0
votes
0
answers
51
views
My friends are disrupting my internet connection [duplicate]
My friends have my ip address and they're all programmers/hackers. They've been interfering with my wifi connection several times today. Asking them to stop or saying "they won't do anything"...
- 1
1
vote
1
answer
120
views
Denial of Service question
I am studying for an exam in computer security, and I got stuck on the following question from a past exam:
A random program generator service S allows clients to generate random data. Each client Ci
...
- 23
1
vote
1
answer
122
views
Outgoing messages while under massive denial-of-service attack
As I understand it, there is no internet protocol that provides true broadcast like in say a card game or a partially synchronous network assumption. How close can internet protocols come though?
We'...
- 837
0
votes
1
answer
184
views
Possible ways to intrigue IP blockage on practical websites
Assume that I share the same IP address with others. Then if I can do something bad to intrigue practical websites, such as Google, Amazon, or jQuery to block me, then all other users will also be ...
- 15
1
vote
1
answer
311
views
How can a SYN flood affect a router in this scenario?
I'm using two routers in my home network, as described in this question (router B in the diagram). Therefore, router B is not accessible from the internet.
Going over the logs of this router, I was ...
user218666
2
votes
4
answers
206
views
Will brute force attack exhaust web server, resulting in DOS
I do know the difference between brute force attack and DOS.
What if a web server doesn't have account lock out in place and a few brute force attacks is being started in parallel, and these attacks ...
- 23
1
vote
0
answers
126
views
Suppose a mischievous coffeeshop wifi gateway wants to drain phone batteries
Suppose a mischievous coffeeshop wifi gateway wants to drain phone batteries.
It is easy to see how it might weaken signals and flip a few bits to wreak NAK havoc at the link level
so wifi chip power ...
- 240
0
votes
1
answer
227
views
"Memory-Hard" vs. "Memory-Bound" Functions?
One of the approaches in order to prevent Sybil or DoS attacks is CPU-bound PoW. However, because of the influence of Moore’s law, the memory-based approaches are suggested.
As actually there are two ...
- 1,317
0
votes
1
answer
98
views
DoS attack blocks website while in another connections show website run normally [closed]
I am learning Ethical Hacking.
I create my own website on a cloud hosting service for testing purposes.
I run DoS attack from my local VM and it shows that website is down.
When I sent a link to my ...
- 3