Questions tagged [denial-of-service]

Denial of Service (DoS) is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) by flooding a target with useless packets, connections or tasks.

Filter by
Sorted by
Tagged with
19 votes
7 answers
6k views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
Brendan Long's user avatar
  • 2,908
16 votes
8 answers
17k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
overrider's user avatar
  • 263
16 votes
6 answers
10k views

What is a DoS Attack and how does it differ from a DDoS attack?

Can someone explain to me the concept of DoS attacks for web applications? Also, what is the distinction between DoS and Distributed DoS (i.e. DDoS) attacks? Wikipedia says: In computing, a denial-...
Geek's user avatar
  • 263
33 votes
3 answers
12k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
binfalse's user avatar
  • 503
17 votes
4 answers
17k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
HEX's user avatar
  • 521
10 votes
1 answer
13k views

802.11w protected management frames - Wi-Fi

I've been reading about protected management frames, introduced in 802.11w, and had a few questions. Apparently, a message integrity check is provided with de-authentication frames, allowing either ...
dahui's user avatar
  • 507
70 votes
2 answers
22k views

How can ISPs handle DDoS attacks?

How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole". Is this enough to mitigate DDoS attacks or are there any other ...
R1W's user avatar
  • 1,627
26 votes
5 answers
4k views

Is unauthorised deletion an integrity or availability issue?

During a web application test I have discovered a parameter tampering issue that allows a user to delete comments left by other users. They can't modify the content of other users' comments, and they ...
paj28's user avatar
  • 33.4k
20 votes
3 answers
45k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
lee peat's user avatar
  • 211
6 votes
2 answers
2k views

Resource consumption attacks against algorithms

I am studying algorithm construction and weaknesses to resource consumption. One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability. The following quote was taken ...
rook's user avatar
  • 47.2k
61 votes
4 answers
12k views

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted ...
Michael0x2a's user avatar
36 votes
6 answers
30k views

Preventing artificial latency or "Lag Hacking" in multiplayer games

There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
rook's user avatar
  • 47.2k
24 votes
4 answers
11k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
Josh Brower's user avatar
  • 1,387
23 votes
3 answers
3k views

Should you care about DoS attacks if your server is using bcrypt?

(I just asked this question on "cryptography SE" and was suggested to ask it here instead) EDIT I just realized my question is mostly a dupe of: Prevent denial of service attacks against slow hashing ...
Cedric Martin's user avatar
19 votes
5 answers
5k views

How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?

I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here. I ...
user avatar
11 votes
3 answers
20k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
IneedHelp's user avatar
  • 213
8 votes
3 answers
721 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
Polynomial's user avatar
  • 135k
7 votes
3 answers
607 views

A way to prevent non distributed, network-level DoS attacks?

I have a DigitalOcean Ubuntu 16.04 machine with Bash as main shell, Nginx, PHP-FPM, and MySQL as server environment, Certbot for TLS and WordPress for web applications. I protect from MITMs with TLS. ...
Arcticooling's user avatar
6 votes
4 answers
12k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN cookies ...
user avatar
5 votes
1 answer
906 views

DNS Flood using DNS Amplification?

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think). Based on recent events (the attack to Dyn's DNS service) I was ...
Ricardo Ribeiro's user avatar
5 votes
1 answer
707 views

HPKP-based persistent denial-of-service attack on web sites

HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
D.W.'s user avatar
  • 99.6k
2 votes
2 answers
2k views

Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]

AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
gaazkam's user avatar
  • 6,015
0 votes
2 answers
1k views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
k to the z's user avatar
  • 1,125
152 votes
7 answers
50k views

Can someone take down Wi-Fi signal?

Is it possible that someone made an attack (DoS or something else) to my Wi-Fi router (without knowing of the password) and make my router's signal unavailable? 1) How it can be done? 2) What are ...
T.Todua's user avatar
  • 2,727
45 votes
3 answers
41k views

Can I trust the source IP of an HTTP request?

As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
KajMagnus's user avatar
  • 707
26 votes
4 answers
106k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
hnn's user avatar
  • 1,047
23 votes
4 answers
14k views

Why does a (D)DoS attack slow down the CPU and crash a server?

So I get the basic idea of (D)DoS used for flooding, but I don't quite understand how this causes servers to crash or get them to slow down due to CPU overuse. As far as I know, the thing that is ...
DrDoom's user avatar
  • 455
17 votes
5 answers
20k views

What is the difference between login throttling and temporary account lockout?

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
Okavango's user avatar
  • 415
17 votes
5 answers
29k views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
Amin Sh's user avatar
  • 273
16 votes
8 answers
3k views

Bruteforce vs Denial of Service

I had a problem presented today which I found quite interesting. You have an application with a management panel. You know some of the accounts as they are standard. You want two things: You want ...
Lucas Kauffman's user avatar
12 votes
4 answers
965 views

What lessons about Denial of Service can we learn from Egypt's "experiment"?

Internet service was widely disrupted in Egypt starting Jan 27th at about 22:15 UTC, in the space of about 20 minutes: How Egypt Killed the Internet. Service was largely restored 5 1/2 days later on ...
nealmcb's user avatar
  • 20.8k
11 votes
4 answers
32k views

Can someone launch a DOS attack on my IP

Suppose, I have a static IP on my PC and is known to others. None of my softwares listen for remote connection. Is it still possible for someone to DOS attack me in such cases? If yes, how it is ...
user avatar
11 votes
3 answers
45k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
user19775's user avatar
  • 191
11 votes
4 answers
2k views

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
SilverlightFox's user avatar
8 votes
2 answers
2k views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
user2633999's user avatar
7 votes
3 answers
12k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
Spencer D's user avatar
  • 770
7 votes
4 answers
1k views

Most reduced types of DoS attacks

As I understand it, there are generally only two common types of Denial of Service attacks in regards to the OSI model: Network-Layer-DoS (NLDoS) on layers 3, 2 or 1. Application-Layer-DoS (ALDoS) on ...
user avatar
6 votes
3 answers
3k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
MicFin's user avatar
  • 201
5 votes
4 answers
748 views

Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?

Imagine a simple API, which offers an endpoint POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses ...
user avatar
5 votes
1 answer
32k views

Is Mailbait still a threat?

Is Mailbait (or similar services) still a threat, was it ever a threat, and if so how can it be mitigated? Mailbait is that service that promises to fill up your email inbox by sending you a huge ...
reed's user avatar
  • 15.8k
5 votes
2 answers
16k views

How to mitigate UDP flood attacks?

My friend linked me some website where you pay $5.00 / m and get access to a plethora of 'dos stresser' tools that offer udp flooding, and other malicious flooders. It's a web-based system and you ...
NiCk Newman's user avatar
4 votes
1 answer
2k views

UDP Flood Attack false positive

Symantec keeps blocking traffic from the IP of my Comcast SMC Network gateway. It blocks traffic because it is detecting a UDP Flood Attack. According to the log the CPU usage is spiking to 100% when ...
Jonathan Eckman's user avatar
4 votes
1 answer
680 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: David-...
user3818650's user avatar
4 votes
4 answers
2k views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
makerofthings7's user avatar
4 votes
3 answers
710 views

Prevent DOS against RSA authentication

In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
Nuoji's user avatar
  • 343
4 votes
3 answers
4k views

Threshold for DDOS Attack

I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
cosmicrao's user avatar
4 votes
2 answers
651 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
William Breathitt Gray's user avatar
3 votes
1 answer
4k views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
jcm's user avatar
  • 133
2 votes
2 answers
12k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
Yasser's user avatar
  • 353
2 votes
3 answers
49k views

Constant Dos attacks on my router appear to be taking out my internet connection

So I'm a noob here and have been doing some research on why my internet (cable modem) locks up about once or twice a week ever since installing a Netgear N900 router a few months ago. After asking ...
King Kona's user avatar