Questions tagged [denial-of-service]

Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

Filter by
Sorted by
Tagged with
22
votes
4answers
11k views

Why does a (D)DoS attack slow down the CPU and crash a server?

So I get the basic idea of (D)DoS used for flooding, but I don't quite understand how this causes servers to crash or get them to slow down due to CPU overuse. As far as I know, the thing that is ...
0
votes
2answers
536 views

In DoS, does every sent Spoofed IP packet have a different IP?

so, my question is: When a DoS attack occurs and the attacker is using spoofed IP packets, do this packets all carry the same spoofed IP or does every packet have a different IP header? Thanks
26
votes
5answers
3k views

Is unauthorised deletion an integrity or availability issue?

During a web application test I have discovered a parameter tampering issue that allows a user to delete comments left by other users. They can't modify the content of other users' comments, and they ...
4
votes
4answers
288 views

Causing Denial of Service by “Session Spaming”

Let's assume you have a single sign on ticket and you logon to a website which authanticates you by the ticket (same thing with user/password). The webserver will create a session and the user stores ...
3
votes
2answers
748 views

Can someone take down my mobile data connection?

I have a friend who says that he can take down anyones mobile data connection and one day he did it while I was in the tram with him. Is it possible that someone can DDOS your mobile data connection, ...
2
votes
1answer
117 views

Server takes 30 seconds to respond to simple request. DoS?

I'm testing a web app and noticed that by converting a particular GET request to a POST request the server takes about 30 seconds to respond and then returns a generic error page (compared to the ...
1
vote
1answer
215 views

Is the Mirai malware attacks related to the TR-069 is a classic port attack?

Refering to the following topic: http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&...
-4
votes
1answer
832 views

Exploit to the hash table collision vulnerability [closed]

Is there an exploit (PoC code) to this vulnerability (hash table collision) for python? 2011-003 multiple implementations denial-of-service via hash algorithm collision Description: A ...
-1
votes
1answer
276 views

Which protocols are the most secure to achieve authentication and encryption for a client downloading data from a sever?

I'm new to Information Security so please bear with me if this question is quite trivial. I want to design a secure protocol that allows someone to download a piece of data that belongs to them from ...
147
votes
7answers
31k views

Can someone take down Wi-Fi signal?

Is it possible that someone made an attack (DoS or something else) to my Wi-Fi router (without knowing of the password) and make my router's signal unavailable? 1) How it can be done? 2) What are ...
0
votes
1answer
239 views

How are Distributed Denial Of Service (DDOS) attacks resovled [duplicate]

I just realised that I don't know how (denial) of service attacks are resolved especially in the long term. The attacking machines don't get tired and there must be some cooperation involved in ...
2
votes
2answers
379 views

Hping and spoofed DDoS (or DoS?) what do -U and -P mean?

Recently I set up 2 virtual machines with Mint 18 inside, to practice and analyze some DDoS attack types. For now on, I'm using hping3 to perform some simple DDoS (or I should say, DoS attacks, since ...
5
votes
1answer
716 views

DNS Flood using DNS Amplification?

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think). Based on recent events (the attack to Dyn's DNS service) I was ...
6
votes
3answers
429 views

Did the October 21, 2016 DDoS attack on Dyn's DNS service cause Bandwidth Exhausion?

A recent attack on Dyn's DNS services affected several major websites last Friday, Oct 21, 2016. I would be interested to know if this was Bandwidth Exhaustion, or if it was mainly load on the server ...
10
votes
5answers
5k views

Is it illegal to DDoS a phishing page? [closed]

I used to go on a site called blockchain.info For storing bitcoins but today when I entered the URL I was redirected to a phishing page. I have entered all my information and it was obviously sent to ...
6
votes
1answer
472 views

How was DDoS attack on Dyn made?

https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/#more-36727 A DDoS attack on Dyn, on 21st Oct 2016, caused outages for Twitter, SoundCloud, Spotify, Reddit, etc. on the ...
0
votes
1answer
255 views

DHCPig not making the hosts discard IP configuration

In DHCPig I have the option to send RELEASE packets to all hosts in the network. This should result in the hosts discarding their configuration. This is the command I ran: pig.py -r eth0 I did run ...
0
votes
1answer
543 views

Restrict access to public URL many times

I have such situation. Imagine there is a public service (URL). What we don't want, is for someone, to be able to access this URL many times in short period of time, because they will be able to block ...
1
vote
1answer
39 views

DoSing Apache versions

Can denial of service attacks affect Apache V2.4 or more? Using Slowloris.pl Or how to DoS Apache servers V2.4 or more?
2
votes
3answers
10k views

Constant Dos attacks on my router appear to be taking out my internet connection

So I'm a noob here and have been doing some research on why my internet (cable modem) locks up about once or twice a week ever since installing a Netgear N900 router a few months ago. After asking ...
0
votes
2answers
732 views

Reverse DoS attack?

Let's say I have a 5mpbs up and 50 mbps down-link. I'm running a web-server with one quite large resource (it's about 1 megabit, not byte). What is there to stop a malicious individual from running 5 ...
59
votes
2answers
13k views

How can ISPs handle DDoS attacks?

How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole". Is this enough to mitigate DDoS attacks or are there any other ...
4
votes
2answers
679 views

How to test CVE-2004-0789 Multiple Vendor DNS Response Flooding Denial Of Service?

I use Nessus to check vulnerabilities on my webserver. It is a Windows Server. Nessus reports that this particular server has a CVE-2004-0789 vulnerability. Here is the description from Nessus: The ...
2
votes
2answers
85 views

Deleting a webpage via 'malware DoS'

I mean, we all know the DoS/DDoS where machine(s) are flooding servers/computers with traffic that it cannot handle. Eventually, it just goes down and nothing can connect to it, neither connect itself ...
1
vote
0answers
21 views

How to analyse a hacked server? [duplicate]

To be clear on of my server have been temporarily suspend because it was doing an DoS to another remote server. I was informed by the hosting company of the abnormal activity and I know what was the ...
57
votes
11answers
15k views

Can a DDoS attack yield any information?

Can a DDoS attack reveal any information or be used to mount a hack? My understanding is that the whole point of DDoS or DoS is to consume all of the resources/overload the server causing it to crash. ...
0
votes
1answer
99 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
13
votes
4answers
10k views

How to perform a proper DDoS test in a safe and controlled way?

What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure? What different types of DDoS attacks are there and what things should be considered performing such a ...
1
vote
1answer
473 views

How do you shun an IP automatically based on the number of current connections?

If I have a single IP that's trying a Denial of Service attack, how can I automatically have it banned/shunned? I go in and manually put it in a group of banned IP addresses, but I'd like for it to ...
2
votes
1answer
79 views

Do a DoS where you permit only your own connection?

Yesterday I was discussing with my brother, a computer scientist, if it is posible to perform a Denial of Service on a webpage so you block all the traffic to the web but you allow your connection to ...
7
votes
1answer
503 views

Any vulnerability in .net implementation for C# object.GetHashCode?

I've already asked this question on SO, but I think that this forum is more appropriate to discuss security issues. My point is that most OO languages has a way to get a unique hash code for an ...
4
votes
0answers
195 views

Attacks on wifi router, don't know what to do or if I should be concerned [closed]

I'm wondering if these attacks are something to worry about, or just my router being a router. [DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.xxx.xxx], Friday, May 06,2016 21:12:...
1
vote
2answers
287 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
5
votes
1answer
593 views

What's happening on my wifi? NTP and ACK STORM attacks.

I'm wondering if these attacks are something to worry about, or just my router being a router. [DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.254.230], Friday, May 06,2016 21:12:...
1
vote
3answers
571 views

Denial of Service by SQL queries - are selective queries better than queries that return a lot?

Lets say I have a search form for a blog (or any other system that would use SQL to run queries) and I want to protect it from denial of service. An attacker wants to attack my site by flooding the ...
3
votes
2answers
757 views

XSS on a single page web application

I'm practicing stored XSS attacks on my vulnerable single page web application. I want to achieve some kind of DoS attack, where the page keeps reloading from the server. I can easily inject window....
4
votes
2answers
126 views

How can Heap Pollution cause a security flaw

I came across this rule in the CERT Secure Coding Standart for Java. Heap Pollution. I understand this can cause the programm throwing an exception at runtime, but i can't understand how this could ...
2
votes
2answers
71 views

Is my computer getting attacked? [closed]

Would anyone be able to have a look at the pcap from my computer? I am thinking my computer get attacked by a process and keeps sending out packets from my computer to DoS my network. I get errors ...
-5
votes
1answer
975 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
3
votes
1answer
445 views

How to successfully report DoS attack coming from a big ISP?

A few weeks ago I reported a small botnet which is coming from the network of a big Internet provider. They asked me for more details which I provided. But the attack is going for weeks already and ...
27
votes
4answers
9k views

Normal usage vs. denial-of-service? How many requests are needed to talk about a denial of service?

Recently I used a tool to download a website and as part of the tool one could adjust the number of parallel connections. So now I found myself asking: starting from how many requests a provider could ...
3
votes
1answer
92 views

If a firewall deletes DOS packets before they reach the designated application. Is it then possible to break trough the firewall with a DDOS attack?

My Question is that if a Firewall blocks for example a DOS attack of UDP packets. Is it then possible to "break" or take up the capacity of a server by sending enough packets trough a DDOS attack? or ...
2
votes
0answers
105 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
4
votes
1answer
113 views

Security monitoring in the cloud?

I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network ...
10
votes
3answers
3k views

Is there any way to stop DDOS attacks? [duplicate]

As many other webmaster I am facing problems with DDOS attacks. I have tried denying offending IP addresses from htaccess files and using bigger and better hosting, but I am unable to stop the attacks ...
1
vote
0answers
514 views

How to keep my VPS server up on Hulk.py attack

This question in not duplicated, I tried everything that was published on stackexchange websites, but could not fix my problem. I have a web server. OS: Ubuntu 15.10 Configured on Apache2 Ram: 1.5 GB ...
1
vote
1answer
187 views

Dealing with a DDoS: horizontal vs vertical scaling?

I'm reading this paper about DDoS protection in AWS. One of the benefits of EC2 is that depending on the instance, it can scale for minimizing the effect of the attack. In the paper there are two ...
1
vote
1answer
118 views

Denial of Service against an asynchronous Web service

Is it possible to perform a denial of service attack on an asynchronous web service? Isn't the operating system supposed to release the thread? It shouldn't matter if someone attacking a system would ...
-3
votes
1answer
424 views

Sniffing or DOS attacks or MIM Attack [closed]

i'm preparing my bachelor's degree, i have to chose an attack, sniffing, dos, or MIM attack, I'm a bit lost, in my project i have to find a solution, how to detect one of this attacks, If you guys may ...
1
vote
1answer
149 views

How can one securely hash passwords server side while avoiding DoS? [duplicate]

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?