All Questions
61 questions
0
votes
1
answer
141
views
icmp smurf attack
I am learning about ICMP smurf attack and for this, I have forged a packet with the following details:
source_mac_address = **??**
destination_mac_address = router mac address
char ...
- 101
1
vote
2
answers
204
views
Are high traffic apps and websites used in DDoS attacks?
Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
1
vote
1
answer
2k
views
Layer7 DDoS Protection vs WAF, which should I use?
I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions;
...
- 113
1
vote
2
answers
1k
views
How to understand a single packet embedded with multiple requests?
When I read Multi VERB Single Request:
This Attack is also a variation of the Excessive Verb Attack
strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after
another ...
- 111
0
votes
2
answers
552
views
My VPS was used for DDOS Attacks [duplicate]
I got an email from my hosting provider telling me that my VPS was used to perform DDOS attacks on this website: cpanel4.vhosting-it.com. Unfortunately I haven't read their email sooner, so they ...
- 1
0
votes
1
answer
13k
views
My router is getting port scan attacks [duplicate]
My internet suddenly cut out yesterday, i checked the router and it looked like nothing is wrong. I looked at the logs and i see this
2019-08-18 12:50:39 Security Warning Detect UDP port scan ...
- 1
0
votes
0
answers
220
views
Unkown attack on linux server wordpress website
I have a WordPress site. Recently under a serious DDoS attack.
For this WordPress site I use nginx, varnish and apache in the backend.
A part of access log shows this:
24.41.213.36 - - [23/Jun/...
4
votes
1
answer
386
views
a mysterious & pointless long-term hacking attempt?
It seems that I am the target of a mysterious ongoing hacking attempt.
I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
- 41
1
vote
2
answers
3k
views
How fill up a gig interface bandwidth with hping3?
I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
1
vote
3
answers
348
views
Website is behaving strangely - was it attacked?
Our website was behaving strangely.
Sometime it was down and nothing was accessible.
Sometime it started loading but pages browsing was too slow.
We checked apache logs and found the below ...
- 111
2
votes
1
answer
2k
views
Difference between DNS flood attack and DNS amplifier attack [duplicate]
I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them?
It ...
- 21
0
votes
1
answer
334
views
What Are the Algorithm and techniques of IP Traceback?
In most of the cases the cyber attacks such as a DDoS attack or other kinds, it is sometimes hard/impossible to identify the real source IP addresses. This is because when you review the logs and ...
- 1,627
-2
votes
1
answer
241
views
Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?
I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
11
votes
1
answer
8k
views
Difference between Amplification and Reflection Attack?
Reflection Attack: Reflection attacks are attacks that use the same protocol in both directions. The attacker spoofs the victim’s IP address and sends a request for information via UDP to servers ...
- 1,176
-3
votes
1
answer
135
views
Most resource intensive assembly instructions? [closed]
Assuming I want to overload a server which is running some kind of web-app or gaming server, what is the best way for me to figure out which usage of legitimate features on the web-app or gaming ...
0
votes
1
answer
161
views
DDos prevention systems behavior for corporate networks [closed]
I asked this question on stackoverflow but couldn't get any answers and I even got a down vote as a present so that I'll try my luck out here. I did some research about this problem and couldn't find ...
- 119
2
votes
2
answers
2k
views
Beginner-friendly tool to simulate HTTP flood on my website
Is there any easy-to-use tool available I can use to produce an HTTP GET flood on a website I maintain? If so, can you also explain in steps how to use it?
I need to do this for testing purposes. Our ...
- 358
4
votes
1
answer
581
views
Trying to determine if someone was "DoS'd"
I'm part of a pretty small video game community and one of our members claims he was DoSed or DDoSed during a recent match. We are currently split as some people believe he was and others believe he ...
- 41
18
votes
1
answer
2k
views
Why is the Wikileaks site still accessible? How come it hasn't been hacked? [closed]
Let me get started by saying I think Wikileaks is great, and that their work is invaluable. Background/context for this question: The recent Wikileaks data dump on the CIA. I've visited the site ...
- 333
13
votes
1
answer
1k
views
What happens inside of a DDoS Scrubbing Center?
I understand, that traffic is redirected to a scrubbing center during a DDoS to differentiate between malicious and legitimate traffic as has been explained in this post. However, from a technical ...
- 131
1
vote
1
answer
374
views
Is the Mirai malware attacks related to the TR-069 is a classic port attack?
Refering to the following topic:
http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&...
- 113
-2
votes
1
answer
320
views
Is it possible to crash the Internet? [duplicate]
Could a skilled hacker given the resources crash the internet itself? With more and more people joining the internet everyday, it would be becoming increasingly easier for hackers to just, overload ...
73
votes
4
answers
12k
views
Did I participate in the recent DDoS attacks on Dyn's DNS service?
It was reported that the recent large scale DDoS attack affecting multiple websites in the US was done by hacking 10s of millions of devices and using them for the attack.
How can one in general know ...
- 3,871
1
vote
1
answer
228
views
What is the purpose of this attack?
The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE
Notes:
The requests come from more than 5733 unique IP addresses
~2 requests per ...
- 111
1
vote
2
answers
2k
views
Is port in UDP flood necessary? HTTP flood-down because? UDP, SYN and ICMP flood methods
I have questions about DDoS attacks.
In flood scripts, the script sends UDP packets to "ip.address:random.port"
Why It doesn't use only the IP? Is port necessary?
If someone is HTTP flooding a ...
70
votes
2
answers
22k
views
How can ISPs handle DDoS attacks?
How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole".
Is this enough to mitigate DDoS attacks or are there any other ...
- 1,627
-4
votes
2
answers
239
views
Facing digital abuse : need advice to severe all digital relationship with ex-boyfriend and secure my computer/phone [closed]
My ex-boyfriend broke up with me on October 9th, 2015 and we haven't been together since and we've been friends. He is still super controlling, jealous, verbally abusive, and manipulative even though ...
- 1
1
vote
1
answer
1k
views
Minimum number of ports needed for HTTP
I am supporting a public campground that provides web site access to its customers via a Time Warner Cable connection with wireless AP points in the park.
The allowed port usage is blocking some ...
13
votes
4
answers
16k
views
How to perform a proper DDoS test in a safe and controlled way?
What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure?
What different types of DDoS attacks are there and what things should be considered performing such a ...
- 7,095
1
vote
1
answer
236
views
Following strategy using DDoS mitigation service - UDP bandwith exhaustion attack from spoofed IPs
I need to defend against receiving a massive spam of UDP packets from random spoofed IP addresses. I would make it this way:
In my protocol, every UDP packet contains username and password.
Firewall(...
- 193
5
votes
2
answers
1k
views
How to deal with UDP bandwidth exhaustion DDoS attacks?
I am building a service, which will use UDP. It will run on Amazon AWS - in the firewall they provide, I can block everything except that one UDP port my service will run.
The only thing I'm ...
- 193
0
votes
2
answers
7k
views
Repeated "Dos Attack" from remote IPs
I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
- 11
1
vote
0
answers
233
views
How to find which domain in my VPS triggered a DDoS attack with WP xmlrpc
Today, my data center suspended my VPS for DDoS attack reasons. They say one of my clients, that has WordPress website, started a DDOS attack to another websites using xmlrpc. But I don't know which ...
- 111
5
votes
1
answer
671
views
What is an Origin Error Attack?
Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one.
From The Forrester Wave™: DDoS Services Providers,
Q3 2015 ...
- 34.4k
10
votes
2
answers
368
views
What is a Poison Dart attack?
From The Forrester Wave™: DDoS Services Providers,
Q3 2015 report, (emphasis mine):
Attack types defended
CGI request, denial of capability,
diluted low rate degrading, direct,
DNS request ...
- 34.4k
1
vote
1
answer
259
views
Why is a DNS Amplification attack considered a DDoS attack?
My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victim's. The DNS responds to this IP address with a ...
- 10.2k
1
vote
1
answer
759
views
Must an attacker using a Smurf attack be on the same network as the victim?
I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
- 10.2k
2
votes
3
answers
9k
views
TSource Engine Query DDoS attack
My gaming machine is under DDoS attack and when I used Wireshark I found the following string "TSource Engine Query" in all UDP packets coming from random IP's.
I found using Google that some gaming ...
- 133
2
votes
5
answers
172
views
Does services provided by different companies for DDoS protection work well?
Is it necessary to use any DDoS service provided by different web hosting provider and other people?
We know, they are running their business to provide security to thousands of web property. They are ...
- 29
1
vote
1
answer
254
views
Different types of DDoS attacks [closed]
What is behavior of UDP flood, TCP SYN flood, Ping of Death and Smurf attack?
- 27
0
votes
0
answers
50
views
Slow internet, IP Flood? [duplicate]
Lately, I've been getting slow internet. I checked wireshark and noticed I keep receiving in matter of seconds thousands of UDP packets that my computer does not respond to, and here's the twist: ...
- 101
3
votes
1
answer
654
views
How can I launch DHCP starvation attack in WLAN?
In WLAN, due to MAC association on Access Point (AP), I can't send the DHCPDISCOVER messages using random MAC addresses. But if I keep my original MAC address as the source ethernet MAC a and random ...
- 31
1
vote
0
answers
1k
views
Akamai or Incapsula (or other) for CDN with DDoS Protection? [closed]
One of our clients is launching a new site and I've been tasked with making a short overview of the advantages/disadvantages of Akamai, Incapsula or other CDN providers who are strong with DDoS ...
- 203
18
votes
3
answers
2k
views
NTP DDoS Attack on Home Servers
After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
user42740
4
votes
2
answers
6k
views
Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks
Hope someone can clarify.
As I understand, in a DNS DDos Amplification attacks
Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server.
The ...
- 141
9
votes
4
answers
15k
views
Why is it so hard to trace origins of DDOS attacks?
According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
- 2,431
1
vote
2
answers
323
views
I don't understand how BIPS got hacked [closed]
http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html
In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
- 21
0
votes
1
answer
5k
views
What methods are there of protecting a VPS from DDOS attacks? [duplicate]
I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
0
votes
1
answer
233
views
Finding the method of attack [closed]
My server has been repeatedly attacked in the last few days. Here's the observations:
The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
- 103
8
votes
3
answers
2k
views
Lessen impact of DoS attack on cpu-expensive login?
This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing functions?...
- 343