All Questions
Tagged with distributed-dos or ddos
506 questions
1
vote
1
answer
148
views
Potential Linux.Xor.DDoS - chkrootkit
I have a Debian server, and I was recently contacted by my hosting provider that my server is being used to DDoS people/servers. Is this the cause?
Searching for Linux.Xor.DDoS ... INFECTED: Possible ...
CommunityBot
- 1
1
vote
3
answers
941
views
JS challenge based on computational complexity
Assuming I have a website with a button that sends AJAX requests to my server which will be expensive to process.
I suppose that mostly cookie or JavaScript + cookie challenges are used to prevent (...
CommunityBot
- 1
1
vote
5
answers
3k
views
DDOS Server Attacks & Domain Names
I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
- 1
3
votes
3
answers
433
views
How to secure an email subscription endpoint?
I have a simple static webpage that lets users sign-up for a newsletter. Once they enter their email address, it gets sent to a public endpoint (AWS Lambda). This lambda function forwards the email ...
CommunityBot
- 1
1
vote
0
answers
358
views
How to diagnose a DDOS on a home network?
I'm a user with a consumer level modem and a plain wifi router.
I have been seeing activity where for long periods of time over night, my internet connection will shut off for 10-20 minutes at a time. ...
- 202
1
vote
2
answers
1k
views
How to understand a single packet embedded with multiple requests?
When I read Multi VERB Single Request:
This Attack is also a variation of the Excessive Verb Attack
strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after
another ...
CommunityBot
- 1
0
votes
1
answer
151
views
I am being attacked by a DDoS tool. How do I defend against it? [closed]
I used Cloudflare's waf and created several rules to allow only a few countries to access, deny access to old browsers, and started hosting rules. Although the defense was successful, my website was ...
- 132k
0
votes
0
answers
31
views
Router getting several port scans and DOS a minute from foreign IPs. Should I be worried? [duplicate]
What Happened:
I was looking at the logs in my router and saw that suddenly I started getting warnings about "port scan attacks" and "DDOS attempts" every few seconds from my ...
- 101
0
votes
1
answer
188
views
How to prevent spam attacks from rotating proxies
My website has hundreds of thousands of html pages that are open to public. Each time a html page is requested, a call will be made to my database to get the correct data. Therefore the cost of each ...
- 208k
0
votes
0
answers
97
views
How to handle Microsoft FTP server being DDoSed
We noticed FTP service going down intermittently in the server and we found an FTP user was used to DDoS the server. Then we deleted the specific user from the server. After that the user "...
- 132k
2
votes
0
answers
2k
views
Checking IP's reputation on CloudFlare and Google [closed]
Google and CloudFlare have recently indicated that my home IP address is contributing to a DDoS or spam network.
I am frequently being checked (What is the website checking about my browser to protect ...
- 132k
1
vote
0
answers
103
views
Ddos attack on the ISP [closed]
I need help in controlling my ISP from Ddos attacks it's happening for almost a month almost everyday bringing down the isp for 4 to 5 hours sometimes for the whole day anyone can help it guide what ...
- 21
1
vote
0
answers
161
views
Code to detect HTTP/2 Rapid Reset Attack vulnerability
Is there code/library to detect this vulnerability? I have been searching online and do not find any
We are using Cloudflare which has fixed the issue but government says "we may" have the ...
- 173
0
votes
1
answer
237
views
Key difference between DoS & DDoS [duplicate]
What are the key components that define them and what are the differences? are there any standard structure of it? I've looked at several papers, and some of them using as a same, and some of them are ...
- 52.1k
1
vote
1
answer
2k
views
How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? [closed]
Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even ...
- 103
1
vote
0
answers
320
views
How can I verify that my DoS attack is effective?
I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
- 132k
3
votes
0
answers
138
views
Can botnets/malicious traffic be effectively reduced on my exit nodes?
I host a small collection of TOR exit nodes to the clear net. Believe it or not, the number one complaint I get in my inbox is not due to illegal materials coming through the nodes (of which I have ...
- 202
1
vote
3
answers
348
views
Website is behaving strangely - was it attacked?
Our website was behaving strangely.
Sometime it was down and nothing was accessible.
Sometime it started loading but pages browsing was too slow.
We checked apache logs and found the below ...
- 18.8k
124
votes
4
answers
112k
views
What is the website checking about my browser to protect the website from a DDoS?
Some sites I visit take me to a page that says roughly, "Checking your browser before accessing example.com. DDoS attack protection by CloudFlare".
What exactly about my browser is being checked and ...
- 125
2
votes
1
answer
235
views
How to avoid breaking end-to-end encryption while employing cloud-based DDoS protection?
I have a few websites and apps that I need to protect from DDoS attacks. These websites and apps are delivered by various servers that sit in several small data centers around the world.
I'm thinking ...
- 2,294
0
votes
1
answer
141
views
icmp smurf attack
I am learning about ICMP smurf attack and for this, I have forged a packet with the following details:
source_mac_address = **??**
destination_mac_address = router mac address
char ...
CommunityBot
- 1
0
votes
3
answers
245
views
Avoid checking passwords for dos attacks
A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
CommunityBot
- 1
1
vote
1
answer
404
views
Is my website under attack?
I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs.
Note: In the log report, I replace the name of my website with example.com and my second ...
- 55.5k
0
votes
2
answers
14k
views
Will resetting IP stop DDoS?
My router has been DDoS'd multiple times (although not taken offline), would resetting the IP stop the attack?
1
vote
1
answer
3k
views
Slow HTTP POST vulnerability in IIS 10
I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer.
From what I understood from this finding, ...
CommunityBot
- 1
0
votes
1
answer
1k
views
Does a DDoS Attack affect the internet connection apart from the service it's attacking?
Lately I've been experiencing some crashes related to my internet connection, I'm on the process of pin-pointing what is causing the issue and one of those possible causes might be a DDoS attack, ...
- 6,948
0
votes
1
answer
371
views
How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?
An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so:
#define CONNECTIONS 1
They then attack with xerxes-executable mydomain 433.
Their strategy is to ...
- 208k
4
votes
1
answer
581
views
Trying to determine if someone was "DoS'd"
I'm part of a pretty small video game community and one of our members claims he was DoSed or DDoSed during a recent match. We are currently split as some people believe he was and others believe he ...
- 2,285
12
votes
4
answers
4k
views
Webserver DDOS protection without giving away private keys (https, tls, ssl)
What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys?
Many of the common solutions for DDoS protection of a ...
- 1,090
0
votes
1
answer
1k
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 99
0
votes
1
answer
287
views
If I create multiple sockets on a single IP and create a connection with the server with each of them, can I do a DDoS?
So basically, if the server is let's say Apache or any other thread based server, so if I create multiple sockets on my machine and request the server until all of its threads get exhausted and try to ...
- 208k
2
votes
1
answer
790
views
Server is sending large amounts of encrypted UDP traffic
The hosting company of a client has shut down their Windows server twice in the past week because the server seems to be sending out massive amounts of outbound encrypted UDP DNS traffic.
I have now ...
CommunityBot
- 1
2
votes
3
answers
815
views
Limit REST API calls by fingerprinting and IP
I have a question regarding request limits for a REST service endpoint.
I think of course the most basic identification used to limit requests is by taking the user's IP address, but what if we have ...
- 2,381
1
vote
1
answer
781
views
Can't free proxies be used to create a botnet?
I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
1
vote
2
answers
326
views
Is Stack Exchange immune to DDoS and DoS attacks?
I have heard that DDoS and DoS attacks work most of the time and that they are used when SQL insertion and other methods fail. I know Stack Exchange has a lot of programmers, and that they have this ...
- 8,275
1
vote
0
answers
97
views
Opencart website getting request from random subdomains (DDoS)
We have an Opencart 3.0.3 website which is getting DDoSed, we then migrated it to AWS and noticed the same thing happening, we blocked access from all other countries except US & Canada. For admin ...
- 1,675
0
votes
1
answer
92
views
DDoS throttling vs deny actions
Recently I saw the Google Report about the DDoS Attack that they managed to stop. In the report, they said,
"They chose the ‘throttle’ action over a ‘deny’ action in
order to reduce chance of ...
- 132k
1
vote
1
answer
1k
views
How to protect home network from DDoS attacks when assigned a static IP that is already known to attackers?
Is there something I can do in this case? My ISP says they cannot assign me a different IP. At this stage a VPN no longer helps, correct?
- 132k
2
votes
1
answer
461
views
What happens to malicious traffic in a scrubbing center during a DDoS attack?
My understanding of a scrubbing center is when a DDoS is underway, all traffic gets routed to a scrubbing center where traffic is analyzed and all legitimate traffic is then sent to the targeted ...
- 1,025
8
votes
2
answers
7k
views
Possible Malicious Linux.Xor.DDoS installed
I am not an expert in information security. I am running Lubuntu on a laptop. Today, I ran chkrootkit and it printed the following:
INFECTED: Possible Malicious Linux.Xor.DDoS installed
/tmp/clamav-...
- 1,104
8
votes
6
answers
13k
views
Why can't we block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative Nameserver(victim)...
- 33.1k
4
votes
6
answers
2k
views
Bot detecting by considering request inter-arrival time
If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time?
When a user request for a page (page request), browser request for several ...
- 2,285
9
votes
4
answers
10k
views
Block all botnets and Tor addresses from accessing our site
I've heard that many DoS attacks and general "black hat hacking" attempts occur over the Tor network. Is it possible for me to dynamically block source Is by their presence in a botnet or ...
- 67.3k
5
votes
1
answer
1k
views
Creating a DDoS attack using DirectConnect
I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
- 2,285
27
votes
2
answers
9k
views
How is Google abused for DDoS attacks?
While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent.
I'm ...
1
vote
0
answers
122
views
What other than ping tools might be suitable for overwhelming a server that has disabled its functionality of being pinged? [closed]
The following code:
#!/usr/bin/bash
TARGETS=("nalog.gov.ru" "www.nalog.gov.ru"
"customs.gov.ru" "www.customs.gov.ru"
"ffs.ru" "www.ffs.ru"
...
- 137
-1
votes
2
answers
388
views
How would routing DDoS attacks over Tor increase effectiveness?
In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes.
I'm curious how a DDoS attack would be more effective when routed over Tor. From ...
- 11.6k
2
votes
1
answer
356
views
How do I differentiate a DDoS attack from a DoS attack?
My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
CommunityBot
- 1
0
votes
1
answer
204
views
Why do DDoS attacks spoof DNS source IPs?
Recently, a lot of my friends have been talking about botnets. They said they've created their own. Obviously, I know this is all illegal so I try not to take part in any of it.
But I've been ...
- 132k
1
vote
0
answers
111
views
How are DDOS protection mechanisms setup when confidential data is involved?
Scenario:
A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data.
Since a hospital is an obvious target for any type of hack, ...
- 132k