280

There's a lot of ways you can attack a WiFi without knowing any passwords: Physical layer attacks: Simply jam the frequency spectrum with your own signal. That signal might just be noise, but it might also be a WiFi of your own under heavy load, with the nodes in that WiFi being configured not to play nice with others. (depending on the WiFi chipset, that ...


137

Yes. Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).


86

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the target IP address. Typically, ISP's try to use RTBH (remotely triggered blackholing), by which they can ask their upstream networks to discard the traffic, so it ...


85

A DDoS will certainly give an attacker information about response times, load capability and routing. It may also give information about how incidents are handled internally and externally, as well as how they are reported to the public. But this is not what the main uses are. Generally the two key reasons for DDoS are to: take a service or website ...


81

I would compare accepting user supplied regular expressions to parsing most sorts of structured user input, such as date strings or markdown, in terms of risk of code execution. Regular expressions are much more complex than date strings or markdown (although safely producing html from untrusted markdown has its own risks) and so represents more room for ...


74

In general a (Distributed) Denial of Service attack will not provide you with much information directly. However, there are a few scenarios where information could be gleaned as a result of a DoS. The following are a few examples, but this is not at all exhaustive: A load balancer may divulge internal subnet information or leak internal machine names in ...


61

First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing). My compliments to you. Ultimately, this is a matter of personal ethics, so it is hard to give advice. You need to do what you feel is right. That said, your suggestion to try ...


60

DDoS (Distributed DoS) is characterised by floods creating a DoS (in all available definitions). A single node causing a flood successfully is kind of rare. But DoS can be caused by a broad range of triggers. CVSS even has an example of a software crash classified as DoS for you: Due to a flaw in the handler function for RPC commands, it is possible ...


45

Enough to cause the service to be denied to someone. Might be 1 unexpected malicious request, which causes excessive load on the server. Might be several million expected requests, from a TV advert with a really good response. There isn't a specific value, since all servers will fail at different levels - serving static content is a lot easier on the server ...


40

How does one crash a server using (D)DoS? To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of attacks specifically attempt to use up as much of the target servers resources a possible and bring it down, rather than just hammer it with network traffic. ...


40

... but they used their own infrastructure It's not really their own infrastructure what they use. They use instead botnets consisting of hijacked systems. These are systems which they p0wn but definitely not own. And thus it is very cheap for them. Apart from that any VPS provider who would rent their VPS for DDoS attacks would quickly lose reputation ...


39

Disclaimer: I'm not an IT guru nor a security expert. First, I agree with @D.W. that it can't hurt to contact the site owner and explain what happened. (For all you know, the 509 responses may be totally unrelated to your haywire script.) Second, in the future, it's a simple matter to include your email address or other contact info in the User-Agent ...


39

If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the network is saturated. Also, very often phishers use hacked websites (for example poorly managed and outdaged Wordpress installs) to host their phishing sites, so ...


37

The real reason why such policies are in place is because they are in place by default. That's how things go in Active Directory: Passwords expire after 42 days. When changing his password, the (non-admin) user cannot reuse one of his 24 previous passwords. User cannot change his password twice within the same 24-hour frame. So you will encounter such ...


37

To summarize: It may work, or not, depending on how the server manages its cache for session parameters. The RFC are not consistent. It is not a "real" vulnerability. TLS sessions were initially meant to be an optimization, to avoid client and server doing the full handshake with its "heavy asymmetric crypto" for each connection (the actual cost of such ...


33

DoS attacks can be used in several ways as part of gaining access: Overwhelming primary defenses. when you are conducting a DoS attack, the primary defense mechanisms get caught up in it too. They can be overwhelmed and as a result, they may: a) not respond appropriate b) can hang altogether c) the watchers watching them are distracted, or your efforts are ...


32

As pointed out in this (unanswered) question, Availability in CVSSv3 is about how well the web service performs, not whether its data is available: While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the impacted component, this metric refers to the loss of ...


31

This normally occurs when a client decides to reduce its TCP window size, without the server expecting it. This can be the case when fragmentation is an issue, or when the client is using an embedded device with very little NIC buffer memory. This is a completely normal behaviour, and you're likely to see quite a few such packets in your log. The messages ...


28

Typically it is used in combination with a password history policy, eg “you can't re-use any of your last 12 passwords”. Without a minimum-change-period it would be possible to circumvent this by changing your password 12 times in a row, back to the original. It is IMO of pretty doubtful value.


26

Anonymous tries to talk people into supporting their DDoS actions by installing a tool on their computer. It has a botnet-mode which allows the leaders to define the target for all the drowns. In other words: Anonymous uses social engineering instead of technical vulnerabilities to distribute their botnet client. This tool just generates a lot of direct ...


24

There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address. You can use http://whois.domaintools.com/ to do a whois lookup to get the address. Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...


24

I see two conceptual paths for dealing with lag attacks: Punish lags. When an "artificial" lag is detected, evict the offender and enforce a ban period. This is hard to do in practice because there is a delicate balance to be found between people who cheat through lagging, and people who simply suffer from an occasional hiccup in their Internet connection. ...


23

Yes (with your assumptions of neglecting the client being able to intercept the return of the handshake at a spoofed IP) if you do things correctly. HTTP requests are done over TCP; until the handshake is completed the web server doesn't start processing the HTTP request. Granted a random user could attempt to spoof the end of a handshake; but as they have ...


23

So these are two quite different things, the first is a classification of protocol exploit, the second is a method sometimes employed by DDoSsers. I give examples of both. Authentication Reflection The classic example used to explain the concept of a reflection attack is the MIG in the middle. How it should work A military decides to implement a system ...


23

The question is a bit vague, the short answer is Yes clicking on links could DoS your site. A for a more in-depth answer you would need to look at what those links are doing. For example if every time you clicked a link it ran some monstrous database query that used all your CPU power or Disk IO, or if the links played a video that would quickly saturate ...


23

If you're running a website that's under attack, you should consider a service such as Cloudflare. Cloudflare and other CDNs are designed with DDoS attacks in mind - traffic passes through Cloudflare's network before it reaches yours. Since Cloudflare will filter DDoS traffic, only clean traffic will reach you. On the other hand, if the attack is small ...


23

Yes, in the sense that anything which "denies service" is a "denial of service". The CIA Triad defines information security as anything which affects Confidentiality, Integrity, or Availability of the system / data. As pointed out in comments, this is not always an "attack" since it's just as likely to be accidental. Whether this is the result of a ...


22

A) Yep you got it. Same in that they both result from a failed login attempt(s), though they differ in things like logging, the resulting UX implementation, and when one is used. If a user is temporarily locked out, this is email-worthy. You should send an email or text-message to them notifying them that enough failed attempts were made to warrant a ...


21

A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories: Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time) Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid ...


20

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


Only top voted, non community-wiki answers of a minimum length are eligible