Denial of Service (DoS)
There are two distinct types of denial of service:
- Denial of Service (DoS): using a single machine, a DoS attack reduces or prevents accessibility of service for its users. It usually does so by flooding the targeted machine with a consequent amount of requests to overload the system or by exploiting logic flaws that make the target server compute way too much.
- Distributed Denial of Service (DDoS): a DDoS attack has the same goal as the DoS attack. Except it uses a multitude of compromised machines to cause a denial of service and usually relies on flooding rather than finding and exploiting logical flaws.
There are various ways to cause a denial of service by flooding such as:
- MAC flooding: flooding a switch with packets using different source MAC addresses.
- ARP poisoning/spoofing: linking multiple IP addresses with a single MAC address (to a target).
- Slow HTTP: sending HTTP requests in a slow and fragmented way, one at a time.
- File upload: exhausting the back-end system's disk space and network bandwidth by uploading lengthy files. Also, uploading a file that will be interpreted in the back-end could cause a DoS, if the file uploaded is malicious and its goal is to overload the system.
- ICMP flood: flooding the targeted machine with an overwhelming amount of ICMP requests.
The list is not exhaustive however, one can keep in mind that multiple categories exist, presenting a different approach for conducting a DoS attack: bandwidth, packets, TCP-related components, application layer, etc.
Testing for DoS in engagements can be useful for detecting applications and configurations vulnerabilities, by then providing the client with possible mitigation to prevent DoS attacks.
The command sends a huge amount of packets with random source addresses to stress firewall state tables and other dynamic tables (IP based) within the TCP/IP stacks and firewall software.
hping3 --rand-source --flood $TARGET_IP
The command sends a huge amount of SYN packets with a specified port.
hping3 -S --flood -V -p $TARGET_PORT $TARGET_IP
feroxbuster -H "User-Agent: PENTEST" -w $WORDLIST -u $TARGET_IP -t $THREADS
Unrestricted file upload in a website can lead to DoS by uploading lengthy files. If the back-end server interprets any file uploaded (PHP, JSP...), a DoS could occur depending on the goal of the file's code.
By sending a very long password, a DoS attack can be possible. The password hashing implementation may exhaust its CPU and memory resources.