In the past I had to do several DoS security audits, with mĂșltiples types of tests and intensities. Sometimes several DDoS protections were present like Akamai for static content, and Arbor for absorb part of the bandwith.
One consideration for the DoS/DDoS tools is that probably it will loss the control of the attacker host, and the tool at least has to be able to stop automatically with a timeout, but can also implement remote response checks.
In order to size the minimum mbps needed to flood a service or to retard the response in a significant amount of time, the attacker hosts need a bandwith limiter, that increments in a logarithmic way up to a limit agreed with the customer/isp/cpd.
There are DoS tools that doesn't have this timeouts, and bandwith limit based on mbps, for that reason I have to implement a LD_PRELOAD based solution: bwcontrol
Although there are several good tools for stressing web servers and web aplications like apache ab, or other common tools used for pen-testing, but I also wrote a fast web flooder in c++ named wflood.
As expected the most effective for taking down the web server are the slow-loris, slow-read and derivatives, few host were needed to DoS an online banking.
Remote attacks to database and highly dynamic web content were discarded, that could be impacted for sure.
I did another tool in c++ for crafting massive tcp/udp/ip malformed packets, that impacted sometimes on load balancers and firewalls, it was vulcan, it freezed even the firewall client software.
The funny thing was that the common attacks against Akamai hosts, where ineffective, and so does the slow-loris family of attacks, because are common, and the Akamai nginx webservers are well tunned. But when tried vulcan, few intensity was enough to crash Akamai hosts.
Another attack vector for static sites was trying to locate the IP of the customer instead of Akamai, if the customer doesn't use the Akamai Shadow service, it's possible to perform a HTTP Host header scan, and direct the attack to that host bypassing Akamai.
And what about Arbor protection? is good for reducing the flood but there are other kind of attacks, and this protection use to be disabled by default and in local holidays can be a mess.
More articles
- Usb Pentest Tools
- Hacks And Tools
- Computer Hacker
- Hacker Tools For Ios
- Hacker Tools For Ios
- Hack Tools
- Termux Hacking Tools 2019
- Pentest Tools Bluekeep
- Hacker Tools Apk
- Pentest Tools Framework
- Termux Hacking Tools 2019
- Hack App
- Beginner Hacker Tools
- Physical Pentest Tools
- Pentest Tools Kali Linux
- Pentest Tools Alternative
- Pentest Tools List
- Wifi Hacker Tools For Windows
- Hacking Tools Kit
- Pentest Tools Subdomain
- Hacker Tools Hardware
- Hacking Tools
- Hack Tool Apk
- Hack App
- Pentest Tools Github
- Pentest Tools Nmap
- Game Hacking
- Hacking Tools Free Download
- Hak5 Tools
- Pentest Tools Online
- How To Make Hacking Tools
- Pentest Tools For Windows
- Hack Tools Mac
- Hacker Tools List
- What Is Hacking Tools
- Hacking Tools Download
- Hacking Tools For Mac
- Hacking Tools Github
- Pentest Tools Open Source
- Usb Pentest Tools
- Best Hacking Tools 2020
- Hacker Tools For Pc
- What Are Hacking Tools
- Hacker Tools
- Hack Tools For Ubuntu
- Hacking Tools For Windows 7
- Hacker Tools Windows
- Wifi Hacker Tools For Windows
- Hack Website Online Tool
- Hacking Tools Free Download
- Hacking Tools For Mac
- Hacking Tools Mac
- Hacking Tools
- Easy Hack Tools
- Termux Hacking Tools 2019
- Tools Used For Hacking
- Pentest Tools List
- Hacker Tools Linux
- How To Hack
- Hackrf Tools
- Pentest Tools Open Source
- Hack Tools For Windows
- Hacker Tools Windows
- Pentest Tools For Ubuntu
- Hack Tools For Ubuntu
- Hacker Tools Free
- Hacker Tools Free Download
- Hacking Tools 2019
- Hack Tool Apk
- Hacking Tools Free Download
- Hack Tools For Mac
- Hacking Tools Github
- Hacker Tools Apk
- Hacking Tools Online
- Tools 4 Hack
- Pentest Tools For Windows
- Pentest Tools Website
- Pentest Tools Android
- Hacker Tools For Pc
- Hacker Tools Mac
- Pentest Tools Website
- Game Hacking
- Hacking Tools For Games
- Hackrf Tools
- Easy Hack Tools
- Top Pentest Tools
- Pentest Tools Framework
- Pentest Tools Download
- Hack And Tools
- Growth Hacker Tools
- Hack Rom Tools
- Easy Hack Tools
- Hacking Tools 2020
- Hacker Security Tools
- Pentest Tools Tcp Port Scanner
- Growth Hacker Tools
- Hacking Tools Windows
- Pentest Tools Review
- Pentest Tools Find Subdomains
- Hacking Tools Windows
- Underground Hacker Sites
- Hack Apps
- Hack Tools Pc
- Pentest Tools Tcp Port Scanner
- Pentest Tools Apk
- Pentest Tools Website Vulnerability
- Hack Tools For Ubuntu
- Nsa Hack Tools Download
- Hacking Tools For Games
- Hacking Tools For Windows Free Download
- Hack Tool Apk
- Nsa Hack Tools
- Tools For Hacker
- Hacker Tools For Windows
- Hacking Tools Windows
- Hacker Tools Apk Download
- Hacker Tools Online
- Free Pentest Tools For Windows
- Pentest Box Tools Download
- Hack Tools Github
- Pentest Tools Apk
- Hacks And Tools
- Best Hacking Tools 2019
- Hacking Tools Mac
0 comments:
Post a Comment