In the past I had to do several DoS security audits, with múltiples types of tests and intensities. Sometimes several DDoS protections were present like Akamai for static content, and Arbor for absorb part of the bandwith.
One consideration for the DoS/DDoS tools is that probably it will loss the control of the attacker host, and the tool at least has to be able to stop automatically with a timeout, but can also implement remote response checks.
In order to size the minimum mbps needed to flood a service or to retard the response in a significant amount of time, the attacker hosts need a bandwith limiter, that increments in a logarithmic way up to a limit agreed with the customer/isp/cpd.
There are DoS tools that doesn't have this timeouts, and bandwith limit based on mbps, for that reason I have to implement a LD_PRELOAD based solution: bwcontrol
Although there are several good tools for stressing web servers and web aplications like apache ab, or other common tools used for pen-testing, but I also wrote a fast web flooder in c++ named wflood.
As expected the most effective for taking down the web server are the slow-loris, slow-read and derivatives, few host were needed to DoS an online banking.
Remote attacks to database and highly dynamic web content were discarded, that could be impacted for sure.
I did another tool in c++ for crafting massive tcp/udp/ip malformed packets, that impacted sometimes on load balancers and firewalls, it was vulcan, it freezed even the firewall client software.
The funny thing was that the common attacks against Akamai hosts, where ineffective, and so does the slow-loris family of attacks, because are common, and the Akamai nginx webservers are well tunned. But when tried vulcan, few intensity was enough to crash Akamai hosts.
Another attack vector for static sites was trying to locate the IP of the customer instead of Akamai, if the customer doesn't use the Akamai Shadow service, it's possible to perform a HTTP Host header scan, and direct the attack to that host bypassing Akamai.
And what about Arbor protection? is good for reducing the flood but there are other kind of attacks, and this protection use to be disabled by default and in local holidays can be a mess.
Continue reading
- Hacking Tools For Kali Linux
- Hack Tools 2019
- Pentest Tools Review
- Physical Pentest Tools
- How To Make Hacking Tools
- Nsa Hacker Tools
- Hacker Tools 2019
- Pentest Tools Linux
- Hack Tools
- Beginner Hacker Tools
- Hack App
- Nsa Hack Tools
- Hacker Tools List
- Hacking Tools Online
- Hacking Tools For Windows
- Hacking Tools For Kali Linux
- Hacking Tools Name
- Hacker Tools List
- Hack Tools For Pc
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Online
- Pentest Tools Kali Linux
- Pentest Tools Nmap
- Hacking Tools Github
- Hacking Tools Kit
- Pentest Tools Tcp Port Scanner
- Best Hacking Tools 2019
- Hacking Apps
- Hackers Toolbox
- Pentest Tools Online
- Hack Tools Mac
- Hack Apps
- Ethical Hacker Tools
- Install Pentest Tools Ubuntu
- Hack Tool Apk No Root
- How To Install Pentest Tools In Ubuntu
- Hacking Tools For Pc
- Pentest Tools Review
- Hacker Tools Free
- Hacking Tools For Pc
- Hacking Tools Download
- Pentest Tools For Mac
- Pentest Tools Kali Linux
- Hacking Apps
- Physical Pentest Tools
- Pentest Tools Bluekeep
- Hacking Tools For Windows 7
- Hacker Tools For Pc
- Pentest Tools Tcp Port Scanner
- Install Pentest Tools Ubuntu
- Hack App
- Pentest Reporting Tools
- Hack Tools Online
- Pentest Tools Find Subdomains
- Pentest Tools Framework
- Hackrf Tools
- Hack Tools For Mac
- Best Hacking Tools 2019
- Pentest Tools Website Vulnerability
- Pentest Tools Nmap
- Hacker Tools Software
- Hacker Tools Linux
- Game Hacking
- Hack Tools Pc
- Ethical Hacker Tools
- Hacker Tools
- Hacker
- Hack Tools Github
- Hack Tool Apk
- Install Pentest Tools Ubuntu
- Hacker Tools For Mac
- Ethical Hacker Tools
- What Are Hacking Tools
- Hacking Tools Github
- Pentest Tools Port Scanner
- Easy Hack Tools
- Nsa Hack Tools Download
- Hacker Tools 2020
- Top Pentest Tools
- Pentest Box Tools Download
- Hack Tools For Games
- Pentest Tools Windows
- Hacking Apps
- Hack Tool Apk
- Pentest Automation Tools
- Hack Tools Mac
- Usb Pentest Tools
- Hak5 Tools
- Hack Tool Apk
- Hacking Tools 2020
- Hacker Tools Free
- Beginner Hacker Tools
- Usb Pentest Tools
- Hacking Tools For Kali Linux
- Hacking Tools Online
- Pentest Tools Find Subdomains
- Hacker Tools Online
- Hacker Tools Free
- Easy Hack Tools
- Hacking Tools And Software
- Hack Website Online Tool
- Github Hacking Tools
- Pentest Tools Url Fuzzer
- Pentest Box Tools Download
- Kik Hack Tools
- Hacking Tools 2020
- Blackhat Hacker Tools
- Pentest Tools Apk
- Pentest Tools Linux
- Best Pentesting Tools 2018
- Pentest Tools Url Fuzzer
- Hack Tools For Ubuntu
- Hack Rom Tools
- Hacking Tools Windows 10
- Hacking Tools And Software
- Hack Tools 2019
- Hacking Tools For Windows Free Download
- Hack Tools 2019
- Hacking Tools Kit
- Hack Tools
- Kik Hack Tools
- Hack Tools 2019
- Hacker Tool Kit
- Usb Pentest Tools
- Pentest Tools For Ubuntu
- Hacking Tools For Games
- Pentest Tools Website Vulnerability
- Hacker Tools Online
- Pentest Tools List
- Hacking Tools For Mac
- Hacker Tools Free
- Nsa Hacker Tools
- Pentest Tools Github
- Pentest Tools For Android
- Hacker Tools Free Download
- Hacker Tools For Mac
- Hacker Tools Free Download
- Hacking Tools For Windows Free Download
- Pentest Tools Android
- Pentest Tools Linux
- Pentest Tools Website
- Physical Pentest Tools
- How To Make Hacking Tools
- What Is Hacking Tools
- Hacking Tools For Windows 7
- Hacking Tools Software
- Pentest Tools Bluekeep
- Hacker Tools Apk Download
- Pentest Tools Windows
- Hackers Toolbox
- How To Make Hacking Tools
- Nsa Hack Tools
- Hack Tools Online
- Growth Hacker Tools
- Tools For Hacker
- Physical Pentest Tools
- Hack Tools For Mac
- Pentest Tools For Mac
- Pentest Tools Download
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Open Source
- Best Hacking Tools 2020
- What Are Hacking Tools
- Pentest Box Tools Download
- Hack Tools For Ubuntu
- Pentest Tools Online
- Hacking Tools Kit
No comments:
Post a Comment