Denial of Service (DoS) Attacks and how it works - Linklinkgo
Denial of Service (DoS) Attacks
A Denial of Service (DoS) attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting the services of a host connected to the Internet. DoS attacks typically occur when attackers use malicious code to flood a targeted machine or network with illegitimate requests, overloading it so that it cannot respond to legitimate traffic, or responding so slowly that it becomes unusable. Examples of DoS attacks include SYN floods, ping floods, and smurf attacks.
How does a DoS attack work?
A Denial-of-Service (DoS) attack is a malicious attack to make a machine or network resource unavailable to its intended users. It is often done by flooding the target with traffic or sending it information that triggers a crash. In some cases, the attacker may also use malware to delete or modify files or disrupt services on a host computer. The goal of a DoS attack is to overwhelm the target with requests, making it impossible for legitimate users to access the resource.
Three broad types of DDoS attacks are as follows.
1. Network Layer Attacks: These attacks target the underlying infrastructure of the Internet by flooding a target system with requests from multiple sources. Common Network Layer attacks include SYN floods, Ping floods, and UDP floods.
2. Application Layer Attacks: These attacks target specific applications and services running on a server. Common Application Layer attacks include HTTP floods, Slowloris attacks, and DNS amplification attacks.
3. Volume-Based Attacks: These attacks attempt to overwhelm a target system by inundating it with more requests than it can handle. Common Volume-Based attacks include ICMP floods and Smurf attacks.
DoS attacks typically fall into categories:
1. Volume-Based Attacks: These attacks involve flooding the target with a large amount of traffic, such as sending numerous requests for web pages or data, in order to overwhelm the target's network resources and cause it to slow down or crash.
2. Protocol Attacks: These attacks take advantage of weaknesses in the protocol used to communicate between computers, such as the Transmission Control Protocol (TCP). These attacks send malicious packets to the target in an attempt to disrupt its normal operations.
3. Application Attacks: These attacks target specific applications, such as web servers, databases, or email servers, in an attempt to overwhelm them with malicious requests or data.
4. User Datagram Protocol (UDP) Floods: These attacks involve sending numerous UDP packets to the target in an attempt to overwhelm its network resources and cause it to slow down or crash.
5. Distributed Denial of Service (DDoS) Attacks: These attacks involve using multiple computers to send malicious traffic to a single target in an attempt to overwhelm it with traffic and cause it to slow down or crash.
A few common historic DoS attacks include:
1. Smurf Attack: This attack involves flooding a target system with ICMP echo request packets, with the source address spoofed to match the IP of the victim.
2. SYN Flood Attack: This attack involves sending numerous SYN packets to a target server in an attempt to consume all available resources.
3. Ping of Death Attack: This attack involves sending an abnormally large ICMP packet to a target system in an attempt to cause a system crash or buffer overflow.
4. Teardrop Attack: This attack involves sending fragmented IP packets to a target system in an attempt to cause a system crash or buffer overflow.
5. Fraggle Attack: This attack is similar to a Smurf attack, but instead of ICMP echo request packets, it involves sending UDP broadcast packets.
Indicators of a DoS attack include:
1. Increased network traffic: Unusually high levels of traffic can be an indication of a DoS attack.
2. Connection Refusal Errors: An attacker may attempt to flood your server with requests, leading to connection refusal errors.
3. Unexpected Service Shutdowns: If services suddenly become unavailable, this could be a sign of a DoS attack.
4. Increased Latency: A DoS attack may cause delays in service or cause latency to be much higher than usual.
5. Suspicious Log Entries: Look for unusual log entries that could indicate malicious activity.
What is the difference between a DDoS attack and a DOS attack?
A DDoS (Distributed Denial of Service) attack is an attack from multiple computers or systems, usually from different locations. The attackers flood the targeted system with requests, making it unable to respond to legitimate traffic.
A DOS (Denial of Service) attack is an attack from a single source. The attacker floods the target with requests, making it unable to respond to legitimate traffic.
150 Types of DDoS Attacks
1. SYN Flood
2. UDP Flood
3. ICMP Flood
4. HTTP Flood
5. NTP Amplification
6. Smurf Attack
7. Fraggle Attack
8. TCP SYNACK Reflection
9. GRE IP Packet Reflection
10. DNS Reflection
11. SSDP Reflection
12. Chargen Reflection
13. Slowloris
14. Zero-day DDoS Attack
15. DNS Amplification
16. Application Layer Attack
17. Distributed Reflection Denial of Service (DRDoS)
18. Volumetric Attacks
19. Ping of Death
20. Teardrop Attack
21. ReDoS Attack
22. Peer-to-peer Botnet Attacks
23. ACK Flood
24. TCP Connection Attack
25. Command & Control Attack
26. HTTP POST Attack
27. HTTP GET Flood
28. HTTP Headers Attack
29. Slow Read Attack
30. Reflected File Download (RFD)
31. TCP State Exhaustion Attack
32. Resource Depletion Attack
33. Multi-Vector Attack
34. Botnet Attack
35. High-Bandwidth Attack
36. Spoofed Source Attack
37. FTP Bounce Attack
38. SYN-ACK Flood
39. ARP Cache Poisoning
40. Botnet Network Flood
41. Jamming Attack
42. Amplification Attack
43. Multi-Stage Attack
44. Distributed Denial of Service Attack (DDoS)
45. Fraggle Attack
46. HTTP/S Flood
47. Layer 7 DDoS Attack
48. UDP Flood Attack
49. ICMP Flood Attack
50. Multi-Vector DDoS Attack
51. Application Layer DDoS Attack
52. User Datagram Protocol (UDP) Flood
53. ICMP Echo Request Flood
54. ICMP Redirect Attack
55. ICMP Destination Unreachable Attack
56. Ping Flood
57. Teardrop Attack
58. Smurf Attack
59. SYN Flood Attack
60. Fragmented Packet Attack
61. Low-and-Slow Attack
62. HTTP Application Attack
63. ApacheKiller Attack
64. XML-RPC Attack
65. Slowloris Attack
66. Slow HTTP GET Attack
67. Slowloris POST Attack
68. Slow HTTP POST Attack
69. Slowloris POST Attack
70. Slow HTTP PUT Attack
71. Slowloris PUT Attack
72. Slow HTTP Headers Attack
73. Slowloris Headers Attack
74. Slow HTTP Options Attack
75. Slowloris Options Attack
76. Slow HTTP Trace Attack
77. Slowloris Trace Attack
78. Slow HTTP Connect Attack
79. Slowloris Connect Attack
80. Slow Read Attack
81. HTTP POST Flood
82. ReDoS Attack
83. DNS Amplification Attack
84. DNS Reflection Attack
85. NTP Amplification Attack
86. Peer-to-peer Botnet Attack
87. GRE IP Packet Reflection Attack
88. SSDP Reflection Attack
89. Chargen Reflection Attack
90. TCP SYNACK Reflection Attack
91. TCP Connection Attack
92. Command & Control Attack
93. High-Bandwidth Attack
94. Spoofed Source Attack
95. FTP Bounce Attack
96. ACK Flood Attack
97. Resource Depletion Attack
98. Multi-Stage Attack
99. Jamming Attack
100. Zero-day DDoS Attack
101. Amplification Attack
102. Reflected File Download (RFD) Attack
103. TCP State Exhaustion Attack
104. Layer 7 DDoS Attack
105. Multi-Vector DDoS Attack
106. Distributed Denial of Service (DDoS) Attack
107. HTTP GET Flood
108. HTTP Headers Flood
109. Application Layer Flood
110. UDP Flood
111. ICMP Flood
112. HTTP Flood
113. SYN Flood
114. NTP Amplification
115. Smurf Attack
116. Fraggle Attack
117. TCP SYNACK Reflection
118. GRE IP Packet Reflection
119. DNS Reflection
120. SSDP Reflection
121. Chargen Reflection
122. Slowloris
123. Zero-day DDoS Attack
124. DNS Amplification
125. Application Layer Attack
126. Distributed Reflection Denial of Service (DRDoS)
127. Volumetric Attacks
128. Ping of Death
129. Teardrop Attack
130. ReDoS Attack
131. Peer-to-peer Botnet Attacks
132. ACK Flood
133. TCP Connection Attack
134. Command & Control Attack
135. HTTP POST Attack
136. HTTP GET Flood
137. HTTP Headers Attack
138. Slow Read Attack
139. Reflected File Download (RFD)
140. TCP State Exhaustion Attack
141. Resource Depletion Attack
142. Multi-Vector Attack
143. Botnet Attack
144. High-Bandwidth Attack
145. Spoofed Source Attack
146. FTP Bounce Attack
147. SYN-ACK Flood
148. ARP Cache Poisoning
149. Botnet Network Flood
150. Jamming Attack
151. Amplification Attack
152. Multi-Stage Attack
153. Distributed Denial of Service Attack (DDoS)
154. Fraggle Attack
155. HTTP/S Flood
156. Layer 7 DDoS Attack
157. UDP Flood Attack
158. ICMP Flood Attack
159. Multi-Vector DDoS Attack
160. Application Layer DDoS Attack
161. User Datagram Protocol (UDP) Flood
162. ICMP Echo Request Flood
163. ICMP Redirect Attack
164. ICMP Destination Unreachable Attack
165. Ping Flood
166. Teardrop Attack
167. Smurf Attack
168. SYN Flood Attack
169. Fragmented Packet Attack
170. Low-and-Slow Attack
171. HTTP Application Attack
172. ApacheKiller Attack
173. XML-RPC Attack
174. Slowloris Attack
175. Slow HTTP GET Attack
176. Slowloris POST Attack
177. Slow HTTP POST Attack
178. Slowloris POST Attack
179. Slow HTTP PUT Attack
180. Slowloris PUT Attack
181. Slow HTTP Headers Attack
182. Slowloris Headers Attack
183. Slow HTTP Options Attack
184. Slowloris Options Attack
185. Slow HTTP Trace Attack
186. Slowloris Trace Attack
187. Slow HTTP Connect Attack
188. Slowloris Connect Attack