Denial of Service

DoS Countermeasure Strategies

Techniques / Vectors

Application Layer DOS Attack Techniques

Consume application resources or services, thereby making them unavailable to other legitimate users

HTTP GET POST attack
Slow Loris attack
UDP application layer flood attack
DDoS extortion attack

Protocol Attacks Techniques

Consume resources like connection state tables present in the network infrastructure components such as load-balancers, firewalls, and application servers

Volumetric Attack Techniques

Consume the bandwidth of the target network or service

Ping of Death
UDP flood attack
ICMP Flood Attack
Smurf Attack
Pulse wave and zero-day attack

Compromise Availability
- Reduce
- Restrict
- Prevent

Tools

use auxiliary/dos/tcp/synflood

I'm So Bored
High Orbit Ion Cannon (HOIC) (https://sourceforge.net)
Low Orbit Ion Cannon (LOIC) (https://sourceforge.net)
HULK (https://github.com)
Slowloris Attack (https://github.com)
UFONet (https://ufonet.03c8.net)
Packet Flooder Tool (https://www.netscantools.com)

Based on the provided sources, Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks are critical threats aimed at making a machine or network resource unavailable to authorized users. DDoS attacks typically exploit vulnerabilities in the implementation of the TCP/IP model or specific operating system bugs.

DoS/DDoS attack vectors are broadly categorized into three basic types, primarily defined by the resources they target and the units used to measure their magnitude:

1. Volumetric Attacks

Volumetric attacks aim to consume the bandwidth of a target network, service, or the connection between the target and the Internet, causing traffic blockage and preventing access for legitimate users. The magnitude of these attacks is measured in bits-per-second (bps).

Volumetric attacks rely on two primary strategies for bandwidth depletion:

Flood Attacks: Attackers use compromised systems (zombies) to send large volumes of traffic to the victim's systems to exhaust the bandwidth.
Amplification Attack: The attacker sends messages to a broadcast IP address, which amplifies malicious traffic directed at the victim's systems, consuming their bandwidth.

Examples of Volumetric Attack Techniques:

Attack Type	Description
UDP flooding attack	An attacker sends spoofed UDP packets at a high rate to random ports on the target server, causing the server to repeatedly check for nonexistent applications and return ICMP "Destination Unreachable" packets, exhausting resources until the network goes offline.
ICMP Flood Attack	Attackers send large volumes of ICMP echo request packets to overwhelm the victim's network connection. The incoming requests and outgoing replies saturate the bandwidth, causing the system to stop responding to legitimate TCP/IP requests.
Ping of Death (PoD) Attack	The attacker sends malformed or oversized packets (e.g., exceeding the IP size limit of 65,535 bytes prescribed by RFC 791) using a simple ping command to crash, destabilize, or freeze the target system during the packet reassembly process.
Smurf Attack	The attacker spoofs the source IP address with the victim's IP address and sends numerous ICMP ECHO request packets to an IP broadcast network. All hosts on that network respond to the victim, flooding the machine with traffic until it crashes.
NTP Amplification Attack	An attacker uses a botnet to send large UDP packets with a spoofed IP address (mimicking the victim) to an NTP server, often leveraging the enabled `monlist` command. This triggers large response packets directed back to the victim, inundating the network and exhausting bandwidth.
Pulse Wave DDoS Attack	A periodic attack where attackers send highly repetitive, massive strains of packets as pulses (e.g., 300 Gbps or more) to the victim, consuming the entire bandwidth.
Zero-day DDoS Attack	Exploits DDoS vulnerabilities for which no patches or effective defensive mechanisms are yet available.
Malformed IP packet flood attack	A technique used under volumetric attacks.
Spoofed IP packet flood attack	A technique used under volumetric attacks.

2. Protocol Attacks

Protocol attacks focus on consuming non-bandwidth resources, specifically exhausting the connection state tables found in network infrastructure components like firewalls, load balancers, and application servers. The attack magnitude is measured in packets-per-second (pps) or connections per second (cps).

Examples of Protocol Attack Techniques:

Attack Type	Description
TCP SYN-flooding attack	Exploits the TCP three-way handshake by sending a large number of SYN requests with fake source IP addresses. The target's connection queue fills up with partially open connections awaiting the ACK response, preventing new legitimate connections until the incomplete ones time out (up to 75 seconds).
Fragmentation Attack	Floods the target system with TCP or UDP fragments (e.g., 1500+ byte packets) at a small packet rate. The process of reassembling and inspecting these large fragments consumes excessive resources, causing performance reduction or system crashes.
Spoofed Session Flood Attack	Attackers create fake or spoofed TCP sessions using multiple SYN, ACK, RST, or FIN packets to bypass firewalls and exhaust network resources. This category includes Multiple SYN-ACK Spoofed Session Flood Attack and Multiple ACK Spoofed Session Flood Attack.
TCP SACK Panic Attack	Attackers send SACK packets with malformed maximum segment size (MSS) to crash the target Linux machine, exploiting an integer overflow vulnerability in the Linux Socket Buffer (SKB) that triggers a kernel panic and DoS.
SYN-ACK Flood Attack	Similar to the SYN flood, but the attacker exploits the second stage of the three-way handshake by sending a large number of SYN-ACK packets.
ACK Flood Attack	Attackers send a large amount of spoofed ACK packets to the target machine. This also includes the ACK and PUSH ACK Flood Attack during an active TCP session.
TCP connection flood attack	A technique used under protocol attacks.
TCP state exhaustion attack	A technique used under protocol attacks.
RST attack	A technique used under protocol attacks.

3. Application Layer Attacks (Layer 7)

Application layer attacks exploit vulnerabilities in the application layer protocol or the application itself to consume its specific resources or services, making the application unavailable to legitimate users. These attacks are effective with low traffic rates and are measured in requests-per-second (rps).

Examples of Application Layer Attack Techniques:

Attack Type	Description
HTTP Flood Attack (GET/POST Attack)	Attackers flood web applications with legitimate-looking traffic. HTTP GET Attacks use a time-delayed header to keep the HTTP connection open without sending the full request. HTTP POST Attacks send complete headers but incomplete message bodies, forcing the server to wait indefinitely.
Slowloris Attack	The attacker sends partial HTTP requests to the target web server. The server opens multiple connections and waits for them to complete, exhausting the maximum concurrent connection pool and denying additional connection attempts.
UDP Application Layer Flood Attack	Leverages application protocols that rely on UDP (e.g., CHARGEN, SNMPv2, NTP, VoIP) to flood target networks, exploiting application-level vulnerabilities.
DDoS Extortion/Ransom DDoS (RDDoS) Attack	Attackers threaten an organization with a DDoS attack and insist on a ransom payment, often initiating a sample attack to prove capability.

Other Major DoS/DDoS Attack Categories

The sources detail several other complex attack types that fall under the umbrella of DoS/DDoS:

Distributed Reflection Denial-of-Service (DRDoS) Attack: Also known as a spoofed attack, it uses multiple intermediary compromised machines (zombies) and secondary non-compromised machines (reflectors) to redirect huge volumes of traffic (e.g., SYN/ACK packets) to the primary target, overwhelming it. This attack makes it difficult to trace the actual attacker.
Permanent Denial-of-Service (PDOS) Attack (Phlashing): An attack targeting hardware, causing irreversible damage that requires the victim to replace or reinstall the hardware. Attackers achieve this by sending fraudulent, corrupted hardware updates to "brick a system".
Multi-Vector Attack: Attackers combine volumetric, protocol, and application-layer attacks, rapidly changing vectors (e.g., SYN packets to Layer 7) sequentially or in parallel to confuse IT staff and exhaust resources.
Peer-to-Peer Attack: Exploits bugs in P2P servers (like those using the Direct Connect or DC++ protocol). Attackers instruct clients of large P2P file-sharing hubs to aggressively attempt to connect to the victim's website, causing performance degradation without the use of botnets.
Web Server DoS/DDoS Attack: Involves flooding web servers with fake requests to consume resources such as network bandwidth, server memory, CPU usage, hard-disk space, and database space, making the server unavailable to legitimate users.
HTTP/2 Continuation Flood Attack: Exploits the handling mechanism of HTTP/2 CONTINUATION frames by sending numerous incomplete frames over a single TCP connection, exhausting the Apache server's resources and causing a DoS condition.
Cache Poisoned Denial of Service (CPDoS) Attack: Attackers create malformed or oversized HTTP requests that trick a Content Delivery Network (CDN) server into caching error content (like "404 Not Found") for a legitimate web page, thereby denying service to subsequent legitimate users.
API DDoS Attacks: Involve saturating an API with a huge volume of traffic from multiple infected computers (botnet) to delay API services to legitimate users, exploiting vulnerabilities or API rate limit controls.
VoIP Attacks: VoIP infrastructure is vulnerable to DoS attacks, alongside other attacks like Session Hijacking, Caller ID spoofing, Eavesdropping, and SPIT (Spam over Internet Telephony).
DHCP Starvation Attack: An attacker floods the DHCP server with forged DHCP requests using spoofed MAC addresses, exhausting the available IP addresses in the scope, thus leading to a DoS attack as legitimate users cannot obtain or renew an IP address.
Abusing E-stop: An attack on industrial (OT) systems where an attacker sends multiple E-stop (emergency stop) commands to the target device to cause DoS.
IoT DDoS Attack: Attackers infect multiple IoT devices with malicious software to turn them into bots, which form an "Army of Botnets" used to send a large volume of requests to a target server. Mirai malware is a notorious example of a botnet used to launch massive DDoS attacks by exploiting vulnerable IoT devices.
Resource Exhaustion: A general category where an attack damages a server by sending multiple resource requests to exploit software bugs or errors, hanging the system or causing a crash. This is similar to a DoS attack.

DDOS

UltraDDOS-v2

Example

Robert, a professional hacker, has launched a reflection attack on the target organization’s Microsoft Cloud/vendors/azure environment to downgrade its network capacity

For this purpose, he initiated sending a large number of spoofed UDP packets with fake IP addresses that resembled the source IP addresses to an intermediary server
The intermediary server started responding to all the source IP addresses at once causing legitimate users to wait for some time to receive the resources.