Denial of Service (DoS) Attacks and how it works - Linklinkgo

Denial of Service (DoS) Attacks

A Denial of Service (DoS) attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting the services of a host connected to the Internet. DoS attacks typically occur when attackers use malicious code to flood a targeted machine or network with illegitimate requests, overloading it so that it cannot respond to legitimate traffic, or responding so slowly that it becomes unusable. Examples of DoS attacks include SYN floods, ping floods, and smurf attacks.

How does a DoS attack work?

A Denial-of-Service (DoS) attack is a malicious attack to make a machine or network resource unavailable to its intended users. It is often done by flooding the target with traffic or sending it information that triggers a crash. In some cases, the attacker may also use malware to delete or modify files or disrupt services on a host computer. The goal of a DoS attack is to overwhelm the target with requests, making it impossible for legitimate users to access the resource.

Three broad types of DDoS attacks are as follows.

1. Network Layer Attacks: These attacks target the underlying infrastructure of the Internet by flooding a target system with requests from multiple sources. Common Network Layer attacks include SYN floods, Ping floods, and UDP floods.

2. Application Layer Attacks: These attacks target specific applications and services running on a server. Common Application Layer attacks include HTTP floods, Slowloris attacks, and DNS amplification attacks.

3. Volume-Based Attacks: These attacks attempt to overwhelm a target system by inundating it with more requests than it can handle. Common Volume-Based attacks include ICMP floods and Smurf attacks.

DoS attacks typically fall into categories:

1. Volume-Based Attacks: These attacks involve flooding the target with a large amount of traffic, such as sending numerous requests for web pages or data, in order to overwhelm the target's network resources and cause it to slow down or crash.

2. Protocol Attacks: These attacks take advantage of weaknesses in the protocol used to communicate between computers, such as the Transmission Control Protocol (TCP). These attacks send malicious packets to the target in an attempt to disrupt its normal operations.

3. Application Attacks: These attacks target specific applications, such as web servers, databases, or email servers, in an attempt to overwhelm them with malicious requests or data.

4. User Datagram Protocol (UDP) Floods: These attacks involve sending numerous UDP packets to the target in an attempt to overwhelm its network resources and cause it to slow down or crash.

5. Distributed Denial of Service (DDoS) Attacks: These attacks involve using multiple computers to send malicious traffic to a single target in an attempt to overwhelm it with traffic and cause it to slow down or crash.

A few common historic DoS attacks include:

1. Smurf Attack: This attack involves flooding a target system with ICMP echo request packets, with the source address spoofed to match the IP of the victim.

2. SYN Flood Attack: This attack involves sending numerous SYN packets to a target server in an attempt to consume all available resources.

3. Ping of Death Attack: This attack involves sending an abnormally large ICMP packet to a target system in an attempt to cause a system crash or buffer overflow.

4. Teardrop Attack: This attack involves sending fragmented IP packets to a target system in an attempt to cause a system crash or buffer overflow.

5. Fraggle Attack: This attack is similar to a Smurf attack, but instead of ICMP echo request packets, it involves sending UDP broadcast packets.

Indicators of a DoS attack include:

1. Increased network traffic: Unusually high levels of traffic can be an indication of a DoS attack.

2. Connection Refusal Errors: An attacker may attempt to flood your server with requests, leading to connection refusal errors.

3. Unexpected Service Shutdowns: If services suddenly become unavailable, this could be a sign of a DoS attack.

4. Increased Latency: A DoS attack may cause delays in service or cause latency to be much higher than usual.

5. Suspicious Log Entries: Look for unusual log entries that could indicate malicious activity.

What is the difference between a DDoS attack and a DOS attack?

A DDoS (Distributed Denial of Service) attack is an attack from multiple computers or systems, usually from different locations. The attackers flood the targeted system with requests, making it unable to respond to legitimate traffic. 

A DOS (Denial of Service) attack is an attack from a single source. The attacker floods the target with requests, making it unable to respond to legitimate traffic.

150 Types of DDoS Attacks

1. SYN Flood

2. UDP Flood

3. ICMP Flood

4. HTTP Flood

5. NTP Amplification

6. Smurf Attack

7. Fraggle Attack

8. TCP SYNACK Reflection

9. GRE IP Packet Reflection

10. DNS Reflection

11. SSDP Reflection

12. Chargen Reflection

13. Slowloris

14. Zero-day DDoS Attack

15. DNS Amplification

16. Application Layer Attack

17. Distributed Reflection Denial of Service (DRDoS)

18. Volumetric Attacks

19. Ping of Death

20. Teardrop Attack

21. ReDoS Attack

22. Peer-to-peer Botnet Attacks

23. ACK Flood

24. TCP Connection Attack

25. Command & Control Attack

26. HTTP POST Attack

27. HTTP GET Flood

28. HTTP Headers Attack

29. Slow Read Attack

30. Reflected File Download (RFD)

31. TCP State Exhaustion Attack

32. Resource Depletion Attack

33. Multi-Vector Attack

34. Botnet Attack

35. High-Bandwidth Attack

36. Spoofed Source Attack

37. FTP Bounce Attack

38. SYN-ACK Flood

39. ARP Cache Poisoning

40. Botnet Network Flood

41. Jamming Attack

42. Amplification Attack

43. Multi-Stage Attack

44. Distributed Denial of Service Attack (DDoS)

45. Fraggle Attack

46. HTTP/S Flood

47. Layer 7 DDoS Attack

48. UDP Flood Attack

49. ICMP Flood Attack

50. Multi-Vector DDoS Attack

51. Application Layer DDoS Attack

52. User Datagram Protocol (UDP) Flood

53. ICMP Echo Request Flood

54. ICMP Redirect Attack

55. ICMP Destination Unreachable Attack

56. Ping Flood

57. Teardrop Attack

58. Smurf Attack

59. SYN Flood Attack

60. Fragmented Packet Attack

61. Low-and-Slow Attack

62. HTTP Application Attack

63. ApacheKiller Attack

64. XML-RPC Attack

65. Slowloris Attack

66. Slow HTTP GET Attack

67. Slowloris POST Attack

68. Slow HTTP POST Attack

69. Slowloris POST Attack

70. Slow HTTP PUT Attack

71. Slowloris PUT Attack

72. Slow HTTP Headers Attack

73. Slowloris Headers Attack

74. Slow HTTP Options Attack

75. Slowloris Options Attack

76. Slow HTTP Trace Attack

77. Slowloris Trace Attack

78. Slow HTTP Connect Attack

79. Slowloris Connect Attack

80. Slow Read Attack

81. HTTP POST Flood

82. ReDoS Attack

83. DNS Amplification Attack

84. DNS Reflection Attack

85. NTP Amplification Attack

86. Peer-to-peer Botnet Attack

87. GRE IP Packet Reflection Attack

88. SSDP Reflection Attack

89. Chargen Reflection Attack

90. TCP SYNACK Reflection Attack

91. TCP Connection Attack

92. Command & Control Attack

93. High-Bandwidth Attack

94. Spoofed Source Attack

95. FTP Bounce Attack

96. ACK Flood Attack

97. Resource Depletion Attack

98. Multi-Stage Attack

99. Jamming Attack

100. Zero-day DDoS Attack

101. Amplification Attack

102. Reflected File Download (RFD) Attack

103. TCP State Exhaustion Attack

104. Layer 7 DDoS Attack

105. Multi-Vector DDoS Attack

106. Distributed Denial of Service (DDoS) Attack

107. HTTP GET Flood

108. HTTP Headers Flood

109. Application Layer Flood

110. UDP Flood

111. ICMP Flood

112. HTTP Flood

113. SYN Flood

114. NTP Amplification

115. Smurf Attack

116. Fraggle Attack

117. TCP SYNACK Reflection

118. GRE IP Packet Reflection

119. DNS Reflection

120. SSDP Reflection

121. Chargen Reflection

122. Slowloris

123. Zero-day DDoS Attack

124. DNS Amplification

125. Application Layer Attack

126. Distributed Reflection Denial of Service (DRDoS)

127. Volumetric Attacks

128. Ping of Death

129. Teardrop Attack

130. ReDoS Attack

131. Peer-to-peer Botnet Attacks

132. ACK Flood

133. TCP Connection Attack

134. Command & Control Attack

135. HTTP POST Attack

136. HTTP GET Flood

137. HTTP Headers Attack

138. Slow Read Attack

139. Reflected File Download (RFD)

140. TCP State Exhaustion Attack

141. Resource Depletion Attack

142. Multi-Vector Attack

143. Botnet Attack

144. High-Bandwidth Attack

145. Spoofed Source Attack

146. FTP Bounce Attack

147. SYN-ACK Flood

148. ARP Cache Poisoning

149. Botnet Network Flood

150. Jamming Attack

151. Amplification Attack

152. Multi-Stage Attack

153. Distributed Denial of Service Attack (DDoS)

154. Fraggle Attack

155. HTTP/S Flood

156. Layer 7 DDoS Attack

157. UDP Flood Attack

158. ICMP Flood Attack

159. Multi-Vector DDoS Attack

160. Application Layer DDoS Attack

161. User Datagram Protocol (UDP) Flood

162. ICMP Echo Request Flood

163. ICMP Redirect Attack

164. ICMP Destination Unreachable Attack

165. Ping Flood

166. Teardrop Attack

167. Smurf Attack

168. SYN Flood Attack

169. Fragmented Packet Attack

170. Low-and-Slow Attack

171. HTTP Application Attack

172. ApacheKiller Attack

173. XML-RPC Attack

174. Slowloris Attack

175. Slow HTTP GET Attack

176. Slowloris POST Attack

177. Slow HTTP POST Attack

178. Slowloris POST Attack

179. Slow HTTP PUT Attack

180. Slowloris PUT Attack

181. Slow HTTP Headers Attack

182. Slowloris Headers Attack

183. Slow HTTP Options Attack

184. Slowloris Options Attack

185. Slow HTTP Trace Attack

186. Slowloris Trace Attack

187. Slow HTTP Connect Attack

188. Slowloris Connect Attack