Network and Perimeter Hacking · Topic 5 of 9
DoS and DDoS Concepts, Botnets and Attack Techniques
Understand DoS and DDoS attacks, how botnets and command and control work, and recognize volumetric, protocol and application layer attacks by name.
- 5 min
- Includes a diagram
- DoS targets availability. DDoS uses many sources, usually a botnet.
- Three categories: volumetric, protocol, application layer.
- SYN flood exploits the half open TCP handshake. Slowloris exploits connection limits.
What it is
A denial of service (DoS) attack makes a system or service unavailable to legitimate users. It attacks availability, the A in the confidentiality, integrity, availability triad. A distributed denial of service (DDoS) attack does the same from many sources at once, usually a botnet.
A botnet is a group of compromised devices controlled remotely by an attacker, called the bot herder. Botnets supply the volume that makes DDoS hard to block by address.
How it works
DoS and DDoS categories
| Category | Target | Measured in | Examples |
|---|---|---|---|
| Volumetric | Network bandwidth | Bits per second | UDP flood, ICMP flood, amplification and reflection |
| Protocol | Connection tables of servers, firewalls and load balancers | Packets per second | SYN flood, ACK flood, ping of death, fragmentation attacks, smurf |
| Application layer | A specific service or page | Requests per second | HTTP GET or POST flood, Slowloris |
A symptom list for DoS includes slow network performance, unavailable sites, a sudden jump in traffic or spam, and many connection attempts from varied addresses.
Botnets
A botnet is built in stages: the attacker infects devices (through malware, exploit kits, phishing or weak credentials), the devices join the network of bots, and the herder issues commands through command and control (C2). C2 may be centralized (IRC, HTTP servers), peer to peer, or hidden in legitimate services. Bots may also send spam, steal credentials or mine cryptocurrency.
Internet of Things (IoT) devices with default passwords are a favorite source. The Mirai malware recruited cameras and routers by trying default logins, and Mirai powered the large attack on the DNS provider Dyn in October 2016. A defender can find infected hosts by their traffic to known C2 addresses, and can take over a C2 domain in a sinkhole to cut the botnet off.
Attack techniques
| Technique | How it works |
|---|---|
| UDP flood | Sends large numbers of UDP packets to random ports, forcing the target to reply with errors |
| ICMP flood | Overwhelms the target with ICMP echo requests |
| Ping of death | Sends an oversized or malformed ICMP packet that crashed old systems. Modern systems are patched |
| Smurf | Spoofed ICMP echo requests sent to a broadcast address, so all hosts reply to the victim. A reflection attack |
| SYN flood | Sends many TCP SYN packets and never completes the handshake, so half open connections fill the table |
| ACK flood | Sends ACK packets that do not belong to any connection |
| Fragmentation attack | Sends fragmented packets that are costly to reassemble |
| Amplification (reflection) | Sends small spoofed requests to open servers (DNS, NTP, memcached) which return much larger replies to the victim |
| HTTP GET or POST flood | Sends valid looking requests, often for expensive pages |
| Slowloris | Keeps many connections open by sending partial HTTP requests very slowly, exhausting the server's connection limit |
| Permanent DoS (phlashing) | Damages hardware or firmware so it must be replaced or reflashed |
| Peer to peer attack | Tricks users of a peer to peer network into connecting to the victim |
| Distributed reflection DoS (DRDoS) | Uses third party servers as reflectors so the real attackers stay hidden |
Well known tools include LOIC and HOIC (stress testing tools used in public campaigns), hping3 (packet crafting) and Slowloris. They should be used only on systems you own or are authorized to test.
Amplification works because many UDP services do not verify the source address. The attacker spoofs the victim's address, the server replies to the victim, and the response is far larger than the request, which multiplies the traffic.
A worked example
A web server stops responding. Its connection table is full of entries in the SYN_RECV state, and the source addresses are all different. This is a SYN flood. SYN cookies on the server and rate limiting or cloud scrubbing upstream restore service.
How the exam asks about this
- "Which attack sends spoofed echo requests to a broadcast address so every host replies to the victim?" -> Smurf.
- "Which attack opens many connections and sends partial HTTP headers very slowly?" -> Slowloris.
- "A herder sends commands to infected devices through a central server. What is that server called?" -> The command and control (C2) server.
What to remember for the exam
- DoS targets availability. DDoS uses many sources, usually a botnet.
- Three categories: volumetric, protocol, application layer.
- SYN flood exploits the half open TCP handshake. Slowloris exploits connection limits.
- Amplification and smurf are reflection attacks using spoofed source addresses.
- Mirai recruited IoT devices that kept default credentials.
A smurf attack is ICMP to a broadcast address. Do not confuse it with a DNS or NTP amplification attack, which use UDP services.
Common mistakes
Calling every flood a volumetric attack. A SYN flood is a protocol attack that can succeed with little bandwidth.
Thinking blocking one address stops a DDoS. The sources are many and often spoofed.
Treating a DoS tool as harmless. Running a stress tool without authorization is illegal in most places.
Check yourself
Which TCP flag pattern does a SYN flood abuse?
The handshake. It sends SYN packets and never completes the connection, so half open entries fill the table.
What makes an amplification attack effective?
A small spoofed request produces a much larger reply sent to the victim by an open server.
What do bots use to receive instructions?
A command and control channel run by the bot herder.
Topic 5 of 9 in Network and Perimeter Hacking
Test yourself on Network and Perimeter Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.