Translate

sábado, 29 de agosto de 2020

Vulcan DoS Vs Akamai

In the past I had to do several DoS security audits, with múltiples types of tests and intensities. Sometimes several DDoS protections were present like Akamai for static content, and Arbor for absorb part of the bandwith.

One consideration for the DoS/DDoS tools is that probably it will loss the control of the attacker host, and the tool at least has to be able to stop automatically with a timeout, but can also implement remote response checks.

In order to size the minimum mbps needed to flood a service or to retard the response in a significant amount of time, the attacker hosts need a bandwith limiter, that increments in a logarithmic way up to a limit agreed with the customer/isp/cpd.

There are DoS tools that doesn't have this timeouts, and bandwith limit based on mbps, for that reason I have to implement a LD_PRELOAD based solution: bwcontrol

Although there are several good tools for stressing web servers and web aplications like apache ab, or other common tools used for pen-testing, but I also wrote a fast web flooder in c++ named wflood.

As expected the most effective for taking down the web server are the slow-loris, slow-read and derivatives, few host were needed to DoS an online banking. 
Remote attacks to database and highly dynamic web content were discarded, that could be impacted for sure.

I did another tool in c++ for crafting massive tcp/udp/ip malformed packets, that impacted sometimes on load balancers and firewalls, it was vulcan, it freezed even the firewall client software.

The funny thing was that the common attacks against Akamai hosts, where ineffective, and so does the slow-loris family of attacks, because are common, and the Akamai nginx webservers are well tunned. But when tried vulcan, few intensity was enough to crash Akamai hosts.

Another attack vector for static sites was trying to locate the IP of the customer instead of Akamai, if the customer doesn't use the Akamai Shadow service, it's possible to perform a HTTP Host header scan, and direct the attack to that host bypassing Akamai.

And what about Arbor protection? is good for reducing the flood but there are other kind of attacks, and this protection use to be disabled by default and in local holidays can be a mess.

Continue reading
  1. Hacking Tools 2020
  2. New Hacker Tools
  3. Hacker Tools Windows
  4. Hack Rom Tools
  5. Hack Tool Apk No Root
  6. Hacker Tools Apk Download
  7. Pentest Tools For Ubuntu
  8. Hacker Tools 2019
  9. Install Pentest Tools Ubuntu
  10. Hacking Tools Mac
  11. What Is Hacking Tools
  12. Hacking Tools
  13. Hacking Tools For Windows
  14. Hack App
  15. Hacker Tool Kit
  16. Hacking Tools Pc
  17. Hacker Tools Free Download
  18. Pentest Tools For Ubuntu
  19. Ethical Hacker Tools
  20. Nsa Hack Tools Download
  21. Hack Tools For Windows
  22. Ethical Hacker Tools
  23. Growth Hacker Tools
  24. New Hack Tools
  25. Pentest Tools For Android
  26. Hacker Tools Free Download
  27. Hacking Tools Free Download
  28. Hacking Tools Github
  29. Hacker Tools Free Download
  30. Hack Tools Mac
  31. What Are Hacking Tools
  32. Hack Tools For Games
  33. Pentest Tools Website Vulnerability
  34. Hacker Security Tools
  35. Beginner Hacker Tools
  36. Hacker Tools Free
  37. What Is Hacking Tools
  38. Hacker Tools Mac
  39. Top Pentest Tools
  40. Hack Apps
  41. Hacking Tools Kit
  42. Hacker Tools Free
  43. Hacker Tools Windows
  44. Hacking Tools
  45. Hacker Tools Linux
  46. Nsa Hack Tools Download
  47. Pentest Tools Apk
  48. Pentest Tools Subdomain
  49. Best Hacking Tools 2020
  50. What Are Hacking Tools
  51. Hacker Tools 2020
  52. Wifi Hacker Tools For Windows
  53. Best Hacking Tools 2019
  54. Install Pentest Tools Ubuntu
  55. Hack Tools
  56. Tools For Hacker
  57. Hacking Tools Online
  58. Tools 4 Hack
  59. Termux Hacking Tools 2019
  60. Hacking Tools Kit
  61. Hacker
  62. Pentest Tools Nmap
  63. Hacking Tools Online
  64. Hacker Tools For Pc
  65. Pentest Tools Windows
  66. Hack Tools Mac
  67. Hack App
  68. Hacking Tools Software
  69. Hackers Toolbox
  70. Best Pentesting Tools 2018
  71. Hacking Apps
  72. Pentest Tools Review
  73. Hack Tool Apk No Root
  74. Pentest Tools Bluekeep
  75. Game Hacking
  76. Nsa Hack Tools
  77. Pentest Tools Android
  78. Hacking Tools For Kali Linux
  79. Best Hacking Tools 2020
  80. Pentest Tools Bluekeep
  81. How To Make Hacking Tools
  82. Hacking Tools Kit
  83. Ethical Hacker Tools
  84. Hacker Tools Hardware
  85. Pentest Tools For Mac
  86. Hack Tools Download
  87. Tools 4 Hack
  88. Wifi Hacker Tools For Windows
  89. New Hack Tools
  90. Install Pentest Tools Ubuntu
  91. Pentest Tools Framework
  92. Usb Pentest Tools
  93. Hacking Tools For Windows Free Download
  94. Underground Hacker Sites
  95. Hacker Tools Apk Download
  96. Easy Hack Tools
  97. Hack Tool Apk No Root
  98. Hacking Tools Usb
  99. Hacking Tools For Windows
  100. Hack Apps
  101. Hacker Tools 2019
  102. Growth Hacker Tools
  103. Hacker Tools Windows
  104. Hacker Tools
  105. Hack Apps
  106. Nsa Hack Tools Download
  107. Free Pentest Tools For Windows
  108. Hack Apps
  109. Hack Tool Apk
  110. Hacks And Tools
  111. Hack Tool Apk No Root
  112. Hack Tools Github
  113. Hacking Tools Pc
  114. Android Hack Tools Github
  115. Pentest Tools Bluekeep
  116. Hack Tools
  117. What Is Hacking Tools
  118. Best Pentesting Tools 2018
  119. Nsa Hack Tools
  120. World No 1 Hacker Software
  121. New Hack Tools
  122. How To Hack
  123. Pentest Reporting Tools
  124. Hacking Tools Windows
  125. Hacker Search Tools
  126. Hacker Techniques Tools And Incident Handling
  127. Hacker
  128. Hacking Tools For Kali Linux
  129. Hacking Tools Github
  130. Hack Rom Tools
  131. Hacking Tools And Software
  132. Best Hacking Tools 2019
  133. Pentest Tools Alternative
  134. Pentest Tools Nmap
  135. Hacker
  136. Pentest Tools Review
  137. Hack Apps

Arquivo do blog