TechKnowSurge
TechKnowSurge Catalog Videos Denial of Service (DoS) Attack
VideoSecurityFree

Denial of Service (DoS) Attack

A denial-of-service (DoS) attack targets the availability pillar of the CIA triad by making systems, services, or network resources inaccessible to legitimate users. Attack methods range from volumetric flooding and protocol exploitation to application vulnerabilities and physical disruption.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A denial-of-service (DoS) attack targets the availability pillar of the CIA triad — the same framework security professionals use to evaluate the confidentiality, integrity, and availability of data and systems. By overwhelming or disabling a service, an attacker prevents legitimate users from accessing the resources they depend on. Even degraded performance, short of a full outage, can be sufficient to render a service effectively unusable. Common targets include DNS servers, DHCP servers, directory services, and web applications, since disabling any one of these can cascade into broader connectivity or authentication failures for end users. Attackers can carry out DoS attacks through four general categories of methods. Volumetric attacks exhaust a resource — bandwidth, CPU, memory, or storage — by flooding it with more traffic or requests than it can handle; an ICMP flood is a classic example. Protocol-based attacks exploit design weaknesses in established networking protocols like TCP, UDP, ICMP, and IPv4, many of which were built during an era when security was not a primary concern. Application-layer attacks leverage software vulnerabilities, such as SQL injection against a web-facing database, to corrupt data or crash services. Physical attacks, while less commonly discussed, achieve the same result by directly taking hardware offline. The motivations behind DoS attacks vary widely and do not follow a single attacker profile. Perpetrators may be driven by curiosity, a desire for notoriety, revenge against an employer, competitive business interests, or political activism. Attacks can originate internally or externally and require anywhere from minimal to substantial resources to execute. Security professionals also conduct authorized DoS testing as part of penetration testing and research and development, making an understanding of these techniques essential across both offensive and defensive disciplines.

What you'll learn

What's covered

Denial of Service Attacks

Key terms

Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
CIA Triad
The three core principles of information security: Confidentiality, Integrity, and Availability.
Availability
The assurance that systems and data are accessible and operational when needed by authorized users.
Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Botnet
A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Volumetric Attack
A denial of service method that overwhelms a target by exhausting its resources such as bandwidth, CPU, or memory with excessive traffic.
Protocol-Based Attack
A denial of service method that exploits weaknesses in network protocols such as TCP, UDP, or IP to exhaust target resources.
Application-Layer Attack
A denial of service method that targets vulnerabilities in applications or services to crash or disable them.

Topics

Denial Of Service Cia Triad Volumetric Attacks Application Layer Attacks Protocol Exploitation Cybersecurity

Transcript

We're going to start covering what a denial of service attack is and start looking at different ways we could carry out a denial of service attack.

Availability and the CIA Triad

As security professionals, we use models to help implement security and make sure that we're doing it correctly. One of those models is the CIA triad. CIA stands for confidentiality, integrity, and availability. We measure up our resources and our assets to make sure that they are remaining confidential, that they have a certain level of integrity, and that they have a certain level of availability. We can measure this against data or even our systems.

One of the things that is part of this is that availability, and a denial of service attack attempts to bring down the availability. So that's the thing that we want to focus on throughout this module.

What Is a Denial of Service?

There's two key components to this. Number one, there's a service; and then number two, a denial of that service.

So what does that look like? Think of when you go to a restaurant and somebody is serving you. What they're doing is they're bringing out the drinks and the food to you and making sure that you have everything you need to have a pleasant time. They are providing a service.

The same thing can be true when it comes to servers on your network. These servers are running programs. We call these programs services, and we call them services because they're providing services to other computers and other devices that are on the network. So this would be a client right here, and that client is going to ask the server for some sort of service — maybe it's DHCP, maybe it's DNS, whatever the case may be. A denial of service attack attempts to bring down that service so it's no longer accessible.

So a denial of service attack is when the adversary seeks to make information, systems, devices, and/or network services unavailable to legitimate users.

A DNS Example

Let's say I have a DNS server that's running here, and I've got my clients that are using this DNS server to resolve domain names. They go and ask this DNS server, hey, who belongs to this? And then that DNS server replies to that computer, and then that computer goes out and can access maybe a website, maybe a web page, and so they can go and access this web page.

So if you bring down this DNS server, what essentially happens is they can't resolve these names anymore, and now they can't get to that web page. From the perspective of the end user, bringing down the DNS server means that the internet is broken — it's no longer working. It doesn't necessarily have to be down, either; just if it's performing really badly, that could be enough to really drive people crazy and stop them using the service.

Motivations

So what would be the motivation behind somebody launching a denial of service attack?

One time I had a young student that was using a system that I was managing, and they carried out a denial of service attack just because they were curious. They wanted to see if they could do it. They were really young and didn't really know better. So they carried out this denial of service attack, causing the system to go down.

Maybe there's some sort of feeling of, hey, I've done this, so there's a notoriety there and you can gloat about it. Or maybe they have some sort of power trip, or getting revenge, or vindictiveness because maybe they got laid off from the company. Or maybe there's some sort of financial motivation — maybe it's one company that brings another company down so that way the customers will then move to this new company. Or maybe it's to promote some sort of change, like a hacktivist. And then of course we do it as security professionals for testing and R&D.

There could be a lot of different motivations behind why somebody would carry out a denial of service attack. The thing with a denial of service attack is the motivation could be very wide with this, and it could be internal or external. It could be somebody that has lots of resources or very little resources. It really could be any one of these who would carry out a denial of service attack.

Common Targets

Common attacks would be against DHCP — people wouldn't be able to get onto the network at all if the DHCP server is down. Or DNS, because now they can't resolve names internally or externally and get to any of the resources. Maybe it's directory services, so they can't log on to the computer. Or maybe some sort of other applications that they have access to.

Methods

Different methods to carry out a denial of service attack might be:

  • Volumetric — just overwhelming a service to the point where it's not operational at all.
  • Leveraging something in a protocol, a weakness in the protocol that causes some sort of problem.
  • Some sort of application issue, where by leveraging the application vulnerability we can bring the service down.
  • Physical. I've added physical as well. I haven't seen this out there, but if you go and unplug the server, then that counts as well.

Volumetric is the idea of just overwhelming some sort of resource and exhausting it. An ICMP flood is an example of this. We could be overwhelming the CPU, memory, storage, bandwidth, and so on and so forth.

There are protocols that we can utilize to carry out a denial of service attack. For instance, a single packet that we could send out could cause some sort of deauthentication attack, and then the user doesn't have access to wireless. So now we've disconnected them, and that's a form of denial of service attack. Many of the protocols we use have real weaknesses to them. Number one is that they're not secure, so they're sending clear text. But there's other things that we can leverage within them, like TCP and UDP and IP version 4 and ICMP — there are mechanisms in there that we could utilize. These protocols were created a long time ago, and security wasn't really a top priority back then, and so now we can leverage these protocols to carry out attacks because of their weaknesses.

We also find weaknesses in applications. As an example, we might have a web server with a database on there that's susceptible to SQL injection. Here is where we can leverage the application weakness in order to hack into a system — or in this case, maybe we delete a bunch of data off of the database, and so now that service no longer is up and running, therefore causing a denial of service attack.

And the same thing with physical. If I broke into a building and unplugged a server, that server would go down and would no longer be offering those services. This is an example of a denial of service attack as well.

There are a lot of tools that you can use to carry out denial of service attacks, and depending on which way that you want to approach a denial of service attack might depend on which tool that you use and select to carry out your attack.

The Attack Card

So here's our attack card for a denial of service attack. Essentially it's making the service or resource unavailable. A lot of times we do this through a flood attack, by overwhelming a resource with a bunch of requests or a bunch of traffic that really ties that resource up so it can't deliver legitimate traffic. It's easy to execute but can be difficult to stop. Some examples might be an amp attack, a SYN flood attack, or a buffer overflow — although a buffer overflow could do other things as well.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →