TechKnowSurge
TechKnowSurge Catalog Videos Amplification Attack
VideoSecurityFree

Amplification Attack

Amplification attacks exploit protocols where small requests generate disproportionately large responses, allowing attackers with limited bandwidth to overwhelm target systems. Different protocols carry different amplification ratios, with DNS and NTP among the most commonly abused.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

An amplification attack is a category of denial-of-service attack that exploits an asymmetry between request size and response size in certain network protocols. An attacker with constrained bandwidth — far too little to saturate a target through sheer volume — can instead craft small requests that force a remote server to generate responses many times larger, effectively multiplying the attacker's traffic output without requiring additional resources on the attacker's end. The ratio between request size and response size is known as the amplification factor, and it varies considerably across protocols. NetBIOS carries an amplification factor of roughly four, SNMP version 2 reaches about six, and DNS can reach as high as 179 times the original request size depending on the records associated with a queried domain. DNS is a particularly effective amplification vector because a single query for a domain with many associated IP addresses forces the server to return all of them, and the protocol's ANY record type compounds this further by returning every record type associated with a domain rather than just the one requested. This allows an attacker to send a minimal, well-formed query and receive a response that is orders of magnitude larger. Amplification attacks are often paired with reflection, a related technique in which the attacker spoofs the victim's IP address so that amplified responses are directed at the target rather than back at the attacker. Together, these two techniques form one of the more accessible and damaging forms of volumetric denial-of-service attack, presenting meaningful challenges for defenders even with modern traffic filtering in place.

What you'll learn

What's covered

Amplification Attacks

Key terms

Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Bandwidth
The maximum rate of data transfer across a network path, typically measured in bits per second.
User Datagram Protocol
UDP
A connectionless transport protocol that sends data without establishing a connection or guaranteeing delivery.
Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
Simple Network Management Protocol
SNMP
A protocol used to monitor and manage network devices such as routers, switches, and servers.
Amplification Attack
A denial-of-service technique that exploits protocols where a small request generates a disproportionately large reply, allowing an attacker with limited resources to produce high volumes of traffic toward a victim.
Amplification Factor
The ratio of the response size to the request size for a given protocol, indicating how much traffic an attacker can generate relative to what they send.

Topics

Amplification Attack Denial Of Service Dns Security Ntp Network Protocols Networking

Transcript

If I'm carrying out a flood attack, there are some limitations. Let's say I'm dialed up with a 56k modem. I'm probably not going to be able to generate enough traffic across that 56k modem that would reach its destination, wherever I'm trying to attack, where it's going to cause much harm to that end machine. I just don't have enough resources over here on this side, and so I'm not going to saturate any of the resources on the other side.

However, one thing I can do is leverage some sort of amplification attack. The concept behind the amplification attack is that the resources that go into creating the request are much smaller than the resources that go into creating the reply. There are certain protocols where the request can be very simplistic and very small, and the reply that comes back can be quite a bit larger. That's the idea behind the amplification: my request is going to eat up less resources than the reply that comes back to me.

So an example is maybe my request is only 64 bytes big, so it's fairly small, and it gets to its destination, and the reply back maybe is 6400 bytes big. That's how big the response back is. Well, that's going to take a lot more resources to create and form, and the bandwidth that's being eaten across all of those links is quite a bit more as well.

Amplification levels by protocol

Different protocols will have different amplification effects. For instance, this request right here is only 8 bits, and even the packet is going to be a lot bigger than that. But let's just use this eight bits as an example. So eight bits is going into this, and what gets replied back is four times the amount. So the amplification of this is four times for whatever protocol this is. But different protocols have different amplification levels.

Here are some examples of some protocols and the amplification level that they have. As an example, we have NetBIOS, a protocol out there, and the reply to the request that's made on it is going to be almost four times as big. The Steam protocol, 5.5. SNMP version 2, 6.3. We have DNS, which can be up to 179. Or we have a Mel, which is 2.2 2 billion. I don't even know how that's possible there. That doesn't really even seem right, that response level.

So anyway, the idea behind this is choosing a protocol where the reply back is going to be so much greater.

What makes DNS variable

So let's look at that DNS. That DNS was variable — it said up to 179. What makes it variable? We make a simple request like what is www for a certain domain. Well, it could have many different IP addresses associated with that, so it's got to reply back with all of those responses there. So that's an example of how the DNS reply back could be much larger than the request that's made.

DNS even has this any request. As part of the protocol, as part of the way that it works, the RFC specifies that you can request any records. So then it wouldn't respond just back with www records and the IP addresses associated with www, but all the records of a certain domain would come back. And so it's a way to make this simple little tiny request and get a huge request back.

Now, an amplification attack is a lot of times grouped up with a reflective attack. A reflected attack is different, but for that reason, sometimes when you read the definition of an amplification attack, they'll actually be describing a reflected attack, which operates a little differently. But these often are combined together.

So here's that attack card on amplification attacks. We can see that it's a type of denial of service attack. The idea behind it is that the request that is being sent is much smaller than any reply that's going to come back. This is going to eat up more resources on the victim machine. And so it's a lot of times combined with a reflective attack. They're somewhat easy to execute, and they can be difficult to stop.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →