TechKnowSurge
TechKnowSurge Catalog Videos Distributed Denial of Service (DDoS) Attack
VideoSecurityFree

Distributed Denial of Service (DDoS) Attack

A distributed denial-of-service (DDoS) attack uses multiple machines to overwhelm a target server, making its services unavailable to legitimate users. Two common methods include command-and-control botnets and reflected attacks using spoofed IP addresses.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A denial-of-service (DoS) attack is designed to exhaust a server's resources so that legitimate users can no longer access its services. When an attacker's own connection speed or hardware is insufficient to generate enough traffic to bring a server down, a distributed denial-of-service (DDoS) attack solves that problem by enlisting many other machines to send traffic simultaneously, multiplying the impact far beyond what a single machine could achieve on its own. The distributed nature of this approach makes it both more powerful and considerably harder to defend against than a traditional DoS attack. Two primary methods are used to execute DDoS attacks. In a command-and-control approach, the attacker maintains control over a network of compromised machines, known as a botnet, and issues commands directing them all to flood a specific target at the same time. In a reflected attack, the attacker does not need direct control over any other machines. Instead, the attacker sends requests, such as ICMP ping requests, to a large number of systems while spoofing the victim server's IP address. Those systems then send their replies to the victim rather than to the attacker, generating a flood of inbound traffic from sources the server never contacted. Because DDoS attacks distribute traffic across many originating addresses, filtering or blocking the attack without also disrupting legitimate traffic presents a significant challenge for network defenders.

What you'll learn

What's covered

DDoS Attacks

Key terms

Denial of Service
DoS
An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Distributed Denial of Service
DDoS
An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Botnet
A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Command and Control
C2
Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Reflected Attack
A DDoS technique where an attacker spoofs a victim's IP address to redirect responses from third-party machines toward the target, amplifying attack traffic without direct control of those machines.

Topics

Ddos Dos Attacks Botnet Command And Control Ip Spoofing Reflected Attacks Cybersecurity

Transcript

Bringing Down a Service

If our machine doesn't have a lot of resources to carry out an attack, we can still carry out an attack by leveraging other machines. We call it a distributed denial of service attack.

A denial of service attack is all about bringing down services of another machine. A server is offering services on a network and we're trying to bring those services down. We call that a denial of service, when machines can't connect to that resource. However, we may run into issues if we find that maybe we have a slow connection or some sort of limited resources and can't send enough packets over to flood this machine's resources. That can be problematic if we're trying to carry out this attack.

Getting Other Machines to Do Our Dirty Work

That's where we can employ a distributed denial of service. The idea behind this is that we are getting other machines to do our dirty work. In this case right here, we're employing all of these machines to carry out an attack against this server. This actually can be very easy to do.

Command and Control

There are a few different methods that we could carry out this type of attack. One is through command and control. The idea behind command and control is that there's a command here and we've got control software, and we're controlling all of these botnets. Then we send a command to each one of these machines that says carry out an attack against this server, and they do that. This is one example of a way that we could do a distributed denial of service attack.

Reflected Attacks

That's not the only way. There is a reflected attack, where we can make a request of these machines even though we don't have control over these machines. Maybe it's as simple as an ICMP request. We've done a ping to these machines, but we've spoofed the address of the server right here, so the reply goes back to the server. Now suddenly they're not getting the traffic just from our machine, but from all of these machines that we've sent this message out to.

So here's the attack card on that. This is a distributed denial of service attack, and the idea is that we're utilizing many machines here in order to carry out an attack against some sort of victim here. So it's something that's fairly easy to execute and can be difficult to stop.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →