Ethical Hacking Denial-of-Service (DoS) Attacks Syllabus

Denial-of-Service (DoS) Attacks syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Denial-of-Service (DoS) Attacks in Ethical Hacking, not a summary of it.

1. 1

   DoS Attack Concepts

   3 topics

   • What is a DoS Attack?
   • Types of DoS Attacks
   • Impact of DoS Attacks
2. 2

   DoS Attack Techniques

   3 topics

   • Flood Attacks
   • Ping of Death
   • Teardrop Attack
3. 3

   DoS Attack Tools

   3 topics

   • LOIC
   • HOIC
   • Slowloris
4. 4

   Countermeasures

   3 topics

   • Traffic Analysis
   • Rate Limiting
   • DoS Mitigation Services

Denial-of-Service (DoS) Attacks flashcards for Ethical Hacking

23 of 50 cards from the Denial-of-Service (DoS) Attacks deck — real questions with worked answers.

1. What is a Denial-of-Service (DoS) attack?

   A cyberattack that aims to make a machine, service, or network resource unavailable to its intended users by overwhelming it with traffic or requests, or by exploiting a flaw that exhausts its resources or crashes it.

2. What is the core objective of a DoS attack (the security property it violates)?

   It targets availability, one of the three pillars of the CIA triad (Confidentiality, Integrity, Availability). It does not steal or alter data; it prevents legitimate access.

3. What is the key difference between a DoS and a DDoS (Distributed Denial-of-Service) attack?

   A DoS attack originates from a single source/machine, while a DDoS attack is launched from many distributed sources (often a botnet of compromised hosts) simultaneously, making it far harder to block and much higher in volume.

4. What is a botnet in the context of DDoS attacks?

   A network of compromised, malware-infected computers or IoT devices ("bots" or "zombies") controlled remotely by an attacker (via a command-and-control server) and used collectively to flood a target.

5. What are the two broad categories of DoS attacks based on mechanism?

   1) Volumetric/flooding attacks that exhaust bandwidth or resources with sheer traffic volume, and 2) Vulnerability/protocol (logic) attacks that exploit a bug or protocol flaw to crash or hang the target with relatively little traffic.

6. Name the three standard classification layers of DDoS attacks by target.

   1) Volumetric attacks (consume bandwidth, e.g., UDP/ICMP floods), 2) Protocol attacks (consume server/firewall state, e.g., SYN flood), and 3) Application-layer (Layer 7) attacks (exhaust app resources, e.g., HTTP flood, Slowloris).

7. At which OSI layers do volumetric, protocol, and application-layer DoS attacks primarily operate?

   Volumetric attacks target Layers 3-4 (network/transport bandwidth), protocol attacks target Layers 3-4 (state tables), and application-layer attacks target Layer 7 (the application itself).

8. In what unit is volumetric DDoS attack magnitude typically measured?

   Bits per second ($\text{bps}$, e.g., $\text{Gbps}$/$\text{Tbps}$) for bandwidth consumption. Protocol and application attacks are often measured in packets per second ($\text{pps}$) or requests per second ($\text{rps}$).

9. List four major business impacts of a DoS attack.

   1) Revenue loss from downtime, 2) reputational/brand damage and lost customer trust, 3) operational disruption and recovery/mitigation costs, and 4) potential SLA penalties or regulatory consequences.

10. How is the direct downtime cost of a DoS outage commonly estimated?

    $$\text{Cost} = \text{Downtime (hours)} \times \text{Revenue per hour}$$ plus indirect costs such as remediation labor, reputational damage, and SLA credits.

11. Why can a DoS attack sometimes be used as a smokescreen?

    Attackers may launch a DoS to distract security teams and consume monitoring resources while carrying out a stealthier attack (e.g., data exfiltration or malware installation) elsewhere in the network.

12. What is a flood attack?

    A DoS technique that overwhelms a target by sending a very high volume of packets or connection requests, exhausting bandwidth, connection tables, or processing capacity so legitimate traffic cannot be served.

13. How does a SYN flood attack work?

    The attacker sends many TCP SYN packets (often with spoofed source IPs) but never completes the three-way handshake with the final ACK. The server holds many half-open connections, exhausting its connection (backlog) table so it can't accept legitimate connections.

14. What is the TCP three-way handshake that a SYN flood abuses?

    $$\text{Client} \xrightarrow{\text{SYN}} \text{Server} \xrightarrow{\text{SYN-ACK}} \text{Client} \xrightarrow{\text{ACK}} \text{Server}$$ A SYN flood sends SYNs but omits the final ACK, leaving connections half-open.

15. What is a SYN cookie and how does it defend against SYN floods?

    A technique where the server encodes connection state into the initial sequence number of the SYN-ACK instead of allocating memory. It only creates a connection when a valid ACK returns, so half-open SYNs consume no state and can't exhaust the backlog.

16. How does a UDP flood attack cause denial of service?

    The attacker sends numerous UDP packets to random ports. The host checks for an application on each port, finds none, and replies with ICMP "Destination Unreachable" packets. The volume of processing and replies exhausts host resources and bandwidth.

17. How does an ICMP (Ping) flood attack work?

    The attacker floods the target with ICMP Echo Request (ping) packets faster than it can respond with Echo Replies, consuming both inbound and outbound bandwidth and CPU until the target is overwhelmed.

18. What is a reflection/amplification DDoS attack?

    The attacker sends requests with a spoofed source IP (the victim's) to third-party servers (e.g., DNS, NTP, memcached). The servers send large responses to the victim, amplifying traffic. Amplification factor is $$\text{AF} = \frac{\text{response size}}{\text{request size}}.$$

19. What was the Ping of Death attack?

    A DoS attack that sent a malformed or oversized ICMP ping packet exceeding the maximum allowed IPv4 size. When reassembled, the oversized packet caused a buffer overflow, crashing, freezing, or rebooting the target system.

20. What is the maximum legal size of an IPv4 packet that the Ping of Death exceeds?

    $65{,}535$ bytes ($2^{16} - 1$). The Ping of Death used fragmentation to reassemble a packet larger than $65{,}535$ bytes, overflowing the reassembly buffer.

21. Why is the classic Ping of Death largely ineffective on modern systems?

    Modern operating systems (post late-1990s) fixed the IP reassembly bug with proper bounds checking, so oversized/malformed fragmented packets are discarded rather than overflowing a buffer.

22. What is a Teardrop attack?

    A DoS attack that sends IP fragments with overlapping, malformed offset fields. When the target tries to reassemble them, the offset arithmetic causes it to crash or hang due to a flaw in the reassembly code.

23. What field in the IP fragmentation header does the Teardrop attack manipulate?

    The fragment offset field. The attacker crafts fragments whose offsets overlap improperly so that reassembly produces negative lengths or out-of-bounds writes, crashing vulnerable TCP/IP stacks.

See more Denial-of-Service (DoS) Attacks flashcards →

Planning Denial-of-Service (DoS) Attacks for Ethical Hacking

Denial-of-Service (DoS) Attacks (Ethical Hacking) FAQ