Examius

🌍 Ethical Hacking · subject

Ethical Hacking Denial-of-Service (DoS) Attacks Syllabus

The Denial-of-Service (DoS) Attacks syllabus for Ethical Hacking in full: 4 chapters and 12 topics, every one listed below, plus 50 Denial-of-Service (DoS) Attacks flashcards with answers.

4Chapters
12Topics
50Flashcards

Denial-of-Service (DoS) Attacks syllabus: all 4 chapters

Expand any chapter to see its topics and sub-topics.

  1. DoS Attack Concepts

     3 topics
    • What is a DoS Attack?
    • Types of DoS Attacks
    • Impact of DoS Attacks

  2. DoS Attack Techniques

     3 topics
    • Flood Attacks
    • Ping of Death
    • Teardrop Attack

  3. DoS Attack Tools

     3 topics
    • LOIC
    • HOIC
    • Slowloris

  4. Countermeasures

     3 topics
    • Traffic Analysis
    • Rate Limiting
    • DoS Mitigation Services

Ethical Hacking Denial-of-Service (DoS) Attacks flashcards — 50 questions with answers

  1. What is a Denial-of-Service (DoS) attack?

    A cyberattack that aims to make a machine, service, or network resource unavailable to its intended users by overwhelming it with traffic or requests, or by exploiting a flaw that exhausts its resources or crashes it.

  2. What is the core objective of a DoS attack (the security property it violates)?

    It targets availability, one of the three pillars of the CIA triad (Confidentiality, Integrity, Availability). It does not steal or alter data; it prevents legitimate access.

  3. What is the key difference between a DoS and a DDoS (Distributed Denial-of-Service) attack?

    A DoS attack originates from a single source/machine, while a DDoS attack is launched from many distributed sources (often a botnet of compromised hosts) simultaneously, making it far harder to block and much higher in volume.

  4. What is a botnet in the context of DDoS attacks?

    A network of compromised, malware-infected computers or IoT devices ("bots" or "zombies") controlled remotely by an attacker (via a command-and-control server) and used collectively to flood a target.

  5. What are the two broad categories of DoS attacks based on mechanism?

    1) Volumetric/flooding attacks that exhaust bandwidth or resources with sheer traffic volume, and 2) Vulnerability/protocol (logic) attacks that exploit a bug or protocol flaw to crash or hang the target with relatively little traffic.

  6. Name the three standard classification layers of DDoS attacks by target.

    1) Volumetric attacks (consume bandwidth, e.g., UDP/ICMP floods), 2) Protocol attacks (consume server/firewall state, e.g., SYN flood), and 3) Application-layer (Layer 7) attacks (exhaust app resources, e.g., HTTP flood, Slowloris).

  7. At which OSI layers do volumetric, protocol, and application-layer DoS attacks primarily operate?

    Volumetric attacks target Layers 3-4 (network/transport bandwidth), protocol attacks target Layers 3-4 (state tables), and application-layer attacks target Layer 7 (the application itself).

  8. In what unit is volumetric DDoS attack magnitude typically measured?

    Bits per second ($\text{bps}$, e.g., $\text{Gbps}$/$\text{Tbps}$) for bandwidth consumption. Protocol and application attacks are often measured in packets per second ($\text{pps}$) or requests per second ($\text{rps}$).

  9. List four major business impacts of a DoS attack.

    1) Revenue loss from downtime, 2) reputational/brand damage and lost customer trust, 3) operational disruption and recovery/mitigation costs, and 4) potential SLA penalties or regulatory consequences.

  10. How is the direct downtime cost of a DoS outage commonly estimated?

    $$\text{Cost} = \text{Downtime (hours)} \times \text{Revenue per hour}$$ plus indirect costs such as remediation labor, reputational damage, and SLA credits.

  11. Why can a DoS attack sometimes be used as a smokescreen?

    Attackers may launch a DoS to distract security teams and consume monitoring resources while carrying out a stealthier attack (e.g., data exfiltration or malware installation) elsewhere in the network.

  12. What is a flood attack?

    A DoS technique that overwhelms a target by sending a very high volume of packets or connection requests, exhausting bandwidth, connection tables, or processing capacity so legitimate traffic cannot be served.

  13. How does a SYN flood attack work?

    The attacker sends many TCP SYN packets (often with spoofed source IPs) but never completes the three-way handshake with the final ACK. The server holds many half-open connections, exhausting its connection (backlog) table so it can't accept legitimate connections.

  14. What is the TCP three-way handshake that a SYN flood abuses?

    $$\text{Client} \xrightarrow{\text{SYN}} \text{Server} \xrightarrow{\text{SYN-ACK}} \text{Client} \xrightarrow{\text{ACK}} \text{Server}$$ A SYN flood sends SYNs but omits the final ACK, leaving connections half-open.

  15. What is a SYN cookie and how does it defend against SYN floods?

    A technique where the server encodes connection state into the initial sequence number of the SYN-ACK instead of allocating memory. It only creates a connection when a valid ACK returns, so half-open SYNs consume no state and can't exhaust the backlog.

  16. How does a UDP flood attack cause denial of service?

    The attacker sends numerous UDP packets to random ports. The host checks for an application on each port, finds none, and replies with ICMP "Destination Unreachable" packets. The volume of processing and replies exhausts host resources and bandwidth.

  17. How does an ICMP (Ping) flood attack work?

    The attacker floods the target with ICMP Echo Request (ping) packets faster than it can respond with Echo Replies, consuming both inbound and outbound bandwidth and CPU until the target is overwhelmed.

  18. What is a reflection/amplification DDoS attack?

    The attacker sends requests with a spoofed source IP (the victim's) to third-party servers (e.g., DNS, NTP, memcached). The servers send large responses to the victim, amplifying traffic. Amplification factor is $$\text{AF} = \frac{\text{response size}}{\text{request size}}.$$

  19. What was the Ping of Death attack?

    A DoS attack that sent a malformed or oversized ICMP ping packet exceeding the maximum allowed IPv4 size. When reassembled, the oversized packet caused a buffer overflow, crashing, freezing, or rebooting the target system.

  20. What is the maximum legal size of an IPv4 packet that the Ping of Death exceeds?

    $65{,}535$ bytes ($2^{16} - 1$). The Ping of Death used fragmentation to reassemble a packet larger than $65{,}535$ bytes, overflowing the reassembly buffer.

Show the other 30 Denial-of-Service (DoS) Attacks flashcards

  1. Why is the classic Ping of Death largely ineffective on modern systems?

    Modern operating systems (post late-1990s) fixed the IP reassembly bug with proper bounds checking, so oversized/malformed fragmented packets are discarded rather than overflowing a buffer.

  2. What is a Teardrop attack?

    A DoS attack that sends IP fragments with overlapping, malformed offset fields. When the target tries to reassemble them, the offset arithmetic causes it to crash or hang due to a flaw in the reassembly code.

  3. What field in the IP fragmentation header does the Teardrop attack manipulate?

    The fragment offset field. The attacker crafts fragments whose offsets overlap improperly so that reassembly produces negative lengths or out-of-bounds writes, crashing vulnerable TCP/IP stacks.

  4. How do Ping of Death and Teardrop attacks differ in mechanism?

    Ping of Death overflows the reassembly buffer with an oversized packet (too big), while Teardrop crashes reassembly using overlapping/mangled fragment offsets (malformed alignment). Both exploit IP fragmentation reassembly bugs.

  5. What does LOIC stand for and what is it?

    Low Orbit Ion Cannon: an open-source network stress-testing and DoS attack tool that floods a target with TCP, UDP, or HTTP requests. It became well known through use by the hacktivist group Anonymous.

  6. Why does LOIC provide little anonymity to attackers?

    LOIC does not spoof or hide the source IP address; it sends traffic directly from the user's machine. Investigators can trace participating attackers by the source IPs logged at the target, leading to arrests.

  7. What is LOIC's "Hive Mind" mode?

    A voluntary botnet feature that lets a user connect their LOIC client to an IRC channel so a coordinator can direct all connected clients to attack the same target simultaneously, aggregating their firepower.

  8. What does HOIC stand for and how does it improve on LOIC?

    High Orbit Ion Cannon: a DoS tool that succeeds LOIC. It focuses on HTTP flooding, can attack up to 256 URLs at once, and uses customizable "booster" scripts to randomize headers/user-agents, making traffic harder to filter.

  9. What are HOIC "booster" scripts?

    Configurable script files (.hoic) that randomize HTTP request attributes such as user-agent strings, referrers, and target URL paths, helping evade signature-based filtering and increasing attack effectiveness against Layer 7 targets.

  10. Compare LOIC and HOIC in one sentence.

    LOIC is an older tool offering TCP/UDP/HTTP floods against a single target with no anonymity, while HOIC is a more powerful HTTP-focused successor that hits multiple URLs and uses booster scripts to randomize/obfuscate requests.

  11. What is a Slowloris attack?

    A Layer 7 low-bandwidth DoS attack that opens many connections to a web server and keeps each alive by sending partial HTTP headers very slowly, never completing a request, thereby exhausting the server's connection pool.

  12. Why is Slowloris called a "low and slow" attack?

    It uses minimal bandwidth and very few packets, sending data slowly to hold connections open. This lets a single machine take down a server while blending in with normal-looking (just slow) traffic, evading volume-based detection.

  13. Which types of web servers are most vulnerable to Slowloris, and why?

    Thread/connection-per-request servers like Apache (with default MPM) are vulnerable because each open connection ties up a worker thread. Event-driven servers like Nginx handle many idle connections efficiently and resist it better.

  14. Name three defenses against a Slowloris attack.

    1) Limit connections per source IP and set aggressive connection/header timeouts, 2) increase max allowed connections, and 3) use a reverse proxy/load balancer (e.g., Nginx, HAProxy) or WAF that buffers complete requests before forwarding.

  15. How does Slowloris differ from a volumetric HTTP flood?

    An HTTP flood sends a huge volume of complete requests to exhaust bandwidth/CPU, whereas Slowloris sends very little data slowly to exhaust the connection pool. Slowloris is stealthy and low-bandwidth; a flood is high-volume.

  16. What is traffic analysis in the context of DoS detection?

    The process of monitoring and inspecting network traffic patterns (volume, packet rates, protocols, source distribution, request types) to distinguish malicious attack traffic from legitimate user traffic and detect anomalies indicating an attack.

  17. What is baselining and why is it important for DoS detection?

    Baselining establishes a profile of normal traffic behavior (typical bandwidth, request rates, geographic sources). DoS detection then flags statistically significant deviations from this baseline as potential attacks, reducing reliance on fixed signatures.

  18. Name three traffic indicators that suggest a DoS/DDoS attack is underway.

    1) A sudden, large spike in traffic volume or request rate, 2) many requests from a single IP or a narrow range/geography, and 3) traffic from devices sharing a suspicious profile (same user-agent, device type, or malformed requests).

  19. What is NetFlow (or sFlow) and how does it aid DoS traffic analysis?

    Flow-export protocols that summarize network traffic into records (source/destination IP, ports, protocol, byte/packet counts). They let defenders analyze traffic composition and volume in near real time to spot attack flows without inspecting every packet.

  20. What is rate limiting?

    A defense mechanism that caps the number of requests a client (by IP, API key, or session) may make within a given time window, throttling or dropping excess requests to protect a resource from being overwhelmed.

  21. What is the token bucket algorithm for rate limiting?

    Tokens are added to a bucket at a fixed rate $r$ up to capacity $b$. Each request consumes a token; if the bucket is empty, the request is throttled/dropped. It permits bursts up to $b$ while enforcing an average rate $r$.

  22. How does the leaky bucket rate-limiting algorithm work?

    Requests enter a queue (bucket) and are processed (leak out) at a constant fixed rate. If requests arrive faster than the leak rate and the bucket overflows, excess requests are dropped, smoothing bursty traffic into a steady output rate.

  23. Contrast the token bucket and leaky bucket algorithms.

    Token bucket allows short bursts (up to the bucket size) while limiting the average rate, producing bursty output. Leaky bucket enforces a strictly constant output rate and smooths bursts, but does not allow them to pass through.

  24. What is a key limitation of simple per-IP rate limiting against DDoS?

    In a distributed attack, each of thousands of botnet IPs may stay under the per-IP threshold, so no single source trips the limit. IP spoofing and NAT (many users behind one IP) also reduce its effectiveness.

  25. What is the fixed-window vs sliding-window distinction in rate limiting?

    Fixed-window counts requests per discrete interval (e.g., per minute), but allows bursts at window boundaries (up to $2\times$ the limit). Sliding-window tracks requests over a rolling time span for smoother, more accurate enforcement.

  26. What is a DoS mitigation service?

    A specialized (often cloud-based) service that detects and filters malicious DDoS traffic before it reaches the customer's infrastructure, absorbing large attacks with high-capacity, globally distributed scrubbing centers. Examples: Cloudflare, Akamai, AWS Shield.

  27. What is traffic "scrubbing" in DDoS mitigation?

    Redirecting incoming traffic through a scrubbing center that inspects it, removes malicious/attack packets, and forwards only clean, legitimate traffic to the origin server, keeping the service available during an attack.

  28. How does Anycast routing help absorb DDoS attacks?

    Anycast advertises one IP address from many geographically distributed data centers. Attack traffic is automatically routed to the nearest node and thus spread across the entire network, diluting the load so no single location is overwhelmed.

  29. What role does a Web Application Firewall (WAF) play in DoS mitigation?

    A WAF inspects Layer 7 (HTTP/HTTPS) traffic and blocks malicious requests using rules, rate limits, and behavioral analysis. It defends against application-layer attacks (e.g., HTTP floods, Slowloris) that volumetric network filters miss.

  30. What is blackholing (null routing) and its main drawback as a DoS response?

    Blackholing routes all traffic destined for the attacked IP to a null route, dropping everything. It stops the attack from affecting other systems but also drops legitimate traffic, so it completes the denial of service for that target.

Ethical Hacking Denial-of-Service (DoS) Attacks FAQ

What is in the Ethical Hacking Denial-of-Service (DoS) Attacks syllabus?

Ethical Hacking Denial-of-Service (DoS) Attacks is split into 4 chapters: DoS Attack Concepts, DoS Attack Techniques, DoS Attack Tools and Countermeasures. Together they contain 12 topics.

How many chapters are in Ethical Hacking Denial-of-Service (DoS) Attacks?

4 chapters, containing 12 topics. The largest chapter is DoS Attack Concepts, with 3 topics.

Are there flashcards for Ethical Hacking Denial-of-Service (DoS) Attacks?

Yes — a 50-card Denial-of-Service (DoS) Attacks deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.