Denial of Services (DoS)

Typically, a Penetration Testing exercise is focused on identifying the gaps in security rather than harming a system. This is a key feature that separates a real attacker from an authorized Penetration Tester. Real hackers don't follow the rules and are not concerned about interrupting business if it can improve their situation. In some cases, a hacker is looking to create any form of negative impact on a target, including taking down critical systems. For this reason, it makes sense in some cases to test systems for the risk of Denial of Service (DoS) type attacks. This is commonly termed as stress testing your Internet facing services.

Note

It is absolutely critical to have an approval to test an asset for DoS vulnerabilities. Some attack methods may have a negative impact to a system post-Penetration Test. It is advised to test against redundant systems, lab equipment, or nonproduction systems if possible.

The most common DoS attack involves flooding a target with...