Penetration Testing: Re: DDOS Products

["Drexx Laggui [personal]" <drexxl () gmail com>]

15Nov2006 (UTC -5)

On 11/15/06, R. DuFresne <dufresne () sysinfo com> wrote:
> On Sun, 12 Nov 2006, ankur jindal wrote:
> > Can you please explain what do you mean by a 'good DDoS' tool? What does it
> > exactly do ? I am just trying to learn what should a good tool be able to do
> > in a scenario such as DDoS. I hope its not just rate limiting of traffic.
>
> In a small DDOS attempt there are things and appliances that can help to
> mitigate the issues of alot of packets passing the internet connection<s>.
> But in a majot DDOS that fills your pipes there's really nothing one can
> do themselves, not without the help of a larger piped upstream provider
> assiting.
>
> For pentesting, it is our understanding that DDOS is not in most cases
> considered a useful concept or stratedgy.
>
> As for what those appliacnes might do in small DDOs packet attacks, your
> best source of info is from the vendors sites, provided you can read
> between the fluff....
True, true... OSSTMM's Rules Of Engagement advices against DoS
testing. And if ever, doesn't allow larger sources to DoS smaller
pipes, and much less DDos.

But if one is keen on doing so as a legit pentester, one could use
nmap to spoof a connection to a chargen service on a Unix box, then
have FW-1 do network & port address translation to the target
machine's POP, HTTP, SMTP, Telnet or whatever service.


HTH,

Drexx Laggui - Metro Manila, Philippines
http://www.laggui.com (work: computer forensics, pentesting, policy dev)

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------