Are you sure that your servers can withstand the onslaught of visitors and won't let you down even under the heaviest load? We simulate heavy user traffic to see if the tested infrastructure won't fail even in extreme situations.
Find out how your systems respond under load
Methodology and types of attacks
The attack targets the flooding of the target server or network with a large number of TCP SYN (synchronization) packets. This attack is based on exploiting a flaw in the TCP (Transmission Control Protocol) communication that is used to establish a connection between two devices on the network.
The normal procedure for establishing a TCP connection between a client and a server begins with the client sending a TCP SYN packet to the server. The server should then acknowledge receipt of this packet by sending a reply with a TCP SYN-ACK packet, to which the client should respond with an ACK acknowledgement. Only then the TCP connection is considered successfully established.
In a TCP SYN packet flooding attack, the attacker does not acknowledge the server's responses to its TCP SYN packets. Instead, it sends a large number of TCP SYN packets to the server, thus flooding its queue of active connections. The server waits for an acknowledgement (ACK) from the attacker, but it never arrives, leading to a buildup of inactive entries in the queue.
HTTPS Renegotiation DoS
This is a specific type of attack that targets the exhaustion of server resources due to the misuse of the HTTPS renegotiation feature. When an encrypted connection is established between the client and server, a process known as SSL/TLS handshake occurs. One step in this process is the ability to renegotiate the encryption parameters of the connection, enabling you to change keys or other encryption settings during an already established communication.
We perform the test by repeatedly initiating the renegotiation of the connection without fully completing it. This leaves the unfinished connection open on the server side. If this process is repeated with high frequency, the server will be overwhelmed with a large number of unfinished connections, causing system resources to be exhausted, and the server will become unavailable to legitimate users.
In this attack, we manually select, according to our experience, the HTTP request activity that takes the highest computing power on the backend servers - typically database queries during search, data retrieval, or user login.
We then repeat such HTTP request with high frequency, which can simulate multiple users working at the same time and thus use the full resources of the backend servers and cause their unavailability.
Buffer Overflow DoS
Sending exploits that can make the service inaccessible (if the target software is vulnerable). Here we use our up-to-date vulnerability scanner Nessus to scan for Buffer Overflow vulnerabilities. If such a vulnerability is found, we apply a suitable exploit against the target system, which causes it to crash.
The output is a comprehensive test report
Our final report contains a detailed schedule, so it is possible to assign the monitoring outputs to specific tests. The application-level DoS tests, which are represented by the last two groups in the standard suite, include overall input validation, where e.g. unexpected input from a user causes the system or backend to crash, form upload tests (number of files, file size, space fill), cyclical execution of a function that is logged (space fill with logs), etc.
- You get the overall confidence that your servers can withstand the onslaught of visitors and won't let you down even under the heaviest load
- You'll receive a final report that includes a detailed schedule so you can match monitoring outputs to specific tests.
- We have over 30 years of experience in the field of security in both the Czech and Slovak Republics.
Our penetration tests identified and remediated vulnerabilities within the company Konica Minolta
Raising cybersecurity awareness at Broker Consulting
Security of clients and employees of ČSOB has been improved not only through penetration tests
Audits and sophisticated penetration tests for vulnerability identification for Škoda Auto
At T-Mobile, we performed security tests and audits
At Deutsche Telekom (T-Systems), we cover the areas of cyber security.
Cyber security training services for dozens of OTE employees
Implementation of penetration tests to improve the security of ING
Implementation of security audits and penetration tests for ČEZ
- Increasing cyber security at the Hradec Králové University Hospital
You May Also Like
- Robust multi-level user and data protection of Military Hospital Olomouc
- BUDVAR systematically increases its cyber security
- Kofola has cybersecurity under control
- Data of CENTROPOL ENERGY customers and employees is safe thanks to the DLP system
- The first four companies adopt the new name Aricoma
- Complete management of the corporate IT of MORAVIA PROPAG
- Modern and secure IT infrastructure with operational services for Arkance Systems CZ
- We have joined the EDIH NORTHEAST BOHEMIA consortium’s digitalization project
- Faster and safer login to computers and applications at the Jihlava Hospital
- Companies in KKCG's technology pillar are changing. Qinshift to be spun off from Aricoma
- Security and remote management of thousands of commissioners' mobile devices for Census 2021
- AC Identity - Identity Management for the city of České Budějovice
DO NOT HESITATE TO
Are you interested in more information or an offer for your specific situation?