Detecting Web DDoS Writeup

Overview

This room explores denial-of-service attacks, detection techniques, and strategies for protection against DDoS attacks targeting web services.

Task 1: Introduction to DDoS

1.1 What class of attack relies on disrupting the availability of a web service?

1.2 What do we call the network of compromised machines that attackers use to launch DDoS attacks?

Task 2: DDoS Attack Motivations

2.1 Which attacker motive aims to make customers lose confidence in a company?

2.2 Which motive most likely drove the 2023 DDoS attack against Microsoft?

Task 3: Detecting DDoS Attacks

3.1 What is the attacker's IP address?

3.2 Which page is repeatedly targeted by the attacker's requests?

3.3 What is the HTTP status code that indicates the server is unavailable due to overload?

Task 4: Analyzing Logs with Splunk

4.1 What was the most frequently requested URI?

4.2 Which clientip made the first request to the target URI?

4.3 How many IP addresses were part of the botnet that attacked your website?

4.4 Which useragent was most commonly used by the attacking traffic?

4.5 Use the timechart command to visualize the requests. What is the peak number of requests made per second during the attack?

4.6 Which legitimate (non-attacking) clientip received the first 503 response status post-attack?

Task 5: DDoS Mitigation Strategies

5.1 What type of security challenge blocks bots by asking users to solve a simple puzzle?

5.2 Which CDN feature spreads traffic across multiple servers to prevent overload?

Lessons Learned

• Denial-of-Service attacks aim to disrupt service availability rather than steal data
• Botnets are networks of compromised devices used to amplify attack traffic
• DDoS attacks can be motivated by hacktivism, extortion, or reputational damage
• Early detection involves monitoring unusual traffic patterns and HTTP status codes
• Splunk is valuable for log analysis and attack pattern identification
• Botnets can involve dozens to hundreds of compromised IP addresses
• User-Agent strings can help identify attack traffic patterns
• Time-based analysis reveals attack intensity and duration
• CAPTCHA systems help distinguish human users from automated bots
• Load balancing distributes traffic to maintain service availability