Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 40 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Crashing a server
EH-Net
May 23, 2013, 09:20:55 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: 1 [2]   Go Down
  Print  
Author Topic: Crashing a server  (Read 13829 times)
0 Members and 1 Guest are viewing this topic.
servercrasher365
Newbie
*
Offline Offline

Posts: 11


View Profile
« Reply #15 on: April 30, 2008, 07:51:04 AM »

Thanks a ton.However, one thing my supervisor says is that if the test tool cant crash the server,it suggests that the tool aint good enuff.
But it cud also mean that the server is robust and secure in which case i can list out the reasons y the attacks arent working anymore and the explanations wud fetch me the required credits.

thanx 4 the info bout the daemons,i wasnt aware of that...so in that case DoS isnt that easy to implement as some of the earlier posts suggest...
Logged
servercrasher365
Newbie
*
Offline Offline

Posts: 11


View Profile
« Reply #16 on: April 30, 2008, 07:56:15 AM »

"the listed attack vectors only make sense if the box you are trying to test is running the vulnerable service"

I wouldnt be knowing what vulnerablities,if any that the server wud be running.So I assume,that i wud have to scan for them first and then based on the search,launch attacks to exploit them...did i get that one right?
Logged
Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #17 on: April 30, 2008, 08:00:05 AM »

"the listed attack vectors only make sense if the box you are trying to test is running the vulnerable service"

I wouldnt be knowing what vulnerablities,if any that the server wud be running.So I assume,that i wud have to scan for them first and then based on the search,launch attacks to exploit them...did i get that one right?

Makes sense to me Wink if you could link your tester to a nessus/nmap/etc. scan output then you're getting more automated Cheesy

...so in that case DoS isnt that easy to implement as some of the earlier posts suggest...

Not entirely true, DoS attacks can be the simplest form of assault on a system (other than SE Wink ). But if a system isn't running the service/application you are attacking it is just going to ignore you.

More basically, if you are trying to DoS a system using the apache2 attack you mentioned for example. If the system isn't running apache2 to server web documents then there is no service for you to deny...

Same way you don't need to bring a web server to it's knees to effectively stop it serving web content. Again, I'd recommend that you make sure that you have a well defined scope so that you can effectively prove you have achieved the targets of your project, thus getting the most marks for your project (which I'm assuming is your true goal Wink )
Logged

vijay2
Full Member
***
Offline Offline

Posts: 220


View Profile
« Reply #18 on: April 30, 2008, 08:08:51 AM »

No offense to you but I think if this thread goes long enough, RR would end up doing the project for you. In my opinion you need to do some research and try to understand the methodology of Pen test to evaluate the security of the server. As I have always said Google is your friend. To start you off here are some links

http://en.wikipedia.org/wiki/Penetration_test

http://www.governmentsecurity.org/archive/t125.html

Hope this helps
Logged

GPEN GCFA GCIH CISSP CISA GSEC OSCP C|EH Security+
Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #19 on: April 30, 2008, 08:11:53 AM »

I think if this thread goes long enough, RR would end up doing the project for you.

No thanks, just got out of that game. I've just got used to sleeping again Wink
Logged

Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #20 on: April 30, 2008, 09:01:59 AM »

man,whats the matter with u???

Servercrash,

chill out. Vijay2 was trying to offer assistance, as he has said Google is your friend. But from my experience I know that Google can be daunting and unhelpful if you don't know what to search for, hence why I have given additional pointers.

If you don't agree with/appreciate someones input that's fine, but don't flame them, this isn't that kind of place.

Regardless, remember that Vijay2 did try to offer you assistance. That was on his time and his choice. I think you may have just stopped him (and possibly others) providing further assistance.

RR
Logged

servercrasher365
Newbie
*
Offline Offline

Posts: 11


View Profile
« Reply #21 on: April 30, 2008, 09:14:49 AM »

ok,i removed that post....i really didnt mean to hurt or flame vijay2.....ofcourse theres plenty of stuff on the net,but as u said it doesnt help if you don't know what to search for.And i got to submit an initial proposal for the project by the 2nd,so there aint much time to read all the basic stuff n then plan things from the ocean of knowledge.so thats reason i ask experts like u.....vijay did try to help,but it really freaks me out when
i post something,RR or someone else trys to help n vijay has a thing or 2 to say bout it......just made me  wonder what the matter was with him...anyways,its over as far as i'm concerned,peace with vijay2.cheers buddy....hope ur ok with me
Logged
vijay2
Full Member
***
Offline Offline

Posts: 220


View Profile
« Reply #22 on: April 30, 2008, 09:30:24 AM »

Well I would not have responded to your post .. but just wanted to clear a few things .. yes, this a forum and its all about helping. There are a lots of brilliant and knowledgeable folks here who would not miss an opportunity to help anyone. But, have you wondered why no one else except RR replied to your posts ? Its all about helping people who have done their basic research and need further assistance, you don't expect to be spoon feed here. 

And my if you are asking for help please leave the attitude at home, that wont take you far. We are here to help each other and share knowledge.

Don - Correct me if I am wrong.

VJ 
Logged

GPEN GCFA GCIH CISSP CISA GSEC OSCP C|EH Security+
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 233


Klaatu, Borada,Necktie?


View Profile
« Reply #23 on: April 30, 2008, 09:36:07 AM »

I'm a little confused, and please correct me if I'm out of line. I mean no disrespect to anyone.

If, as you stated, this is for your dissertation, shouldn't you already have built a pretty solid foundation of knowledge on the subject?  Especially if you're planning on testing your theories in an environment other than a lab?
Logged

Reluctant CISSP, Certified ASS
rok
Newbie
*
Offline Offline

Posts: 39


View Profile
« Reply #24 on: April 30, 2008, 09:40:32 AM »

I second vijay!!!
Logged
Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #25 on: April 30, 2008, 09:51:42 AM »

If, as you stated, this is for your dissertation, shouldn't you already have built a pretty solid foundation of knowledge on the subject?  Especially if you're planning on testing your theories in an environment other than a lab?

Servercrash,

I was going to make this suggestion but oneeyedcarmen beat me to it. I'm not sure of your level of study as I don't know where you are studying but if you have 2 days to get the initial proposal in and you are needing information like this you may want to look at a less technical area, where research material will be easier to find and readily available.

As already stated when I completed my dissertation (UK BSc) my project was built on a technology that I had over one year's real world experience implementing, and still found it hard going.

Therefore I would ask one final question, 'Why have you chosen this project over any other?'

Either way, whatever your final topic as has been expressed by other posters you will get more respect, learn more information and ultimately complete a better project if you can fully understand and research the basics for yourself.

Good Luck.
Logged

jason007
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #26 on: April 30, 2008, 12:09:31 PM »

cant help ignore.This posts getting more n more interesting for all the wrong reasons  Cheesy

servercrasher,vijay2... grow up both of u!!

I wouldnt say servercrasher didnt do any research on the topic...seems looks like hes done some searching,but is looking for specific areas to focus on and continue probing.cant blame him for that,the topic is vast......but he himself seems to be a touch impatient about it!

As for vijay2,his previous post has a hint of sarcasm to it,atleast thats how it looks to me...

"No offense to you but I think if this thread goes long enough, RR would end up doing the project for you"

cmon,thats uncalled for....if u think like many here that servercrasher asked something too generic,u can always choose to ignore him rather than provoke ......

servercrasher,plz be more patient , work on  ideas and come out with more specific queries......good luck

guys,help each other rather than question attitudes and where it would take people!!???
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4167


Editor-In-Chief


View Profile WWW
« Reply #27 on: April 30, 2008, 01:06:06 PM »

Great first post jason007 and welcome to EH-Net.

As to servercrasher's question, maybe it might be wise to pint out that there is a difference between crashing a server and a DoS.

If I walk up to one of my servers in a datacenter, and either unplug the network cable or properly shut it down, you could make the case that this is DoS since no users can get to it. But this would not be a case of crashing a server. To me, crashing a server would indicate something sinister or wrong that causes it to shut down improperly or restart.

In addition, a stress test is yet a third topic. It could be somewhat related to a crash or DoS but it doesn't have to be. I could run a stress test on a server and it doesn't come down. Depending on what your purpose is, this could be a successful or unsuccessful test.

So I guess I would agree with the overarching point of this thread which is to have servercrasher bring a tighter focus to his own project and then ask questions based on more specific topics.

Hope this helps,
Don

PS - Cooler heads always prevail!
Logged

CISSP, MCSE, CSTA, Security+ SME
jason007
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #28 on: April 30, 2008, 06:10:28 PM »

Spot on Don n thanx 4 the welcome... servercrasher looks to be a bit naive and mayb he needs to discuss with his supervisor on the scope of this project which would help  come up with more specific topics.but having said that one can't overly criticize him for that post.
to add to what Don said,server crashing can mean anything....u can do a dissertation on it for 3 months or a phd for 3 years n so on.......so nuffin wrong with the question,server crasher would have done quite a bit of reading,made a meal of it n now he wants to know what he should be focusin on..nothing wrong with tat!!......n i just noticed vijay2 in one of his previous posts says
"I am not clear what the goals are for the project or even is there a project."i had be upset if some1 doubts my integrity,particularly if i care to be in an 'ethical' hackers forum.......
but vijay did try to help server crasher,so  probably server guy should have gone light with him,.....I wish both of them can get over this small issue n support each other n everyone else.....
Logged
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4167


Editor-In-Chief


View Profile WWW
« Reply #29 on: April 30, 2008, 08:46:12 PM »

So let's call this one a day for now.

Thread closed.

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Pages: 1 [2]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.081 seconds with 24 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.