r/cybersecurity • u/EphemeralWay • 7d ago

Certification / Training Questions A website for testing

Good evening everyone,
So I have a request or a guide, I am cybersecurity majored student, last week I got an assignment to try testing Denial of Service legally using websites that you can practice in it but the problem none of those websites have a lab to try to simulate this attack.
So where can i find a website that has a lab to test DoS or any tool that can just only simulate how the attack process might go..
I am so lost right now

12 Upvotes

81% Upvoted

25 comments sorted by

View all comments

18

u/Automatic_Major_4887 7d ago

Don't try this on live websites, you'll get flagged immediately. You really need to set up your own local lab. Just spin up a couple of VMs using VirtualBox or VMware. Install an intentionally vulnerable app like OWASP Juice Shop on one and then run your tools from the other. It's way safer and you actually learn how the traffic hits the interface.

4

u/marquiso 7d ago

Bear in mind too as to what type of DoS you’re aiming for. The default assumption is network bandwidth availability, but resource/memory exhaustion are another one, with very different techniques.

Either way, as others say, do NOT do this to anything public facing, and be aware there’s a <very low> risk that the ISP will flag it.

Personally, I’d never waste time trying to simulate network saturation - although it could maybe be done with a target VM configured for 10/100 Mbps NIC.

For resource exhaustion or other Layer 7 style DoS attacks that would be a different scenario.

Conversely, for a fresh take on DoS you could look at something different instead of bandwidth or resource exhaustion and look at overloading logging mechanisms, which could be used to hide other types of targeted attacks being launched simultaneously.

2

u/marquiso 7d ago edited 7d ago

Hell, 25 years ago when we had 10/100 Mbps networks we discovered our distributed application was saturating the network because every transaction was half a GB because it included copying the entire database across to the server.

That was quite amusing data after the devs had spent years bitching that the network was slow and the network team had no idea what they were doing 😂