Denial of Service (DoS) Explained
Learn about Denial of Service attacks, how they work, and how to test for them.
Denial of Service (DoS) is a type of cyberattack where a system, application, or network is overwhelmed so legitimate users cannot access it.
The goal is availability disruption, not data theft.
DoS falls under the Availability pillar of the CIA triad and is recognized by OWASP as a major application security risk.
What Happens in a DoS Attack
An attacker sends excessive requests or exploits a weakness so that:
- Server CPU becomes overloaded
- Memory is exhausted
- Network bandwidth is saturated
- Application threads are consumed
- Database connections are depleted
As a result, the service becomes slow or completely unavailable.
DoS vs DDoS
DoS
Attack originates from a single source.
DDoS (Distributed Denial of Service)
Attack comes from many machines simultaneously, often using botnets.
DDoS is far more common and harder to mitigate.
Common Types of DoS Attacks
1. Volumetric Attacks
Flood the network with traffic.
Example: UDP flood.
2. Protocol Attacks
Exploit weaknesses in network protocols.
Example: SYN flood.
3. Application Layer Attacks
Target the application itself.
Example:
- Repeated login attempts
- Expensive search queries
- Heavy file uploads
- API abuse
Application layer attacks are harder to detect because traffic may look legitimate.
Real World Impact
DoS attacks can:
- Take down eCommerce platforms during peak sales
- Disrupt banking services
- Interrupt healthcare systems
- Cause SLA violations
- Lead to revenue loss
Large scale DDoS attacks have impacted companies like Amazon, GitHub, and Cloudflare.
How to Prevent DoS
Infrastructure Level
- Rate limiting
- Load balancing
- Auto scaling
- Web Application Firewalls
- CDN protection
Application Level
- Input validation
- Request throttling
- CAPTCHA for abuse endpoints
- Query optimization
- Timeout handling
Network Level
- Traffic filtering
- SYN cookies
- DDoS protection services
Denial of Service Testing Checklist
This checklist focuses on availability risks caused by misuse, abuse, or resource exhaustion, not infrastructure level DDoS simulation.
1. Endpoint Risk Identification
Map high risk endpoints:
- Login and authentication APIs
- Password reset
- Search endpoints
- File upload APIs
- Report generation endpoints
- Export to CSV or PDF
- GraphQL endpoints with deep queries
- Public APIs without authentication
Ask:
- Which endpoints are expensive?
- Which endpoints hit database heavily?
- Which endpoints trigger background jobs?
2. Rate Limiting Validation
For each sensitive endpoint:
Test
- Send rapid repeated requests
- Use parallel requests
- Attempt brute force patterns
Validate
- HTTP 429 returned?
- Retry After header present?
- Temporary IP blocking enforced?
- Account lockout policy applied?
Critical areas:
- Login
- OTP verification
- Password reset
- API tokens
3. Authentication Abuse
Test whether attackers can:
- Attempt unlimited login attempts
- Generate unlimited password reset emails
- Reuse expired tokens
- Create excessive sessions
Validate:
- Account lockout threshold
- Cooldown timers
- CAPTCHA enforcement
- Session limits per user
4. Resource Exhaustion Testing
Simulate heavy operations.
Database Stress
- Large search queries
- Wildcard searches
- Unindexed filters
- Deep pagination requests
File Upload Abuse
- Upload max size repeatedly
- Upload concurrent files
- Upload malformed large files
Background Jobs
- Trigger report generation repeatedly
- Trigger export APIs concurrently
Validate:
- Graceful failure
- Timeouts enforced
- System remains responsive
- Proper error handling
5. Concurrency Testing
Test:
- Multiple simultaneous sessions from same account
- Parallel API calls to state changing endpoints
- Rapid cart updates
- Bulk data submission
Validate:
- Thread pool exhaustion prevention
- Connection pool protection
- No deadlocks
- No unbounded memory growth
6. Payload Size Validation
Test maximum limits:
- Request body size
- JSON payload depth
- Array length
- String length
Validate:
- Server rejects large payloads properly
- No crash or memory spike
- Proper HTTP status returned
7. Timeout Handling
Check:
- API timeouts configured
- Reverse proxy timeout limits
- Database query timeout
- Background job timeout
Simulate slow client behavior.
Validate:
- Connections closed properly
- Resources released
- No zombie processes
8. Pagination & Query Controls
Ensure:
- Maximum page size enforced
- No unlimited result sets
- Default pagination applied
- Sorting and filtering bounded
Test:
?page=1&limit=1000000
System must reject or cap it.
9. Caching Validation
Check:
- Repeated GET requests served from cache
- Expensive endpoints cached
- Cache stampede prevention
- Cache TTL reasonable
Absence of caching can cause accidental DoS.
10. API Abuse Scenarios
Test:
- Scripted request bursts
- Token reuse across multiple IPs
- Automation tool behavior
- Unauthenticated scraping attempts
Validate:
- API throttling
- IP reputation filtering
- WAF behavior
11. Monitoring & Observability
Confirm that system:
- Logs abnormal spikes
- Triggers alerts
- Records rate limit violations
- Tracks high latency endpoints
QA should verify monitoring exists, not only functionality.
12. Failure Mode Validation
When system is under stress:
- Does it degrade gracefully?
- Does it return controlled error responses?
- Does it avoid exposing stack traces?
- Does it protect critical services?
No crash. No corrupted data. No partial writes.
13. CI/CD Integration
Include:
- Load smoke tests in pipeline
- Rate limit tests in API automation
- Basic concurrency checks in nightly builds
Avoid performing destructive stress tests in production.
14. Risk Prioritization
Highest risk scenarios:
- No rate limiting on authentication
- Unlimited file uploads
- Expensive unbounded search queries
- Admin report generation without throttling
- Public APIs without throttling
These can lead to application level DoS even without a large scale DDoS attack.