40. DoS and DDoS – Availability Attacks
40.8 Lab-Safe Simulation – Ethics First
Allowed pattern:
- Build weak origin you own on host-only
- From Kali, generate controlled load to that IP only
- Measure impact; stop on timer
- Fix; re-measure
- Snapshot / revert
Banned: public IPs, amp against open resolvers, botnet builders, stresser/booter services (illegal), classmates' laptops without written permission.
# Kali → YOUR lab nginx only (example – keep concurrency LOW)
# ab -n 200 -c 10 http://192.168.56.40/
# siege -c 5 -t 20S http://192.168.56.40/
# hping3: only with trainer limits toward host-only target; never --flood on shared LAN
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Ignores scope; hits production | Written lab scope; network isolation; legal reminder |
| Uses "stresser" SaaS | Blue teaches: those services are criminal tools; never |
| Leaves flood running overnight | Timer + partner watch + kill switch |
Ravindra Bagale's Tip
"Just a quick try" on a friend's shop domain = IT Act risk. Written permission + your own lab. CEH exam modules also put ethics first. Keep this in mind.
Ravindra Bagale's Tip – मराठी
मित्राच्या shop domain वर "फक्त थोडा try" = IT Act risk. Written permission + स्वतःचा lab. CEH exam modules पण ethics first. लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
दोस्त के shop domain पर "बस थोड़ा सा try" = IT Act risk. Written permission + अपनी lab. CEH exam modules भी ethics first. ध्यान रखो.
Lab
Pair work: one student runs 30-second ab against partner's lab VIP; other watches top, nginx access.log, and ss -s. Switch. Write ethics paragraph in notes (Marathi+English mix OK).