Sinisterly
[Need Help] How to stop ddos? - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: [Need Help] How to stop ddos? (/Thread-Need-Help-How-to-stop-ddos)

Pages: 1 2 3 4

[Need Help] How to stop ddos? - Mr.Kurd - 01-17-2017

In The Name Of Allah
Al-Salam Alekum

hello, how to stop huge ddos?
Someone ddosed my friend forums, it was huge ddos, I heard that the ddoser paid a money for ddosing the forum.
You know anyway to stopping it?

Wa Salam Alekum

RE: [Need Help] How to stop ddos? - Pikami - 01-17-2017

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough it will take down cloudflare witch would result in the users not reaching the site...

RE: [Need Help] How to stop ddos? - Satan - 01-18-2017

(01-17-2017, 09:29 PM)Pikami Wrote: There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...
Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

RE: [Need Help] How to stop ddos? - Wildfire - 01-18-2017

Without much details being given, here's what I would do:
  • Configure CloudFlare on the domain
  • Change the IP address of the primary server
  • Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  • Set the DNS up in a way that the A records round robin around those VPSes
  • Configure a caching nginx proxy that reverse proxies to the main server
  • On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  • On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  • Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  • Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback


RE: [Need Help] How to stop ddos? - Mr.Kurd - 01-18-2017

(01-18-2017, 12:04 AM)Satan Wrote:
(01-17-2017, 09:29 PM)Pikami Wrote: There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...
Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

(01-18-2017, 03:45 AM)Axi Wrote: Without much details being given, here's what I would do:
  • Configure CloudFlare on the domain
  • Change the IP address of the primary server
  • Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  • Set the DNS up in a way that the A records round robin around those VPSes
  • Configure a caching nginx proxy that reverse proxies to the main server
  • On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  • On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  • Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  • Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
Yeah, he used Cloud Flare but the site shut down Sad . the ddos was very strong.

RE: [Need Help] How to stop ddos? - Wildfire - 01-18-2017

(01-18-2017, 02:33 PM)Mr.Kurd Wrote:
(01-18-2017, 12:04 AM)Satan Wrote:
(01-17-2017, 09:29 PM)Pikami Wrote: There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...
Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

(01-18-2017, 03:45 AM)Axi Wrote: Without much details being given, here's what I would do:
  • Configure CloudFlare on the domain
  • Change the IP address of the primary server
  • Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  • Set the DNS up in a way that the A records round robin around those VPSes
  • Configure a caching nginx proxy that reverse proxies to the main server
  • On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  • On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  • Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  • Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
Yeah, he used Cloud Flare but the site shut down Sad . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

RE: [Need Help] How to stop ddos? - Mr.Kurd - 01-18-2017

(01-18-2017, 03:24 PM)Axi Wrote:
(01-18-2017, 02:33 PM)Mr.Kurd Wrote:
(01-18-2017, 12:04 AM)Satan Wrote: Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

(01-18-2017, 03:45 AM)Axi Wrote: Without much details being given, here's what I would do:
  • Configure CloudFlare on the domain
  • Change the IP address of the primary server
  • Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  • Set the DNS up in a way that the A records round robin around those VPSes
  • Configure a caching nginx proxy that reverse proxies to the main server
  • On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  • On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  • Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  • Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
Yeah, he used Cloud Flare but the site shut down Sad . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

Maybe I will ask them, but man you didn't hear the ddos attack for money, They start very huge ddos attack for 3 days just by I think 70$.

RE: [Need Help] How to stop ddos? - Blink - 01-18-2017

(01-18-2017, 03:46 PM)Mr.Kurd Wrote:
(01-18-2017, 03:24 PM)Axi Wrote:
(01-18-2017, 02:33 PM)Mr.Kurd Wrote: Yeah, he used Cloud Flare but the site shut down Sad . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

Maybe I will ask them, but man you didn't hear the ddos attack for money, They start very huge ddos attack for 3 days just by I think 70$.

Yeah, there was probably a misconfiguration, as cloudflare (usually) wouldn't just "get up and leave".

RE: [Need Help] How to stop ddos? - CRNpolyfluoric - 01-18-2017

Hey Mr. Kurd,
Sorry to hear of your troubles. Axi's advice on configuration is critical and this is square one for anybody running public-facing systems. You say that the attack was "very strong"; please elaborate. Origin, packet types, bandwidth consumed, duration etc. Logs would be ideal. Load balancers and firewalls are excellent but the fundamental problem with all DOS is link saturation.

PM me if you would like assistance configuring a more aggressive mitigation system.

Cheers,
Poly

RE: [Need Help] How to stop ddos? - zenith - 01-18-2017

Once a ddos is in place. You can't stop it. You can only take precautions.
I wouldn't trust cloudfare due to the fact that last time I checked. Wiresharking their backdoor is ez. So I prefer digitalfort but that's because someone I know runs it.

"He played a moneys to ddos it". There is no way to ddos for free unless you have your own personal method. Usually skids pay for booters.