Originally Posted by Aser
First, a DDoS attack is a distributed denial of service attack, so you can't really perform a DDoS from a single attack point, e.g. your PC.
Regarding DoS attacks, there are a few laws on the books, but I don't think refreshing the page is going to cause any problems, even if you do it 1000/minute. According to a portion of the computer fraud and abuse act, the following is illegal:
Knowingly causing the transmission of a program, information, code, or command that causes damage or intentionally accessing a computer without authorization, and as a result of such conduct, causes damage that results in:
* Loss to one or more persons during any one-year period aggregating at least $5,000 in value.
* The modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of one or more individuals.
* Physical injury to any person.
* A threat to public health or safety.
* Damage affecting a government computer system
So basically you can DoS a server and not get in trouble for it unless you cause over $5,000 loss (the other stuff would be highly unlikely). The money loss in this case would be from server down time, lost sales, etc, depending on the site you attacked.
Now, as for refreshing the page as a means of performing a DoS attack - I don't think that will get you anywhere. If you want to do a DoS attack from a single entry point, you'll probably need to exceed the maximum either:
1. number of connections allowed by the service
2. the bandwidth capacity of the server/network
Since servers are usually on high bandwidth networks, with multiple peers, your home connection won't be sufficient to achieve 2. You may be able to achieve the first option by doing some script which keeps a large number of concurrent, extremely rate-limited, connections to the service you are trying to DoS.
For example, if they are using apache, and have a server limit of 256, you can write a script to open and keep 300 live connections to port 80 (wget, curl, apache benchmark, etc.) and apache won't be able to open additional connections, meaning others can't connect.
|