[JamesHen]

I bought vDos to stress test my own servers

the first I tried went down easily with 1200 sec of SSDP

now I tried another and it didnt do anything..

out of all these which one is the most powerful for taking down web servers

Method:SSDP SUDP NTP ESSYN HOME xSYN Joomla Quake ICMP TS ACK

[Alpis]

NTP SSDP :) Layer 7 Joomla in my opinion :pPp

[iMAD]

SSDP but only if the person running the server has a decent SSDP Amp list
If not it will be as weak as piss.

[_iiDaxter]

Use Udp for people. Syn for sites.
There ya go

[WillHackForPizza]

Recursive DNS amplification is always a winner. Just no one talks about it on here. Also seen some cool SNMP/NTP abuses. UDP is good if you can get the volume.

Also dont rule out socket exhaustion based attacks.

[Tabb]

Considering your goal is webservers and the only HTTP method you listed is joomla, joomla.

[mfacundo94]

It depends pretty much on your hardware capabilities, I mean, suppose you are in a network with decent hardware, let's say Juniper Network firewalls, in this case, you will do nearly anything with SSYN, SYN, ESSYN, UDP FLOOD as long as you do not saturate the banwidth, so layer 4 attacks are not an option.
Now, think you've not a good hardware and you're sharing resources for your website, then the most probably effective attack would be a layer 7 attack, such a slowris attack.
We can't say which method is better, it depends on the circumstances mainly.

[Davy]

Best method is not doing it ofcourse.

[ρãήžε®]

Joomla is by far the most advanced method out of everything. Ive bypassed ddos mitgation with it and it stays unmitgated.

[Tabb]

Joomla is by far the most advanced method out of everything. Ive bypassed ddos mitgation with it and it stays unmitgated.

Advanced isnt the term I'd use. It doesn't bypass anything, it just exploits the google map plugin for joomla and is rather easy to mitigate.

[ρãήžε®]

Advanced isnt the term I'd use. It doesn't bypass anything, it just exploits the google map plugin for joomla and is rather easy to mitigate.

i ran it in short bursts of 60 seconds and looped it and it wasnt able to mitgate it

[Tabb]

i ran it in short bursts of 60 seconds and looped it and it wasnt able to mitgate it

"it" wasn't able to mitigate it? What?

If you look at the actual attack creating firewall rules for it is not difficult is what I meant.

[ρãήžε®]

"it" wasn't able to mitigate it? What?

If you look at the actual attack creating firewall rules for it is not difficult is what I meant.

yea im sure it might not be difficult and im sure future attacks using the method on the same host i did wont work as effeciently as they did. I stopped the attack a while ago and their servers are still down. Its been 8 days now 😏