Hacker News Reader

Comment by lolinder | Hacker News Reader

What about a file-based validation? Require that a file be located at the root of the server with a validation code, and check that file regularly during the stress test.

The only way I can think around that would be to have a reverse proxy that forwards most traffic but not requests for that one file, but then your DDoS isn't actually distributed.

View on HN

I find out my victim uses "SharedPHPHosting-R-US" for their website which uses virtual hosting to have one php server serve many different customers.

I create my own SharedPHPHosting site, host the file, and point the stress testing site at it. Both my site and my victim's site are down. Success.

I believe "neocities" uses the same IP and servers for all neocities websites, so there's another example where this would work.

I wonder why people even do ddos attacks. What possible gain could there be from denying a service for a short while? Maybe competing webshops? It’s still seems overly childish to me. That said I never really looked into this.

1. Money. Most online business can't make money if they are offline. If being offline or unstable is costing you $x / hour and you can stop it by just paying a fee. It's an easy way to end it.

2. Hurt your competition. In some online businesses DDoS attacks are used to compete with other businesses since if your competitor is offline more people will come to you.

3. Power. Some people want to flex the power they have over others.

4. Fame. You can get notoriety for taking something offline.

DDOS can be the definition of a heckler's veto. It's like blasting super loud music so nobody can hear what a person is saying.

Dont like what a site is saying? DDOS so it cant load and people cant read it. For bonus points you are preventing site from getting clicks and thus ad revenue.

There are communities on discord that setup donation links to make sure sites they dont like keep getting hit by DDOS via crowdfunding.

Reply on news.ycombinator.com