Home / Knowledge hub / Denial of service
Knowledge hub
Denial of service
Making an application unavailable by overwhelming or exhausting it.
What it means
Denial of service means making an application unavailable, either by overwhelming it or by triggering something expensive inside it. The distributed version, thousands of machines at once, is the one that reaches the news.
The cheap version is more interesting. One request asking for a report covering ten years, or an upload that expands enormously when unpacked, does the same job with no volume at all.
Why it matters
Customers notice availability immediately. Nobody emails support about a permission bug they cannot see, and everybody emails when the site is down. The volume-based version, though, belongs to your hosting provider and network layer rather than to your code.
Separate the two problems when you budget. Volume attacks are a hosting conversation, handled by providers working at a scale you cannot match. Expensive requests are an application conversation, and they are yours. Teams often buy protection for the first and never look at the second, where one unlucky endpoint does the same damage for free.
How it shows up
The parts deserving your own attention sit in the code. Endpoints with no cap on page size. Search that accepts patterns taking enormous time to evaluate. Exports that run without a queue. File handling with no size limit. Any request that does heavy work before checking who is asking. CWE calls this family uncontrolled resource consumption, and OWASP's cheat sheet lists the usual application-layer versions.
Cyberlop does not run denial of service tests. Knocking your application over proves nothing you wanted to know. What we do not do.
Questions people ask
Denial of service, answered
What is the difference between DoS and DDoS?
A DoS attack comes from one source. A DDoS attack coordinates many machines so the traffic arrives from everywhere at once, which makes blocking by address useless.
The defences differ accordingly. One is often a filtering rule, the other needs capacity you rent rather than build.
Can a single request really take an application down?
Yes, when the request makes your server do something wildly expensive. A regular expression that backtracks, an export with no row limit, or an archive that unpacks to gigabytes will all do it.
These show up in code review far more reliably than in a traffic graph, because there is nothing unusual about the traffic.
Does Cloudflare or our cloud provider handle this for us?
They handle the volume. Providers absorb floods at a scale no application team can match, and that is genuinely most of the news-making attacks.
They cannot help with an endpoint of yours that takes thirty seconds of CPU per call. That request looks entirely legitimate on the way in.
Is a slow endpoint a security bug or a performance bug?
Both, and arguing about the label wastes the afternoon. If an anonymous visitor can trigger it repeatedly, treat it as security. If it only hurts one signed-in user's own experience, treat it as performance.
The fix usually looks the same either way: a limit, a queue, or a check performed earlier.
Do penetration testers try to take your site down?
Reputable ones ask first, and most scopes exclude it. Proving that a service falls over rarely teaches anybody something they wanted to learn, and it costs you a real outage.
Cyberlop does not run these tests at all. We test the classes that move data, and we say so up front.
Sources
Where this comes from
Related
Terms that sit next to this one
Rate limiting
Capping how often something can be attempted, per user or per address.
Firewall
A control deciding which traffic is allowed to reach a system.
WAF
A filter in front of your application that blocks known bad requests.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
Want tests that do not break things?
We do not run denial of service tests, because knocking your application over tells you nothing you wanted to know. We test the ten classes that move data. Ask what a pilot covers.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.