Flood. Prove. Score. Learn.
The first DoS/DDoS training platform with a live proof-of-impact scoring system. Flags are only issued when the judge confirms your service is actually down. No file hunting. No guessing. Real impact or no points.
Each scenario targets one specific vulnerability class. Understand the mechanism. No hand-holding — the hint system is there if you need it.
Use Floodles, hping3, Scapy, or any tool. The arena does not care how you get there. Only whether the service degrades.
The judge polls every target every 5 seconds. When it detects proven degradation matching the scenario criteria, a time-windowed flag is generated.
Submit your flag for points. Full technical writeup unlocks immediately — vulnerability mechanics, real-world context, detection, mitigation.
You can copy a flag without understanding what you did. The platform has no way to verify actual exploitation.
Flags expire every 5 minutes. Your attack must still be running when you submit. The judge is the ground truth.
Exhaust the TCP SYN queue. SYN cookies disabled — backlog fills in seconds. Prove the server stops accepting connections.
Hold all 150 Apache workers with incomplete HTTP requests. Zero bandwidth. mod_reqtimeout not loaded on this target.
Prove ACK packets reach the server behind the stateless firewall. No conntrack, no session check — ACK floods pass through.
Verify the BIND9 server is an open resolver responding to ANY queries from any source. Measure the amplification factor.
Prove NTPd responds to mode 7 monlist. 8-byte request → 43,200 bytes response. ~550x amplification factor.
Highest amplification in the arena. Community=public, full MIB-II. max-repetitions=255 dumps the entire device tree. ~650x.
Fill MySQL's connection table (max=50) with idle TCP connections. No auth needed. Prove the database refuses new connections.
RUDY attack. Declare 10MB Content-Length, send 1 byte/10s. Bypasses header timeouts. Fills workers via body channel.
| IP Address | Hostname | Service | Vulnerable To | Tag | |
|---|---|---|---|---|---|
| 10.0.2.20 | apache-vuln | HTTP :80 | Slowloris, SYN flood, Slow POST, NUKE | L7 | |
| 10.0.2.30 | dns-open | UDP :53 | DNS amplification (~60x) | AMP | |
| 10.0.2.31 | ntp-vuln | UDP :123 | NTP monlist (~550x) | AMP | |
| 10.0.2.32 | snmp-vuln | UDP :161 | SNMP GetBulk (~650x) | AMP | |
| 10.0.2.40 | mysql-vuln | TCP :3306 | TCP starvation (max_connections=50) | L4 | |
| 10.0.2.50 | fw-stateless | HTTP :80 | ACK flood, XMAS flood (no conntrack) | L4 | |
| 10.0.3.20 | apache-protected | HTTP :80 | mod_reqtimeout + SYN cookies + iptables rate limit | Protected | |
| 10.0.3.21 | nginx-protected | HTTP :80 | Event-driven + client_header_timeout + limit_req | Protected |
+ postgres-vuln, fw-stateful, monitor, prometheus, grafana, judge, attacker (infrastructure)
Flags are time-windowed (5-minute validity). The judge must have confirmed degradation within the current window. Keep the attack running, then submit.
Flags are HMAC-SHA256 tokens tied to scenario ID + time window. The judge also verifies it recently confirmed degradation. A valid token without active proof = rejected.
Full technical writeup — vulnerability mechanics, real-world CVEs, server-side detection commands, and remediation config — available immediately after a correct submission.
3 hint levels per scenario. Level 1: directional nudge (-10pts). Level 2: vulnerability class revealed (-25pts). Level 3: near-explicit with commands (-50pts).
Amplification scenarios in DOSArena are recon and proof exercises — verify that equipment in the lab scope can serve as reflectors. Same methodology used in real-world network audits.
Level 1 gives direction without revealing technique. Level 2 names the vulnerability class. Level 3 gives near-explicit commands. Each level deducts points — think before asking.
Research-grade explanations covering: why the vulnerability exists at the kernel level, attack mechanics step-by-step, historical CVEs and incidents, detection commands, and remediation configs.
Every vulnerable target has a hardened equivalent. After exploiting apache-vuln, try the same attack on apache-protected. See exactly which config change stops it. Theory into practice.
# clone and start — builds all images on first run
git clone https://github.com/franckferman/DOSArena.git
cd DOSArena
make up
docker compose -f docker/docker-compose.yml up -d --build
make shell
http://localhost:8888
http://localhost:3000
http://localhost:9090
make down
Docker Compose or Terraform AWS — deploy in minutes
Deploy DOSArena