DDoS + bot testing

The only way to know how prepared you really are for a DDoS or bot attack, is to test.

Our DDoS testing service goes far beyond conventional load testing by assessing both expected and unexpected traffic patterns across the entire application delivery stack. While traditional load testing focuses on high-volume traffic, we specialize in evaluating resilience against sophisticated attack methods, which may not look like large-scale attacks, but can cause significant disruption.

The testing process

First we’ll spend some time with you gaining an understanding of your systems and requirements. We configure our in-house developed testing appliance with all the relevant details, and set up all of the appropriate attack types to run. We’ll book your test into our calendar, and share a meeting request and the test plan.

Our tests are conducted by video meeting over a 3 hour window. At least one security expert from Siege will facilitate the testing session; you may invite as many of your team as you wish.

During the test we’ll run a raft of different attack types (details below). Have a read to make sure you understand all of the different attack methods, and consider which systems you might need to monitor. We’re here to help, so if you have any questions about what to monitor and how, don’t hesitate to ask.

After the test we’ll send you a report with details of how the test ran, what was observed, and follow up with recommended improvements to make sure you’re as prepared as you can be for a real attack.

Comprehensive testing across all layers

Network layer

We analyse how your infrastructure handles unexpected traffic such as traffic on incorrect ports, unsupported protocols, out-of-state messages, and malformed data within protocols.

Application layer

We test how well applications withstand unexpected payloads, including technology-specific CVEs that could lead to application overload or service degradation.

Defense evasion

We assess DoS and bot detection mechanisms, including techniques like TLS fingerprinting, JavaScript challenges, and CAPTCHA, ensuring that defensive layers are both effective and properly configured.

Common use cases

Resilience testing
Resilience testing

Identify architectural and security flaws in applications such as SAP, Oracle, and other enterprise systems. Ensure proper patching and mitigate potential exploits.

defense effectiveness
Defense effectiveness

Validate whether security controls are correctly implemented and can withstand real-world attack scenarios.

Fire drills & incident response
Fire drills & incident response

Test organizational response to unexpected traffic events, assessing alarm triggers and incident handling processes.

Third-party application
Third-party application assessment

Evaluate how integrated services handle unexpected or adversarial traffic patterns.

Siege testing vs typical penetration testing

Our testing rationale aligns with The Siege Mentality, embracing the reality that attackers don’t respect scope. They look at everything — infrastructure, misconfigurations, forgotten services, leaked data, employee behavior. Defenders must do the same.

Penetration Testing is a critical part of the development lifecycle, but it belongs within the domain of the product team. It’s a point-in-time assessment of specific features or applications — more akin to testing one entrance to a castle.

However, in the context of real-world threats, scope becomes the enemy of effectiveness. Most penetration tests are constrained by time, budget, or predefined parameters. They cannot reflect the persistent, unscoped nature of actual attacks.

Frequently asked questions

Why is this necessary?

DDoS and unexpected traffic can lead to service outages, degraded performance, and security bypasses. Our testing identifies these risks before attackers do, helping organizations build more robust defenses. Additionally, it is crucial to assess not only the technical detection and mitigation measures but also the effectiveness of incident response processes and operational procedures in handling unexpected traffic scenarios.

How is this different from load testing?

Traditional load testing simulates high user traffic under normal conditions. Our service introduces unpredictable elements that go beyond just volume-based attacks, exposing vulnerabilities at multiple layers of your application stack.

Why can’t any penetration tester do this?

Penetration testing primarily focuses on security vulnerabilities related to unauthorized access and data breaches. Our testing is centered on availability, resilience, and defensive control validation, which requires a different approach, specialized techniques, and purpose-built tools.

Our tool supports high parallelization, allowing us to efficiently simulate large-scale and complex attack scenarios. It also incorporates bypass techniques to test the effectiveness of defenses against evasion strategies. Additionally, it includes infotainment and educational features to provide context, explain attack methodologies, and enhance reporting. This ensures that organizations gain leading-edge knowledge at a minimum cost, improving both technical resilience and operational preparedness.

Isn’t this covered by my DDoS protection provider?

Many DDoS mitigation providers focus on large-scale volumetric attacks. However, unexpected traffic often exploits overlooked protocol weaknesses, application-layer vulnerabilities, or evasion techniques that standard protections may not detect or mitigate effectively.

Do you require security clearance (for example: CREST, CHECK)?

No. We do not engage in hacking or unauthorized access; our testing methodology is focused purely on availability and traffic resilience within agreed-upon boundaries, making formal security clearances unnecessary.

Test categories

DDoS defense configuration testing

Simulate common DDoS attacks

Test volumetric attacks using tools like LOIC, HOIC, or commercial DDoS simulation tools (e.g., Radware or IXIA).

Evaluate protection against pulse wave attacks, carpet bombing, and GRE flood attacks targeting clean traffic tunnels from scrubbing providers.

Protocol-based testing

Validate defenses against SYN floods, UDP floods, and ICMP floods.

Test how your system handles malformed or oversized packets (e.g., Ping of Death, Teardrop attacks).

Application-layer testing

Conduct tests with low-bandwidth, high-impact attacks (e.g., HTTP Slowloris, slow POST/GET).

Validate protections against human-like automation by simulating JavaScript challenges, CAPTCHA bypasses, and behavioural analysis evasion.

Failover and scaling validation

Simulate high traffic to test auto-scaling, load balancing, and traffic rerouting mechanisms.

Evaluate your infrastructure’s ability to sustain partial or full failovers under heavy load.

Geo-blocking and rate limiting tests

Verify the effectiveness of geo-restrictions by simulating traffic from restricted regions.

Test rate-limiting configurations using high-frequency request patterns from multiple sources.

 

 

DDoS bypass testing

Bypass methodology simulations

JA3/JA4 Fingerprint Spoofing
Use tools to mimic legitimate fingerprints and test their effectiveness at evading detection.

GRE Tunnel Exploitation
Simulate attacks targeting clean traffic from scrubbing services, such as overwhelming the return path.

Protocol Spoofing
Test how the system handles irregular protocol sequencing to identify gaps in defenses.

Challenge-response validation

Test the robustness of CAPTCHA and JavaScript challenges by emulating automated solutions and verifying false-negative rates.

Simulate human-like behaviour to evaluate behavioural analytics.

Layer 7 automation

Use advanced tools (e.g., Selenium, Puppeteer) to simulate bypass attempts for application-layer defenses.

Credential testing

Credential stuffing resilience

Use tools like Burp Suite, Hydra, or SentryMBA to simulate credential stuffing attacks with breached credentials.

Evaluate rate-limiting mechanisms by testing login attempts with high velocity from different IPs.

Password policy validation

Test the system’s enforcement of password complexity and expiry policies.

Validate handling of reused or commonly used passwords against breach databases.

Multi-factor authentication (2FA)

Simulate attacks against 2FA mechanisms (e.g., phishing, token replay, and bypass scenarios).

Evaluate user experience for 2FA implementation and check for fallback vulnerabilities (e.g., SMS interception or email-based recovery).

Exposure analysis

Compare usernames and credentials against breach data from sources like Have I Been Pwned and dark web databases.

Validate mechanisms for alerting users about compromised credentials and enforcing mandatory resets.

User enumeration

Test for username discoverability through error messages, metadata, or misconfigured endpoints.

 

 

Application exploitability assessment

Third-party or custom software built on certain frameworks may be vulnerable to resource exhaustion from unexpected request payloads, potentially rendering the application inaccessible.

Approximately one-third of all reported Common Vulnerabilities and Exposures (CVEs) fall into this category, with thousands currently known.

Mitigation strategies include regular patching or virtual patching.

Our test suite evaluates application behaviour against technology-specific exploits, assessing:

  • Whether the software is properly patched
  • The real-world effectiveness of patches
  • The adequacy of deployed protection mechanisms

DDoS protection verification

Anti-DoS and bot protection vendors offer various detection and mitigation methods, including:

  • Protocol allowances and sequencing requirements
  • Transaction volume thresholds
  • JA3/JA4 fingerprinting to identify malicious clients
  • JavaScript challenges to differentiate between human and automated traffic
  • Behavioural analysis to detect anomalies in human behaviour patterns
  • CAPTCHA challenges to prevent automated attacks

Our test suite evaluates the effectiveness of these measures against common bypass techniques, such as:

  • Pulse Wave Attacks:
    Sudden, high-intensity bursts of traffic for less than the detection period.
  • DDoS Attacks:
    Both volumetric and application-layer attacks designed to exhaust resources or render services inaccessible.
  • GRE Flooding:
    Targeting the clean traffic tunnel established by a scrubbing provider, aiming to disrupt legitimate traffic post-mitigation.

The suite assesses protection levels, mitigation challenges, and susceptibility to common bypass techniques, ensuring robust defenses against evolving attack vectors.

Security control and process verification

Applications must be configured to handle overload conditions gracefully through load balancing, auto-scaling, or fallback mechanisms (e.g., busy tone).

Our test suite validates the application’s configuration and behaviour under load conditions.

To ensure controls are effective, "fire drills" should test configurations and response processes. Internal and external Governance, Risk, and Compliance (GRC) increasingly require proof of robust, regularly tested protections.

Our test suite triggers alerts to assess:

  • The effectiveness of visibility mechanisms
  • The adequacy of response procedures

Access control security assessment

Systems must be resilient against automated attacks and credential compromise through robust access controls and monitoring. Common vulnerabilities include exposed credentials in data breaches and susceptibility to automated attacks targeting login mechanisms. Mitigation strategies include multi-factor authentication, rate limiting, and credential monitoring services.

Our test suite evaluates authentication security by assessing:

  • The exposure of credentials across public breach databases and dark web sources
  • Resistance to automated attack techniques like credential stuffing and password spraying
  • Implementation effectiveness of multi-factor authentication mechanisms
  • Adequacy of rate limiting and account lockout controls
  • Adequacy of monitoring and alerting capabilities for suspicious login activity

DNS assessment

DNS resilience is critical for ensuring uninterrupted application access and mitigating potential exploits targeting domain infrastructure.

Our test suite evaluates DNS security and performance through:

  • Response capacity testing
    Assessing DNS server resilience under high query volumes, justifying the case for insourcing DNS management where necessary.
  • Random subdomain testing
    Measuring the ability to handle random subdomain queries effectively, a common DDoS vector
  • DNSSEC implementation
    Validating the presence and effectiveness of DNSSEC to protect against DNS spoofing and integrity attacks.
  • Subdomain takeover testing
    Identifying unused subdomains that may be vulnerable to takeovers, exposing domains to malicious actors.
  • Domain squatting protection
    Assessing the exposure to domain squatting risks, including typo-squatting and similar threats, and recommending mitigation strategies.

Contact us

Get prepared — contact us today.