Collected research

Cashing Out the Great Cannon? On Browser-Based DDoS Attacks and Economics

Giancarlo Pellegrino, Christian Rossow, Fabrice J. Ryba, Thomas C. Schmidt and Matthias Wählisch · usenix.org

Ordinary visitors' browsers can be conscripted into a DDoS botnet by JavaScript delivered through malicious ads, typosquatted domains or an in-path injector like the Great Cannon, with three JavaScript techniques each driving thousands of HTTP requests per second per client. Costing the approach out shows it is about as expensive as a conventional botnet while giving the attacker less control.

Record

Researcher

Giancarlo Pellegrino, Christian Rossow, Fabrice J. Ryba, Thomas C. Schmidt and Matthias Wählisch

Published by

usenix.org

Topic

Browser

In the archive

• Collected in the 2015 research round

Tags

• dos
• typosquatting
• javascript
• http
• measurement-study
• mitigation
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Giancarlo Pellegrino, Christian Rossow, Fabrice J. Ryba, Thomas C. Schmidt and Matthias Wählisch, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.