Virtual Private Server(VPS)

Short Definition

A VPS is your own virtual computer running in someone else's data center. You get root access and can install whatever you want, but you're sharing physical hardware with others. Cheaper than dedicated server, more control than shared hosting.

Full Definition

A Virtual Private Server is a virtualized server instance allocated to a single customer, providing dedicated resources within a shared physical machine.

Key characteristics:

• Dedicated RAM, CPU, storage
• Full root/admin access
• Can install any software
• Isolated from other VPS on same hardware
• Public IP address
• Lower cost than dedicated server

Common uses:

• Website hosting
• Application servers
• Development/testing
• VPN servers
• Game servers
• Email servers

Popular providers:

• DigitalOcean (Droplets)
• Linode
• Vultr
• AWS Lightsail
• Google Cloud Compute

Why It Matters

For developers:

• Full control over environment
• Scale resources as needed
• Learn server administration
• Host production applications

For security:

• Custom infrastructure for testing
• Out-of-band callbacks (SSRF, blind vulnerabilities)
• Command and control servers
• Proxy/VPN for anonymity
• Lab environments

Cost-effective: $5-20/month for basic VPS

How Attackers Use It (and How Researchers Use It Ethically)

Ethical security research:

1. Out-of-Band (OOB) server:

1# Set up VPS for blind SSRF testing
2# Install DNS logger
3git clone https://github.com/projectdiscovery/interactsh
4./interactsh-server -domain your-vps-domain.com
5
6# Now test for blind SSRF:
7POST /api/webhook
8{"url": "http://unique-id.your-vps-domain.com"}
9
10# VPS logs incoming requests

2. Custom callback server:

1# Flask app to log callbacks
2from flask import Flask, request
3
4app = Flask(__name__)
5
6@app.route('/', defaults={'path': ''})
7@app.route('/')
8def catch_all(path):
9    print(f"Request from {request.remote_addr}")
10    print(f"Path: {path}")
11    print(f"Headers: {request.headers}")
12    return "OK"

3. Test environment:

• Practice exploitation safely
• Build vulnerable labs
• Test security tools
• Learn penetration testing

What malicious actors do (don't do this):

• Host malware/C2 servers
• Proxy malicious traffic
• DDoS attack sources
• Phishing page hosting

Note: Ethical hackers use VPS for authorized testing only.

How to Detect or Prevent It (From Defense Perspective)

Detection:

• Track requests from VPS IP ranges
• Monitor known VPS provider ASNs
• Check IP reputation databases
• Identify unusual VPS-to-enterprise traffic

Prevention (as VPS provider):

• Abuse monitoring
• Terms of service enforcement
• Automated abuse detection
• Respond to abuse reports

Prevention (as security tester):

• Use VPS responsibly
• Stay within authorized scope
• Follow bug bounty rules
• Document legitimate use
• Respect rate limits

Common Misconceptions

• "VPS = dedicated server" - Shared hardware, dedicated resources
• "VPS is always fast" - Depends on provider and oversubscription
• "VPS is cloud" - Cloud is more sophisticated (auto-scaling, managed services)
• "VPS means unlimited resources" - Has defined limits
• "VPS is unhackable" - Requires proper security configuration

Real-World Example

Bug Bounty Hunter Setup

1# Typical VPS setup for security research
2$5/month DigitalOcean Droplet
3
4# Installed tools:
5- interactsh (blind SSRF detection)
6- DNS logger
7- HTTP callback server
8- Burp Collaborator alternative
9
10# Use cases:
111. Test for blind SSRF:
12   url=http://xyz.researcher-vps.com
13   
142. XXE out-of-band:
15   <!ENTITY xxe SYSTEM "http://researcher-vps.com/data">
16   
173. Log DNS requests:
18   ping abc.researcher-vps.com

Why personal VPS matters:

• Burp Collaborator URLs are blocked by many companies
• interactsh public instances are also blocked
• Custom domain looks more legitimate
• Full control over logs and data

Capital One Investigation

After breach, investigators used VPS to:

• Recreate attack infrastructure
• Test similar vulnerabilities
• Understand attack methodology
• Safely analyze exploit behavior

Related Terms

Cloud Infrastructure, Server, Dedicated Server, Out-of-Band