#SLOWLORIS ATTACK INSTALL#

Thanks to Quentin Derosin for the help on this project.In this document I want to describe first the high level description of this attack, second how it can be easily performed, finally which is the possible solution to avoid this problem. However, it is easy to protect yourself against these attacks by implementing a few rules: a limited number of sockets per user, firewall, reverse proxy, etc. The Slowloris attack is exciting if the webserver is vulnerable to this attack because it allows a single computer to easily DDoS a server. Use of proxies to allow more connections when there is a limited number of connections per user.Detection of the maximum number of server connections to be able to choose the level of DDoS you want (a little, a lot, medium).Automatic detection of server timeout for requests.Automatic detection of the server and optimization of the parameters.The program seemed to work, but no slowdowns observed. The second difficulty was to understand that the nodes' servers were not affected. It was impossible to access any website outside, impossible to use a DNS. The main challenge was hardware, trying the attack on a remote server. (env) ➜ slow attack git:(master) ✗ python src/main.py -a 127.0.0.1ġ9:30:54 - No Webserver detected, please verify your target address Difficulties When you try to launch another Slowloris on the same server when there is already a Slowloris running, it won't succeed because the number of open connections is already maxed out. 15.80608Īfter 10 minutes, the program is stopped so that you can see an average latency of 14.7 seconds. There is also a 15-second latency proof that denial of service works. We now try to keep them open as long as possible.Īfter 15 seconds, we try to create new connections to reach 1000 open connections.Īfter 5 minutes, you can see that we have 408 open sockets. We notice here that we managed to initialize only 279 sockets out of 1000 planned. It is therefore noticeable that the latency time is relatively low. In the second step, the initial latency is displayed: - 0.002142 server running with Apache, best configuration for this attack The program ran with the following command: python src/main.py -a 127.0.0.1 -s 1000Īt first, the console shows us that we are on an Apache server, which is perfect for our attack.

The results below were performed on an Apache server with the initial configuration. The request makes a get on the host entered by the user and retrieves the time between sending and answering the request. response = requests.get(self.url).elapsed.total_seconds() Then the Slowloris will calculate the latency by requesting a separate thread.

for _ in range(self.target_info.sockets_number - len(self.sockets_list)): It will then try to open connections again until he reaches the limit we have set. HTTP/1.1 400 Bad Request Date: Wed, 16:18:53 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html charset=iso-8859-1įor the initialization of the sockets three requests are sent: s.send('GET /? '.format(random.randint(1, 5000)).encode('utf-8')) To retrieve the type of server, we send a get request: nd('GET / HTTP/1.1 '.encode('ascii')) On the other hand, attacking a WebServer running with the NodeJS framework from version 8 is useless. For example, an apache 1.x/2.x server will allow an optimal attack. a: Host to perform an attack on, default localhostįirst of all, it is necessary to retrieve the type of server you want to attack.Then it is possible to choose some options: The commands to be executed to have an execution environment are the following: virtualenv env

#SLOWLORIS ATTACK INSTALL#

It is necessary to install some dependencies. If none of these solutions are available, it is always possible to place your web server behind an Nginx or lighthttpd. There are other methods to protect yourself, such as installing a: There are modules for Apache that reduce the chance of a Slowloris attack such as: The servers mostly affected by the Slowloris attack are:

Affected servers will see their maximum number of connections reached and may refuse new user connections. As soon as Slowloris has opened a connection, it will keep it open by sending incomplete requests that it will slowly complete as it goes along but will never finish them. It tries to keep as many connections open with the target web server as possible and tries to keep them open as long as possible. The Slowloris attack allows a user to DDOS a server using only one machine. The following article is based on the work from this Github: