hello, is there any possible ways to defend Apache servers from slowloris DDoS attack on Windows 10? I know it's mostly done with Linux but my instructor wants us to use Windows and we don't have any idea on that? thanks in advance.
Say you "queue" up a million login requests, basically you start the connection, then "slowloris" until all of your connections are queued, then send all the requests at once.
Additionally, what would happen if you queued millions of requests to a performance-heavy endpoint, then sent all the requests at once?
Hi All,
Looking for a bit of help here...
As part of my uni course I need to select an attack then develop a Snort rule to detect it and show it in action. I found a Python implementation of the Slowloris attack, which I ran and analyzed. I found a common theme of the attack is the partial GET headers always contained the text 'X-a:' followed by four random digits. I wrote the following rule utilizing regular expressions (I believed this would cut down on false positives):
alert tcp any any -> any 80 (msg:"Possible Slowloris Attack Detected";
flow:to_server,established; pcre:"/X-a|3a| \d{4}../"; sid:10000005;)
which detects the attack successfully with minimal false positives.
My question is how I could improve upon the rule, or even if there is a better rule altogether. I understand it's not the best method of detecting the attack, as the 'X-a' in the Python script could easily be changed to something altogether (I think).
Thanks in advance for any advice.
A friend decided it is funny to atack my website with slowloris. My vps got completly destroyed. I can't login to ssh. Website is down. VPS support told me it's very hard to detect those types of atacks.
How can I prevent this from happening again?-
Currently, I'm writing a security analysis report on one of the computer labs at my university and I'm just wondering, if the slowloris script (or any other layer 7 dos script) was planted onto one of the lab PCs and was then launched when internet access is available, targetted at the university web server, would it have any affect on the university network? Or would it be completely counter productive? In my head, running the script against the network from within the network would disrupt service and prevent any user from establishing a HTTP connection to anywhere outside of the university.
Layer 7 DoS attack;
- Apache, Goahead and dhttpd servers vulnerable.
- Continuously sends poisonous/incomplete HTTP requests to the server to fill the queue and deny access to any legitimate users.
- Completely bandwidth free.
Any thoughts or input?
References would be extremely helpful for learning purposes and building up knowledge of the layer 7 DoS attack.
Phil
Sudden Lee
