8
votes
1answer
137 views

How to force “expensive calculation” when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. ...
0
votes
2answers
320 views

How to send GET/POST requests without header and agent information

I want to test our DOS prevention system against http requests that are not have header and agent information. Is there any tool I can do that. I tried siege with this command siege -c 3 -b -H ...
4
votes
2answers
207 views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
5
votes
3answers
3k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
9
votes
5answers
1k views

Apache/Linux server, DoS attack from own IP

I have an unusual problem I've been trying to diagnose for a while: It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
1
vote
2answers
485 views

Secure against HTTP FLOOD ATTACK

What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
2
votes
3answers
899 views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
4
votes
3answers
9k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
9
votes
3answers
4k views

Can I trust the source IP of an HTTP request?

As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
3
votes
1answer
262 views

Could somebody explain connect loop DoS?

I'm trying to understand this vulnerability. How can I reproduce this?