2

This question already has an answer here:

I am performing a test on some DoS attacks and how to detect them. I am currently testing the slowloris tool, but all the signature I have seen online, as very very few as they are,do not work even after modifying some parameters. Can someone point me to a site or an example of the snort detection rule for detecting slowloris attacks.

marked as duplicate by Community Feb 3 '18 at 17:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • And the only answer to the latter correctly mentions that "it goes outside of the normal bounds of what Snort is designed to detect". – ximaera supports Monica Feb 3 '18 at 15:59
  • @Ximaera when deciding what is a duplicate, don't you look at the time stamp? This question was asked in April 2017. While the one you referenced was asked in November 2017... So which one is a duplicate of the other ? – obiigbe91 Feb 3 '18 at 17:05
  • But that question got a proper answer. I thought it's a good idea to reference it. Is it against the community rules here? Please advise. – ximaera supports Monica Feb 3 '18 at 17:30
  • 1
    Yeah @ximaera you are right. The question can be marked as duplicate if there exits another question with a good enough answer. See How should duplicate questions be handled?. I have gone ahead and accepted it as a duplicate. – obiigbe91 Feb 3 '18 at 17:41
0

slowloris don't finish web request header.

pcre:!"/\x0D\x0A\x0D\x0A$/H"; will detect web request not ending with 0D0A0D0A

Or you can also use /D that Match unnormalized HTTP request or HTTP response header.

But i'm not sure this would work.:) In fact, i think it is better to monitor changes in session volume than pattern matching, if you want to detect like slowloris.

  • 1
    Are you sure this would work? /H matches the normalized HTTP header but since slowloris does send the pieces of the HTTP header slowly there will be no HTTP header to normalize and thus I would expect that this rule does not get executed at all. Apart from that I would expected the normalized header to contain \r\n\r\n because it is normalized. – Steffen Ullrich Apr 9 '17 at 6:05
  • yeah @SteffenUllrich these are some of the complicated things about detecting this attack. Anomaly based IDS's do actual detect this attack, but I wanted to see how effective an open source IDS like snort is to detecting slowloris and so far, non of the signatures I have seen works. I want to be sure I exhaust all expert opinion on this before I draw my conclusion that snort if ineffective on detecting slowloris – obiigbe91 Apr 9 '17 at 8:49
  • I edited my answer. – Mr.kang Apr 9 '17 at 9:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.