0

Can a Slow Post HTTP attack be done from a single client?

The following source cites this line: https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c

Ports are 16-bit numbers, therefore the maximum number of connections any given client can have to any given host port is 64K.

But since the max. number of connections a server can handle is usually much greater than the above limit (around ~300k but scalable), I assume that the Slow Post HTTP attack can only be done as a DDoS attack (using more than 1 client).

But I can also see descriptions about Slow Post HTTP attack as DoS attack. For eg. https://blog.qualys.com/securitylabs/2011/11/02/how-to-protect-against-slow-http-attacks states

Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests in pieces slowly, one at a time to a Web server.

Please let me know if I am missing something.

Improve this question
3
  • 1
    DoS doesn't have to mean exhaustion of the network bandwidth - remember it can also be exhaustion of sockets, connections, or in fact any resource
    – Rory Alsop ♦
    Jul 17, 2020 at 7:47
  • @RoryAlsop I didn't mention the term bandwidth anywhere, in fact it uses very minimal bandwidth to carry out this attack. The attack is concerned with exhaustion of connections here. But I just want to know whether this attack can be performed from a single system (as in DoS attack) or from multiple systems (as in DDoS attack) with reference to the facts given in the question above
    – Mehul
    Jul 17, 2020 at 8:07
  • 1
    Of course it can - as long as your single connection can request more connections to be open than the server can cope with.
    – Rory Alsop ♦
    Jul 17, 2020 at 8:17

2 Answers 2

Reset to default
1

Yes, a server can handle a lot of requests, but it is not handling just the attacker's requests. It is handling it's normal load, and these attacks are on top of that load.

It certainly is possible for a single attacker to exhaust remaining server resources, which means that this type of attack is correctly described as a non-DDoS attack. Yes, it might be enhanced by multiple nodes using this attack, but it's not a fundamental requirement.

Improve this answer
0

Yes it can, in fact basically that type of attack tries to consume the internal memory that is handling the buffering of the post operation. In general the backends have parameters for handle this type of situations.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.