1

Our firewall detected and blocked a Slow HTTP DoS the other day. There were only a few attempts in the log. It wasn't a full on attack (there would be more traffic). My question is...if I'm an attacker and I launch this type of attack, how would I know if it is potentially successful?

Is any traffic returned from the target during a Slow HTTP Dos?

Thanks!

Improve this question
5
  • What research have you done? Are you aware of code.google.com/p/slowhttptest
    – schroeder ♦
    Jan 16, 2015 at 20:27
  • I'm all for research and your point is well taken. I do a lot of research but also have time constraints. Since it was a yes/no scenario, I figured I would just ask.
    – Matt
    Jan 16, 2015 at 20:56
  • Also thanks for the link. I know there are several vuln. scanners with this built in but was not aware of this code.
    – Matt
    Jan 16, 2015 at 20:57
  • could be slowloris as well, then you wouldnt see much in the logs of your webserver
    – that guy from over there
    Jan 16, 2015 at 22:15
  • Didn't see you comment until I posted mine, lol. Good stuff. At least this confirms the train of thought.
    – Matt
    Jan 16, 2015 at 23:12

1 Answer 1

Reset to default
1

The ultimate success metric of a DoS attack is the loss of service. What is different about this type of DoS attack is that the control is in the attacker's hands: you limit how fast you read the server's response. So, yes, you get instant feedback that your attack is succeeding.

The answer to the question:

Is traffic returned?

is, of course, "Yes." Returning traffic is required.

Google's full write up on the attack is here

Improve this answer
1
  • I'll share one of the sites I am using to learn about this. blogs.akamai.com/2013/09/slow-dos-on-the-rise.html I am understanding that there are 3 types: Slow HTTP Headers (Slowloris), Slow HTTP Post (RUDY), and Slow Read (what you linked to). So, I would focus my question on the first type, Slow HTTP Headers (Slowloris). I'm wondering if the web server responds with anything (Hey, I'm still waiting), or does it just wait for the completed response which never comes?
    – Matt
    Jan 16, 2015 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.