A slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made after extremely long periods of time, from my understanding.

GET / HTTP/1.1\r\nHost: hostname\r\nUserAgent: user-agent\r\n"


GET / HTTP/1.1\r\nHost: hostname\r\nUserAgent: user-agent"

Here are two examples of incomplete get requests that could be used for slow loris attacks (correct me if I'm wrong).

My question is, for each connection, how are these meant to be sent. Is there meant to be a time interval? Is it meant to be sent in parts? Or could you just send them whole with/without a time interval and it would still work?

And lastly is the slow loris attack outdated?

1 Answer 1


Each connection should be send completely (so send a complete incomplete request), the incomplete GET request will make the server think that you are on a poor connection and keeps waiting for the rest of the request.

Each connection does require its own port, for this reason slowloris doesn't work well on windows, which limits it to ~130 ports. Sending the requests with an interval will still have the same result, but keep in mind that you need to fill up all the incoming connections of the server before the first one starts to time-out.

It's not out dated, they even updated the script to also support ipv6, you can simply test this by setting up an apache2 server and run slowloris.pl. If you setup mod_status you can watch the connections filling up real time.

  • Just one thing, you said "...for this reason slowloris doesn't work well on windows...". Could you explain more on this, because I have tested it on windows, and managed to take a friends server down, but could not do it on many other apache servers.
    – Shane
    Commented Apr 10, 2015 at 8:31
  • There are many things that could cause this, a server could handle more connections than you are sending, they could have set a max on the waiting connections, set the timeout to a lower time or set a max of connections per ip. This attack is pretty easy to prevent if you configure apache a bit ;)
    – BadSkillz
    Commented Apr 10, 2015 at 9:23
  • I see, so does this mean slow loris doesn't work on windows OS because it does not allow one connection only per port?
    – Shane
    Commented Apr 10, 2015 at 9:26
  • From their website: I have not had any luck getting Slowloris to successfuly deny service from within Windows, because Slowloris requires more than a few hundred sockets to work (sometimes a thousand or more), and Windows limits sockets to around 130, from what I've seen. I highly suggest you use a *NIX operating system to execute Slowloris from for the best results, and not from within a virtual machine, as that could have unexpected results based on the parent operating system.
    – BadSkillz
    Commented Apr 10, 2015 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .