4

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this

GET / HTTP/1.1\r\nHost: David-PC\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)\r\nContent-Length: 42\r\n

Yes, this is how a Slow Loris header should look like, so this is ideal, but after a while I received more data on the same socket which was

X-a: b\r\n

And this would continuously be sent after time intervals on the same sockets that already made connections and sent the first header, and the program would continue making new connections after time intervals.

My question is, what is the use of the 2nd part of the data sent?

X-a: b\r\n

Is it significant?

4

This second part of data sent is actually part of a loop on order to artificially keep some activity on the line.

If your script was only opening the connection to the server, send the first header, then passively wait, the server would close the connection after some inactivity timeout.

Here, you maintain a low activity, actually simulating some kind of very slow client needing a very, very long time to complete his request. Since there is still activity, the server cannot reach any inactivity timeout, and since the client has not yet ended its request the server cannot send any response yet. So the server thread is stuck waiting for this "slow client" to complete its request. And if you have enough of such requests ongoing in parallel, hopefully you will lock each available threads on this server with your "slow clients" requests, thus causing a Denial Of Service.

As per complementary information, the actual data sent to the server to keep a low activity is not such important. The idea here is just to send a formally valid HTTP header (: \r\n), the prefix "X-" being added to non-standard or proprietary headers, so we are still appearing to send some legit request data.

  • But couldn't the Server interpret it as finishing the HTTP header? – user3818650 Apr 18 '15 at 8:53
  • 1
    No, because to end an HTTP request you need to send a empty line ('\r\n' with no leading data). Would the script send "X-a: b\r\n\r\n", it would mark the request end, however he just send "X-a: b\r\n", letting the server wait for the next header or a second carriage return which would mark the request end (which is not part of the intent of the nasty script ;) whose goal is just to keep the server waiting as long as possible). – WhiteWinterWolf Apr 18 '15 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.