I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this
GET / HTTP/1.1\r\nHost: David-PC\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)\r\nContent-Length: 42\r\n
Yes, this is how a Slow Loris header should look like, so this is ideal, but after a while I received more data on the same socket which was
And this would continuously be sent after time intervals on the same sockets that already made connections and sent the first header, and the program would continue making new connections after time intervals.
My question is, what is the use of the 2nd part of the data sent?
Is it significant?