Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability.

Have tried reducing the httpruntime executiontimeout value in the web.config for the site, but the site still fails the security scan.

Anyone got any recommendations to IIS settings / configuration to prevent slow post dos attacks?

Edit: I'm thinking the only way to possibly prevent this is to do it in the application, looking at the headers in the beginrequest sub in the global.asx and based on the kind of content, ending/closing the response...

The tool recommends testing the vulnerability with this : https://www.owasp.org/index.php/OWASP_HTTP_Post_Tool But i'm really just trying to identify if there's any iis configuration that can be done to fix it.

Slow post: " How HTTP POST DDOS attack works (HTTP/1.0) (cont'd)

  1. For e.g., Content-Length = 1000 (bytes) The HTTP message body is properly URL-encoded, but ..
  2. .....is sent at, again for e.g., 1 byte per 110 seconds.
  3. Multiply such connections by 20,000 and your IIS web server will be DDOS.
  4. Most web servers can accept up to 2GB worth of content in a single HTTP POST request.

ref: https://media.blackhat.com/bh-dc-11/Brennan/BlackHat_DC_2011_Brennan_Denial_Service-Slides.pdf

share|improve this question
1  
From the name, it sounds like a slow post is just a way of tying up your server's resources by sending large amounts of post data slowly. One question you might want to ask yourself is--do you have users that will actually be sending that much data slowly? Another is, what is the timeout limit that your security program is testing for? This is not exactly an OWASP vulnerability. –  Andrew M. Jul 8 '11 at 15:16
    
Altough the OWASP have a tool for testing slow posts...... ;) –  GordonB Jul 14 '11 at 14:30
add comment

3 Answers 3

up vote 2 down vote accepted
+50

IIS doesn't have any rate throttling natively (or I guess it's negative rate throttling in this case). You can check out the Dynamic IP Restrictions module (http://www.iis.net/download/DynamicIPRestrictions). I don't believe it will check this specifically, but it's worth a peek.

Checks for this may stand a better chance on your firewall IDS filtering. There may be support there for checking this type of attack.

share|improve this answer
    
DynamicIPRestrictions doesn't really help.... However the network guys like the sounds of putting in an IDS device. –  GordonB Jul 14 '11 at 14:21
    
Good deal. Sometimes that's a hard sell, so if you have them on board, you're on the right track. –  Scott Forsyth - MVP Jul 14 '11 at 21:53
add comment

Your security scan ought to tell you what it triggered on.

How low did you set the execution timeout? Something else to lower (it'd have to be pretty low to mitigate this attack..) would be the connection timeout.

But, the thing with these mitigations is that they don't prevent the attack outright, just make it less potent per the volume of attacking resources; the threshold setting for your security scan is likely a pretty arbitrary number, and getting under that number doesn't mean you're immune to the attack.

share|improve this answer
    
it was timing out at 140s. My aim is to reduce the timeout down to about 20s, which should pass the test. Of course, i'm just trying to mitigate the risk by lowering timouts. –  GordonB Jul 11 '11 at 10:56
    
Have you tried turning down the connection timeout (under advanced settings for the site)? –  Shane Madden Jul 11 '11 at 15:14
    
Yep, turned it down. No difference. –  GordonB Jul 14 '11 at 14:20
add comment

This might be OTT and might not even do what you want but might be worth the look http://www.snort.org/ http://www.sans.org/security-resources/idfaq/snort.php

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.