Tagged Questions
-2
votes
1answer
52 views
Apache: What is the best anti Denial of Service module and caching combination for a penny auction site? [closed]
The site is a simple penny auction site.
The site runs on:
MySQL
PHP
At any given time:
an auction can have 100 - 2000 concurrent users.
each user has one single "long poll" running in the ...
-2
votes
4answers
287 views
Getting attacked, what do I do? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I'm getting millions of these requests in my Apache access log. How do I stop them?
173.59.227.11 - - [30/May/2012:18:23:45 -0400] ...
1
vote
1answer
332 views
DoS - Apache threads hanging when not receiving TCP ACKs after sending HTTP response
In summary, I had a case where all Apache threads were hung because all of them were waiting for a TCP ACK from clients after having sent the HTTP page, and because of that, the Apache threads were ...
-4
votes
1answer
193 views
Wich module to defend my apache server?
Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack?
Server version: Apache/2.2.17 (Win32)
...
2
votes
2answers
818 views
Apache SSL Renogotiation (thc-ssl-dos)
Looking at thc-ssl-dos, it only affects SSL enabled web sites with renegotiations enabled.
I have been checking a few servers and have the following questions;
First; renegotiations are disabled by ...
1
vote
1answer
268 views
Apache's built-in anti-dos mechanism by returning code 403?
In the process of learning more about how to survive simple DoS attack for my Apache server, I found some script to initiate attack on my own server and I notice that Apache returns error code 403 ...
1
vote
1answer
113 views
Is it normal to collapse VPS CPU with this script?
This is the script, it comes with mod_evasive:
#!/usr/bin/perl
#test.pl: small script to test mod_dosevasive's effectiveness
use IO::Socket;
use strict;
for(0..100) {
my($response);
...
2
votes
2answers
413 views
Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log
I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here ...
1
vote
3answers
168 views
Apache relaying to prevent DoS
I've been wondering, is there a technology that relays (slows down) responses to a given IP according to the rate It makes requests?
E.g I have an apache server with a "heavy" API service that I want ...
1
vote
1answer
71 views
What is idea of web server attack on thinker/js/think.js?
My web server is getting a lot of GET request on thinker/js/think.js and thinker/showSimilarInfo.do.
These requests obviously constitute a server attacks.
What is point of these attacks?
Also, ...
5
votes
1answer
759 views
Why are NginX and Lighttpd not affected by Slowloris?
I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works.
What I don't understand is why Lighttpd and NginX are not affected (according to the ...
1
vote
3answers
400 views
Fail2ban advice on banning IP's and HTTP
I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then ...
1
vote
1answer
871 views
Logging Timeout'd Request in Apache 2.X
I am migrating some applications from Apache 1.3 to 2.2.
We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 ...
1
vote
3answers
410 views
Apache mod status is showing ..reading
Recently my apache got DoS attack, it happened attacker flood SYN request to our apache, i know because at that time i have wireshark enabled.
After the attack finished, i restart my apache and its ...
1
vote
2answers
155 views
How are suspected DoS attacks handled by webservers?
I rent a server somewhere out in Canada or so that I'm using to host a website of mine. That website has close to 400,000 pages that I wanted to index today. For that, I wrote a crawler a while back ...
1
vote
1answer
235 views
Repetitive / incessant hits to pages, blank referrer, non-malicious
I asked this question last week, and followed the debugging advice and now have additional information.
I have an odd problem-- on a high traffic website (millions of visitors a month), every day we ...
2
votes
3answers
380 views
How to stop repetitive hits from same host to same URL?
I have an odd problem-- on a high traffic website (millions of visitors a month), every day we get about 20 or so situations where one host begins incessantly requesting the same page, over and over-- ...
1
vote
3answers
149 views
What is the best way to prevent somone abusing access to your site using scripts?
What is the best way to prevent someone abusing access to your site using scripts?
25
votes
6answers
13k views
How to best defend against a “slowloris” DOS attack against an Apache web server?
Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against ...
