Slowloris is program which allows attacker to take down Web Server by making multiple request to it.

learn more… | top users | synonyms

0
votes
2answers
94 views

Is this slowloris attack or not?

IP is hidden in apache log for privacy, except last octet. /billing is our application start page. But it doesn't make sense that it sends POST requests, and get 500 response. Or maybe this is ...
1
vote
0answers
107 views

Slowloris on Apache: is mod_reqtimeout + mod_qos enough?

I detected few days ago that my server was under slowloris attack (I found a lot of "-" 408 0 "-" "-" values in my access.log). I changed my configuration like this: In mod_reqtimeout: ...
0
votes
0answers
64 views

Is Jetty immune to Slow HTTP Denial of Service attacks (e.g., slowloris)?

After a security scan, our webserver was found to be vulnerable to "slow HTTP denial of service" attacks. We are currently on an older version of Jetty (6.1.22). I'm not sure if the scan actually ...
6
votes
2answers
2k views

Why are NginX and Lighttpd not affected by Slowloris?

I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works. What I don't understand is why Lighttpd and NginX are not affected (according to the ...
1
vote
0answers
181 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
1
vote
1answer
288 views

How can I limit Googlebot's crawl rate?

I have a problem with one of my servers. Google opens lots of http connections to the apache server and basically performs a slowloris attack. This netstat call results in the following output ...
0
votes
0answers
150 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
1
vote
1answer
215 views

How do you make Apache vulnerable to Slowloris? [closed]

I'm trying to set up an apache server that's distinctly vulnerable to the slowloris denial of service so I can test the results, the only problem is that I can't seem to get slowloris to actually work ...
1
vote
1answer
297 views

Restrict number of parallel connections on Apache server

I'm on an Ubuntu server running Apache2. I would like to protect myself against (d)dos and syn flood attacks and therefore try to limit the number of parallel connections per client IP. I've heard ...