6

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability.

Have tried reducing the httpruntime executiontimeout value in the web.config for the site, but the site still fails the security scan.

Anyone got any recommendations to IIS settings / configuration to prevent slow post dos attacks?

Edit: I'm thinking the only way to possibly prevent this is to do it in the application, looking at the headers in the beginrequest sub in the global.asx and based on the kind of content, ending/closing the response...

The tool recommends testing the vulnerability with this : https://www.owasp.org/index.php/OWASP_HTTP_Post_Tool But i'm really just trying to identify if there's any iis configuration that can be done to fix it.

Slow post: " How HTTP POST DDOS attack works (HTTP/1.0) (cont'd)

  1. For e.g., Content-Length = 1000 (bytes) The HTTP message body is properly URL-encoded, but ..
  2. .....is sent at, again for e.g., 1 byte per 110 seconds.
  3. Multiply such connections by 20,000 and your IIS web server will be DDOS.
  4. Most web servers can accept up to 2GB worth of content in a single HTTP POST request.

ref: https://media.blackhat.com/bh-dc-11/Brennan/BlackHat_DC_2011_Brennan_Denial_Service-Slides.pdf

2
  • 1
    From the name, it sounds like a slow post is just a way of tying up your server's resources by sending large amounts of post data slowly. One question you might want to ask yourself is--do you have users that will actually be sending that much data slowly? Another is, what is the timeout limit that your security program is testing for? This is not exactly an OWASP vulnerability.
    – Andrew M.
    Jul 8, 2011 at 15:16
  • Altough the OWASP have a tool for testing slow posts...... ;)
    – GordonBy
    Jul 14, 2011 at 14:30

4 Answers 4

4
+50

IIS doesn't have any rate throttling natively (or I guess it's negative rate throttling in this case). You can check out the Dynamic IP Restrictions module (http://www.iis.net/download/DynamicIPRestrictions). I don't believe it will check this specifically, but it's worth a peek.

Checks for this may stand a better chance on your firewall IDS filtering. There may be support there for checking this type of attack.

2
  • DynamicIPRestrictions doesn't really help.... However the network guys like the sounds of putting in an IDS device.
    – GordonBy
    Jul 14, 2011 at 14:21
  • Good deal. Sometimes that's a hard sell, so if you have them on board, you're on the right track. Jul 14, 2011 at 21:53
1

Your security scan ought to tell you what it triggered on.

How low did you set the execution timeout? Something else to lower (it'd have to be pretty low to mitigate this attack..) would be the connection timeout.

But, the thing with these mitigations is that they don't prevent the attack outright, just make it less potent per the volume of attacking resources; the threshold setting for your security scan is likely a pretty arbitrary number, and getting under that number doesn't mean you're immune to the attack.

3
  • it was timing out at 140s. My aim is to reduce the timeout down to about 20s, which should pass the test. Of course, i'm just trying to mitigate the risk by lowering timouts.
    – GordonBy
    Jul 11, 2011 at 10:56
  • Have you tried turning down the connection timeout (under advanced settings for the site)? Jul 11, 2011 at 15:14
  • Yep, turned it down. No difference.
    – GordonBy
    Jul 14, 2011 at 14:20
1

In our tests, we found out that Qualys is flagging the URL because the server keeps the connection open for 500 seconds while waiting for request to be completed.

The parameter that we edited for the connection to stay open during the slow response is minBytesPerSecond. the default value is 250. We set it to 400

Prevent Slow HTTP POST vulnerability Denial of Service (DoS) attack

0

This might be OTT and might not even do what you want but might be worth the look http://www.snort.org/ http://www.sans.org/security-resources/idfaq/snort.php

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .