Slowloris – HTTP DoS Tool in PERL


This tool has been hitting the news, including some mentions in the SANS ISC Diary.

It’s not actually a new attack (it’s been around since 2005) but this is the first time a packaged tool has been released for the attack.

Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they’ll allow.

Slowloris must wait for all the sockets to become available before it’s successful at consuming them, so if it’s a high traffic website, it may take a while for the site to free up it’s sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they’ll still be able to see the site.

So it’s a bit of a race condition, but one that Slowloris will eventually always win – and sooner than later.

Slowloris lets the webserver return to normal almost instantly (usually within 5 seconds or so). That makes it ideal for certain attacks that may just require a brief down-time.

This affects a number of webservers that use threaded processes and ironically attempt to limit that to prevent memory exhaustion – fixing one problem created another. This includes but is not necessarily limited to the following:

  • Apache 1.x
  • Apache 2.x
  • dhttpd
  • GoAhead WebServer
  • Squid

There are a number of webservers that this doesn’t affect as well, in the authors testing:

  • IIS6.0
  • IIS7.0
  • lighttpd
  • nginx
  • Cherokee (verified by user community)

You can download Slowloris here:

slowloris.pl

Or read more here.

Posted in: Exploits/Vulnerabilities, Networking Hacking Tools, Web Hacking

, , , , ,


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc


5 Responses to Slowloris – HTTP DoS Tool in PERL

  1. Greg June 23, 2009 at 10:06 am #

    As i saw it appearing on Milw0rm, i knew this will be a headliner :)

  2. Motoma June 23, 2009 at 6:08 pm #

    There is a python version of this titled PyLoris which runs in Windows, Linux, and Mac OS X.

  3. David June 23, 2009 at 6:12 pm #

    Another great sharing from RSnake. Tool very well developed and I already tested with success on my home pen-testing. Top of the news!

  4. droope June 24, 2009 at 2:41 am #

    uh, that seems like a fun tool.

    I can smell all fellow script kiddies enjoying this.

  5. Jeff Price June 24, 2009 at 6:38 pm #

    I wrote this version a few years ago in bash

    #!/bin/bash
    while true; do
    printf “GET / HTTP/1.0\n”|nc $1 80 &
    done