We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
79,814 News Articles

Qualys offers tool to spot server DDoS weaknesses

Assesses servers for Slowloris and Slow POST vulnerability.

Security company Qualys is offering a tool admins can use to work out how vulnerable their servers might be to simple but often hard-to-detect a types of DDoS attack that exploit vulnerabilities in the design of HTTP.

The work of engineer Sergey Shekyan, QualysGuard Web Application Scanner (WAS) can be used to detect vulnerability to one of two possible slow HTTP attacks, 'Slowloris' and Slow POST detection; the first opens a connection but delays completion and can be exploited using a circulating tool, while the second involves manipulating the content length header.

Both can slow attacked servers down to a crawl or even a stop.

Despite being fairly simple to pull off, these techniques are believed to have been behind some of the attacks carried out in recent times by groups such as LulzSec, notably one on the CIA in June. Earlier in the year, slow HTTP was also used to attack Wikileaks.

An unknown number of servers could be configured in a way that might allow these attacks to succeed but quickly assessing vulnerability can be difficult without causing the server in question some difficulty. WAS allows this to be done without taking the server down.

"These types of attack are easy to execute because a single machine is able to establish thousands of connections to a server and generate thousands of unfinished HTTP requests in a very short period of time using minimal bandwidth," writes Shekyan.

One thing WAS does not do is to mitigate the attacks which will vary from server platform to platform. On Apache, the first line of defence is to set up IPtables to disallow large numbers of requests from one IP address but this is still only one of a number of possible avenues. Defending against these types of DDoS can still be difficult.


IDG UK Sites

The 30 best TV shows on Netflix UK: Our pick of the best programmes you can watch right now

IDG UK Sites

Nostalgia time: Top 10 best selling mobile phones in history

IDG UK Sites

VFX Emmy: Game of Thrones work garners gong for Rodeo FX

IDG UK Sites

Apple 13-inch MacBook Pro with Retina review (2.6GHz, 128GB, mid-2014)