We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Qualys offers tool to spot server DDoS weaknesses

Assesses servers for Slowloris and Slow POST vulnerability.

Security company Qualys is offering a tool admins can use to work out how vulnerable their servers might be to simple but often hard-to-detect a types of DDoS attack that exploit vulnerabilities in the design of HTTP.

The work of engineer Sergey Shekyan, QualysGuard Web Application Scanner (WAS) can be used to detect vulnerability to one of two possible slow HTTP attacks, 'Slowloris' and Slow POST detection; the first opens a connection but delays completion and can be exploited using a circulating tool, while the second involves manipulating the content length header.

Both can slow attacked servers down to a crawl or even a stop.

Despite being fairly simple to pull off, these techniques are believed to have been behind some of the attacks carried out in recent times by groups such as LulzSec, notably one on the CIA in June. Earlier in the year, slow HTTP was also used to attack Wikileaks.

An unknown number of servers could be configured in a way that might allow these attacks to succeed but quickly assessing vulnerability can be difficult without causing the server in question some difficulty. WAS allows this to be done without taking the server down.

"These types of attack are easy to execute because a single machine is able to establish thousands of connections to a server and generate thousands of unfinished HTTP requests in a very short period of time using minimal bandwidth," writes Shekyan.

One thing WAS does not do is to mitigate the attacks which will vary from server platform to platform. On Apache, the first line of defence is to set up IPtables to disallow large numbers of requests from one IP address but this is still only one of a number of possible avenues. Defending against these types of DDoS can still be difficult.

IDG UK Sites

5 reasons Facebook Messenger is terrible, and 5 reasons it's great

IDG UK Sites

Samsung: King of the Androids (or MWC, at least)

IDG UK Sites

Inside Microsoft's universal platform for designing apps that work on PCs, tablets, phones, Xbox...

IDG UK Sites

How to watch Apple's 9 March 'Spring Forward' Apple Watch event live stream, and what to expect: Ap?......