Tests a web server for vulnerability to the Slowloris DoS attack by launching a Slowloris attack.
Slowloris was described at Defcon 17 by RSnake (see http://ha.ckers.org/slowloris/).
This script opens and maintains numerous 'half-HTTP' connections until the server runs out of ressources, leading to a denial of service. When a successful DoS is detected, the script stops the attack and returns these pieces of information (which may be useful to tweak further filtering rules):
- Time taken until DoS
- Number of sockets used
- Number of queries sent
Please note that the number of concurrent connexions must be defined
--max-parallelism option (default is 20, suggested
is 400 or more) Also, be advised that in some cases this attack can
bring the web server down for good, not only while the attack is
Also, due to OS limitations, the script is unlikely to work when run from Windows.
Specify that the script should continue the attack forever. Defaults to false.
Specify maximum run time for DoS attack (30 minutes default).
Time to wait before sending new http header datas in order to maintain the connection. Defaults to 100 seconds.
http.max-cache-size, http.max-pipeline, http.pipeline, http.useragentSee the documentation for the http library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusernameSee the documentation for the smbauth library.
nmap --script http-slowloris --max-parallelism 400 <target>
PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack Apache httpd 2.2.20 ((Ubuntu)) | http-slowloris: | Vulnerable: | the DoS attack took +2m22s | with 501 concurrent connections |_ and 441 sent queries
Author: Aleksandar Nikolic, Ange Gutek
License: Same as Nmap--See http://nmap.org/book/man-legal.html