File http-slowloris
Script types:
portrule
Categories:
dos, intrusive
Download: http://nmap.org/svn/scripts/http-slowloris.nse
User Summary
Tests a web server for vulnerability to the Slowloris DoS attack by launching a Slowloris attack.
Slowloris was described at Defcon 17 by RSnake (see http://ha.ckers.org/slowloris/).
This script opens and maintains numerous 'half-HTTP' connections until the server runs out of ressources, leading to a denial of service. When a successful DoS is detected, the script stops the attack and returns these pieces of information (which may be useful to tweak further filtering rules):
- Time taken until DoS
- Number of sockets used
- Number of queries sent
Please note that the number of concurrent connexions must be defined
with the --max-parallelism option (default is 20, suggested
is 400 or more) Also, be advised that in some cases this attack can
bring the web server down for good, not only while the attack is
running.
Also, due to OS limitations, the script is unlikely to work when run from Windows.
Script Arguments
http-slowloris.runforever
Specify that the script should continue the attack forever. Defaults to false.
http-slowloris.timelimit
Specify maximum run time for DoS attack (30 minutes default).
http-slowloris.send_interval
Time to wait before sending new http header datas in order to maintain the connection. Defaults to 100 seconds.
http.max-cache-size, http.max-pipeline, http.pipeline, http.useragent
See the documentation for the http library.smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername
See the documentation for the smbauth library.Example Usage
nmap --script http-slowloris --max-parallelism 400 <target>
Script Output
PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack Apache httpd 2.2.20 ((Ubuntu)) | http-slowloris: | Vulnerable: | the DoS attack took +2m22s | with 501 concurrent connections |_ and 441 sent queries
Requires
Author: Aleksandar Nikolic, Ange Gutek
License: Same as Nmap--See http://nmap.org/book/man-legal.html