File http-slowloris

脚本使用类型: portrule
脚本所属分类: dos, intrusive
脚本下载地址: http://nmap.org/svn/scripts/http-slowloris.nse

User Summary

Tests a web server for vulnerability to the Slowloris DoS attack by launching a Slowloris attack.

Slowloris was described at Defcon 17 by RSnake (see http://ha.ckers.org/slowloris/).

This script opens and maintains numerous 'half-HTTP' connections until the server runs out of ressources, leading to a denial of service. When a successful DoS is detected, the script stops the attack and returns these pieces of information (which may be useful to tweak further filtering rules):

• Time taken until DoS
• Number of sockets used
• Number of queries sent

Please note that the number of concurrent connexions must be defined with the --max-parallelism option (default is 20, suggested is 400 or more) Also, be advised that in some cases this attack can bring the web server down for good, not only while the attack is running.

Also, due to OS limitations, the script is unlikely to work when run from Windows.

Script Arguments

http-slowloris.runforever

Specify that the script should continue the attack forever. Defaults to false.

http-slowloris.timelimit

Specify maximum run time for DoS attack (30 minutes default).

http-slowloris.send_interval

Time to wait before sending new http header datas in order to maintain the connection. Defaults to 100 seconds.

http.max-cache-size, http.max-pipeline, http.pipeline, http.useragent

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

Example Usage

执行格式

nmap --script http-slowloris --max-parallelism 400  <target>

Script Output

PORT     STATE SERVICE REASON  VERSION
80/tcp   open  http    syn-ack Apache httpd 2.2.20 ((Ubuntu))
| http-slowloris:
|   Vulnerable:
|   the DoS attack took +2m22s
|   with 501 concurrent connections
|_  and 441 sent queries

Requires

• coroutine
• math
• nmap
• os
• shortport
• stdnse
• http
• comm

Author: Aleksandar Nikolic, Ange Gutek

License: VER007 整理 http://www.ver007.com