In each HTTP header, the end of headerР’В is marked by CRLF(Carriage Return and Line Feed) denoted by ( ).The HTTP header use two CRLF to show end of the header which denotes the complete request but in case of Slowloris, it doesnРІР‚в„ўt add another last blank line which is denoted by ( )Р’В to show the end of header and hence server perceive it as incomplete header and set the timeout for the request. Server -РІР‚вЂњ>again gets bond with the clientРІР‚в„ўs incomplete request.Р”В«ut the question is how server knows the request header is incomplete? You would know it if you have knowledge about HTTP headers and connection.Client -РІР‚вЂњ>Also waits for the timeout to complete and then again send fake incomplete header.Server-РІР‚вЂњ>wait for the complete request till 300 seconds.Client -РІР‚вЂњSends spurious and incomplete request to the server->Server.This is the nasty thing to do for a web server. The Apache web server have the timeout of 300 seconds which we can change which means this tool can tied up the connection for about 300 seconds after which it again sends the spurious header and set the connection timeout back again to 300 seconds. The web server waits for a certain amount of time for a particular request to complete before it can open a new connection.

The architecture that IРІР‚в„ўm talking about above is timeout. It takes down the server slowly but have huge effect on theР’В server. Apache server is thread based means once we use Slowloris on Apache,the server would get wait for the client request for completing connection but the client would keep delaying that and hence server process threads would stay busy with the incomplete headers by the attacker and the legit users will not be able to use the resources on the web server.Р”В«ut why Apache?Not just Apache is getting hurt by the attack but there are plenty more web server which have a specific architecture based on which they are being attacked by Slowloris. This tool is specially crafted for certain vulnerability with servers which use process thread. Slowloris tries to keep the multiple connectionР’В open for a long period of time with the server. The server have to hold the connection and waits for the complete header from the client but client never sends that instead the client send spurious header and this setР’В timeout counters with each incomplete request. It holds the connection open while sending incomplete HTTP request. Slowloris sends partial HTTP request,and none of them are completed. It require minimal bandwidth and works on only web-servers.

This tool can work as a single soldier to take down the web server.

This is an HTTP dos attack tool not a TCP dos tool but it does make a legit TCP connection with the victim server. It is a Dos attack tool for web serversР’В developed by Robert РІР‚СљRSnakeРІР‚Сњ Hansen and was announced on the blog ha.Р’В in 2009. One of those tools that we are going to discuss right now is Slowloris. But a nice tool is the one which can go undetected for longer and can give really appreciative results. Like if we talk about Pyloris(http Based), LOIC(TCP,UDP,Http), R-U-DEAD-YET( targets the web server resources) and many others. There are many tools out there for the Dos purpose, which also varies in the type of platform they effect. In this article, we are looking at how Dos attack works.

Slowloris attack mitigation