1. QA Fest , Kyiv 2018
56K DoS

2. QA Fest , Kyiv 2018
Denys Zhevner
✖ Senior Troll QA;
✖ The prisoner of Azkaban
Enterprise;
✖ Open Source evangelist;
✖ Old good paranoid;

3. QA Fest , Kyiv 2018
DoS
}{@ckEr: я новый нюк нашел, ща всех
поубиваю!!!
}{@ckEr: дайте IP какого-нить лоха!!!
Tr011: 127.0.0.1
}{@ckEr: Пасиба! щас он подохнет!!!11
*}{@ckEr went offline.
© somewhere on the internet

4. QA Fest , Kyiv 2018
Agenda:
✘ DoS, DDoS;
✘ OSI;
✘ Level 7 DoS;
✘ Slow and Low;
✘ How it works?
✘ How to test?
✘ How to mitigate;

5. QA Fest , Kyiv 2018
DoS

6. QA Fest , Kyiv 2018
DDoS

7. QA Fest , Kyiv 2018
OSI

8. QA Fest , Kyiv 2018
Classic DDoS

9. QA Fest , Kyiv 2018
OSI

10. QA Fest , Kyiv 2018
Level 7 (HTTP) (D)DoS

11. QA Fest , Kyiv 2018
Slow and Low

12. QA Fest , Kyiv 2018
Slow and Low

13. QA Fest , Kyiv 2018
Affected web servers

14. QA Fest , Kyiv 2018
Types of attacks
Slow HTTP Post
(R-U-Dead-
Yet)
Slow Read Slow SSL
Slow Loris
(Slow headers)

15. QA Fest , Kyiv 2018
How does it work?
Open
connection
to the
server
Send partial
request
data/header
Never
complete
the request

16. QA Fest , Kyiv 2018
How does it work?

17. QA Fest , Kyiv 2018
“Features”
✘ Uses legitimate Level 4 (TCP) traffic;
✘ Mimics legitimate Level 7 (HTTP) traffic;
✘ Requires extremely low link bandwidth;
✘ Works with proxy, VPN, TOR, etc.
✘ Low local resources utilization;
✘ Cross tech, platforms, agentless;
✘ Scalable to other L7 protocols / apps;

18. QA Fest , Kyiv 2018
Tools to use
✘ Slow HTTP Test
✘ R.U.D.Y.
✘ OWASP HTTP Post Tool
✘ Slowloris
✘ Burp Suite

19. QA Fest , Kyiv 2018
Let’s try ;)
http://qafest.biz.tm

20. QA Fest , Kyiv 2018
Ways to mitigate
✘ Limit request body/headers size;
✘ Limit connections from one IP;
✘ Identify common legitimate requests speed;
✘ Increase maximum connections allowed;
✘ Use Reverse Proxy;
✘ Firewalls, load balancers, etc

21. QA Fest , Kyiv 2018
thanks!
Any questions?
You can find me at
denys.zhevner@globallogic.com
Skype: denis.zhevner
FaceBook: denis.v.zhevner