This document discusses the Slowloris HTTP denial of service (DoS) attack. Slowloris works by opening many connections to a target web server and holding them open as long as possible to overload the server's resources. It differs from a traditional DDoS attack by gradually increasing open sessions with minimal bandwidth until the server runs out of resources and denies service to other clients. The document explains how Slowloris works at a technical level by sending incomplete acknowledgement signals to servers to keep connections open indefinitely.

1. Slowloris HTTP Dos
Gichan_Lee_Alex

2. Slowloris
• “Slowloris is a piece of
software written by Robert
"RSnake" Hansen which
allows a single machine to
take down another
machine's web server with
minimal bandwidth”(Wiki)
• Slowloris tries to keep many
connections to the target
web server open and hold
them open as long as
possible.

3. Features
• This is based on HTTP get Flooding
• Attacking PC is only one face-to-face
• It has a very normal session
• It does not leave the log until the attack ends.
• Target is located in the architecture itself of the
server, therefore it’s difficult to defense originally.

4. Are you dead yet?

5. RUDY(R-U-Dead-Yet?)
• RUDY is translated into
“아직 죽지 않았니?” in Korean. it
means that dying slowly.
Slowloris is a subset of RUDY that is
kind of DDoS.
• RUDY is different from general DDoS
attack. The biggest difference is a
attacking way.
• Slowloris has a method that gradually
increasing the session established,
and then gradually undermine those
target server resources instead of
sending a large traffic the server can’t
endure.
when sessions the server had become full,
the server will die

6. Principle
OPENED
OPENED
OPENED
OPENED
OPENED
OPENED
OPENED
Denial
of
Service
other
clients

7. Client Server
SYN
SYN-ACK
Connection established
Incomplete ACK
The ACK signal to server have to be ended with ‘0d0a0d0a’
BUT
Slowloris sends only first ‘0d0a-’. therefore the server will wait
the remainder ‘-0d0a’ with established connection

8. Environment
Target Server : 172.17.22.178
Slowloris.pl

9. DEMO