+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Video - Take out an Apache Webserver with one HTTP POST Tool (/showthread.php?tid=2329728)
Video - Take out an Apache Webserver with one HTTP POST Tool - Mauri - Mar 23, 2012
This Tutorials shows, how you can easily take out an Apache Webserver with one HTTP POST Tool using a std. slow DSL Connection.
This is NO Slowloris Attack!
Limitations of HTTP GET DDOS attack:
- Does not work on IIS web servers or web
servers with timeout limits for HTTP headers.
- Easily defensible using popular load balancers,
such as F5 and Cisco, reverse proxies and
certain Apache modules, such as mod_antiloris.
- Anti-DDOS systems may use "delayed
binding"/"TCP Splicing" to defend against HTTP
GET attacks.
Why HTTP POST DDOS attack works
- This attack can evade Layer 4 detection
techniques as there is no malformed TCP, just
like Slowloris.
- Unlike Slowloris, there is no delay in sending
HTTP Header, hence nullifying IIS built-in
defense, making IIS vulnerable too.
- Size, character sets and time intervals can be
randomised to foil any recognition of Layer 7
traffic patterns by DDOS protection systems.
- Difficult to differentiate from legit connections
which are slow
http://goo.gl/U6ZGw
* - turkunit - Mar 23, 2012
doesn't work only appears offline for your self.But not for other people.
* - Mauri - Mar 23, 2012
muhahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha omg..this was one of the stupidest responses EVER.