Slow HTTP denial of Service Attack

Corrective Suggestions

1. Interrupts use the URL does not support the HTTP method access to the session

2. Limit the HTTP header and packet length to a reasonable value

3. Set an absolute session time-out

4. If the server supports the backlog, you need to set a reasonable size

5. Set a minimum inbound data transfer rate

Penetration Status:

Security Scan + Manual test.

Vulnerability principle:

Scan Discovery Web

The server or application server exists slow HTTP denial of Service attack vulnerability.

Vulnerability Hazard:

When a malicious attacker initiates an HTTP request at a very low rate, the service side remains connected for a long time, which makes the server vulnerable to the use of all available connections, resulting in a denial of service

-----------------------------------------------------------------------

Try to resolve:

1.Just in Case:for a plain Tomcat the corresponding solution are to add:

org.apache.tomcat.util.http.parameters.max_count=10000

In Catalina.properties

2.

maxhttpheadersize= "8192" setting limits HTTP header and packet length

maxthreads= "minsparethreads=" maxsparethreads= "75"
Enablelookups= "false" redirectport= "8443" disableuploadtimeout= "true"/>

3 [Room suggestion]

The following settings are referenced in the Tomcat configuration file Server.xml (note the appropriate port, restart the service):

Changing the implementation of the connector in ${tomcat-home}/conf/server.xml, using the NIO (non-blocking IO) Implementation to replace the default bio (blocking IO) implementation, can increase the number of concurrent connections, referring to the following:
<connector port= "8080" protocol= "http/1.1"
connectiontimeout= "20000"
redirectport= "8443"/>
Switch
<connector port= "8080" protocol= "Org.apache.coyote.http11.Http11NioProtocol "
connectiontimeout= "8000"
redirectport= "8443"/>
Change the ConnectionTimeout configuration item value to about 8000 (that is, 8 seconds)

4 Stackflow Recommendations

Using APAHCE + Tomcat

Use Apache to block.

Slow HTTP denial of Service Attack