Slow Loris - Revision history

>CrackRabbit: Created page with "Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org), allo..."

2013-05-26T23:25:47Z

Created page with "Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org), allo..."

← Older revision		Revision as of 23:25, 26 May 2013
Line 1:		Line 1:
	Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org), allowing you to perform a de facto "SYN flood over HTTP."[~~http://www.anonym.to/?~~http://ha.ckers.org/slowloris/]		Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org), allowing you to perform a de facto "SYN flood over HTTP."[http://ha.ckers.org/slowloris/]

	==Concept==		==Concept==
	The ha.ckers.org article that revealed Slowloris explains its function as follows:[~~http://www.anonym.to/?~~http://ha.ckers.org/slowloris/]		The ha.ckers.org article that revealed Slowloris explains its function as follows:[http://ha.ckers.org/slowloris/]
	<blockquote>''Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they'll allow. Slowloris must wait for all the sockets to become available before it's successful at consuming them, so if it's a high traffic website, it may take a while for the site to free up it's sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they'll still be able to see the site. So it's a bit of a race condition, but one that Slowloris will eventually always win - and sooner than later.''</blockquote>		<blockquote>''Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they'll allow. Slowloris must wait for all the sockets to become available before it's successful at consuming them, so if it's a high traffic website, it may take a while for the site to free up it's sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they'll still be able to see the site. So it's a bit of a race condition, but one that Slowloris will eventually always win - and sooner than later.''</blockquote>

Line 12:		Line 12:

	Slowloris.pl can be obtained at the following addresses:		Slowloris.pl can be obtained at the following addresses:
	*[~~http://www.anonym.to/?~~http://ha.ckers.org/slowloris/slowloris.pl The original source from ha.ckers.org.]		*[http://ha.ckers.org/slowloris/slowloris.pl The original source from ha.ckers.org.]
	*[ftp://rlance.ru/Upload/a/slowloris.bin A Linux binary created with the PAR packer.]		*[ftp://rlance.ru/Upload/a/slowloris.bin A Linux binary created with the PAR packer.]

Line 29:		Line 29:

	To acquire QSlowLoris, visit the proceeding download pages:		To acquire QSlowLoris, visit the proceeding download pages:
	*[~~http://www.anonym.to/?~~http://www.megaupload.com/?d=08RJVYTE Linux version.]		*[http://www.megaupload.com/?d=08RJVYTE Linux version.]
	*[~~http://www.anonym.to/?~~http://www.megaupload.com/?d=3DV6R4ZL Windows version.]		*[http://www.megaupload.com/?d=3DV6R4ZL Windows version.]

	===PyLoris===		===PyLoris===
Line 40:		Line 40:

	PyLoris can be obtained via the following resources:		PyLoris can be obtained via the following resources:
	*[~~http://www.anonym.to/?~~http://www.sourceforge.net/projects/pyloris/ The SourceForge PyLoris project.]		*[http://www.sourceforge.net/projects/pyloris/ The SourceForge PyLoris project.]

	TACTICAL PITFALLS:		TACTICAL PITFALLS:
Line 48:		Line 48:
	==Further Reading==		==Further Reading==
	===Documentation===		===Documentation===
	*[~~http://www.anonym.to/?~~http://ha.ckers.org/slowloris/ The full Slowloris release document.]		*[http://ha.ckers.org/slowloris/ The full Slowloris release document.]
	*[~~http://www.anonym.to/?~~http://www.motomastyle.com/pyloris/ The PyLoris home page.]		*[http://www.motomastyle.com/pyloris/ The PyLoris home page.]

	{{tools}}[[Category:Tools]]		{{tools}}[[Category:Tools]]

>Pseudonymous: Wording.

2010-08-01T19:33:26Z

Wording.

← Older revision		Revision as of 19:33, 1 August 2010
Line 1:		Line 1:
	Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org) ~~that allows~~ you to perform a de facto "SYN flood over HTTP."[http://www.anonym.to/?http://ha.ckers.org/slowloris/]		Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org), allowing you to perform a de facto "SYN flood over HTTP."[http://www.anonym.to/?http://ha.ckers.org/slowloris/]

	==Concept==		==Concept==

>Pseudonymous: Aesthetic fix. Ignore.

2010-07-05T08:32:50Z

Aesthetic fix. Ignore.

← Older revision		Revision as of 08:32, 5 July 2010
Line 51:		Line 51:
	*[http://www.anonym.to/?http://www.motomastyle.com/pyloris/ The PyLoris home page.]		*[http://www.anonym.to/?http://www.motomastyle.com/pyloris/ The PyLoris home page.]

	[[Category:Tools]]~~{{tools}}~~		{{tools}}[[Category:Tools]]

>Pseudonymous: Complete Rewrite. Please edit my Userpage if there are any problems.

2010-07-05T08:24:00Z

Complete Rewrite. Please edit my Userpage if there are any problems.

@@ Line 1: / Line 1: @@
-[[File:QSlowLoris.png|right|500px]]
+Slowloris is a utility (originally written in perl) that can be used to exploit a flaw in many webservers (the most vulnerable are listed in the article on ha.ckers.org) that allows you to perform a de facto "SYN flood over HTTP."[http://www.anonym.to/?http://ha.ckers.org/slowloris/]
-__TOC__
+==Concept==
-Summary:
+==Utility Downloads==
-*http://anonym.to/?http://ha.ckers.org/slowloris/
+Slowloris.pl can be obtained at the following addresses:
-*http://anonym.to/?http://ha.ckers.org/blog/20090617/slowloris-http-dos/
+*[http://www.anonym.to/?http://ha.ckers.org/slowloris/slowloris.pl The original source from ha.ckers.org.]
-==QSlowLoris==
+TACTICAL PITFALLS:
-This is C++ with heavy use of Qt libs. I could make a CLI version, but I don't know how the fuck you use sockets in WINAPI, so you still would need to supply QtCore4.dll(2,6MB) and QtNetwork4.dll(1,33MB) with the exe
+===PyLoris===
-*Wait, I just reailzed that it can be compressed with upx:
+PyLoris is a Python implementation of the Slowloris concept.  It allows an insurgent to specify the bandwidth for the connection, as well as how large each request is.
-*QSlowloris.exe - 20KB
+====USAGE====
-*QtCore.dll - 903KB
+Common usage:
-*QtNetwork.dll - 447KB
+<pre>python pyloris-1.7.py -l -r POST -s 500000 -g "/fa/pages/?cid=407" www.gerdab.ir \
-===Linux build===
+PyLoris can be obtained via the following resources:
-*http://anonym.to/?http://www.megaupload.com/?d=08RJVYTE
+TACTICAL PITFALLS:
+*Usage on Windows is not guaranteed to work, as some versions throttle the use of sockets.
+**To avoid and work around this pitfall, either dual-boot a Linux installation or use a virtual operating system (''exempli gratia'': VirtualBox or VMWare).
 [[Category:Tools]]{{tools}}

>AnonUser: Reverted edits by F00 (Talk) to last revision by Xyz

2010-06-05T01:10:38Z

Reverted edits by F00 (Talk) to last revision by Xyz

← Older revision		Revision as of 01:10, 5 June 2010
Line 24:		Line 24:
	===Windows build===		===Windows build===

	*http://anonym.to/?http://www.~~mediafire~~.com/?~~y2hkri5b1ih~~		*http://anonym.to/?http://www.megaupload.com/?d=3DV6R4ZL

	==Original Version==		==Original Version==

>F00 at 16:32, 4 June 2010

2010-06-04T16:32:09Z

← Older revision		Revision as of 16:32, 4 June 2010
Line 24:		Line 24:
	===Windows build===		===Windows build===

	*http://anonym.to/?http://www.~~megaupload~~.com/?~~d=3DV6R4ZL~~		*http://anonym.to/?http://www.mediafire.com/?y2hkri5b1ih

	==Original Version==		==Original Version==

>Xyz at 21:15, 25 April 2010

2010-04-25T21:15:09Z

← Older revision		Revision as of 21:15, 25 April 2010
Line 37:		Line 37:
	==pyLoris==		==pyLoris==

	PyLoris is a platform independent python version of Slowloris (Limitations for windows (130 sockets) still apply). It runs a little differently than Slowloris, in that it throttles the entire request, allowing users to specify the bandwidth for the connection as well as how large the request is.		PyLoris is a platform independent python version of Slowloris (Limitations for windows (130 sockets if you are on xp sp2 >) still apply). It runs a little differently than Slowloris, in that it throttles the entire request, allowing users to specify the bandwidth for the connection as well as how large the request is.

	*http://anonym.to/?http://motomastyle.com/pyloris-a-python-implementation-of-slowloris/		*http://anonym.to/?http://motomastyle.com/pyloris-a-python-implementation-of-slowloris/

>Hitlerlol: Created page with '500px TOC Summary: http://anonym.to/?http://ha.ckers.org/slowloris/ http://anonym.to/?http://ha.ckers.org/blog/20090617/slowloris-http-dos/…'

2010-04-22T19:43:43Z

Created page with 'right|500px __TOC__ Summary: *http://anonym.to/?http://ha.ckers.org/slowloris/ *http://anonym.to/?http://ha.ckers.org/blog/20090617/slowloris-http-dos/…'

New page

[[File:QSlowLoris.png|right|500px]]

__TOC__

Summary:

*http://anonym.to/?http://ha.ckers.org/slowloris/
*http://anonym.to/?http://ha.ckers.org/blog/20090617/slowloris-http-dos/

==QSlowLoris==

This is C++ with heavy use of Qt libs. I could make a CLI version, but I don't know how the fuck you use sockets in WINAPI, so you still would need to supply QtCore4.dll(2,6MB) and QtNetwork4.dll(1,33MB) with the exe
*Wait, I just reailzed that it can be compressed with upx:
*QSlowloris.exe - 20KB
*QtCore.dll - 903KB
*QtNetwork.dll - 447KB

===Linux build===

*http://anonym.to/?http://www.megaupload.com/?d=08RJVYTE

===Windows build===

*http://anonym.to/?http://www.megaupload.com/?d=3DV6R4ZL

==Original Version==

This is the original CLI version.<br>
Example usage: ''./slowloris.pl -dns www.president.ir -port 80 -timeout 500 -num 2000''
* http://www.milw0rm.com/exploits/8976 (perl script)<br>
* ftp://rlance.ru/Upload/a/slowloris.bin (linux binary created with PAR packer)
Some hosts might ban the Useragent which Slowloris is using. This version pretends to be Mozilla.<br>
* http://anonymous.pastebay.com/24430

==pyLoris==

PyLoris is a platform independent python version of Slowloris (Limitations for windows (130 sockets) still apply). It runs a little differently than Slowloris, in that it throttles the entire request, allowing users to specify the bandwidth for the connection as well as how large the request is.

*http://anonym.to/?http://motomastyle.com/pyloris-a-python-implementation-of-slowloris/
*http://anonym.to/?http://anonymous.pastebay.com/28113
*http://anonym.to/?http://sourceforge.net/projects/pyloris/

Example usage:
<pre>
python pyloris-1.7.py -l -r POST -s 500000 -g "/fa/pages/?cid=407" www.gerdab.ir \
-u "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.31 Safari/530.5"
</pre>

[[Category:Tools]]{{tools}}
[[Category:DoS]]