What is Slowloris?

Slowloris Definition

Slowloris is a Denial of Service (DoS) attack technique created by a hacker known as “RSnake” in 2009. The attack involves maintaining many open HTTP connections with a server by sending partial, incomplete requests that are never completed.

How Does Slowloris Work?

Attack Mechanism

1. Attacker establishes many HTTP connections with server
2. Sends partial HTTP headers (without final empty line)
3. Periodically sends additional headers to keep connection alive
4. Server waits for request completion (timeout)
5. Server's connection pool becomes exhausted
6. Legitimate users cannot connect

Example of Incomplete Request

GET / HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0
X-Custom-Header: value
X-Another-Header: value
[no empty line ending headers]

Keeping Connection Alive

Every 10-15 seconds an additional header is sent:
X-Keep-Alive-1: value
X-Keep-Alive-2: value
...

Attack Characteristics

Slowloris Features

Feature	Description
Type	Low-and-slow DoS
Bandwidth	Minimal (~kilobits)
Connections	Hundreds to thousands
Target	Application layer (L7)
Detectability	Difficult to detect

Comparison with Traditional DDoS

Aspect	Volumetric DDoS	Slowloris
Bandwidth	Very high (Gbps)	Minimal (Kbps)
Sources	Botnet (thousands)	Single computer
Detection	Easy	Difficult
Filtering	Simple	Complex
Attack cost	High	Very low

Vulnerable Servers

Most Vulnerable

• Apache (up to version 2.2.15 without mod_reqtimeout)
• Apache without proper configuration
• Servers with long timeouts
• Servers with large connection pools

Naturally Resistant

• Nginx - event-driven architecture
• Lighttpd - similar architecture
• IIS - different connection management
• Servers with worker pool

Attack Variants

Classic Slowloris

Incomplete HTTP headers:

GET / HTTP/1.1\r\n
Host: target.com\r\n
[missing \r\n\r\n ending headers]

Slow POST (R-U-Dead-Yet)

Slow POST body transmission:

POST /form HTTP/1.1
Content-Length: 100000

[sending 1 byte every few seconds]

Slow Read

Slow response receiving:

Setting small TCP buffer
Slowly "reading" server response

Attack Tools

Popular Tools (for educational purposes)

• slowloris.py - original Python script
• slowhttptest - testing tool
• OWASP HTTP Slow Test - security testing

Testing Example (slowhttptest)

# Slowloris type test
slowhttptest -c 1000 -H -i 10 -r 200 -t GET -u http://target.com

# Slow POST type test
slowhttptest -c 1000 -B -i 10 -r 200 -t POST -u http://target.com

Protection Against Slowloris

Apache Configuration

mod_reqtimeout:

<IfModule mod_reqtimeout.c>
    RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

Connection limiting:

<IfModule mod_limitipconn.c>
    MaxConnPerIP 10
</IfModule>

Nginx Configuration

# Connection limits
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
limit_conn conn_limit 10;

# Timeouts
client_body_timeout 10s;
client_header_timeout 10s;
keepalive_timeout 5s 5s;
send_timeout 10s;

Firewall and WAF

iptables:

# Limit new connections from single IP
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 20 -j DROP

# Rate limiting
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 1 --hitcount 10 -j DROP

Load Balancer

• Traffic distribution between servers
• Health checks
• Connection pooling
• Request queuing

Defense Strategies

Infrastructure Level

1. CDN - traffic absorption
2. Load balancer - distribution
3. WAF - filtering
4. DDoS protection - cloud services

Application Level

1. Timeouts - short time limits
2. Connection limits - per IP
3. Rate limiting - request limiting
4. Queue management - queue handling

Monitoring

Indicators to observe:

• Number of open connections
• Connection duration
• Connections per IP
• Incomplete requests

Attack Detection

Symptoms

• Increase in open connections
• Long connection durations
• Many connections from single IP
• Server availability decrease
• No bandwidth increase

Monitoring Tools

# Connections per IP
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

# ESTABLISHED connections
netstat -an | grep ESTABLISHED | wc -l

# HTTP connections
ss -o state established '( dport = :80 or sport = :80 )'

Historical Incidents

Known Slowloris Attacks

• 2009 - Attacks on Iranian government servers
• Operation Payback - attacks on anti-piracy services
• Various hacktivism - attacks on government services

Best Practices

For Administrators

1. Update software - security patches
2. Configure timeouts - aggressive values
3. Limit connections - per IP and globally
4. Use reverse proxy - Nginx in front of Apache
5. Deploy WAF - layer 7 protection
6. Monitor - alerting on anomalies

For Developers

1. Async I/O - non-blocking operations
2. Connection pooling - efficient management
3. Graceful degradation - overload handling
4. Health endpoints - status monitoring

Slowloris demonstrates that an effective attack doesn’t require massive resources - clever exploitation of HTTP protocol limitations and server architecture is enough.

Explore our services

• Penetration testing