mod_antiloris - Anti Slowloris Apache Module
<h2>Slowloris</h2>
Slowloris is a piece of software written by Robert "RSnake" Hansen which allows a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports.
Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to—but never completing—the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients.
More information about the attack: http://ha.ckers.org/slowloris/
<h2>mod_antiloris</h2>
mod_antiloris limits the number of simultaneous connections per IP address that are in the "reading request" state on Apache 2.x systems. It can mitigate denial of service attacks done with the "slowloris" script.
Written by Nathan Malcolm
Related protips
Have a fresh tip? Share with Coderwall community!
Most application security programs still stop at the repository. The page a visitor loads can run third-party scripts that read the DOM, change a checkout, or steal a session after the deploy already looks clean.
Security insights from Cside