full-disclosure - Re: how to detect DDoS attack through HTTP response analysis(throuput)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E09F164.2050009@gmail.com>
Date: Tue, 28 Jun 2011 11:21:08 -0400
From: Emanuel dos Reis Rodrigues <emanueldosreis@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: how to detect DDoS attack through HTTP
 response analysis(throuput)

Hello folks,


The modsecurity have a better result than mod_qos to slowloris attack, 
mod_qos trend to increase the false positives  because of NAT and slow 
users.

If you test the R-U-D-Y,  you see that, modsecurity too  protect against 
them.

See: 
http://blog.spiderlabs.com/2010/11/advanced-topic-of-the-week-mitigating-slow-http-dos-attacks.html


best regards,



Emanuel dos Reis Rodrigues
Senior Level Linux Professional (LPIC-3)
LPI 302 (Mixed Environment) Specialty
LPI 304 (Virtualization and High Availability) Specialty
C|EH Certified Ethical Hacker
CompTIA Security+ Certified
http://br.linkedin.com/in/emanuelreis
t:@emanueldosreis
emanueldosreis(No*SpAm)gmail.com
Mobile: +55 95 8112-9628







On 06/28/2011 10:44 AM, nix@...roxylists.com wrote:
>>   Hi,
>>
>>   its kinda<s>stupid</s>  incorrect way of detecting ddos by reading http
>>   responce.
>>   if server says error 408, it could be just a script which takes long to
>>   complete. if there is some caching server, e.g. nginx, before actual web
>>   server, e.g. apache httpd, then error 502 could be a result of any
>>   apache death, not a ddos attack.
>>   but if you still want to monitor sites in such "unusual" way, and if
>>   you have access to web-servers' serverstatus, you'd could parse them to
>>   find out: amount of simultaneous requests; similar requests by IP;
>>   similar requests by Requested Page; etc.
>>
>>
>>
>> --
>>   Cheers,
>>
>>   Kai
>>
>>      
> Definitely. One way could be also using mod_qos, it provides protection
> against slowtoris attack and you can limit amount of allowed simultaneus
> connections per IP. Here's an example output from log:
>
> Slowtoris:
>
> [Tue Jun 28 02:30:07 2011] [error] mod_qos(034): access denied,
> QS_SrvMinDataRate rule (in): min=154,
> this connection=0, c=64.132.201.98
>
> Too many conns. per IP
>
> [Sun Jun 26 05:13:15 2011] [error] mod_qos(031): access denied,
> QS_SrvMaxConnPerIP rule: max=15, concurrent connections=21,
> message repeated 20 times, c=10.100.12.19
>
> Check out http://opensource.adnovum.ch/mod_qos/
>
>    
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>      
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>    

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/