full-disclosure - Re: THC SSL DOS tool released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJVRA1TTDc+wzgOWazJYa34WSoW+bggjB3pnrQAz17UYT=rQ4A@mail.gmail.com>
Date: Thu, 3 Nov 2011 19:17:31 -0700
From: coderman <coderman@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: THC SSL DOS tool released

On Wed, Nov 2, 2011 at 2:07 PM, coderman <coderman@...il.com> wrote:
>...
> - cipher suite probing to find un-accelerated suites or more
> computationally expensive suites supported by a target.

a nice write up here covering relative costs of some suites, and more
discussion on computation DoS:
  http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html

suites clearly make a big difference (but you knew that already, right?)


regarding concurrent connections stress, use >= 8G of memory on injector and:

# in /etc/security/limits.conf :
*               soft    nofile          65535
*               hard    nofile         2097152
# ... and ulimit -Hn 2097152 before launching load

# in /etc/sysctl.conf :
net.core.somaxconn = 2097152
net.ipv4.tcp_fin_timeout = 5 # or less
# ... and sysctl -p /etc/sysctl.conf

if you're routing through conntrack or equivalent facilities (this
will cut your capacity in half) you also need to adjust conntrack
limits.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/