1, problem description
- Slow HTTP denial of service attack is an application layer denial of service attack specifically aimed at the Web. Attackers manipulate broilers on the network to carry out massive HTTP request attacks on the target Web server until the server bandwidth is full, resulting in denial of service.
- Slow HTTP denial of service attacks have evolved and developed. There are three main types of attacks: Slow headers, Slow body, and Slow read. Taking Slow headers as an example, Web applications must receive all HTTP headers before processing HTTP requests, because HTTP headers contain some important information that Web applications may use. The attacker takes advantage of this to initiate an HTTP request and keep sending HTTP headers, consuming the server's connection and memory resources. The packet capture data shows that after the attacking client establishes a TCP connection with the server, it only sends an HTTP header to the server every 10 seconds. However, when the Web server does not receive two consecutive \r\n, it will think that the client has not sent the header and continuously wait for the client to send data. If a malicious client continues to establish such a connection, the available connections on the server will become full at the 1.1 point, resulting in a denial of service. This type of attack is known as a slow HTTP denial of service attack.
2, operating instructions
Open the CMSServerV6\tomcat\conf\server.xml file, change the connectionTimeout value of <Connector> to 5000ms， the default value is 20000ms, and restart the web service.
