Git Product home page Git Product logo

slow-http-header-attack-on-apache-server's Introduction

SLOW-HTTP-HEADER-ATTACK-ON-APACHE-SERVER

Computer and Network Security course project. A bot to launch typical DOS attack based on HTTP and thread based server vulnerabilities

Slow HTTP Header vulnerability:

Post incomplete HTTP headers regularly after a certain interval of time.The bot creates large number of HTTP connections to the given web server. Since, a thread based web server has a upper limit on the maximum amount of threads it can handle, eventually we will succeed to create a DOS attack and put down the web server or drastically increase the time to access the web page.

Tools Required

Python3
An Apache web server to attack(Thread based server)
Wireshark
SlowHttpTest Tool

Installing Dependencies:

pip3 install -r requirements.txt

Installing WireShark on Ubuntu:

sudo apt-get install wireshark
sudo groupadd wireshark
sudo usermod -a -G wireshark YOUR_USER_NAME
sudo chgrp wireshark /usr/bin/dumpcap
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
sudo getcap /usr/bin/dumpcap

Installing SlowHttpTest Tool

sudo apt-get update
sudo apt-get install slowhttptest

Submissions

main.py : The main function to set up attack parameters for the bot
target.py : Create a target vector
connection.py : Set up the connection to the server under attack and get results
wireshark capture.pcapng : The WireShark capture for the attack on a sample web server.
COMPUTER AND NETWORK SECURITY โ€“ CST 308 REPORT.pdf : Presentation Report on the Attack Bot
supplementary document prepared by me.pdf : Supplementary text doc

Usage

python3 main.py
enter the ip address of server to be attacked 
enter the port number
enter time to wait before posting next incomplete header is made in seconds(the time between sending consecutive set of         incomplete HTTP headers by connections)
enter the number of concurrent connections to make to the server

The system shows if the given (ip,port) pair is valid or  not , and if its valid then checks if the server vulnerable to the attack(is it thread based Apache server) and the initial lateny.
Press enter to start the attack 

Log Info

Initial Latency to access web page
Displays when the connections are opened
The time of sending new set of incomplete headers 
The when does a timeout occurs.

slow-http-header-attack-on-apache-server's People

Contributors

pranshu1200 avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.