Carlos, On Jun 26, 2009, at 5:17 PM, Carlos perez wrote:
> Slowloris is part of the architecture of apache not a bug so the only > way to check if an admin took preventive measures for his specific > environent would be to check the apache.conf file > I may be wrong, but I think slowloris is a problem with apache in general. Apache should not be keep partial http connections open, in the same fashion that IIS does not. The only way to truly 'test' for slowloris is to be able to DoS it to 'prove' that it's keep its connections half open. Instead, I think the only way to truly 'detect' for slowloris is to find out that you are running a known vulnerable http server such as 'apache'. Bummer? Yeah. I think the check your talking about Carlos is checking the .conf file for allowing for a large amount of connections at the same time, but is that truly a mitigation or a performance issue? Moses > Sent from my iPhone > > On Jun 26, 2009, at 3:25 PM, Andres Riancho <[email protected]> > wrote: > >> List, >> >> Does anyone know if it's possible to test for the ""slowris >> vulnerability"" [0] without DoS'ing the web server? I was thinking >> that if that was possible, we could add it to w3af. Someone already >> did something in python [1], so it shouldn't be hard to add it to >> w3af. >> >> [0] http://ha.ckers.org/slowloris/ >> [1] http://motomastyle.com/pyloris-a-python-implementation-of-slowloris/ >> >> Cheers, >> -- >> Andrés Riancho >> Founder, Bonsai - Information Security >> http://www.bonsai-sec.com/ >> http://w3af.sf.net/ >> >> --- >> --- >> --- >> --------------------------------------------------------------------- >> _______________________________________________ >> W3af-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/w3af-users > > ------------------------------------------------------------------------------ > _______________________________________________ > W3af-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/w3af-users ------------------------------------------------------------------------------ _______________________________________________ W3af-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/w3af-users
