PyLoris 2.0

This class of attack is described by RSnake--along with the original proof of concept--at http://ha.ckers.org/slowloris.<br /><br />What is so special about PyLoris?<br /><br />One common method for performing a Denial of Service attack is called flooding. By roudning up a large number of computers, and telling them all to send or requjest a large amount of data from a server simultaneously. The purpose of these requests are not to gather large amounts of information; rather, the intent is merely to overwhelm the capabilities of the server. In a situation like this, a server could fail because of the bandwidth restrictions of the internet service provider, the memory limitations of the server, the lack of hard drive space to store the data being sent, or the inability of the CPU to process the data fast enough. The common thread between these four issues is that these are finite resources that have been given to the server. PyLoris is different from this form of attack because it does not prey of any physical resource; instead, it overwhelms an artificial resource???*a*?connections.<br /><br />In order for prevent these types the aformentioned form of attacks, applications will limit their own utilization of system resources. If a process is going to use too much CPU, hard disk space, or memory, they will slow down and throttle requests--thereby ensuring the server's stability. Unfortunately, a number of web servers invent another form of resource--total connection count--with the idea that the connection count is linearly related to the utilization of other resources. This assumption is invalid; in the case of PyLoris, connections are relatively low in regards to CPU, memory, and network utilization. The offshoot of this is that web servers imposing restrictions on the total number of connections will reject connections well before they hit their physical resources' limits. Essentially developers have invented an artificial resource that causes a bottleneck far before any other physical limitation would.

Requirements:	No special requirements
Platforms:	Windows, Mac, *nix, Mac OSX, Linux, Python , BSD Solaris
Keyword:	Dos,  Dos Attack,  Server,  Test,  Test Environment,  Test Server
Users rating:	0/10